mirror of
https://github.com/opencontainers/runc.git
synced 2026-07-11 06:03:57 +08:00
docs: remove prompt symbols from shell snippets
Remove prompt symbols (`$`, `%`) for ease of copy-pasting Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
This commit is contained in:
@@ -24,8 +24,8 @@ but for most users the security benefit is identical.
|
|||||||
The provided `memfd-bind@.service` file can be used to get systemd to manage
|
The provided `memfd-bind@.service` file can be used to get systemd to manage
|
||||||
this daemon. You can supply the path like so:
|
this daemon. You can supply the path like so:
|
||||||
|
|
||||||
```
|
```bash
|
||||||
% systemctl start memfd-bind@$(systemd-escape -p /usr/bin/runc)
|
systemctl start memfd-bind@$(systemd-escape -p /usr/bin/runc)
|
||||||
```
|
```
|
||||||
|
|
||||||
Thus, there are three ways of protecting against CVE-2019-5736, in order of how
|
Thus, there are three ways of protecting against CVE-2019-5736, in order of how
|
||||||
|
|||||||
+11
-11
@@ -34,18 +34,18 @@ The recommended systemd version is 244 or later. Older systemd does not support
|
|||||||
|
|
||||||
Make sure you also have the `dbus-user-session` (Debian/Ubuntu) or `dbus-daemon` (CentOS/Fedora) package installed, and that `dbus` is running. On Debian-flavored distros, this can be accomplished like so:
|
Make sure you also have the `dbus-user-session` (Debian/Ubuntu) or `dbus-daemon` (CentOS/Fedora) package installed, and that `dbus` is running. On Debian-flavored distros, this can be accomplished like so:
|
||||||
|
|
||||||
```console
|
```bash
|
||||||
$ sudo apt install -y dbus-user-session
|
sudo apt install -y dbus-user-session
|
||||||
$ systemctl --user start dbus
|
systemctl --user start dbus
|
||||||
```
|
```
|
||||||
|
|
||||||
## Rootless
|
## Rootless
|
||||||
On cgroup v2 hosts, rootless runc can talk to systemd to get cgroup permissions to be delegated.
|
On cgroup v2 hosts, rootless runc can talk to systemd to get cgroup permissions to be delegated.
|
||||||
|
|
||||||
```console
|
```bash
|
||||||
$ runc spec --rootless
|
runc spec --rootless
|
||||||
$ jq '.linux.cgroupsPath="user.slice:runc:foo"' config.json | sponge config.json
|
jq '.linux.cgroupsPath="user.slice:runc:foo"' config.json | sponge config.json
|
||||||
$ runc --systemd-cgroup run foo
|
runc --systemd-cgroup run foo
|
||||||
```
|
```
|
||||||
|
|
||||||
The container processes are executed in a cgroup like `/user.slice/user-$(id -u).slice/user@$(id -u).service/user.slice/runc-foo.scope`.
|
The container processes are executed in a cgroup like `/user.slice/user-$(id -u).slice/user@$(id -u).service/user.slice/runc-foo.scope`.
|
||||||
@@ -60,11 +60,11 @@ memory pids
|
|||||||
|
|
||||||
To allow delegation of other controllers, you need to change the systemd configuration as follows:
|
To allow delegation of other controllers, you need to change the systemd configuration as follows:
|
||||||
|
|
||||||
```console
|
```bash
|
||||||
# mkdir -p /etc/systemd/system/user@.service.d
|
sudo mkdir -p /etc/systemd/system/user@.service.d
|
||||||
# cat > /etc/systemd/system/user@.service.d/delegate.conf << EOF
|
cat <<EOF | sudo tee /etc/systemd/system/user@.service.d/delegate.conf
|
||||||
[Service]
|
[Service]
|
||||||
Delegate=cpu cpuset io memory pids
|
Delegate=cpu cpuset io memory pids
|
||||||
EOF
|
EOF
|
||||||
# systemctl daemon-reload
|
sudo systemctl daemon-reload
|
||||||
```
|
```
|
||||||
|
|||||||
+8
-8
@@ -35,8 +35,8 @@ descriptors to preserve. Instead, it takes how many file descriptors (not
|
|||||||
including `stdio` or `LISTEN_FDS`) should be passed to the container. In the
|
including `stdio` or `LISTEN_FDS`) should be passed to the container. In the
|
||||||
following example:
|
following example:
|
||||||
|
|
||||||
```
|
```bash
|
||||||
% runc run --preserve-fds 5 <container>
|
runc run --preserve-fds 5 <container>
|
||||||
```
|
```
|
||||||
|
|
||||||
`runc` will pass the first `5` file descriptors (`3`, `4`, `5`, `6`, and `7` --
|
`runc` will pass the first `5` file descriptors (`3`, `4`, `5`, `6`, and `7` --
|
||||||
@@ -46,8 +46,8 @@ In addition to `--preserve-fds`, `LISTEN_FDS` file descriptors are passed
|
|||||||
automatically to allow for `systemd`-style socket activation. To extend the
|
automatically to allow for `systemd`-style socket activation. To extend the
|
||||||
above example:
|
above example:
|
||||||
|
|
||||||
```
|
```bash
|
||||||
% LISTEN_PID=$pid_of_runc LISTEN_FDS=3 runc run --preserve-fds 5 <container>
|
LISTEN_PID=$pid_of_runc LISTEN_FDS=3 runc run --preserve-fds 5 <container>
|
||||||
```
|
```
|
||||||
|
|
||||||
`runc` will now pass the first `8` file descriptors (and it will also pass
|
`runc` will now pass the first `8` file descriptors (and it will also pass
|
||||||
@@ -136,8 +136,8 @@ not a terminal (some `ssh` implementations only look for a terminal on stdin).
|
|||||||
|
|
||||||
Another way is to run runc under the `script` utility, like this
|
Another way is to run runc under the `script` utility, like this
|
||||||
|
|
||||||
```console
|
```bash
|
||||||
$ script -e -c 'runc run <container>'
|
script -e -c 'runc run <container>'
|
||||||
```
|
```
|
||||||
|
|
||||||
[tty_ioctl(4)]: https://linux.die.net/man/4/tty_ioctl
|
[tty_ioctl(4)]: https://linux.die.net/man/4/tty_ioctl
|
||||||
@@ -150,8 +150,8 @@ the contained process (this is not necessarily the same as `--preserve-fds`'s
|
|||||||
passing of file descriptors -- [details below](#runc-modes)). As an example
|
passing of file descriptors -- [details below](#runc-modes)). As an example
|
||||||
(assuming that `terminal: false` is set in `config.json`):
|
(assuming that `terminal: false` is set in `config.json`):
|
||||||
|
|
||||||
```
|
```bash
|
||||||
% echo input | runc run some_container > /tmp/log.out 2> /tmp/log.err
|
echo input | runc run some_container > /tmp/log.out 2> /tmp/log.err
|
||||||
```
|
```
|
||||||
|
|
||||||
Here the container's various `stdio` file descriptors will be substituted with
|
Here the container's various `stdio` file descriptors will be substituted with
|
||||||
|
|||||||
+13
-13
@@ -15,20 +15,20 @@ framework.
|
|||||||
## Running integration tests
|
## Running integration tests
|
||||||
|
|
||||||
The easiest way to run integration tests is with Docker:
|
The easiest way to run integration tests is with Docker:
|
||||||
```
|
```bash
|
||||||
$ make integration
|
make integration
|
||||||
```
|
```
|
||||||
Alternatively, you can run integration tests directly on your host through make:
|
Alternatively, you can run integration tests directly on your host through make:
|
||||||
```
|
```bash
|
||||||
$ sudo make localintegration
|
sudo make localintegration
|
||||||
```
|
```
|
||||||
Or you can just run them directly using bats
|
Or you can just run them directly using bats
|
||||||
```
|
```bash
|
||||||
$ sudo bats tests/integration
|
sudo bats tests/integration
|
||||||
```
|
```
|
||||||
To run a single test bucket:
|
To run a single test bucket:
|
||||||
```
|
```bash
|
||||||
$ make integration TESTPATH="/checkpoint.bats"
|
make integration TESTPATH="/checkpoint.bats"
|
||||||
```
|
```
|
||||||
|
|
||||||
|
|
||||||
@@ -36,11 +36,11 @@ To run them on your host, you need to set up a development environment plus
|
|||||||
[bats (Bash Automated Testing System)](https://github.com/bats-core/bats-core#installing-bats-from-source).
|
[bats (Bash Automated Testing System)](https://github.com/bats-core/bats-core#installing-bats-from-source).
|
||||||
|
|
||||||
For example:
|
For example:
|
||||||
```
|
```bash
|
||||||
$ cd ~/go/src/github.com
|
cd ~/go/src/github.com
|
||||||
$ git clone https://github.com/bats-core/bats-core.git
|
git clone https://github.com/bats-core/bats-core.git
|
||||||
$ cd bats-core
|
cd bats-core
|
||||||
$ ./install.sh /usr/local
|
./install.sh /usr/local
|
||||||
```
|
```
|
||||||
|
|
||||||
> **Note**: There are known issues running the integration tests using
|
> **Note**: There are known issues running the integration tests using
|
||||||
|
|||||||
Reference in New Issue
Block a user