You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: config.md
+17-12Lines changed: 17 additions & 12 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -69,7 +69,8 @@ For Solaris, the mount entry corresponds to the 'fs' resource in the [zonecfg(1M
69
69
* Windows: a local directory on the filesystem of the container host. UNC paths and mapped drives are not supported.
70
70
* Solaris: corresponds to "special" of the fs resource in [zonecfg(1M)][zonecfg.1m].
71
71
***`options`** (array of strings, OPTIONAL) Mount options of the filesystem to be used.
72
-
* Linux: supported options are listed in the [mount(8)][mount.8] man page. Note both [filesystem-independent][mount.8-filesystem-independent] and [filesystem-specific][mount.8-filesystem-specific] options are listed.
72
+
* Linux: supported options are listed in the [mount(8)][mount.8] man page.
73
+
Note both [filesystem-independent][mount.8-filesystem-independent] and [filesystem-specific][mount.8-filesystem-specific] options are listed.
73
74
* Solaris: corresponds to "options" of the fs resource in [zonecfg(1M)][zonecfg.1m].
74
75
75
76
### Example (Linux)
@@ -136,8 +137,11 @@ For Solaris, the mount entry corresponds to the 'fs' resource in the [zonecfg(1M
136
137
***`env`** (array of strings, OPTIONAL) with the same semantics as [IEEE Std 1003.1-2001's `environ`][ieee-1003.1-2001-xbd-c8.1].
137
138
***`args`** (array of strings, REQUIRED) with similar semantics to [IEEE Std 1003.1-2001 `execvp`'s *argv*][ieee-1003.1-2001-xsh-exec].
138
139
This specification extends the IEEE standard in that at least one entry is REQUIRED, and that entry is used with the same semantics as `execvp`'s *file*.
139
-
***`capabilities`** (object, OPTIONAL) is an object containing arrays that specifies the sets of capabilities for the process(es) inside the container. Valid values are platform-specific. For example, valid values for Linux are defined in the [capabilities(7)][capabilities.7] man page, such as `CAP_CHOWN`. Any value which cannot be mapped to a relevant kernel interface MUST cause an error.
140
-
capabilities contains the following properties:
140
+
***`capabilities`** (object, OPTIONAL) is an object containing arrays that specifies the sets of capabilities for the process(es) inside the container.
141
+
Valid values are platform-specific.
142
+
For example, valid values for Linux are defined in the [capabilities(7)][capabilities.7] man page, such as `CAP_CHOWN`.
143
+
Any value which cannot be mapped to a relevant kernel interface MUST cause an error.
144
+
`capabilities` contains the following properties:
141
145
***`effective`** (array of strings, OPTIONAL) - the `effective` field is an array of effective capabilities that are kept for the process.
142
146
***`bounding`** (array of strings, OPTIONAL) - the `bounding` field is an array of bounding capabilities that are kept for the process.
143
147
***`inheritable`** (array of strings, OPTIONAL) - the `inheritable` field is an array of inheritable capabilities that are kept for the process.
@@ -148,7 +152,8 @@ For Solaris, the mount entry corresponds to the 'fs' resource in the [zonecfg(1M
148
152
149
153
***`type`** (string, REQUIRED) - the platform resource being limited, for example on Linux as defined in the [setrlimit(2)][setrlimit.2] man page.
150
154
***`soft`** (uint64, REQUIRED) - the value of the limit enforced for the corresponding resource.
151
-
***`hard`** (uint64, REQUIRED) - the ceiling for the soft limit that could be set by an unprivileged process. Only a privileged process (e.g. under Linux: one with the CAP_SYS_RESOURCE capability) can raise a hard limit.
155
+
***`hard`** (uint64, REQUIRED) - the ceiling for the soft limit that could be set by an unprivileged process.
156
+
Only a privileged process (e.g. under Linux: one with the CAP_SYS_RESOURCE capability) can raise a hard limit.
152
157
153
158
If `rlimits` contains duplicated entries with same `type`, the runtime MUST error out.
154
159
@@ -178,7 +183,7 @@ For Linux and Solaris based systems the user structure has the following fields:
178
183
179
184
***`uid`** (int, REQUIRED) specifies the user ID in the [container namespace](glossary.md#container-namespace).
180
185
***`gid`** (int, REQUIRED) specifies the group ID in the [container namespace](glossary.md#container-namespace).
181
-
***`additionalGids`** (array of ints, OPTIONAL) specifies additional group IDs (in the [container namespace](glossary.md#container-namespace) to be added to the process.
186
+
***`additionalGids`** (array of ints, OPTIONAL) specifies additional group IDs in the [container namespace](glossary.md#container-namespace) to be added to the process.
182
187
183
188
_Note: symbolic name for uid and gid, such as uname and gname respectively, are left to upper levels to derive (i.e. `/etc/passwd` parsing, NSS, etc)_
184
189
@@ -306,13 +311,13 @@ For Windows based systems the user structure has the following fields:
306
311
307
312
**`platform`** (object, REQUIRED) specifies the configuration's target platform.
308
313
309
-
***`os`** (string, REQUIRED) specifies the operating system family of the container configuration's specified [`root`](#root)file system bundle.
314
+
***`os`** (string, REQUIRED) specifies the operating system family of the container configuration's specified [`root`](#root)filesystem bundle.
310
315
The runtime MUST generate an error if it does not support the specified **`os`**.
311
-
Bundles SHOULD use, and runtimes SHOULD understand, **`os`** entries listed in the Go Language document for [`GOOS`][go-environment].
316
+
Values SHOULD be, and runtimes SHOULD understand, **`os`** entries listed in the Go Language document for [`GOOS`][go-environment].
312
317
If an operating system is not included in the `GOOS` documentation, it SHOULD be submitted to this specification for standardization.
313
-
***`arch`** (string, REQUIRED) specifies the instruction set for which the binaries in the specified [`root`](#root)file system bundle have been compiled.
318
+
***`arch`** (string, REQUIRED) specifies the instruction set for which the binaries in the specified [`root`](#root)filesystem bundle have been compiled.
314
319
The runtime MUST generate an error if it does not support the specified **`arch`**.
315
-
Values for **`arch`**SHOULD use, and runtimes SHOULD understand, **`arch`** entries listed in the Go Language document for [`GOARCH`][go-environment].
320
+
Values SHOULD be, and runtimes SHOULD understand, **`arch`** entries listed in the Go Language document for [`GOARCH`][go-environment].
316
321
If an architecture is not included in the `GOARCH` documentation, it SHOULD be submitted to this specification for standardization.
317
322
318
323
### Example
@@ -432,7 +437,7 @@ Keys MUST be unique within this map.
432
437
Keys MUST NOT be an empty string.
433
438
Keys SHOULD be named using a reverse domain notation - e.g. `com.example.myKey`.
434
439
Keys using the `org.opencontainers` namespace are reserved and MUST NOT be used by subsequent specifications.
435
-
Implementations that are reading/processing this configuration file MUST NOT generate an error if they encounter an unknown annotation key.
440
+
Runtimes that are reading or processing this configuration file MUST NOT generate an error if they encounter an unknown annotation key.
436
441
437
442
Values MUST be strings.
438
443
Values MAY be an empty string.
@@ -444,12 +449,12 @@ Values MAY be an empty string.
444
449
```
445
450
446
451
## <aname="configExtensibility" />Extensibility
447
-
Implementations that are reading/processing this configuration file MUST NOT generate an error if they encounter an unknown property.
452
+
Runtimes that are reading or processing this configuration file MUST NOT generate an error if they encounter an unknown property.
448
453
Instead they MUST ignore unknown properties.
449
454
450
455
## Valid values
451
456
452
-
Implementations that are reading/processing this configuration file MUST generate an error when invalid or unsupported values are encountered.
457
+
Runtimes that are reading or processing this configuration file MUST generate an error when invalid or unsupported values are encountered.
453
458
Unless support for a valid value is explicitly required, runtimes MAY choose which subset of the valid values it will support.
0 commit comments