On Mon, Aug 04, 2014 at 03:34:11PM -0400, Daniel J Walsh wrote:
> -v /var/..:/host --net="host"
>
That looks good, except you don't have /proc shared.
Right. The container can only access /proc and friends if you also use a the
policy/entrypoint hack to allow it to become unconfined_t . Like I said, this is just a
dirty simulation of your future feature.
Speaking of that: you mentioned a "set" collection of namespaces/privileges to
choose from at container launch time. How clear are those at this point? It would be good
if we could whip up roughly equivalent types now so that the cockpit guys could begin
seeing what they'd need to adjust.
_Trevor
--
Sent from my Amiga 500.
(Trevor Jay) Red Hat Product Security
gpg-key:
https://ssl.montrose.is/chat/gpg-key