github/kata-containers
1
0
Fork 2
mirror of https://github.com/kata-containers/kata-containers.git synced 2025-10-31 17:37:20 +00:00
Code Issues Projects Releases Wiki Activity

rootfs: Always add SYS_ADMIN, CHROOT, and MKNOD caps to docker cmdline

Browse Source 
We use those, independently of the distro.

Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com>
This commit is contained in:
Fabiano Fidêncio
2021-01-08 20:07:24 +01:00
parent 90ec2fa802
commit bbeebcdbba
1 changed files with 7 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
tools/osbuilder/rootfs-builder/rootfs.sh
View File

@@ -181,29 +181,22 @@ docker_extra_args()
{
local args=""
# Required to mount inside a container
args+=" --cap-add SYS_ADMIN"
# Requred to chroot
args+=" --cap-add SYS_CHROOT"
# debootstrap needs to create device nodes to properly function
args+=" --cap-add MKNOD"
case "$1" in
gentoo)
# Requred to chroot
args+=" --cap-add SYS_CHROOT"
# debootstrap needs to create device nodes to properly function
args+=" --cap-add MKNOD"
# Required to mount inside a container
args+=" --cap-add SYS_ADMIN"
# Required to build glibc
args+=" --cap-add SYS_PTRACE"
# mount portage volume
args+=" -v ${gentoo_local_portage_dir}:/usr/portage/packages"
args+=" --volumes-from ${gentoo_portage_container}"
;;
ubuntu | debian)
# Requred to chroot
args+=" --cap-add SYS_CHROOT"
# debootstrap needs to create device nodes to properly function
args+=" --cap-add MKNOD"
;;
suse)
# Required to mount inside a container
args+=" --cap-add SYS_ADMIN"
# When AppArmor is enabled, mounting inside a container is blocked with docker-default profile.
# See https://github.com/moby/moby/issues/16429
args+=" --security-opt apparmor=unconfined"