github/kata-containers
1
0
Fork 1
mirror of https://github.com/kata-containers/kata-containers.git synced 2025-06-28 16:27:50 +00:00
Code Issues Projects Releases Wiki Activity

Limitations: add selinux support limitation

Browse Source 
We do not currently support enablement of `selinux` in the
dockerd config. Document that.

Fixes: #252

Signed-off-by: Graham Whaley <graham.whaley@intel.com>
This commit is contained in:
Graham Whaley 2018-09-25 15:21:25 +01:00
parent 4eeae1d4d3
commit 38a06cadee
1 changed files with 19 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
Limitations.md
View File

@ -14,6 +14,8 @@
* [Resource management](#resource-management) * [Resource management](#resource-management)
* [docker run and shared memory](#docker-run-and-shared-memory) * [docker run and shared memory](#docker-run-and-shared-memory)
* [docker run and sysctl](#docker-run-and-sysctl) * [docker run and sysctl](#docker-run-and-sysctl)
* [Docker daemon features](#docker-daemon-features)
* [selinux support](#selinux-support)
* [Architectural limitations](#architectural-limitations) * [Architectural limitations](#architectural-limitations)
* [Networking limitations](#networking-limitations) * [Networking limitations](#networking-limitations)
* [Support for joining an existing VM network](#support-for-joining-an-existing-vm-network) * [Support for joining an existing VM network](#support-for-joining-an-existing-vm-network)
@ -177,6 +179,23 @@ allows configuring the sysctl settings that support namespacing. From a security
See issue https://github.com/kata-containers/runtime/issues/185 for more information. See issue https://github.com/kata-containers/runtime/issues/185 for more information.
## Docker daemon features
Some features enabled or implemented via the
[dockerd daemon](https://docs.docker.com/config/daemon/) configuration are not yet
implemented.
### selinux support
The `dockerd` configuration option `"selinux-enabled": true` is not presently implemented
in Kata Containers. Enabling this option causes an OCI runtime error.
See issue https://github.com/kata-containers/runtime/issues/784 for more information.
The consequence of this is that the [Docker --security-opt is only partially supported](#docker---security-opt-option-partially-supported).
Kubernetes [selinux labels](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#assign-selinux-labels-to-a-container) will also not be applied.
# Architectural limitations # Architectural limitations
This section lists items that might not be fixed due to fundamental This section lists items that might not be fixed due to fundamental