Skip to content

Latest commit

 

History

History
63 lines (52 loc) · 3.03 KB

config-linux.md

File metadata and controls

63 lines (52 loc) · 3.03 KB

Linux-specific Container Configuration

The Linux container specification uses various kernel features like namespaces, cgroups, capabilities, LSM, and file system jails to fulfill the spec. Additional information is needed for Linux over the default spec configuration in order to configure these various kernel features.

Capabilities

Capabilities is an array that specifies Linux capabilities that can be provided to the process inside the container. Valid values are the strings for capabilities defined in the man page

   "capabilities": [
        "CAP_AUDIT_WRITE",
        "CAP_KILL",
        "CAP_NET_BIND_SERVICE"
    ]

User namespace mappings

    "uidMappings": [
        {
            "hostID": 1000,
            "containerID": 0,
            "size": 10
        }
    ],
    "gidMappings": [
        {
            "hostID": 1000,
            "containerID": 0,
            "size": 10
        }
    ]

uid/gid mappings describe the user namespace mappings from the host to the container. The mappings represent how the bundle rootfs expects the user namespace to be setup and the runtime SHOULD NOT modify the permissions on the rootfs to realize the mapping. hostID is the starting uid/gid on the host to be mapped to containerID which is the starting uid/gid in the container and size refers to the number of ids to be mapped. There is a limit of 5 mappings which is the Linux kernel hard limit.

Default Devices and File Systems

The Linux ABI includes both syscalls and several special file paths. Applications expecting a Linux environment will very likely expect these files paths to be setup correctly.

The following devices and filesystems MUST be made available in each application's filesystem

Path Type Notes
/proc procfs
/sys sysfs
/dev/null device
/dev/zero device
/dev/full device
/dev/random device
/dev/urandom device
/dev/tty device
/dev/console device
/dev/pts devpts
/dev/ptmx device Bind-mount or symlink of /dev/pts/ptmx
/dev/shm tmpfs