Automatic translation of MLS labels is currently not
supported, so should not be documented as an example.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Upstream-commit: 841cf6fffb6a821d6c5777871090c9d2bcc95b36
Component: engine
Currently the default seccomp profile is fixed. This changes it
so that it varies depending on the Linux capabilities selected with
the --cap-add and --cap-drop options. Without this, if a user adds
privileges, eg to allow ptrace with --cap-add sys_ptrace then still
cannot actually use ptrace as it is still blocked by seccomp, so
they will probably disable seccomp or use --privileged. With this
change the syscalls that are needed for the capability are also
allowed by the seccomp profile based on the selected capabilities.
While this patch makes it easier to do things with for example
cap_sys_admin enabled, as it will now allow creating new namespaces
and use of mount, it still allows less than --cap-add cap_sys_admin
--security-opt seccomp:unconfined would have previously. It is not
recommended that users run containers with cap_sys_admin as this does
give full access to the host machine.
It also cleans up some architecture specific system calls to be
only selected when needed.
Signed-off-by: Justin Cormack <justin.cormack@docker.com>
Upstream-commit: a01c4dc8f85827f32d88522e5153dddc02f11806
Component: engine
Auto-creation of host-directories was marked deprecated in
Docker 1.9, but was decided to be too much of an backward-incompatible
change, so it was decided to keep the feature.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Upstream-commit: 0f70f53826ac311ca1653827c0d6bc170f300e84
Component: engine
This allows a user to specify explicitly to enable
automatic copying of data from the container path to the volume path.
This does not change the default behavior of automatically copying, but
does allow a user to disable it at runtime.
Signed-off-by: Brian Goff <cpuguy83@gmail.com>
Upstream-commit: b0ac69b67ef79c6c937f84bee3df20a1924ad334
Component: engine
All other options we have use `=` as separator, labels,
log configurations, graph configurations and so on.
We should be consistent and use `=` for the security
options too.
Signed-off-by: David Calavera <david.calavera@gmail.com>
Upstream-commit: cb9aeb0413ca75bb3af7fa723a1f2e6b2bdbcb0e
Component: engine
Missing documentation and man pages on seccomp options.
Signed-off-by: Dan Walsh <dwalsh@redhat.com>
Upstream-commit: 450fa7536edc03fb5b071c0d04af534b2f8572ff
Component: engine
Docker creates a UTS namespace by default, even with --net=host, so it
is reasonable to let the user set the hostname. Note that --hostname is
forbidden if the user specifies --uts=host.
Closes#12076
Signed-off-by: Jason Heiss <jheiss@aput.net>
Upstream-commit: 3f445e63b4568845f439c5d30a99ba10603b1938
Component: engine
Underlying files are no longer copied to the tmpfs.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Upstream-commit: 386392f79987a135fd9168cc92482f92c671713c
Component: engine
Fixing the links
Updating with Seb's comments
Adding weight
Fixing the engine aliases
Updating after Arun pushed
Removing empty file
Signed-off-by: Mary Anthony <mary@docker.com>
Upstream-commit: e310d070f498a2ac494c6d3fde0ec5d6e4479e14
Component: engine
This makes it so when calling `docker run --rm`, or `docker rm -v`, only
volumes specified without a name, e.g. `docker run -v /foo` instead of
`docker run -v awesome:/foo` are removed.
Note that all volumes are named, some are named by the user, some get a
generated name. This is specifically about how the volume was specified
on `run`, assuming that if the user specified it with a name they expect
it to persist after the container is cleaned up.
Signed-off-by: Brian Goff <cpuguy83@gmail.com>
Upstream-commit: dd7d1c8a02d8693aa4f381f82c5bbdcad9a5ff58
Component: engine
Correcting `overlay` -> `bridge` driver in run.md to match the preceding paragraph.
Signed-off-by: Jasmine Hegman <jasmine@jhegman.com>
Upstream-commit: ae5fce9fe02523e7a43ddd533f645d1a8fb20193
Component: engine
The existing example didn't illustrate how to
install strace in the container. In addition,
the rhel7 image used is no longer public (and maintained)
so not a good image to use in the example.
This updates the example to use htop (strace is
not working without disabling apparmor for the container)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Upstream-commit: 9b6592ca858a23376b838e9808d7fa3f15ebc381
Component: engine
This re-aligns the docs with what the cmd line now does.
Signed-off-by: Doug Davis <dug@us.ibm.com>
Upstream-commit: e6115a6c1c02768898b0a47e550e6c67b433c436
Component: engine
add a note around restart policies only working in detached mode
Signed-off-by: Aidan Feldman <aidan.feldman@gmail.com>
Update restart description with Mary's comments.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Upstream-commit: c32ec8b93b199168425f29cab040d9d8cc23566f
Component: engine
This fixes markdown formatting, and formatting of tables;
- Our markdown engine doesn't support spanning rows, so
re-wrapped table contents.
- Added a CSS-styles to prevent "code" blocks in tables
from wrapping
- The "logging drivers" table didn't have a header
- Aligned table borders in source code for better readability.
- Standardize on using `-it` in stead of -i -t or -ti
- Some markup issues
- Some minor textual fixups
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Upstream-commit: c60c0c4e9b65bd69fd1e1d6ca78bfcb2d7281c87
Component: engine
It will Tar up contents of child directory onto tmpfs if mounted over
This patch will use the new PreMount and PostMount hooks to "tar"
up the contents of the base image on top of tmpfs mount points.
Signed-off-by: Dan Walsh <dwalsh@redhat.com>
Upstream-commit: b3e527dfd242ad30c0297c8b257862116cf2c50e
Component: engine
