kernel-configs: Add docker fragment

Ran Moby's check-config script against a mainline + defconfig kernel and
followed Debian's existing configs as much as possible. Will need to
maintain and update from time to time.

Signed-off-by: Loïc Minier <[email protected]>

Author: lool

kernel-configs/docker.config

@@ -0,0 +1,115 @@
+# Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries.
+# SPDX-License-Identifier: BSD-3-Clause
+
+# Prepared by reviewing the output of
+# https://github.com/moby/moby/blob/master/contrib/check-config.sh on a RB1
+# running a trixie + 6.15.0-rc6 + defconfig kernel; also added CONFIG_NF_TABLES
+# and a few NETFILTER_NETLINK modules; see
+# https://github.com/qualcomm-linux/qcom-deb-images/issues/43 and
+# https://github.com/qualcomm-linux/qcom-deb-images/pull/47
+CONFIG_NAMESPACES=y
+CONFIG_NET_NS=y
+CONFIG_PID_NS=y
+CONFIG_IPC_NS=y
+CONFIG_UTS_NS=y
+CONFIG_CGROUPS=y
+CONFIG_CGROUP_CPUACCT=y
+CONFIG_CGROUP_DEVICE=y
+CONFIG_CGROUP_FREEZER=y
+CONFIG_CGROUP_SCHED=y
+CONFIG_CPUSETS=y
+CONFIG_MEMCG=y
+CONFIG_KEYS=y
+CONFIG_VETH=m
+CONFIG_BRIDGE=m
+CONFIG_BRIDGE_NETFILTER=m
+CONFIG_IP_NF_FILTER=m
+CONFIG_IP_NF_MANGLE=m
+CONFIG_IP_NF_TARGET_MASQUERADE=m
+CONFIG_IP6_NF_FILTER=m
+CONFIG_IP6_NF_MANGLE=m
+CONFIG_IP6_NF_TARGET_MASQUERADE=m
+CONFIG_NETFILTER_XT_MATCH_ADDRTYPE=m
+CONFIG_NETFILTER_XT_MATCH_CONNTRACK=m
+CONFIG_NETFILTER_XT_MATCH_IPVS=m
+CONFIG_NETFILTER_XT_MARK=m
+CONFIG_IP_NF_RAW=m
+CONFIG_IP_NF_NAT=m
+CONFIG_NF_NAT=m
+CONFIG_IP6_NF_RAW=m
+CONFIG_IP6_NF_NAT=m
+CONFIG_NF_NAT=m
+CONFIG_POSIX_MQUEUE=y
+CONFIG_CGROUP_BPF=y
+
+# optional features
+CONFIG_USER_NS=y
+CONFIG_SECCOMP=y
+CONFIG_SECCOMP_FILTER=y
+CONFIG_CGROUP_PIDS=y
+CONFIG_BLK_CGROUP=y
+CONFIG_BLK_DEV_THROTTLING=y
+CONFIG_CGROUP_PERF=y
+CONFIG_CGROUP_HUGETLB=y
+CONFIG_NET_CLS_CGROUP=m
+CONFIG_CGROUP_NET_PRIO=y
+CONFIG_CFS_BANDWIDTH=y
+CONFIG_FAIR_GROUP_SCHED=y
+CONFIG_IP_NF_TARGET_REDIRECT=m
+CONFIG_IP_VS=m
+CONFIG_IP_VS_NFCT=y
+CONFIG_IP_VS_PROTO_TCP=y
+CONFIG_IP_VS_PROTO_UDP=y
+CONFIG_IP_VS_RR=m
+CONFIG_SECURITY_SELINUX=y
+CONFIG_SECURITY_APPARMOR=y
+CONFIG_EXT4_FS=y
+CONFIG_EXT4_FS_POSIX_ACL=y
+CONFIG_EXT4_FS_SECURITY=y
+
+# network drivers
+## overlay
+CONFIG_VXLAN=m
+CONFIG_BRIDGE_VLAN_FILTERING=y
+### optional (for encrypted networks):
+CONFIG_CRYPTO=y
+CONFIG_CRYPTO_AEAD=y
+CONFIG_CRYPTO_GCM=m
+CONFIG_CRYPTO_SEQIV=m
+CONFIG_CRYPTO_GHASH=m
+CONFIG_XFRM=y
+CONFIG_XFRM_USER=m
+CONFIG_XFRM_ALGO=m
+CONFIG_INET_ESP=m
+CONFIG_NETFILTER_XT_MATCH_BPF=m
+## ipvlan
+CONFIG_IPVLAN=m
+## macvlan
+CONFIG_MACVLAN=m
+CONFIG_DUMMY=m
+## ftp,tftp client in container
+CONFIG_NF_NAT_FTP=m
+CONFIG_NF_CONNTRACK_FTP=m
+CONFIG_NF_NAT_TFTP=m
+CONFIG_NF_CONNTRACK_TFTP=m
+
+# storage drivers
+## btrfs
+CONFIG_BTRFS_FS=m
+CONFIG_BTRFS_FS_POSIX_ACL=y
+## overlay
+CONFIG_OVERLAY_FS=m
+
+# iptables netlink related options
+# extended accounting via NFNETLINK
+CONFIG_NETFILTER_NETLINK_ACCT=m
+# queueing packets via NFNETLINK
+CONFIG_NETFILTER_NETLINK_QUEUE=m
+# logging packets via NFNETLINK
+CONFIG_NETFILTER_NETLINK_LOG=m
+# passive OS fingerprint via NFNETLINK
+CONFIG_NETFILTER_NETLINK_OSF=m
+
+# iptables is built with nftables in Debian
+CONFIG_NF_TABLES=m
+