2.2 KiB
2.2 KiB
Linux-specific Container Configuration
The Linux container specification uses various kernel features like namespaces, cgroups, capabilities, LSM, and file system jails to fulfill the spec. Additional information is needed for Linux over the default spec configuration in order to configure these various kernel features.
Capabilities
Capabilities is an array that specifies Linux capabilities that can be provided to the process inside the container. Valid values are the strings for capabilities defined in the man page
"capabilities": [
"CAP_AUDIT_WRITE",
"CAP_KILL",
"CAP_NET_BIND_SERVICE"
]
Default Devices and File Systems
The Linux ABI includes both syscalls and several special file paths. Applications expecting a Linux environment will very likely expect these files paths to be setup correctly.
The following devices and filesystems MUST be made available in each application's filesystem
| Path | Type | Notes |
|---|---|---|
| /proc | procfs | |
| /sys | sysfs | |
| /dev/null | device | |
| /dev/zero | device | |
| /dev/full | device | |
| /dev/random | device | |
| /dev/urandom | device | |
| /dev/tty | device | |
| /dev/console | device | |
| /dev/pts | devpts | |
| /dev/ptmx | device | Bind-mount or symlink of /dev/pts/ptmx |
| /dev/shm | tmpfs |