e0f1623f01
Docker-DCO-1.1-Signed-off-by: Victor Vieux <vieux@docker.com> (github: vieux) Upstream-commit: 0abb52c7a97940dc17c45ac45226af8156d0e712 Component: engine
45 lines
1016 B
Go
45 lines
1016 B
Go
package template
|
|
|
|
import (
|
|
"github.com/dotcloud/docker/pkg/apparmor"
|
|
"github.com/dotcloud/docker/pkg/libcontainer"
|
|
"github.com/dotcloud/docker/pkg/libcontainer/cgroups"
|
|
"github.com/dotcloud/docker/pkg/libcontainer/mount/nodes"
|
|
)
|
|
|
|
// New returns the docker default configuration for libcontainer
|
|
func New() *libcontainer.Container {
|
|
container := &libcontainer.Container{
|
|
Capabilities: []string{
|
|
"CHOWN",
|
|
"DAC_OVERRIDE",
|
|
"FOWNER",
|
|
"MKNOD",
|
|
"NET_RAW",
|
|
"SETGID",
|
|
"SETUID",
|
|
"SETFCAP",
|
|
"SETPCAP",
|
|
"NET_BIND_SERVICE",
|
|
},
|
|
Namespaces: map[string]bool{
|
|
"NEWNS": true,
|
|
"NEWUTS": true,
|
|
"NEWIPC": true,
|
|
"NEWPID": true,
|
|
"NEWNET": true,
|
|
},
|
|
Cgroups: &cgroups.Cgroup{
|
|
Parent: "docker",
|
|
DeviceAccess: false,
|
|
},
|
|
Context: libcontainer.Context{},
|
|
RequiredDeviceNodes: nodes.DefaultNodes,
|
|
OptionalDeviceNodes: []string{"/dev/fuse"},
|
|
}
|
|
if apparmor.IsEnabled() {
|
|
container.Context["apparmor_profile"] = "docker-default"
|
|
}
|
|
return container
|
|
}
|