blob: a358bab6e458af36a62fa08647b0f6fc86d1c1b1 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
|
Alpine Linux unprivileged LXC containers
========================================
At the moment unprivileged containers are only working with linux-vanilla.
They may work with grsecurity in the future with the following disabled:
echo 0 > /proc/sys/kernel/grsecurity/chroot_deny_mount
echo 0 > /proc/sys/kernel/grsecurity/chroot_deny_pivot
echo 0 > /proc/sys/kernel/grsecurity/chroot_caps
see also: https://en.wikibooks.org/wiki/Grsecurity/Runtime_Configuration
-------------------------------------------------------------------------------
Instructions:
-------------
(a) add the name(s) of the containers to run unprivileged to /etc/conf.d/lxcfs
(b) rc-service lxcfs setup => converts privileged => unprivileged containers
=> creates /etc/subuid & /etc/subgid
(c) rc-service lxcfs start
(d) rc-update add lxcfs
(e) rc-service lxcfs info => print & add config file settings to the containers
-------------------------------------------------------------------------------
Start the container & verify processes are running unprivileged:
ps aux | grep 100000
|
