mirror of
https://github.com/kata-containers/kata-containers.git
synced 2026-07-14 22:06:46 +00:00
716c55abdd
Adds a practical set of kernel config used by docker-in-docker and kind for network bridging and filtering. It also includes the matching IPv6 support to allow tools like kind that require IPv6 network policies to work out of the box. This support includes: - nftables reject and filtering support for inet/ipv4/ipv6 - Bridge filtering for container-to-container traffic - IPv6 NAT, filtering, and packet matching rules for network policies - VXLAN and IPsec crypto support for network tunneling - TMPFS POSIX ACL support for filesystem permissions The configs are organized across fragment files: - common/fs.conf: TMPFS ACL support - common/crypto.conf: IPsec/VXLAN crypto algorithms - common/network.conf: VXLAN, IPsec ESP, nftables bridge/ARP/netdev - common/netfilter.conf: IPv6 netfilter stack and nftables advanced features Fixes: #11886 Signed-off-by: Simon Kaegi <simon.kaegi@gmail.com>
65 lines
1.4 KiB
Plaintext
65 lines
1.4 KiB
Plaintext
# Enable a whole bunch of filesystem related items
|
|
|
|
CONFIG_BLK_DEV_INITRD=y
|
|
|
|
# Recommended for Docker
|
|
CONFIG_BLK_DEV_THROTTLING=y
|
|
|
|
# Required for hotplug block devices into Kata, using SCSI
|
|
CONFIG_BLK_DEV_LOOP=y
|
|
CONFIG_BLK_DEV_BSG=y
|
|
CONFIG_BLK_DEV_SD=y
|
|
# Required in v6.8+ to use mounted loop devices
|
|
CONFIG_BLK_DEV_WRITE_MOUNTED=y
|
|
|
|
# support initial ramdisk
|
|
CONFIG_RD_GZIP=y
|
|
CONFIG_FS_IOMAP=y
|
|
CONFIG_EXT4_FS=y
|
|
CONFIG_EXT4_USE_FOR_EXT2=y
|
|
CONFIG_EXT4_FS_POSIX_ACL=y
|
|
CONFIG_EXT4_FS_SECURITY=y
|
|
# FIXME - do we need journalling support in the container?
|
|
# https://github.com/kata-containers/packaging/issues/483
|
|
CONFIG_JBD2=y
|
|
CONFIG_FS_MBCACHE=y
|
|
CONFIG_XFS_FS=y
|
|
CONFIG_FS_POSIX_ACL=y
|
|
CONFIG_EXPORTFS=y
|
|
CONFIG_EXPORTFS_BLOCK_OPS=y
|
|
CONFIG_FILE_LOCKING=y
|
|
# A bunch of these are required for systemd at least.
|
|
CONFIG_FSNOTIFY=y
|
|
CONFIG_DNOTIFY=y
|
|
CONFIG_INOTIFY_USER=y
|
|
CONFIG_FANOTIFY=y
|
|
CONFIG_AUTOFS_FS=y
|
|
CONFIG_TMPFS=y
|
|
CONFIG_TMPFS_XATTR=y
|
|
CONFIG_TMPFS_POSIX_ACL=y
|
|
CONFIG_DEVTMPFS=y
|
|
CONFIG_DEVTMPFS_MOUNT=y
|
|
CONFIG_MISC_FILESYSTEMS=y
|
|
CONFIG_EROFS_FS=y
|
|
CONFIG_EROFS_FS_XATTR=y
|
|
CONFIG_EROFS_FS_ZIP=y
|
|
CONFIG_EROFS_FS_SECURITY=y
|
|
CONFIG_SIGNALFD=y
|
|
CONFIG_TIMERFD=y
|
|
CONFIG_EPOLL=y
|
|
CONFIG_FHANDLE=y
|
|
|
|
# We should support Async IO.
|
|
CONFIG_AIO=y
|
|
|
|
# Docker in Docker support requires overlay
|
|
CONFIG_OVERLAY_FS=y
|
|
CONFIG_OVERLAY_FS_INDEX=y
|
|
CONFIG_OVERLAY_FS_REDIRECT_DIR=y
|
|
CONFIG_OVERLAY_FS_METACOPY=y
|
|
CONFIG_OVERLAY_FS_XINO_AUTO=y
|
|
|
|
# virtio-fs driver support:
|
|
CONFIG_VIRTIO_FS=y
|
|
CONFIG_FUSE_FS=y
|