You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
This introduces verbiage of fields that may occur in json (technically
optional), but is required on certain platforms (e.g. Linux).
The JSON document will look the same as it presently does, but now the
reference source compiles regardless of platform.
Not adding a "name" string to the user sturct, as that is not a
requirement yet.
In the event a windows runtime shows up, I could imagine an `sid` on the
user struct, but we'll get to that when it happens.
Closes#135
Related to #166
Signed-off-by: Vincent Batts <[email protected]>
// Root contains information about the container's root filesystem on the host.
37
51
typeRootstruct {
38
52
// Path is the absolute path to the container's root filesystem.
@@ -57,3 +71,9 @@ type MountPoint struct {
57
71
// Path specifies the path of the mount. The path and child directories MUST exist, a runtime MUST NOT create directories automatically to a mount point.
58
72
Pathstring`json:"path"`
59
73
}
74
+
75
+
// Linux contains platform specific configuration for linux based containers.
76
+
typeLinuxstruct {
77
+
// Capabilities are linux capabilities that are kept for the container.
Copy file name to clipboardExpand all lines: config.md
+58-17Lines changed: 58 additions & 17 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -28,10 +28,10 @@ Each container has exactly one *root filesystem*, specified in the *root* object
28
28
*Example*
29
29
30
30
```json
31
-
"root": {
31
+
"root": {
32
32
"path": "rootfs",
33
33
"readonly": true
34
-
}
34
+
}
35
35
```
36
36
37
37
## Mount Points
@@ -46,24 +46,24 @@ The runtime MUST mount entries in the listed order.
46
46
*Example*
47
47
48
48
```json
49
-
"mounts": [
49
+
"mounts": [
50
50
{
51
-
"name": "proc",
52
-
"path": "/proc"
51
+
"name": "proc",
52
+
"path": "/proc"
53
53
},
54
54
{
55
-
"name": "dev",
56
-
"path": "/dev"
55
+
"name": "dev",
56
+
"path": "/dev"
57
57
},
58
58
{
59
-
"name": "devpts",
60
-
"path": "/dev/pts"
59
+
"name": "devpts",
60
+
"path": "/dev/pts"
61
61
},
62
62
{
63
-
"name": "data",
64
-
"path": "/data"
63
+
"name": "data",
64
+
"path": "/data"
65
65
}
66
-
]
66
+
]
67
67
```
68
68
69
69
## Process configuration
@@ -76,9 +76,9 @@ The runtime MUST mount entries in the listed order.
76
76
The user for the process is a platform-specific structure that allows specific control over which user the process runs as.
77
77
For Linux-based systems the user structure has the following fields:
78
78
79
-
***`uid`** (int, required) specifies the user id.
80
-
***`gid`** (int, required) specifies the group id.
81
-
***`additionalGids`** (array of ints, optional) specifies additional group ids to be added to the process.
79
+
***`uid`** (int, required on Linux) specifies the user id.
80
+
***`gid`** (int, required on Linux) specifies the group id.
81
+
***`additionalGids`** (array of ints, optional on Linux) specifies additional group ids to be added to the process.
82
82
83
83
*Example (Linux)*
84
84
@@ -101,7 +101,6 @@ For Linux-based systems the user structure has the following fields:
101
101
}
102
102
```
103
103
104
-
105
104
## Hostname
106
105
107
106
***`hostname`** (string, optional) as it is accessible to processes running inside. On Linux, you can only set this if your bundle creates a new [UTS namespace][uts-namespace].
@@ -117,6 +116,8 @@ For Linux-based systems the user structure has the following fields:
117
116
***`os`** (string, required) specifies the operating system family this image must run on. Values for os must be in the list specified by the Go Language document for [`$GOOS`](https://golang.org/doc/install/source#environment).
118
117
***`arch`** (string, required) specifies the instruction set for which the binaries in the image have been compiled. Values for arch must be in the list specified by the Go Language document for [`$GOARCH`](https://golang.org/doc/install/source#environment).
119
118
119
+
*Example*
120
+
120
121
```json
121
122
"platform": {
122
123
"os": "linux",
@@ -125,6 +126,46 @@ For Linux-based systems the user structure has the following fields:
125
126
```
126
127
127
128
Interpretation of the platform section of the JSON file is used to find which platform-specific sections may be available in the document.
128
-
For example, if `os` is set to `linux`, then a JSON object conforming to the [Linux-specific schema](config-linux.md) SHOULD be found at the key `linux` in the `config.json`.
129
+
For example, if `os` is set to `linux`, then a JSON object conforming to the [Linux-specific schema](#linux-specific-container-configuration) SHOULD be found at the key `linux` in the `config.json`.
130
+
131
+
## Linux-specific Container Configuration
132
+
133
+
The Linux container specification.
134
+
uses various kernel features like namespaces, cgroups, capabilities, LSM, and file system jails to fulfill the spec.
135
+
136
+
### Capabilities
137
+
138
+
Capabilities is an array that specifies Linux capabilities that can be provided to the process inside the container.
139
+
Valid values are the strings for capabilities defined in [the man page](http://man7.org/linux/man-pages/man7/capabilities.7.html)
140
+
141
+
```json
142
+
"capabilities": [
143
+
"CAP_AUDIT_WRITE",
144
+
"CAP_KILL",
145
+
"CAP_NET_BIND_SERVICE"
146
+
]
147
+
```
148
+
149
+
### Default Devices and File Systems
150
+
151
+
The Linux ABI includes both syscalls and several special file paths.
152
+
Applications expecting a Linux environment will very likely expect these files paths to be setup correctly.
153
+
154
+
The following devices and filesystems MUST be made available in each application's filesystem
0 commit comments