toolshed/docker-cli
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add support for ambient capabilities

Browse Source 
Linux kernel 4.3 and later supports "ambient capabilities" which are the
only way to pass capabilities to containers running as a non root uid.

Previously there was no way to allow containers not running as root
capabilities in a useful way.

Fix #8460

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
Upstream-commit: 856a50e733
Component: cli
This commit is contained in:
Justin Cormack
2017-06-02 00:10:13 +00:00
committed by Tibor Vass
parent fe9abc4e81
commit 9916ceda76
1 changed files with 4 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
components/cli/docs/reference/run.md
+4
View File
@@ -1220,6 +1220,10 @@ since Docker 1.12. In Docker 1.10 and 1.11 this did not happen and it may be nec
to use a custom seccomp profile or use `--security-opt seccomp=unconfined` when adding
capabilities.
It is only possible to grant capabilities to a container running as a user other than `root`
on a system with a Linux kernel version of 4.3 or later, as this requires "ambient capabilities"
to be granted. These will be added if the kernel allows it from Docker version 1.13.
## Logging drivers (--log-driver)
The container can have a different logging driver than the Docker daemon. Use