github/containerd
4
0
Fork 0
Code Issues Pull Requests Packages Projects Releases 2 Wiki Activity

vendor for new seccomp helpers

Browse Source 
Signed-off-by: Mike Brown <brownwm@us.ibm.com>
This commit is contained in:
Mike Brown
2017-09-14 18:14:00 -05:00
parent c0a2d152d9
commit 78a925f57b
29 changed files with 894 additions and 54 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
pkg/server/container_create.go
View File

@@ -26,7 +26,7 @@ import (
"github.com/containerd/containerd"
"github.com/containerd/containerd/contrib/apparmor"
"github.com/containerd/containerd/contrib/seccomp"
"github.com/containerd/containerd/typeurl"
"github.com/containerd/typeurl"
"github.com/docker/docker/pkg/mount"
"github.com/golang/glog"
imagespec "github.com/opencontainers/image-spec/specs-go/v1"
@@ -51,14 +51,14 @@ const (
profileNamePrefix = "localhost/" // TODO (mikebrow): get localhost/ & runtime/default from CRI kubernetes/kubernetes#51747
// runtimeDefault indicates that we should use or create a runtime default profile.
runtimeDefault = "runtime/default"
// runtimeDefault indicates that we should use or create a docker default profile.
// dockerDefault indicates that we should use or create a docker default profile.
dockerDefault = "docker/default"
// appArmorDefaultProfileName is name to use when creating a default apparmor profile.
appArmorDefaultProfileName = "cri-containerd.apparmor.d"
// unconfinedProfile is a string indicating one should run a pod/containerd without a security profile
unconfinedProfile = "unconfined"
// seccompDefaultPodProfile is the default seccomp profile for pods.
seccompDefaultSandboxProfile = unconfinedProfile
// seccompDefaultSandboxProfile is the default seccomp profile for pods.
seccompDefaultSandboxProfile = dockerDefault
// seccompDefaultContainerProfile is the default seccomp profile for containers.
seccompDefaultContainerProfile = dockerDefault
// seccompEnabled is a flag for globally enabling/disabling seccomp profiles for containers.