github/kata-containers
1
0
Fork 1
mirror of https://github.com/kata-containers/kata-containers.git synced 2025-04-30 12:44:39 +00:00
Code Issues Projects Releases Wiki Activity

rootfs: Always add SYS_ADMIN, CHROOT, and MKNOD caps to docker cmdline

Browse Source 
We use those, independently of the distro.

Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com>
This commit is contained in:
Fabiano Fidêncio 2021-01-08 20:07:24 +01:00
parent 90ec2fa802
commit bbeebcdbba
1 changed files with 7 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
tools/osbuilder/rootfs-builder/rootfs.sh
View File

@ -181,29 +181,22 @@ docker_extra_args()
{ {
local args="" local args=""
# Required to mount inside a container
args+=" --cap-add SYS_ADMIN"
# Requred to chroot
args+=" --cap-add SYS_CHROOT"
# debootstrap needs to create device nodes to properly function
args+=" --cap-add MKNOD"
case "$1" in case "$1" in
gentoo) gentoo)
# Requred to chroot
args+=" --cap-add SYS_CHROOT"
# debootstrap needs to create device nodes to properly function
args+=" --cap-add MKNOD"
# Required to mount inside a container
args+=" --cap-add SYS_ADMIN"
# Required to build glibc # Required to build glibc
args+=" --cap-add SYS_PTRACE" args+=" --cap-add SYS_PTRACE"
# mount portage volume # mount portage volume
args+=" -v ${gentoo_local_portage_dir}:/usr/portage/packages" args+=" -v ${gentoo_local_portage_dir}:/usr/portage/packages"
args+=" --volumes-from ${gentoo_portage_container}" args+=" --volumes-from ${gentoo_portage_container}"
;; ;;
ubuntu | debian)
# Requred to chroot
args+=" --cap-add SYS_CHROOT"
# debootstrap needs to create device nodes to properly function
args+=" --cap-add MKNOD"
;;
suse) suse)
# Required to mount inside a container
args+=" --cap-add SYS_ADMIN"
# When AppArmor is enabled, mounting inside a container is blocked with docker-default profile. # When AppArmor is enabled, mounting inside a container is blocked with docker-default profile.
# See https://github.com/moby/moby/issues/16429 # See https://github.com/moby/moby/issues/16429
args+=" --security-opt apparmor=unconfined" args+=" --security-opt apparmor=unconfined"