2016-01-20 00:27:47 +08:00
|
|
|
{
|
|
|
|
|
"linux": {
|
|
|
|
|
"description": "Linux platform-specific configurations",
|
|
|
|
|
"id": "https://opencontainers.org/schema/bundle/linux",
|
|
|
|
|
"type": "object",
|
|
|
|
|
"properties": {
|
|
|
|
|
"devices": {
|
|
|
|
|
"id": "https://opencontainers.org/schema/bundle/linux/devices",
|
2017-01-12 14:06:03 +08:00
|
|
|
"type": "array",
|
|
|
|
|
"items": {
|
|
|
|
|
"$ref": "defs-linux.json#/definitions/Device"
|
|
|
|
|
}
|
2016-01-20 00:27:47 +08:00
|
|
|
},
|
|
|
|
|
"uidMappings": {
|
|
|
|
|
"id": "https://opencontainers.org/schema/bundle/linux/uidMappings",
|
2017-01-12 14:06:03 +08:00
|
|
|
"type": "array",
|
|
|
|
|
"items": {
|
|
|
|
|
"$ref": "defs.json#/definitions/IDMapping"
|
|
|
|
|
}
|
2016-01-20 00:27:47 +08:00
|
|
|
},
|
|
|
|
|
"gidMappings": {
|
|
|
|
|
"id": "https://opencontainers.org/schema/bundle/linux/gidMappings",
|
2017-01-12 14:06:03 +08:00
|
|
|
"type": "array",
|
|
|
|
|
"items": {
|
|
|
|
|
"$ref": "defs.json#/definitions/IDMapping"
|
|
|
|
|
}
|
2016-01-20 00:27:47 +08:00
|
|
|
},
|
|
|
|
|
"namespaces": {
|
|
|
|
|
"id": "https://opencontainers.org/schema/bundle/linux/namespaces",
|
|
|
|
|
"type": "array",
|
|
|
|
|
"items": {
|
|
|
|
|
"anyOf": [
|
|
|
|
|
{
|
|
|
|
|
"$ref": "defs-linux.json#/definitions/NamespaceReference"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
}
|
|
|
|
|
},
|
|
|
|
|
"resources": {
|
|
|
|
|
"id": "https://opencontainers.org/schema/bundle/linux/resources",
|
|
|
|
|
"type": "object",
|
|
|
|
|
"properties": {
|
2016-08-30 10:13:09 +08:00
|
|
|
"devices": {
|
|
|
|
|
"id": "https://opencontainers.org/schema/bundle/linux/resources/devices",
|
2017-01-12 14:06:03 +08:00
|
|
|
"type": "array",
|
|
|
|
|
"items": {
|
|
|
|
|
"$ref": "defs-linux.json#/definitions/DeviceCgroup"
|
|
|
|
|
}
|
2016-08-30 10:13:09 +08:00
|
|
|
},
|
2016-04-07 05:04:18 +08:00
|
|
|
"pids": {
|
|
|
|
|
"id": "https://opencontainers.org/schema/bundle/linux/resources/pids",
|
2016-08-11 05:14:25 +08:00
|
|
|
"type": "object",
|
2016-04-07 05:04:18 +08:00
|
|
|
"properties": {
|
|
|
|
|
"limit": {
|
|
|
|
|
"id": "https://opencontainers.org/schema/bundle/linux/resources/pids/limit",
|
|
|
|
|
"$ref": "defs.json#/definitions/int64"
|
|
|
|
|
}
|
2017-01-05 10:57:58 +08:00
|
|
|
},
|
|
|
|
|
"required": [
|
|
|
|
|
"limit"
|
|
|
|
|
]
|
2016-04-07 05:04:18 +08:00
|
|
|
},
|
2016-01-20 00:27:47 +08:00
|
|
|
"blockIO": {
|
|
|
|
|
"id": "https://opencontainers.org/schema/bundle/linux/resources/blockIO",
|
|
|
|
|
"type": "object",
|
|
|
|
|
"properties": {
|
|
|
|
|
"blkioWeight": {
|
|
|
|
|
"id": "https://opencontainers.org/schema/bundle/linux/resources/blockIO/blkioWeight",
|
2017-01-19 13:17:05 +08:00
|
|
|
"$ref": "defs-linux.json#/definitions/blkioWeight"
|
2016-01-20 00:27:47 +08:00
|
|
|
},
|
|
|
|
|
"blkioLeafWeight": {
|
|
|
|
|
"id": "https://opencontainers.org/schema/bundle/linux/resources/blockIO/blkioLeafWeight",
|
2017-01-19 13:17:05 +08:00
|
|
|
"$ref": "defs-linux.json#/definitions/blkioWeight"
|
2016-01-20 00:27:47 +08:00
|
|
|
},
|
|
|
|
|
"blkioThrottleReadBpsDevice": {
|
|
|
|
|
"id": "https://opencontainers.org/schema/bundle/linux/resources/blockIO/blkioThrottleReadBpsDevice",
|
2017-01-12 14:06:03 +08:00
|
|
|
"type": "array",
|
|
|
|
|
"items": {
|
|
|
|
|
"$ref": "defs-linux.json#/definitions/blockIODeviceThrottle"
|
|
|
|
|
}
|
2016-01-20 00:27:47 +08:00
|
|
|
},
|
|
|
|
|
"blkioThrottleWriteBpsDevice": {
|
|
|
|
|
"id": "https://opencontainers.org/schema/bundle/linux/resources/blockIO/blkioThrottleWriteBpsDevice",
|
2017-01-12 14:06:03 +08:00
|
|
|
"type": "array",
|
|
|
|
|
"items": {
|
|
|
|
|
"$ref": "defs-linux.json#/definitions/blockIODeviceThrottle"
|
|
|
|
|
}
|
2016-01-20 00:27:47 +08:00
|
|
|
},
|
|
|
|
|
"blkioThrottleReadIopsDevice": {
|
|
|
|
|
"id": "https://opencontainers.org/schema/bundle/linux/resources/blockIO/blkioThrottleReadIopsDevice",
|
2017-01-12 14:06:03 +08:00
|
|
|
"type": "array",
|
|
|
|
|
"items": {
|
|
|
|
|
"$ref": "defs-linux.json#/definitions/blockIODeviceThrottle"
|
|
|
|
|
}
|
2016-01-20 00:27:47 +08:00
|
|
|
},
|
|
|
|
|
"blkioThrottleWriteIopsDevice": {
|
|
|
|
|
"id": "https://opencontainers.org/schema/bundle/linux/resources/blockIO/blkioThrottleWriteIopsDevice",
|
2017-01-12 14:06:03 +08:00
|
|
|
"type": "array",
|
|
|
|
|
"items": {
|
|
|
|
|
"$ref": "defs-linux.json#/definitions/blockIODeviceThrottle"
|
|
|
|
|
}
|
2016-01-20 00:27:47 +08:00
|
|
|
},
|
|
|
|
|
"blkioWeightDevice": {
|
|
|
|
|
"id": "https://opencontainers.org/schema/bundle/linux/resources/blockIO/blkioWeightDevice",
|
|
|
|
|
"type": "array",
|
2016-04-07 05:04:18 +08:00
|
|
|
"items": {
|
2016-08-29 11:58:16 +08:00
|
|
|
"$ref": "defs-linux.json#/definitions/blockIODeviceWeight"
|
2016-04-07 05:04:18 +08:00
|
|
|
}
|
2016-01-20 00:27:47 +08:00
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
},
|
|
|
|
|
"cpu": {
|
|
|
|
|
"id": "https://opencontainers.org/schema/bundle/linux/resources/cpu",
|
2016-08-11 05:14:25 +08:00
|
|
|
"type": "object",
|
2016-01-20 00:27:47 +08:00
|
|
|
"properties": {
|
|
|
|
|
"cpus": {
|
|
|
|
|
"id": "https://opencontainers.org/schema/bundle/linux/resources/cpu/cpus",
|
2017-02-08 16:32:34 +08:00
|
|
|
"type": "string"
|
2016-01-20 00:27:47 +08:00
|
|
|
},
|
|
|
|
|
"mems": {
|
|
|
|
|
"id": "https://opencontainers.org/schema/bundle/linux/resources/cpu/mems",
|
2017-02-08 16:32:34 +08:00
|
|
|
"type": "string"
|
2016-01-20 00:27:47 +08:00
|
|
|
},
|
|
|
|
|
"period": {
|
|
|
|
|
"id": "https://opencontainers.org/schema/bundle/linux/resources/cpu/period",
|
2017-01-19 13:17:05 +08:00
|
|
|
"$ref": "defs.json#/definitions/uint64"
|
2016-01-20 00:27:47 +08:00
|
|
|
},
|
|
|
|
|
"quota": {
|
|
|
|
|
"id": "https://opencontainers.org/schema/bundle/linux/resources/cpu/quota",
|
2017-01-19 13:17:05 +08:00
|
|
|
"$ref": "defs.json#/definitions/int64"
|
2016-01-20 00:27:47 +08:00
|
|
|
},
|
|
|
|
|
"realtimePeriod": {
|
|
|
|
|
"id": "https://opencontainers.org/schema/bundle/linux/resources/cpu/realtimePeriod",
|
2017-01-19 13:17:05 +08:00
|
|
|
"$ref": "defs.json#/definitions/uint64"
|
2016-01-20 00:27:47 +08:00
|
|
|
},
|
|
|
|
|
"realtimeRuntime": {
|
|
|
|
|
"id": "https://opencontainers.org/schema/bundle/linux/resources/cpu/realtimeRuntime",
|
2017-01-19 13:17:05 +08:00
|
|
|
"$ref": "defs.json#/definitions/int64"
|
2016-01-20 00:27:47 +08:00
|
|
|
},
|
|
|
|
|
"shares": {
|
|
|
|
|
"id": "https://opencontainers.org/schema/bundle/linux/resources/cpu/shares",
|
2017-01-19 13:17:05 +08:00
|
|
|
"$ref": "defs.json#/definitions/uint64"
|
2016-01-20 00:27:47 +08:00
|
|
|
}
|
2016-08-31 06:46:26 +08:00
|
|
|
}
|
2016-01-20 00:27:47 +08:00
|
|
|
},
|
|
|
|
|
"disableOOMKiller": {
|
|
|
|
|
"id": "https://opencontainers.org/schema/bundle/linux/resources/disableOOMKiller",
|
|
|
|
|
"type": "boolean"
|
|
|
|
|
},
|
|
|
|
|
"hugepageLimits": {
|
|
|
|
|
"id": "https://opencontainers.org/schema/bundle/linux/resources/hugepageLimits",
|
2017-01-12 14:06:03 +08:00
|
|
|
"type": "array",
|
|
|
|
|
"items": {
|
|
|
|
|
"type": "object",
|
|
|
|
|
"properties": {
|
|
|
|
|
"pageSize": {
|
|
|
|
|
"type": "string"
|
|
|
|
|
},
|
|
|
|
|
"limit": {
|
2017-03-01 09:10:43 +08:00
|
|
|
"$ref": "defs.json#/definitions/uint64"
|
2016-01-20 00:27:47 +08:00
|
|
|
}
|
|
|
|
|
},
|
2017-01-12 14:06:03 +08:00
|
|
|
"required": [
|
|
|
|
|
"pageSize",
|
|
|
|
|
"limit"
|
|
|
|
|
]
|
|
|
|
|
}
|
2016-01-20 00:27:47 +08:00
|
|
|
},
|
|
|
|
|
"memory": {
|
|
|
|
|
"id": "https://opencontainers.org/schema/bundle/linux/resources/memory",
|
|
|
|
|
"type": "object",
|
|
|
|
|
"properties": {
|
|
|
|
|
"kernel": {
|
|
|
|
|
"id": "https://opencontainers.org/schema/bundle/linux/resources/memory/kernel",
|
2017-03-01 09:10:43 +08:00
|
|
|
"$ref": "defs.json#/definitions/uint64"
|
2016-01-20 00:27:47 +08:00
|
|
|
},
|
2017-01-12 19:13:43 +08:00
|
|
|
"kernelTCP": {
|
|
|
|
|
"id": "https://opencontainers.org/schema/bundle/linux/resources/memory/kernelTCP",
|
2017-03-01 09:10:43 +08:00
|
|
|
"$ref": "defs.json#/definitions/uint64"
|
2016-01-20 00:27:47 +08:00
|
|
|
},
|
|
|
|
|
"limit": {
|
|
|
|
|
"id": "https://opencontainers.org/schema/bundle/linux/resources/memory/limit",
|
2017-03-01 09:10:43 +08:00
|
|
|
"$ref": "defs.json#/definitions/uint64"
|
2016-01-20 00:27:47 +08:00
|
|
|
},
|
|
|
|
|
"reservation": {
|
|
|
|
|
"id": "https://opencontainers.org/schema/bundle/linux/resources/memory/reservation",
|
2017-03-01 09:10:43 +08:00
|
|
|
"$ref": "defs.json#/definitions/uint64"
|
2016-01-20 00:27:47 +08:00
|
|
|
},
|
|
|
|
|
"swap": {
|
|
|
|
|
"id": "https://opencontainers.org/schema/bundle/linux/resources/memory/swap",
|
2017-03-01 09:10:43 +08:00
|
|
|
"$ref": "defs.json#/definitions/uint64"
|
2016-01-20 00:27:47 +08:00
|
|
|
},
|
|
|
|
|
"swappiness": {
|
|
|
|
|
"id": "https://opencontainers.org/schema/bundle/linux/resources/memory/swappiness",
|
2017-01-19 13:17:05 +08:00
|
|
|
"$ref": "defs.json#/definitions/uint64"
|
2016-01-20 00:27:47 +08:00
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
},
|
|
|
|
|
"network": {
|
|
|
|
|
"id": "https://opencontainers.org/schema/bundle/linux/resources/network",
|
|
|
|
|
"type": "object",
|
|
|
|
|
"properties": {
|
2016-04-07 05:04:18 +08:00
|
|
|
"classID": {
|
2016-01-20 00:27:47 +08:00
|
|
|
"id": "https://opencontainers.org/schema/bundle/linux/resources/network/classId",
|
2016-04-07 05:04:18 +08:00
|
|
|
"$ref": "defs.json#/definitions/uint32"
|
2016-01-20 00:27:47 +08:00
|
|
|
},
|
|
|
|
|
"priorities": {
|
|
|
|
|
"id": "https://opencontainers.org/schema/bundle/linux/resources/network/priorities",
|
2017-01-12 14:06:03 +08:00
|
|
|
"type": "array",
|
|
|
|
|
"items": {
|
|
|
|
|
"$ref": "defs-linux.json#/definitions/NetworkInterfacePriority"
|
|
|
|
|
}
|
2016-01-20 00:27:47 +08:00
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
},
|
|
|
|
|
"cgroupsPath": {
|
2017-01-13 07:27:56 +08:00
|
|
|
"id": "https://opencontainers.org/schema/bundle/linux/cgroupsPath",
|
2017-02-08 16:32:34 +08:00
|
|
|
"type": "string"
|
2016-01-20 00:27:47 +08:00
|
|
|
},
|
|
|
|
|
"rootfsPropagation": {
|
|
|
|
|
"id": "https://opencontainers.org/schema/bundle/linux/rootfsPropagation",
|
2017-04-21 13:29:13 +08:00
|
|
|
"$ref": "defs-linux.json#/definitions/RootfsPropagation"
|
2016-01-20 00:27:47 +08:00
|
|
|
},
|
|
|
|
|
"seccomp": {
|
|
|
|
|
"id": "https://opencontainers.org/schema/bundle/linux/seccomp",
|
2016-08-11 05:14:25 +08:00
|
|
|
"type": "object",
|
2016-01-20 00:27:47 +08:00
|
|
|
"properties": {
|
|
|
|
|
"defaultAction": {
|
|
|
|
|
"id": "https://opencontainers.org/schema/bundle/linux/seccomp/defaultAction",
|
|
|
|
|
"type": "string"
|
|
|
|
|
},
|
|
|
|
|
"architectures": {
|
|
|
|
|
"id": "https://opencontainers.org/schema/bundle/linux/seccomp/architectures",
|
2017-01-12 14:06:03 +08:00
|
|
|
"type": "array",
|
|
|
|
|
"items": {
|
|
|
|
|
"$ref": "defs-linux.json#/definitions/SeccompArch"
|
|
|
|
|
}
|
2016-01-20 00:27:47 +08:00
|
|
|
},
|
|
|
|
|
"syscalls": {
|
|
|
|
|
"id": "https://opencontainers.org/schema/bundle/linux/seccomp/syscalls",
|
|
|
|
|
"type": "array",
|
|
|
|
|
"items": {
|
|
|
|
|
"$ref": "defs-linux.json#/definitions/Syscall"
|
|
|
|
|
}
|
|
|
|
|
}
|
config-linux: Make linux.seccomp.syscalls OPTIONAL
Before this commit, linux.seccomp.sycalls was required, but we didn't
require an entry in the array. That means '"syscalls": []' would be
technically valid, and I'm pretty sure that's not what we want.
If it makes sense to have a seccomp property that does not need
syscalls entries, then syscalls should be optional (which is what this
commit is doing).
If it does not makes sense to have an empty/unset syscalls then it
should be required and have a minimum length of one.
Before 652323c (improve seccomp format to be more expressive,
2017-01-13, #657), syscalls was omitempty (and therefore more
optional-feeling, although there was no real Markdown spec for seccomp
before 3ca5c6c, config-linux.md: fix seccomp, 2017-03-02, #706, so
it's hard to know). This commit has gone with OPTIONAL, because a
seccomp config which only sets defaultAction seems potentially valid.
The SCMP_ACT_KILL example is prompted by:
On Tue, Apr 25, 2017 at 01:32:26PM -0700, David Lyle wrote [1]:
> Technically, OPTIONAL is the right value, but unless you specify the
> default action for seccomp to be SCMP_ACT_ALLOW the result will be
> an error at run time.
>
> I would suggest an additional clarification to this fact in
> config-linux.md would be very helpful if marking syscall as
> OPTIONAL.
I've phrased the example more conservatively, because I'm not sure
that SCMP_ACT_ALLOW is the only possible value to avoid an error. For
example, perhaps a SCMP_ACT_TRACE default with an empty syscalls array
would not die on the first syscall. The point of the example is to
remind config authors that without a useful syscalls array, the
default value is very important ;).
Also add the previously-missing 'required' property to the seccomp
JSON Schema entry.
[1]: https://github.com/opencontainers/runtime-spec/pull/768#issuecomment-297156102
Signed-off-by: W. Trevor King <wking@tremily.us>
2017-04-13 01:03:10 +08:00
|
|
|
},
|
|
|
|
|
"required": [
|
|
|
|
|
"defaultAction"
|
|
|
|
|
]
|
2016-01-20 00:27:47 +08:00
|
|
|
},
|
|
|
|
|
"sysctl": {
|
|
|
|
|
"id": "https://opencontainers.org/schema/bundle/linux/sysctl",
|
2017-01-19 13:17:05 +08:00
|
|
|
"$ref": "defs.json#/definitions/mapStringString"
|
2016-04-01 08:14:44 +08:00
|
|
|
},
|
|
|
|
|
"maskedPaths": {
|
|
|
|
|
"id": "https://opencontainers.org/schema/bundle/linux/maskedPaths",
|
|
|
|
|
"$ref": "defs.json#/definitions/ArrayOfStrings"
|
|
|
|
|
},
|
|
|
|
|
"readonlyPaths": {
|
|
|
|
|
"id": "https://opencontainers.org/schema/bundle/linux/readonlyPaths",
|
|
|
|
|
"$ref": "defs.json#/definitions/ArrayOfStrings"
|
2016-04-22 05:01:40 +08:00
|
|
|
},
|
|
|
|
|
"mountLabel": {
|
|
|
|
|
"id": "https://opencontainers.org/schema/bundle/linux/mountLabel",
|
|
|
|
|
"type": "string"
|
2016-01-20 00:27:47 +08:00
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
}
|
