Skip to content

Commit 5ab8432

Browse files
gao-fenggao-feng
committed
move the description of user ns mapping and default files to proper filea
They should stay in runtime not config. Signed-off-by: Gao feng <[email protected]>
1 parent cbda521 commit 5ab8432

File tree

3 files changed

+74
-70
lines changed

3 files changed

+74
-70
lines changed

‎config-linux.md‎

Lines changed: 0 additions & 46 deletions
Original file line numberDiff line numberDiff line change
@@ -15,49 +15,3 @@ Valid values are the strings for capabilities defined in [the man page](http://m
1515
"CAP_NET_BIND_SERVICE"
1616
]
1717
```
18-
19-
## User namespace mappings
20-
21-
```json
22-
"uidMappings": [
23-
{
24-
"hostID": 1000,
25-
"containerID": 0,
26-
"size": 10
27-
}
28-
],
29-
"gidMappings": [
30-
{
31-
"hostID": 1000,
32-
"containerID": 0,
33-
"size": 10
34-
}
35-
]
36-
```
37-
38-
uid/gid mappings describe the user namespace mappings from the host to the container.
39-
The mappings represent how the bundle `rootfs` expects the user namespace to be setup and the runtime SHOULD NOT modify the permissions on the rootfs to realize the mapping.
40-
*hostID* is the starting uid/gid on the host to be mapped to *containerID* which is the starting uid/gid in the container and *size* refers to the number of ids to be mapped.
41-
There is a limit of 5 mappings which is the Linux kernel hard limit.
42-
43-
## Default Devices and File Systems
44-
45-
The Linux ABI includes both syscalls and several special file paths.
46-
Applications expecting a Linux environment will very likely expect these files paths to be setup correctly.
47-
48-
The following devices and filesystems MUST be made available in each application's filesystem
49-
50-
| Path | Type | Notes |
51-
| ------------ | ------ | ------- |
52-
| /proc | [procfs](https://www.kernel.org/doc/Documentation/filesystems/proc.txt) | |
53-
| /sys | [sysfs](https://www.kernel.org/doc/Documentation/filesystems/sysfs.txt) | |
54-
| /dev/null | [device](http://man7.org/linux/man-pages/man4/null.4.html) | |
55-
| /dev/zero | [device](http://man7.org/linux/man-pages/man4/zero.4.html) | |
56-
| /dev/full | [device](http://man7.org/linux/man-pages/man4/full.4.html) | |
57-
| /dev/random | [device](http://man7.org/linux/man-pages/man4/random.4.html) | |
58-
| /dev/urandom | [device](http://man7.org/linux/man-pages/man4/random.4.html) | |
59-
| /dev/tty | [device](http://man7.org/linux/man-pages/man4/tty.4.html) | |
60-
| /dev/console | [device](http://man7.org/linux/man-pages/man4/console.4.html) | |
61-
| /dev/pts | [devpts](https://www.kernel.org/doc/Documentation/filesystems/devpts.txt) | |
62-
| /dev/ptmx | [device](https://www.kernel.org/doc/Documentation/filesystems/devpts.txt) | Bind-mount or symlink of /dev/pts/ptmx |
63-
| /dev/shm | [tmpfs](https://www.kernel.org/doc/Documentation/filesystems/tmpfs.txt) | |

‎runtime-config-linux.md‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,30 @@ container via system level IPC.
4545
* **user** the container will be able to remap user and group IDs from the host to local users and groups
4646
within the container.
4747

48+
## User namespace mappings
49+
50+
uid/gid mappings describe the user namespace mappings from the host to the container.
51+
The mappings represent how the bundle `rootfs` expects the user namespace to be setup and the runtime SHOULD NOT modify the permissions on the rootfs to realize the mapping.
52+
*hostID* is the starting uid/gid on the host to be mapped to *containerID* which is the starting uid/gid in the container and *size* refers to the number of ids to be mapped.
53+
There is a limit of 5 mappings which is the Linux kernel hard limit.
54+
55+
```json
56+
"uidMappings": [
57+
{
58+
"hostID": 1000,
59+
"containerID": 0,
60+
"size": 10
61+
}
62+
],
63+
"gidMappings": [
64+
{
65+
"hostID": 1000,
66+
"containerID": 0,
67+
"size": 10
68+
}
69+
]
70+
```
71+
4872
## Devices
4973

5074
Devices is an array specifying the list of devices to be created in the container.
@@ -126,6 +150,55 @@ Next parameters can be specified:
126150
]
127151
```
128152

153+
Note: The following devices MUST be made available in each Linux application's filesystem
154+
155+
| Path | Type | Notes |
156+
| ------------ | ------ | ------- |
157+
| /dev/null | [device](http://man7.org/linux/man-pages/man4/null.4.html) | |
158+
| /dev/zero | [device](http://man7.org/linux/man-pages/man4/zero.4.html) | |
159+
| /dev/full | [device](http://man7.org/linux/man-pages/man4/full.4.html) | |
160+
| /dev/random | [device](http://man7.org/linux/man-pages/man4/random.4.html) | |
161+
| /dev/urandom | [device](http://man7.org/linux/man-pages/man4/random.4.html) | |
162+
| /dev/tty | [device](http://man7.org/linux/man-pages/man4/tty.4.html) | |
163+
| /dev/console | [device](http://man7.org/linux/man-pages/man4/console.4.html) | |
164+
| /dev/ptmx | [device](https://www.kernel.org/doc/Documentation/filesystems/devpts.txt) | Bind-mount or symlink of /dev/pts/ptmx |
165+
166+
## Mounts in Linux
167+
168+
```json
169+
"mounts": {
170+
"proc": {
171+
"type": "proc",
172+
"source": "proc",
173+
"options": []
174+
},
175+
"dev": {
176+
"type": "tmpfs",
177+
"source": "tmpfs",
178+
"options": ["nosuid","strictatime","mode=755","size=65536k"]
179+
},
180+
"devpts": {
181+
"type": "devpts",
182+
"source": "devpts",
183+
"options": ["nosuid","noexec","newinstance","ptmxmode=0666","mode=0620","gid=5"]
184+
},
185+
"data": {
186+
"type": "bind",
187+
"source": "/volumes/testing",
188+
"options": ["rbind","rw"]
189+
}
190+
}
191+
```
192+
193+
Note: The following filesystems MUST be made available in each Linux application's filesystem
194+
195+
| Path | Type |
196+
| ------------ | ------ |
197+
| /proc | [procfs](https://www.kernel.org/doc/Documentation/filesystems/proc.txt) |
198+
| /sys | [sysfs](https://www.kernel.org/doc/Documentation/filesystems/sysfs.txt) |
199+
| /dev/pts | [devpts](https://www.kernel.org/doc/Documentation/filesystems/devpts.txt) |
200+
| /dev/shm | [tmpfs](https://www.kernel.org/doc/Documentation/filesystems/tmpfs.txt) |
201+
129202
## Control groups
130203

131204
Also known as cgroups, they are used to restrict resource usage for a container and handle device access.

‎runtime-config.md‎

Lines changed: 1 addition & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -12,30 +12,7 @@ Only [mounts from the portable config](config.md#mount-points) will be mounted.
1212

1313
*Example (Linux)*
1414

15-
```json
16-
"mounts": {
17-
"proc": {
18-
"type": "proc",
19-
"source": "proc",
20-
"options": []
21-
},
22-
"dev": {
23-
"type": "tmpfs",
24-
"source": "tmpfs",
25-
"options": ["nosuid","strictatime","mode=755","size=65536k"]
26-
},
27-
"devpts": {
28-
"type": "devpts",
29-
"source": "devpts",
30-
"options": ["nosuid","noexec","newinstance","ptmxmode=0666","mode=0620","gid=5"]
31-
},
32-
"data": {
33-
"type": "bind",
34-
"source": "/volumes/testing",
35-
"options": ["rbind","rw"]
36-
}
37-
}
38-
```
15+
See Mounts [example](runtime-config-linux.md#mounts-in-linux) in Linux
3916

4017
*Example (Windows)*
4118

0 commit comments

Comments
 (0)