Cockpit as a privileged container?

Trevor Jay tjay at redhat.com
Tue Aug 5 02:57:02 UTC 2014


On Mon, Aug 04, 2014 at 03:34:11PM -0400, Daniel J Walsh wrote:
> >     -v /var/..:/host --net="host"
> >
> That looks good, except you don't have /proc shared.
> 

Right. The container can only access /proc and friends if you also use a the policy/entrypoint hack to allow it to become unconfined_t . Like I said, this is just a dirty simulation of your future feature.

Speaking of that: you mentioned a "set" collection of namespaces/privileges to choose from at container launch time. How clear are those at this point? It would be good if we could whip up roughly equivalent types now so that the cockpit guys could begin seeing what they'd need to adjust.

_Trevor

-- 
Sent from my Amiga 500.
(Trevor Jay) Red Hat Product Security
gpg-key: https://ssl.montrose.is/chat/gpg-key


More information about the cockpit-devel mailing list