Commit Graph

13 Commits

Author SHA1 Message Date
Riyaz Faizullabhoy
b919d6483b Add fs link protection sysctls
Signed-off-by: Riyaz Faizullabhoy <riyaz.faizullabhoy@docker.com>
2017-01-18 15:20:40 +00:00
Justin Cormack
d7508166bf Combine sysctl configs
Where the suggestions came from is not that useful, just have a
single file for the main ones and then distro specific versions.

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
2017-01-10 11:40:36 +00:00
Riyaz Faizullabhoy
07f4f90b6c Add kspp recommended sysctl settings
Signed-off-by: Riyaz Faizullabhoy <riyaz.faizullabhoy@docker.com>
2016-12-22 10:00:22 -08:00
Riyaz Faizullabhoy
bee11d02f7 Only disable sysrq for cloud editions
Signed-off-by: Riyaz Faizullabhoy <riyaz.faizullabhoy@docker.com>
2016-12-16 09:24:34 -08:00
Riyaz Faizullabhoy
9284759f2c Disable kexec from kernel_config, revert sysctl config because key is now unknown
Signed-off-by: Riyaz Faizullabhoy <riyaz.faizullabhoy@docker.com>
2016-12-07 11:43:10 -08:00
Riyaz Faizullabhoy
23c895a3d3 Disable kexec load in sysctl config
Signed-off-by: Riyaz Faizullabhoy <riyaz.faizullabhoy@docker.com>
2016-12-05 09:26:17 -08:00
Justin Cormack
933372e45a Run rngd inside a system container
- this needs an init as it does not respond to stop signals, so include tini
- needs CAP_SYS_ADMIN to write to kernel entropy estimate
- set kernel.random.write_wakeup_threshold so that rngd does not need sysctl write access
- build patches from Alpine, but statically linked
- remove rngd from base image, means we no longer need community repository

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
2016-12-02 14:00:12 +00:00
Riyaz Faizullabhoy
0eefa15623 Add sysctl changes as suggested by lynis
Signed-off-by: Riyaz Faizullabhoy <riyaz.faizullabhoy@docker.com>
2016-12-01 15:41:57 -08:00
Riyaz Faizullabhoy
c492c01c82 Disable kernel modules for cloud editions from moby by checking in
a modified sysctl init with a cloud config

Signed-off-by: Riyaz Faizullabhoy <riyaz.faizullabhoy@docker.com>
2016-11-28 15:40:02 -08:00
Justin Cormack
53e367326b Increase neighbor cache threshold values
Needed for larger clusters.

Needed for https://github.com/docker/editions/issues/377

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
2016-10-28 22:25:36 +01:00
Justin Cormack
68da2c2a49 Support memory overcommit
One less complaint in Redis startup.

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
2016-10-05 11:46:58 +02:00
Justin Cormack
ed88a46f97 Increase default fs.aio-max-nr
As recommended by Oracle for MySQL.

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
2016-09-19 23:38:26 +01:00
Justin Cormack
f4442e388b Add default sysfs settings
This uses the new Alpine sysfs.conf service to allow config of sysfs.

Default file that sets transparent huge pages to only be used on request
to fix #368

Database setting available for user configuration.

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
2016-08-12 14:13:40 +01:00