mirror of
https://github.com/linuxkit/linuxkit.git
synced 2025-12-26 15:53:42 +00:00
b3378652e3
Mounting a directory inside a read only container requires that to be created in advance, but `runc` worked around that if the rootfs was not originally read only. You cannot even bind mount a file that does not exist into a read only container. The containerd test is given a disk, as running on an overlay does not work; however it is also disabled as one of the parts of the test is failing, needs investigation. Signed-off-by: Justin Cormack <justin.cormack@docker.com>
16 lines
669 B
Docker
16 lines
669 B
Docker
FROM linuxkit/alpine:34af9cb1990debd17fae6d4198c62ce3910d9908 AS mirror
|
|
|
|
RUN mkdir -p /out/etc/apk && cp -r /etc/apk/* /out/etc/apk/
|
|
RUN apk add --no-cache --initdb -p /out alpine-baselayout busybox musl bash
|
|
|
|
ENV DOCKER_CHECK_CONFIG_COMMIT=72cda6a6c2f25854bea2d69168082684f2c9feca
|
|
ADD https://raw.githubusercontent.com/docker/docker/${DOCKER_CHECK_CONFIG_COMMIT}/contrib/check-config.sh /out/check-config.sh
|
|
ADD . ./out
|
|
|
|
RUN mkdir -p /out/lib/modules
|
|
|
|
FROM scratch
|
|
COPY --from=mirror /out /
|
|
ENTRYPOINT ["/bin/sh", "/check.sh"]
|
|
LABEL org.mobyproject.config='{"readonly": true, "binds": ["/lib/modules:/lib/modules", "/dev:/dev", "/sys:/sys"], "capabilities": ["all"]}'
|