diff options
| author | Stuart Cardall <developer@it-offshore.co.uk> | 2016-09-13 23:16:58 +0000 |
|---|---|---|
| committer | Carlo Landmeter <clandmeter@gmail.com> | 2016-09-15 20:55:44 +0200 |
| commit | f78de62584abc5348ac3a31d84c4ad3adaf08004 (patch) | |
| tree | 748f297cde05541882e0a74d09e31ccdd8cf89f7 /community/lxcfs/README.alpine | |
| parent | b078598f2b1a0b60825e4decc2310fec57d2bb16 (diff) | |
| download | aports-f78de62584abc5348ac3a31d84c4ad3adaf08004.tar.bz2 aports-f78de62584abc5348ac3a31d84c4ad3adaf08004.tar.xz | |
testing/lxcfs: fix build & move to community
this enables unprivileged lxc containers on the vanilla kernel
full instructions in README.alpine
Diffstat (limited to 'community/lxcfs/README.alpine')
| -rw-r--r-- | community/lxcfs/README.alpine | 31 |
1 files changed, 31 insertions, 0 deletions
diff --git a/community/lxcfs/README.alpine b/community/lxcfs/README.alpine new file mode 100644 index 0000000000..a358bab6e4 --- /dev/null +++ b/community/lxcfs/README.alpine @@ -0,0 +1,31 @@ +Alpine Linux unprivileged LXC containers +======================================== + +At the moment unprivileged containers are only working with linux-vanilla. + +They may work with grsecurity in the future with the following disabled: + + echo 0 > /proc/sys/kernel/grsecurity/chroot_deny_mount + echo 0 > /proc/sys/kernel/grsecurity/chroot_deny_pivot + echo 0 > /proc/sys/kernel/grsecurity/chroot_caps + +see also: https://en.wikibooks.org/wiki/Grsecurity/Runtime_Configuration +------------------------------------------------------------------------------- + +Instructions: +------------- + +(a) add the name(s) of the containers to run unprivileged to /etc/conf.d/lxcfs +(b) rc-service lxcfs setup => converts privileged => unprivileged containers + => creates /etc/subuid & /etc/subgid +(c) rc-service lxcfs start +(d) rc-update add lxcfs +(e) rc-service lxcfs info => print & add config file settings to the containers + +------------------------------------------------------------------------------- + +Start the container & verify processes are running unprivileged: + +ps aux | grep 100000 + + |