824de2eaf8
By default, the cgroup setting in libcontainer's configs.Cgroup for memory swappiness will default to 0, which is a valid choice for memory swappiness, but that means by default every container's memory swappiness will be set to zero instead of the default 60, which is probably not what users are expecting. When the swappiness UI PR comes into Docker, there will be docker run controls to set this per container, but for now we want to make sure *not* to change the default, as well as work around an older kernel issue that refuses to allow it to be set when cgroup hiearchies are in use. Docker-DCO-1.1-Signed-off-by: Phil Estes <estesp@linux.vnet.ibm.com> (github: estesp) Upstream-commit: 9e9d2276777ba6f48390a33d67ed544b5c183968 Component: engine
105 lines
2.1 KiB
Go
105 lines
2.1 KiB
Go
package template
|
|
|
|
import (
|
|
"syscall"
|
|
|
|
"github.com/docker/libcontainer/apparmor"
|
|
"github.com/docker/libcontainer/configs"
|
|
)
|
|
|
|
const defaultMountFlags = syscall.MS_NOEXEC | syscall.MS_NOSUID | syscall.MS_NODEV
|
|
|
|
// New returns the docker default configuration for libcontainer
|
|
func New() *configs.Config {
|
|
container := &configs.Config{
|
|
Capabilities: []string{
|
|
"CHOWN",
|
|
"DAC_OVERRIDE",
|
|
"FSETID",
|
|
"FOWNER",
|
|
"MKNOD",
|
|
"NET_RAW",
|
|
"SETGID",
|
|
"SETUID",
|
|
"SETFCAP",
|
|
"SETPCAP",
|
|
"NET_BIND_SERVICE",
|
|
"SYS_CHROOT",
|
|
"KILL",
|
|
"AUDIT_WRITE",
|
|
},
|
|
Namespaces: configs.Namespaces([]configs.Namespace{
|
|
{Type: "NEWNS"},
|
|
{Type: "NEWUTS"},
|
|
{Type: "NEWIPC"},
|
|
{Type: "NEWPID"},
|
|
{Type: "NEWNET"},
|
|
}),
|
|
Cgroups: &configs.Cgroup{
|
|
Parent: "docker",
|
|
AllowAllDevices: false,
|
|
MemorySwappiness: -1,
|
|
},
|
|
Mounts: []*configs.Mount{
|
|
{
|
|
Source: "proc",
|
|
Destination: "/proc",
|
|
Device: "proc",
|
|
Flags: defaultMountFlags,
|
|
},
|
|
{
|
|
Source: "tmpfs",
|
|
Destination: "/dev",
|
|
Device: "tmpfs",
|
|
Flags: syscall.MS_NOSUID | syscall.MS_STRICTATIME,
|
|
Data: "mode=755",
|
|
},
|
|
{
|
|
Source: "devpts",
|
|
Destination: "/dev/pts",
|
|
Device: "devpts",
|
|
Flags: syscall.MS_NOSUID | syscall.MS_NOEXEC,
|
|
Data: "newinstance,ptmxmode=0666,mode=0620,gid=5",
|
|
},
|
|
{
|
|
Device: "tmpfs",
|
|
Source: "shm",
|
|
Destination: "/dev/shm",
|
|
Data: "mode=1777,size=65536k",
|
|
Flags: defaultMountFlags,
|
|
},
|
|
{
|
|
Source: "mqueue",
|
|
Destination: "/dev/mqueue",
|
|
Device: "mqueue",
|
|
Flags: defaultMountFlags,
|
|
},
|
|
{
|
|
Source: "sysfs",
|
|
Destination: "/sys",
|
|
Device: "sysfs",
|
|
Flags: defaultMountFlags | syscall.MS_RDONLY,
|
|
},
|
|
},
|
|
MaskPaths: []string{
|
|
"/proc/kcore",
|
|
"/proc/latency_stats",
|
|
"/proc/timer_stats",
|
|
},
|
|
ReadonlyPaths: []string{
|
|
"/proc/asound",
|
|
"/proc/bus",
|
|
"/proc/fs",
|
|
"/proc/irq",
|
|
"/proc/sys",
|
|
"/proc/sysrq-trigger",
|
|
},
|
|
}
|
|
|
|
if apparmor.IsEnabled() {
|
|
container.AppArmorProfile = "docker-default"
|
|
}
|
|
|
|
return container
|
|
}
|