Skip to content

Commit 5d43705

Browse files
gao-fenggao-feng
committed
move the description of user ns mapping and default files to proper file
They should stay in runtime not config. Signed-off-by: Gao feng <[email protected]>
1 parent 2d9842b commit 5d43705

File tree

3 files changed

+46
-46
lines changed

3 files changed

+46
-46
lines changed

‎config-linux.md‎

Lines changed: 0 additions & 46 deletions
Original file line numberDiff line numberDiff line change
@@ -25,49 +25,3 @@ Its value is either slave, private, or shared.
2525
```json
2626
"rootfsPropagation": "slave",
2727
```
28-
29-
## User namespace mappings
30-
31-
```json
32-
"uidMappings": [
33-
{
34-
"hostID": 1000,
35-
"containerID": 0,
36-
"size": 10
37-
}
38-
],
39-
"gidMappings": [
40-
{
41-
"hostID": 1000,
42-
"containerID": 0,
43-
"size": 10
44-
}
45-
]
46-
```
47-
48-
uid/gid mappings describe the user namespace mappings from the host to the container.
49-
The mappings represent how the bundle `rootfs` expects the user namespace to be setup and the runtime SHOULD NOT modify the permissions on the rootfs to realize the mapping.
50-
*hostID* is the starting uid/gid on the host to be mapped to *containerID* which is the starting uid/gid in the container and *size* refers to the number of ids to be mapped.
51-
There is a limit of 5 mappings which is the Linux kernel hard limit.
52-
53-
## Default Devices and File Systems
54-
55-
The Linux ABI includes both syscalls and several special file paths.
56-
Applications expecting a Linux environment will very likely expect these files paths to be setup correctly.
57-
58-
The following devices and filesystems MUST be made available in each application's filesystem
59-
60-
| Path | Type | Notes |
61-
| ------------ | ------ | ------- |
62-
| /proc | [procfs](https://www.kernel.org/doc/Documentation/filesystems/proc.txt) | |
63-
| /sys | [sysfs](https://www.kernel.org/doc/Documentation/filesystems/sysfs.txt) | |
64-
| /dev/null | [device](http://man7.org/linux/man-pages/man4/null.4.html) | |
65-
| /dev/zero | [device](http://man7.org/linux/man-pages/man4/zero.4.html) | |
66-
| /dev/full | [device](http://man7.org/linux/man-pages/man4/full.4.html) | |
67-
| /dev/random | [device](http://man7.org/linux/man-pages/man4/random.4.html) | |
68-
| /dev/urandom | [device](http://man7.org/linux/man-pages/man4/random.4.html) | |
69-
| /dev/tty | [device](http://man7.org/linux/man-pages/man4/tty.4.html) | |
70-
| /dev/console | [device](http://man7.org/linux/man-pages/man4/console.4.html) | |
71-
| /dev/pts | [devpts](https://www.kernel.org/doc/Documentation/filesystems/devpts.txt) | |
72-
| /dev/ptmx | [device](https://www.kernel.org/doc/Documentation/filesystems/devpts.txt) | Bind-mount or symlink of /dev/pts/ptmx |
73-
| /dev/shm | [tmpfs](https://www.kernel.org/doc/Documentation/filesystems/tmpfs.txt) | |

‎runtime-config-linux.md‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,30 @@ container via system level IPC.
4444
* **user** the container will be able to remap user and group IDs from the host to local users and groups
4545
within the container.
4646

47+
## User namespace mappings
48+
49+
uid/gid mappings describe the user namespace mappings from the host to the container.
50+
The mappings represent how the bundle `rootfs` expects the user namespace to be setup and the runtime SHOULD NOT modify the permissions on the rootfs to realize the mapping.
51+
*hostID* is the starting uid/gid on the host to be mapped to *containerID* which is the starting uid/gid in the container and *size* refers to the number of ids to be mapped.
52+
There is a limit of 5 mappings which is the Linux kernel hard limit.
53+
54+
```json
55+
"uidMappings": [
56+
{
57+
"hostID": 1000,
58+
"containerID": 0,
59+
"size": 10
60+
}
61+
],
62+
"gidMappings": [
63+
{
64+
"hostID": 1000,
65+
"containerID": 0,
66+
"size": 10
67+
}
68+
]
69+
```
70+
4771
## Devices
4872

4973
Devices is an array specifying the list of devices to be created in the container.
@@ -125,6 +149,19 @@ Next parameters can be specified:
125149
]
126150
```
127151

152+
Note: The following devices MUST be made available in each Linux application's filesystem
153+
154+
| Path | Type | Notes |
155+
| ------------ | ------ | ------- |
156+
| /dev/null | [device](http://man7.org/linux/man-pages/man4/null.4.html) | |
157+
| /dev/zero | [device](http://man7.org/linux/man-pages/man4/zero.4.html) | |
158+
| /dev/full | [device](http://man7.org/linux/man-pages/man4/full.4.html) | |
159+
| /dev/random | [device](http://man7.org/linux/man-pages/man4/random.4.html) | |
160+
| /dev/urandom | [device](http://man7.org/linux/man-pages/man4/random.4.html) | |
161+
| /dev/tty | [device](http://man7.org/linux/man-pages/man4/tty.4.html) | |
162+
| /dev/console | [device](http://man7.org/linux/man-pages/man4/console.4.html) | |
163+
| /dev/ptmx | [device](https://www.kernel.org/doc/Documentation/filesystems/devpts.txt) | Bind-mount or symlink of /dev/pts/ptmx |
164+
128165
## Control groups
129166

130167
Also known as cgroups, they are used to restrict resource usage for a container and handle device access.

‎runtime-config.md‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,15 @@ Only [mounts from the portable config](config.md#mount-points) will be mounted.
3636
}
3737
}
3838
```
39+
Note: The following filesystems MUST be made available in each Linux application's filesystem
40+
41+
| Path | Type |
42+
| ------------ | ------ |
43+
| /proc | [procfs](https://www.kernel.org/doc/Documentation/filesystems/proc.txt) |
44+
| /sys | [sysfs](https://www.kernel.org/doc/Documentation/filesystems/sysfs.txt) |
45+
| /dev/pts | [devpts](https://www.kernel.org/doc/Documentation/filesystems/devpts.txt) |
46+
| /dev/shm | [tmpfs](https://www.kernel.org/doc/Documentation/filesystems/tmpfs.txt) |
47+
3948

4049
*Example (Windows)*
4150

0 commit comments

Comments
 (0)