From d8237f1899a0bbe46eef63b3a23a6c9835b743a3 Mon Sep 17 00:00:00 2001 From: Mrunal Patel Date: Wed, 1 Jul 2015 17:32:03 -0400 Subject: [PATCH] Adds a section for user namespace mappings Signed-off-by: Mrunal Patel --- config-linux.md | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/config-linux.md b/config-linux.md index 1ee02f31..868bd4f7 100644 --- a/config-linux.md +++ b/config-linux.md @@ -118,6 +118,27 @@ For more information, see [the man page](http://man7.org/linux/man-pages/man8/sy rlimits allow setting resource limits. The type is from the values defined in [the man page](http://man7.org/linux/man-pages/man2/setrlimit.2.html). The kernel enforces the soft limit for a resource while the hard limit acts as a ceiling for that value that could be set by an unprivileged process. +## Linux user namespace mappings + +``` + "uidMappings": [ + { + "from" : 1000, + "to" : 0, + "count" : 10 + } + ], + "gidMappings": [ + { + "from" : 1000, + "to" : 0, + "count" : 10 + } + ] +``` + +uid/gid mappings describe the user namespace mappings from the host to the container. *from* is the starting uid/gid on the host to be mapped to *to* which is the starting uid/gid in the container and *count* refers to the number of ids to be mapped. The Linux kernel has a limit of 5 such mappings that can be specified. + ## Security **TODO:** security profiles