mirror/runc
1
0
Fork 0
mirror of https://github.com/opencontainers/runc.git synced 2026-07-11 14:13:58 +08:00
Code Issues Packages Projects Releases Wiki Activity

config-linux: Make "don't modify filesystem permissions" generic

Browse Source 
The user-namespace restriction isn't about the root filesystem in
particular.  For example, if you bind mount in a second filesystem,
the runtime shouldn't adjust ownership on that filesystem either.

I've also adjusted the old "permissions" to "ownership", since that
more clearly reflects the fields (user and group) that you would
modify if you wanted to adjust for user namespacing.

Signed-off-by: W. Trevor King <wking@tremily.us>
This commit is contained in:
W. Trevor King
2016-05-03 20:30:30 -07:00
parent 3a386261e9
commit f830d50a52
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
config-linux.md
+1 -1
View File
@@ -88,7 +88,7 @@ Also, when a path is specified, a runtime MUST assume that the setup for that pa
```
uid/gid mappings describe the user namespace mappings from the host to the container.
The mappings represent how the bundle `rootfs` expects the user namespace to be setup and the runtime SHOULD NOT modify the permissions on the rootfs to realize the mapping.
The runtime SHOULD NOT modify the ownership of referenced filesystems to realize the mapping.
*hostID* is the starting uid/gid on the host to be mapped to *containerID* which is the starting uid/gid in the container and *size* refers to the number of ids to be mapped.
There is a limit of 5 mappings which is the Linux kernel hard limit.