Update config-linux for better formatting on values
Signed-off-by: Michael Crosby <crosbymichael@gmail.com>
This commit is contained in:
Michael Crosby
parent
106bc8ebb2
commit
f2569d17b4
|
|
@ -1,6 +1,17 @@
|
|||
# Linux
|
||||
|
||||
## Linux Namespaces
|
||||
## Linux namespaces
|
||||
|
||||
A namespace wraps a global system resource in an abstraction that makes it
|
||||
appear to the processes within the namespace that they have their own isolated
|
||||
instance of the global resource. Changes to the global resource are visible to
|
||||
other processes that are members of the namespace, but are invisible to other
|
||||
processes. For more information, see [the man page](http://man7.org/linux/man-pages/man7/namespaces.7.html)
|
||||
|
||||
Namespaces are specified in the spec as an array of entries. Each entry has a
|
||||
type field with possible values described below and an optional path element.
|
||||
If a path is specified, that particular file is used to join that type of namespace.
|
||||
|
||||
```json
|
||||
"namespaces": [
|
||||
{
|
||||
|
|
@ -26,23 +37,25 @@
|
|||
]
|
||||
```
|
||||
|
||||
A namespace wraps a global system resource in an abstraction that makes it appear to the processes within the namespace that they have their own isolated instance of the global resource. Changes to the global resource are visible to other processes that are members of the namespace, but are invisible to other processes. For more information, see http://man7.org/linux/man-pages/man7/namespaces.7.html
|
||||
#### Namespace types
|
||||
|
||||
Namespaces are specified in the spec as an array of entries. Each entry has a type field with possible values described below and an optional path element. If a path is specified, that particular fd is used to join that type of namespace.
|
||||
|
||||
* pid: the process ID number space is specific to the container, meaning that processes in different PID namespaces can have the same PID
|
||||
|
||||
* network: the container will have an isolated network stack
|
||||
|
||||
* mnt: container can only access mounts local to itself
|
||||
|
||||
* ipc: processes in the container can only communicate with other processes inside same container
|
||||
|
||||
* uts: Hostname and NIS domain name are specific to the container
|
||||
|
||||
* user: uids/gids on the host are mapped to different uids/gids in the container, so root in a container could be a non-root, unprivileged uid on the host
|
||||
* **pid** processes inside the container will only be able to see other processes inside the same container.
|
||||
* **network** the container will have it's own network stack.
|
||||
* **mnt** the container will have an isolated mount table.
|
||||
* **ipc** processes inside the container will only be able to communicate to other processes inside the same
|
||||
container via system level IPC.
|
||||
* **uts** the container will be able to have it's own hostname and domain name.
|
||||
* **user** the container will be able to remap user and group IDs from the host to local users and groups
|
||||
within the container.
|
||||
|
||||
### Access to devices
|
||||
|
||||
Devices is an array specifying the list of devices from the host to make available in the container.
|
||||
By providing a device name within the list the runtime should lookup the same device on the host's `/dev`
|
||||
and collect information about the device node so that it can be recreated for the container. The runtime
|
||||
should not only create the device inside the container but ensure that the root user inside
|
||||
the container has access rights for the device.
|
||||
|
||||
```json
|
||||
"devices": [
|
||||
"null",
|
||||
|
|
@ -54,15 +67,17 @@ Namespaces are specified in the spec as an array of entries. Each entry has a ty
|
|||
]
|
||||
```
|
||||
|
||||
Devices is an array specifying the list of devices from the host to make available in the container.
|
||||
## Linux control groups
|
||||
|
||||
The array contains names: for each name, the device /dev/<name> will be made available inside the container.
|
||||
Also known as cgroups, they are used to restrict resource usage for a container and handle
|
||||
device access. cgroups provide controls to restruct cpu, memory, IO, and network for
|
||||
the container.
|
||||
|
||||
## Linux Control groups
|
||||
## Linux capabilities
|
||||
|
||||
## Linux Seccomp
|
||||
|
||||
## Linux Process Capabilities
|
||||
Capabilities is an array that specifies Linux capabilities that can be provided to the process
|
||||
inside the container. Valid values are the string after `CAP_` for capabilities defined
|
||||
in [the man page](http://man7.org/linux/man-pages/man7/capabilities.7.html)
|
||||
|
||||
```json
|
||||
"capabilities": [
|
||||
|
|
@ -72,9 +87,10 @@ The array contains names: for each name, the device /dev/<name> will be made ava
|
|||
]
|
||||
```
|
||||
|
||||
capabilities is an array of Linux process capabilities. Valid values are the string after `CAP_` for capabilities defined in http://man7.org/linux/man-pages/man7/capabilities.7.html
|
||||
## Linux sysctl
|
||||
|
||||
## Linux Sysctl
|
||||
sysctl allows kernel parameters to be modified at runtime for the container.
|
||||
For more information, see [the man page](http://man7.org/linux/man-pages/man8/sysctl.8.html)
|
||||
|
||||
```
|
||||
"sysctl": {
|
||||
|
|
@ -83,9 +99,7 @@ capabilities is an array of Linux process capabilities. Valid values are the str
|
|||
}
|
||||
```
|
||||
|
||||
sysctl allows kernel parameters to be modified at runtime. For more information, see http://man7.org/linux/man-pages/man8/sysctl.8.html
|
||||
## Security
|
||||
|
||||
## SELinux
|
||||
|
||||
## Apparmor
|
||||
**TODO:** security profiles
|
||||
|
||||
|
|
|
|||
Loading…
Reference in New Issue