container: document ambient capabilities
All checks were successful
Test / Hakurei (push) Successful in 2m3s
Test / Flake checks (push) Successful in 1m22s
Test / Create distribution (push) Successful in 32s
Test / Sandbox (push) Successful in 2m3s
Test / Hpkg (push) Successful in 3m54s
Test / Sandbox (race detector) (push) Successful in 4m20s
Test / Hakurei (race detector) (push) Successful in 4m45s
All checks were successful
Test / Hakurei (push) Successful in 2m3s
Test / Flake checks (push) Successful in 1m22s
Test / Create distribution (push) Successful in 32s
Test / Sandbox (push) Successful in 2m3s
Test / Hpkg (push) Successful in 3m54s
Test / Sandbox (race detector) (push) Successful in 4m20s
Test / Hakurei (race detector) (push) Successful in 4m45s
Signed-off-by: Ophestra <cat@gensokyo.uk>
This commit is contained in:
parent
acffa76812
commit
edd6f2cfa9
@ -145,8 +145,14 @@ func (p *Container) Start() error {
|
||||
Cloneflags: CLONE_NEWUSER | CLONE_NEWPID | CLONE_NEWNS |
|
||||
CLONE_NEWIPC | CLONE_NEWUTS | CLONE_NEWCGROUP,
|
||||
|
||||
// remain privileged for setup
|
||||
AmbientCaps: []uintptr{CAP_SYS_ADMIN, CAP_SETPCAP, CAP_DAC_OVERRIDE},
|
||||
AmbientCaps: []uintptr{
|
||||
// general container setup
|
||||
CAP_SYS_ADMIN,
|
||||
// drop capabilities
|
||||
CAP_SETPCAP,
|
||||
// overlay access to upperdir and workdir
|
||||
CAP_DAC_OVERRIDE,
|
||||
},
|
||||
|
||||
UseCgroupFD: p.Cgroup != nil,
|
||||
}
|
||||
|
Loading…
x
Reference in New Issue
Block a user