Skip to content

Commit 01528b3

Browse files
gao-fenggao-feng
committed
move the description of user ns mapping and default files to proper file
They should stay in runtime not config Signed-off-by: Gao feng <[email protected]>
1 parent 3f1b4c6 commit 01528b3

File tree

3 files changed

+78
-70
lines changed

3 files changed

+78
-70
lines changed

‎config-linux.md‎

Lines changed: 0 additions & 46 deletions
Original file line numberDiff line numberDiff line change
@@ -15,49 +15,3 @@ Valid values are the strings for capabilities defined in [the man page](http://m
1515
"CAP_NET_BIND_SERVICE"
1616
]
1717
```
18-
19-
## User namespace mappings
20-
21-
```json
22-
"uidMappings": [
23-
{
24-
"hostID": 1000,
25-
"containerID": 0,
26-
"size": 10
27-
}
28-
],
29-
"gidMappings": [
30-
{
31-
"hostID": 1000,
32-
"containerID": 0,
33-
"size": 10
34-
}
35-
]
36-
```
37-
38-
uid/gid mappings describe the user namespace mappings from the host to the container.
39-
The mappings represent how the bundle `rootfs` expects the user namespace to be setup and the runtime SHOULD NOT modify the permissions on the rootfs to realize the mapping.
40-
*hostID* is the starting uid/gid on the host to be mapped to *containerID* which is the starting uid/gid in the container and *size* refers to the number of ids to be mapped.
41-
There is a limit of 5 mappings which is the Linux kernel hard limit.
42-
43-
## Default Devices and File Systems
44-
45-
The Linux ABI includes both syscalls and several special file paths.
46-
Applications expecting a Linux environment will very likely expect these files paths to be setup correctly.
47-
48-
The following devices and filesystems MUST be made available in each application's filesystem
49-
50-
| Path | Type | Notes |
51-
| ------------ | ------ | ------- |
52-
| /proc | [procfs](https://www.kernel.org/doc/Documentation/filesystems/proc.txt) | |
53-
| /sys | [sysfs](https://www.kernel.org/doc/Documentation/filesystems/sysfs.txt) | |
54-
| /dev/null | [device](http://man7.org/linux/man-pages/man4/null.4.html) | |
55-
| /dev/zero | [device](http://man7.org/linux/man-pages/man4/zero.4.html) | |
56-
| /dev/full | [device](http://man7.org/linux/man-pages/man4/full.4.html) | |
57-
| /dev/random | [device](http://man7.org/linux/man-pages/man4/random.4.html) | |
58-
| /dev/urandom | [device](http://man7.org/linux/man-pages/man4/random.4.html) | |
59-
| /dev/tty | [device](http://man7.org/linux/man-pages/man4/tty.4.html) | |
60-
| /dev/console | [device](http://man7.org/linux/man-pages/man4/console.4.html) | |
61-
| /dev/pts | [devpts](https://www.kernel.org/doc/Documentation/filesystems/devpts.txt) | |
62-
| /dev/ptmx | [device](https://www.kernel.org/doc/Documentation/filesystems/devpts.txt) | Bind-mount or symlink of /dev/pts/ptmx |
63-
| /dev/shm | [tmpfs](https://www.kernel.org/doc/Documentation/filesystems/tmpfs.txt) | |

‎runtime-config-linux.md‎

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,31 @@ container via system level IPC.
4646
* **user** the container will be able to remap user and group IDs from the host to local users and groups
4747
within the container.
4848

49+
## User namespace mappings
50+
51+
uid/gid mappings describe the user namespace mappings from the host to the container.
52+
The mappings represent how the bundle `rootfs` expects the user namespace to be setup and the runtime SHOULD NOT modify the permissions on the rootfs to realize the mapping.
53+
*hostID* is the starting uid/gid on the host to be mapped to *containerID* which is the starting uid/gid in the container and *size* refers to the number of ids to be mapped.
54+
There is a limit of 5 mappings which is the Linux kernel hard limit.
55+
56+
*Example*
57+
```json
58+
"uidMappings": [
59+
{
60+
"hostID": 1000,
61+
"containerID": 0,
62+
"size": 10
63+
}
64+
],
65+
"gidMappings": [
66+
{
67+
"hostID": 1000,
68+
"containerID": 0,
69+
"size": 10
70+
}
71+
]
72+
```
73+
4974
## Devices
5075

5176
Devices is an array specifying the list of devices to be created in the container.
@@ -62,6 +87,19 @@ Next parameters can be specified:
6287
* **uid** - uid of device owner
6388
* **gid** - gid of device owner
6489

90+
Note: The following devices MUST be made available in each application's filesystem
91+
92+
| Path | Type | Notes |
93+
| ------------ | ------ | ------- |
94+
| /dev/null | [device](http://man7.org/linux/man-pages/man4/null.4.html) | |
95+
| /dev/zero | [device](http://man7.org/linux/man-pages/man4/zero.4.html) | |
96+
| /dev/full | [device](http://man7.org/linux/man-pages/man4/full.4.html) | |
97+
| /dev/random | [device](http://man7.org/linux/man-pages/man4/random.4.html) | |
98+
| /dev/urandom | [device](http://man7.org/linux/man-pages/man4/random.4.html) | |
99+
| /dev/tty | [device](http://man7.org/linux/man-pages/man4/tty.4.html) | |
100+
| /dev/console | [device](http://man7.org/linux/man-pages/man4/console.4.html) | |
101+
| /dev/ptmx | [device](https://www.kernel.org/doc/Documentation/filesystems/devpts.txt) | Bind-mount or symlink of /dev/pts/ptmx |
102+
65103
*Example*
66104
```json
67105
"devices": [
@@ -128,6 +166,45 @@ Next parameters can be specified:
128166
]
129167
```
130168

169+
## Mounts
170+
171+
See [the description of Mounts](runtime-config.md#mount_configuration)
172+
173+
Note: The following filesystems MUST be made available in each Linux application's filesystem
174+
175+
| Path | Type |
176+
| ------------ | ------ |
177+
| /proc | [procfs](https://www.kernel.org/doc/Documentation/filesystems/proc.txt) |
178+
| /sys | [sysfs](https://www.kernel.org/doc/Documentation/filesystems/sysfs.txt) |
179+
| /dev/pts | [devpts](https://www.kernel.org/doc/Documentation/filesystems/devpts.txt) |
180+
| /dev/shm | [tmpfs](https://www.kernel.org/doc/Documentation/filesystems/tmpfs.txt) |
181+
182+
*Example*
183+
```json
184+
"mounts": {
185+
"proc": {
186+
"type": "proc",
187+
"source": "proc",
188+
"options": []
189+
},
190+
"dev": {
191+
"type": "tmpfs",
192+
"source": "tmpfs",
193+
"options": ["nosuid","strictatime","mode=755","size=65536k"]
194+
},
195+
"devpts": {
196+
"type": "devpts",
197+
"source": "devpts",
198+
"options": ["nosuid","noexec","newinstance","ptmxmode=0666","mode=0620","gid=5"]
199+
},
200+
"data": {
201+
"type": "bind",
202+
"source": "/volumes/testing",
203+
"options": ["rbind","rw"]
204+
}
205+
}
206+
```
207+
131208
## Control groups
132209

133210
Also known as cgroups, they are used to restrict resource usage for a container and handle device access.

‎runtime-config.md‎

Lines changed: 1 addition & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -12,30 +12,7 @@ Only [mounts from the portable config](config.md#mount-points) will be mounted.
1212

1313
*Example (Linux)*
1414

15-
```json
16-
"mounts": {
17-
"proc": {
18-
"type": "proc",
19-
"source": "proc",
20-
"options": []
21-
},
22-
"dev": {
23-
"type": "tmpfs",
24-
"source": "tmpfs",
25-
"options": ["nosuid","strictatime","mode=755","size=65536k"]
26-
},
27-
"devpts": {
28-
"type": "devpts",
29-
"source": "devpts",
30-
"options": ["nosuid","noexec","newinstance","ptmxmode=0666","mode=0620","gid=5"]
31-
},
32-
"data": {
33-
"type": "bind",
34-
"source": "/volumes/testing",
35-
"options": ["rbind","rw"]
36-
}
37-
}
38-
```
15+
See [Mounts example in Linux](runtime-config-linux.md#mounts)
3916

4017
*Example (Windows)*
4118

0 commit comments

Comments
 (0)