This adds `type Namespaces []Namespace` so that methods can be added to
this slice so that it is easier for consumers to work with the values.
Signed-off-by: Michael Crosby <crosbymichael@gmail.com>
This patch changes the incorrectly named functions GetPasswdFile,
GetGroupFile, GetExecUserFile and several internal components to
GetPasswdPath, GetGroupPath, etc -- as these are far more appropriate
names and more clearly convey to users what the arguments represent.
Signed-off-by: Aleksa Sarai <cyphar@cyphar.com> (github: cyphar)
also document that the executor will only try to remove all the children in a
best-effort way.
Docker-DCO-1.1-Signed-off-by: Daniel, Dao Quang Minh <dqminh89@gmail.com> (github: dqminh)
when the test binary starts, it detects whether it should run the container
initialization code or the execin initialization code based on the suppplied
arguments. The execin initialization code is taken from docker.
also added a sample test for execin process.
Docker-DCO-1.1-Signed-off-by: Daniel, Dao Quang Minh <dqminh89@gmail.com> (github: dqminh)
This removes the unsued namespace types from the namespace package
and simplifies getting the values for the namespaces.
Signed-off-by: Michael Crosby <crosbymichael@gmail.com>
This changes the namespace configuration on the config to include the
name of the namespace along with an optional path. This path is used to
point to a file of another namespace for the namespace so that it can be
joined in place of the empty, initialized namespace.
Signed-off-by: Michael Crosby <crosbymichael@gmail.com>
This document specifies the current container specification with all the
underlying setup and configuration that goes into making a container.
This is the v1 spec that is today but allows for flexability when we
introduce more features such as seccomp default profiles and more.
Signed-off-by: Michael Crosby <crosbymichael@gmail.com>
Adds a new item to the config struct []*Rlimit
Rlimit takes a type (ie, syscall.RLIMIT_NOFILE) and the hard/soft limit
(As max/cur)
Signed-off-by: Brian Goff <cpuguy83@gmail.com>
SELinux supports a call that tells the kernel, from this point onward
create content with this label. If you pass "", the kernel will
go back to the default.
Docker-DCO-1.1-Signed-off-by: Dan Walsh <dwalsh@redhat.com> (github: rhatdan)
Writing to this file within /sys is casuing some issues for
older kernels, specifically with 2.6.xx, where the write is failing
because /sys is becoming ro. We will continue to work on the 2.6 issues
but for the time being we cannot ship this with it enabled as it's
breaking all container runs.
Signed-off-by: Michael Crosby <crosbymichael@gmail.com>
Currently if we don't use --cpuset, the cpuset cgroup is not
created, it's bad if we want to modify cpuset config subsequently,
change the behavior to make it right.
Signed-off-by: Qiang Huang <h.huangqiang@huawei.com>
Daniel, Dao Quang Minh
Michael Crosby
Victor Marmol
Aleksa Sarai
Mrunal Patel
Rohit Jnagal
Gary Berger
Ketouem
Michael Crosby
Qiang Huang
Brian Goff
Milos Gajdos
Yohei Ueda
unclejack
Dan Walsh
Vishnu Kannan