a750afc31e
Mount over dev and only copy allowed nodes in
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com > (github: crosbymichael)
Upstream-commit: 5ba1242bdc309352c2b0b9a1ef9e07fe835e4857
Component: engine
2014-04-24 10:35:20 -07:00
20ba5d97da
No not mount sysfs by default for non privilged containers
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com > (github: crosbymichael)
Upstream-commit: 81e5026a6afb282589704fd5f6bcac9ed50108ea
Component: engine
2014-04-24 10:35:20 -07:00
bdab73285c
Add lxc support for restricting proc
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com > (github: crosbymichael)
Upstream-commit: 0779a8c3287fbf7ff1938df10897b551b839cbee
Component: engine
2014-04-24 10:35:20 -07:00
9da373d6b1
Add restrictions to proc in libcontainer
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com > (github: crosbymichael)
Upstream-commit: 60a90970bc4add3547064004f08c19ab5027141b
Component: engine
2014-04-24 10:35:19 -07:00
505086c799
devicemapper: Don't mount in Create()
...
We used to mount in Create() to be able to create a few files that
needs to be in each device. However, this mount is problematic for
selinux, as we need to set the mount label at mount-time, and it
is not known at the time of Create().
This change just moves the file creation to first Get() call and
drops the mount from Create(). Additionally, this lets us remove
some complexities we had to avoid an extra unmount+mount cycle.
Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com > (github: alexlarsson)
Upstream-commit: 73d9ede12c9328c44e38699dbe3a04479d3926e6
Component: engine
2014-04-23 13:50:53 +02:00
1ea14534fa
Merge branch 'master' into load-profile
...
Conflicts:
daemon/execdriver/native/create.go
daemon/execdriver/native/driver.go
Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume@charmes.net > (github: creack)
Upstream-commit: 813cebc64fb4b628e2938405d86144060c330eb9
Component: engine
2014-04-21 10:32:13 -07:00
de47414003
Remove IsGhost checks around networking
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com > (github: crosbymichael)
Upstream-commit: eceeebc22d9e4d75630e333759895a868ceba234
Component: engine
2014-04-17 23:49:59 +00:00
f7be50364d
Rename runtime/* to daemon/*
...
Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com > (github: alexlarsson)
Upstream-commit: 359b7df5d2af5733b8a1ea6746d062053053b23e
Component: engine
2014-04-17 14:43:01 -07:00
