Skip to content

Commit 4dc623c

Browse files
gao-fenggao-feng
committed
move the description of user ns mapping and default files to proper filea
They should stay in runtime not config. Signed-off-by: Gao feng <[email protected]>
1 parent dca1dfd commit 4dc623c

File tree

3 files changed

+89
-70
lines changed

3 files changed

+89
-70
lines changed

‎config-linux.md‎

Lines changed: 0 additions & 46 deletions
Original file line numberDiff line numberDiff line change
@@ -15,49 +15,3 @@ Valid values are the strings for capabilities defined in [the man page](http://m
1515
"CAP_NET_BIND_SERVICE"
1616
]
1717
```
18-
19-
## User namespace mappings
20-
21-
```json
22-
"uidMappings": [
23-
{
24-
"hostID": 1000,
25-
"containerID": 0,
26-
"size": 10
27-
}
28-
],
29-
"gidMappings": [
30-
{
31-
"hostID": 1000,
32-
"containerID": 0,
33-
"size": 10
34-
}
35-
]
36-
```
37-
38-
uid/gid mappings describe the user namespace mappings from the host to the container.
39-
The mappings represent how the bundle `rootfs` expects the user namespace to be setup and the runtime SHOULD NOT modify the permissions on the rootfs to realize the mapping.
40-
*hostID* is the starting uid/gid on the host to be mapped to *containerID* which is the starting uid/gid in the container and *size* refers to the number of ids to be mapped.
41-
There is a limit of 5 mappings which is the Linux kernel hard limit.
42-
43-
## Default Devices and File Systems
44-
45-
The Linux ABI includes both syscalls and several special file paths.
46-
Applications expecting a Linux environment will very likely expect these files paths to be setup correctly.
47-
48-
The following devices and filesystems MUST be made available in each application's filesystem
49-
50-
| Path | Type | Notes |
51-
| ------------ | ------ | ------- |
52-
| /proc | [procfs](https://www.kernel.org/doc/Documentation/filesystems/proc.txt) | |
53-
| /sys | [sysfs](https://www.kernel.org/doc/Documentation/filesystems/sysfs.txt) | |
54-
| /dev/null | [device](http://man7.org/linux/man-pages/man4/null.4.html) | |
55-
| /dev/zero | [device](http://man7.org/linux/man-pages/man4/zero.4.html) | |
56-
| /dev/full | [device](http://man7.org/linux/man-pages/man4/full.4.html) | |
57-
| /dev/random | [device](http://man7.org/linux/man-pages/man4/random.4.html) | |
58-
| /dev/urandom | [device](http://man7.org/linux/man-pages/man4/random.4.html) | |
59-
| /dev/tty | [device](http://man7.org/linux/man-pages/man4/tty.4.html) | |
60-
| /dev/console | [device](http://man7.org/linux/man-pages/man4/console.4.html) | |
61-
| /dev/pts | [devpts](https://www.kernel.org/doc/Documentation/filesystems/devpts.txt) | |
62-
| /dev/ptmx | [device](https://www.kernel.org/doc/Documentation/filesystems/devpts.txt) | Bind-mount or symlink of /dev/pts/ptmx |
63-
| /dev/shm | [tmpfs](https://www.kernel.org/doc/Documentation/filesystems/tmpfs.txt) | |

‎runtime-config-linux.md‎

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@ Each entry has a type field with possible values described below and an optional
99
If a path is specified, that particular file is used to join that type of namespace.
1010
Also, when a path is specified, a runtime MUST assume that the setup for that particular namespace has already been done and error out if the config specifies anything else related to that namespace.
1111

12+
*Example*
1213
```json
1314
"namespaces": [
1415
{
@@ -45,6 +46,31 @@ container via system level IPC.
4546
* **user** the container will be able to remap user and group IDs from the host to local users and groups
4647
within the container.
4748

49+
## User namespace mappings
50+
51+
uid/gid mappings describe the user namespace mappings from the host to the container.
52+
The mappings represent how the bundle `rootfs` expects the user namespace to be setup and the runtime SHOULD NOT modify the permissions on the rootfs to realize the mapping.
53+
*hostID* is the starting uid/gid on the host to be mapped to *containerID* which is the starting uid/gid in the container and *size* refers to the number of ids to be mapped.
54+
There is a limit of 5 mappings which is the Linux kernel hard limit.
55+
56+
*Example*
57+
```json
58+
"uidMappings": [
59+
{
60+
"hostID": 1000,
61+
"containerID": 0,
62+
"size": 10
63+
}
64+
],
65+
"gidMappings": [
66+
{
67+
"hostID": 1000,
68+
"containerID": 0,
69+
"size": 10
70+
}
71+
]
72+
```
73+
4874
## Devices
4975

5076
Devices is an array specifying the list of devices to be created in the container.
@@ -61,6 +87,20 @@ Next parameters can be specified:
6187
* uid - uid of device owner
6288
* gid - gid of device owner
6389

90+
Note: The following devices MUST be made available in each Linux application's filesystem
91+
92+
| Path | Type | Notes |
93+
| ------------ | ------ | ------- |
94+
| /dev/null | [device](http://man7.org/linux/man-pages/man4/null.4.html) | |
95+
| /dev/zero | [device](http://man7.org/linux/man-pages/man4/zero.4.html) | |
96+
| /dev/full | [device](http://man7.org/linux/man-pages/man4/full.4.html) | |
97+
| /dev/random | [device](http://man7.org/linux/man-pages/man4/random.4.html) | |
98+
| /dev/urandom | [device](http://man7.org/linux/man-pages/man4/random.4.html) | |
99+
| /dev/tty | [device](http://man7.org/linux/man-pages/man4/tty.4.html) | |
100+
| /dev/console | [device](http://man7.org/linux/man-pages/man4/console.4.html) | |
101+
| /dev/ptmx | [device](https://www.kernel.org/doc/Documentation/filesystems/devpts.txt) | Bind-mount or symlink of /dev/pts/ptmx |
102+
103+
*Example*
64104
```json
65105
"devices": [
66106
{
@@ -126,6 +166,45 @@ Next parameters can be specified:
126166
]
127167
```
128168

169+
## Mounts
170+
171+
See the [description](runtime-config.md#mount_configuration) of Mounts.
172+
173+
Note: The following filesystems MUST be made available in each Linux application's filesystem
174+
175+
| Path | Type |
176+
| ------------ | ------ |
177+
| /proc | [procfs](https://www.kernel.org/doc/Documentation/filesystems/proc.txt) |
178+
| /sys | [sysfs](https://www.kernel.org/doc/Documentation/filesystems/sysfs.txt) |
179+
| /dev/pts | [devpts](https://www.kernel.org/doc/Documentation/filesystems/devpts.txt) |
180+
| /dev/shm | [tmpfs](https://www.kernel.org/doc/Documentation/filesystems/tmpfs.txt) |
181+
182+
*Example*
183+
```json
184+
"mounts": {
185+
"proc": {
186+
"type": "proc",
187+
"source": "proc",
188+
"options": []
189+
},
190+
"dev": {
191+
"type": "tmpfs",
192+
"source": "tmpfs",
193+
"options": ["nosuid","strictatime","mode=755","size=65536k"]
194+
},
195+
"devpts": {
196+
"type": "devpts",
197+
"source": "devpts",
198+
"options": ["nosuid","noexec","newinstance","ptmxmode=0666","mode=0620","gid=5"]
199+
},
200+
"data": {
201+
"type": "bind",
202+
"source": "/volumes/testing",
203+
"options": ["rbind","rw"]
204+
}
205+
}
206+
```
207+
129208
## Control groups
130209

131210
Also known as cgroups, they are used to restrict resource usage for a container and handle device access.
@@ -140,6 +219,7 @@ The Spec does not include naming schema for cgroups.
140219
The Spec does not support [split hierarchy](https://www.kernel.org/doc/Documentation/cgroups/unified-hierarchy.txt).
141220
The cgroups will be created if they don't exist.
142221

222+
*Example*
143223
```json
144224
"cgroupsPath": "/myRuntime/myContainer"
145225
```
@@ -148,6 +228,7 @@ The cgroups will be created if they don't exist.
148228

149229
Optionally, cgroups limits can be specified via `resources`.
150230

231+
*Example*
151232
```json
152233
"resources": {
153234
"disableOOMKiller": false,
@@ -191,6 +272,7 @@ For example, to run a new process in an existing container without updating limi
191272
sysctl allows kernel parameters to be modified at runtime for the container.
192273
For more information, see [the man page](http://man7.org/linux/man-pages/man8/sysctl.8.html)
193274

275+
*Example*
194276
```json
195277
"sysctl": {
196278
"net.ipv4.ip_forward": "1",
@@ -200,6 +282,7 @@ For more information, see [the man page](http://man7.org/linux/man-pages/man8/sy
200282

201283
## Rlimits
202284

285+
*Example*
203286
```json
204287
"rlimits": [
205288
{
@@ -218,6 +301,8 @@ The kernel enforces the `soft` limit for a resource while the `hard` limit acts
218301

219302
SELinux process label specifies the label with which the processes in a container are run.
220303
For more information about SELinux, see [Selinux documentation](http://selinuxproject.org/page/Main_Page)
304+
305+
*Example*
221306
```json
222307
"selinuxProcessLabel": "system_u:system_r:svirt_lxc_net_t:s0:c124,c675"
223308
```
@@ -227,6 +312,7 @@ For more information about SELinux, see [Selinux documentation](http://selinuxp
227312
Apparmor profile specifies the name of the apparmor profile that will be used for the container.
228313
For more information about Apparmor, see [Apparmor documentation](https://wiki.ubuntu.com/AppArmor)
229314

315+
*Example*
230316
```json
231317
"apparmorProfile": "acme_secure_profile"
232318
```
@@ -238,6 +324,7 @@ Seccomp configuration allows one to configure actions to take for matched syscal
238324
For more information about Seccomp, see [Seccomp kernel documentation](https://www.kernel.org/doc/Documentation/prctl/seccomp_filter.txt)
239325
The actions and operators are strings that match the definitions in seccomp.h from [libseccomp](https://github.com/seccomp/libseccomp) and are translated to corresponding values.
240326

327+
*Example*
241328
```json
242329
"seccomp": {
243330
"defaultAction": "SCMP_ACT_ALLOW",
@@ -256,6 +343,7 @@ rootfsPropagation sets the rootfs's mount propagation.
256343
Its value is either slave, private, or shared.
257344
[The kernel doc](https://www.kernel.org/doc/Documentation/filesystems/sharedsubtree.txt) has more information about mount propagation.
258345

346+
*Example*
259347
```json
260348
"rootfsPropagation": "slave",
261349
```

‎runtime-config.md‎

Lines changed: 1 addition & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -12,30 +12,7 @@ Only [mounts from the portable config](config.md#mount-points) will be mounted.
1212

1313
*Example (Linux)*
1414

15-
```json
16-
"mounts": {
17-
"proc": {
18-
"type": "proc",
19-
"source": "proc",
20-
"options": []
21-
},
22-
"dev": {
23-
"type": "tmpfs",
24-
"source": "tmpfs",
25-
"options": ["nosuid","strictatime","mode=755","size=65536k"]
26-
},
27-
"devpts": {
28-
"type": "devpts",
29-
"source": "devpts",
30-
"options": ["nosuid","noexec","newinstance","ptmxmode=0666","mode=0620","gid=5"]
31-
},
32-
"data": {
33-
"type": "bind",
34-
"source": "/volumes/testing",
35-
"options": ["rbind","rw"]
36-
}
37-
}
38-
```
15+
See Mounts [example](runtime-config-linux.md#mounts-in-linux) in Linux
3916

4017
*Example (Windows)*
4118

0 commit comments

Comments
 (0)