github/containerd
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases 2 Wiki Activity

Merge pull request #6289 from ManaSugi/add-ctr-caps

Browse Source 
ctr: Add Linux Capabilities control flags
This commit is contained in:
Maksym Pavlenko 2021-11-28 11:26:50 -08:00 committed by GitHub
commit 0d720ff9c9
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 26 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
cmd/ctr/commands/commands.go
View File

@ -169,6 +169,14 @@ var (
Name: "device",
Usage: "file path to a device to add to the container; or a path to a directory tree of devices to add to the container",
},
cli.StringSliceFlag{
Name: "cap-add",
Usage: "add Linux capabilities (Set capabilities with 'CAP_' prefix)",
},
cli.StringSliceFlag{
Name: "cap-drop",
Usage: "drop Linux capabilities (Set capabilities with 'CAP_' prefix)",
},
cli.BoolFlag{
Name: "seccomp",
Usage: "enable the default seccomp profile",

18
cmd/ctr/commands/run/run_unix.go
View File

@ -218,6 +218,24 @@ func NewContainer(ctx gocontext.Context, client *containerd.Client, context *cli
)
}
if caps := context.StringSlice("cap-add"); len(caps) > 0 {
for _, cap := range caps {
if !strings.HasPrefix(cap, "CAP_") {
return nil, fmt.Errorf("capabilities must be specified with 'CAP_' prefix")
}
}
opts = append(opts, oci.WithAddedCapabilities(caps))
}
if caps := context.StringSlice("cap-drop"); len(caps) > 0 {
for _, cap := range caps {
if !strings.HasPrefix(cap, "CAP_") {
return nil, fmt.Errorf("capabilities must be specified with 'CAP_' prefix")
}
}
opts = append(opts, oci.WithDroppedCapabilities(caps))
}
seccompProfile := context.String("seccomp-profile")
if !context.Bool("seccomp") && seccompProfile != "" {