github/containerd
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases 2 Wiki Activity
4,927 Commits 3 Branches 2 Tags 112 MiB
d1b9ee543c
Commit Graph

37 Commits

Author SHA1 Message Date
Kenta Tada
5b9a43d2e7 Fix seccomp contributed profile for clone syscall 
All clone flags for namespace should be denied.
Also x/sys should be used instead of syscall.

Signed-off-by: Kenta Tada <Kenta.Tada@sony.com>
 2019-06-03 14:23:34 +09:00
Sebastiaan van Stijn
2741dbe2c1
contrib: Dockerfile: bump go 1.12 
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2019-04-05 12:59:20 +02:00
Sebastiaan van Stijn
a84f87d84f
contrib: Dockerfile: add a base stage 
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2019-04-05 12:26:55 +02:00
Sebastiaan van Stijn
a07e12cded
contrib: Dockerfile: reformat, and use --no-install-recommends 
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2019-04-05 12:24:41 +02:00
Sebastiaan van Stijn
ba9e1ea23c
contrib: Dockerfile: use build-arg for go-version 
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2019-04-05 12:16:36 +02:00
Maksym Pavlenko
8784eb6308 Move snapshotters benchmark to a separate package 
Signed-off-by: Maksym Pavlenko <makpav@amazon.com>
 2019-04-02 14:42:21 -07:00
Maksym Pavlenko
d9526f5c4f Move CloudFormation template to contrib 
Signed-off-by: Maksym Pavlenko <makpav@amazon.com>
 2019-04-01 13:34:48 -07:00
Sebastiaan van Stijn
8f8fd3c3a8
seccomp: whitelist statx syscall 
This whitelists the statx syscall; libseccomp-2.3.3 or up
is needed for this, older seccomp versions will ignore this.

Equivalent of https://github.com/moby/moby/pull/36417

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2019-03-20 11:59:02 +01:00
Avi Kivity
4506eb45bf seccomp: whitelist io_pgetevents 
io_pgetevents() is a new Linux system call, similar to the already-whitelisted
io_getevents(). It has no security implications. Whitelist it so applications can
use the new system call.

Fixes #3105.

Signed-off-by: Avi Kivity <avi@scylladb.com>
 2019-03-19 11:56:32 +02:00
Tibor Vass
7ca2c3d68d contrib/nvidia: export helper binary path and list of Nvidia capabilities 
Signed-off-by: Tibor Vass <tibor@docker.com>
 2019-03-12 15:28:14 -07:00
zhangyue
996c60616a fix: fix error info start capitalized 
Signed-off-by: zhangyue <zy675793960@yeah.net>
 2018-11-28 15:26:16 +08:00
Jean Rouge
90880078b9 Adding a --load-kmods flag to the NVIDIA OCI hook 
Signed-off-by: Jean Rouge <jer329@cornell.edu>
 2018-11-15 01:52:11 -08:00
Sebastiaan van Stijn
07237e34e6
Bump to Go 1.11.x 
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2018-10-25 22:13:21 +02:00
nashasha1
7f03ad6579 Fix typos 
Signed-off-by: nashasha1 <a4012017@sina.com>
 2018-09-07 16:59:42 +08:00
Kenfe-Mickaël Laventure
875b92c507
Merge pull request #2512 from crosbymichael/gpupath 
Add nvidia Opts to lookup containerd binary or hook path
 2018-07-31 09:28:33 -07:00
Michael Crosby
e4f33dcfb5 Add nvidia Opts to lookup containerd binary or hook path 
This is for consumers like Docker that manage a `docker-containerd`.

Signed-off-by: Michael Crosby <crosbymichael@gmail.com>
 2018-07-31 10:11:25 -04:00
Michael Crosby
81e2859e8b Change gpu Capability type to string 
This helps with mappings so that we are not translating multiple times
from caller to hook.

Signed-off-by: Michael Crosby <crosbymichael@gmail.com>
 2018-07-30 15:37:13 -04:00
Derek McGowan
ca71484793
Merge pull request #2480 from dmcgowan/proxy-plugin-doc 
Document plugins
 2018-07-30 11:23:24 -07:00
Michael Crosby
dd0c04970d nvidia GPU support for caps and multiple uuids 
This improves nvidia support for multiple uuids per container and fixes
the API to add individual capabilities.

Signed-off-by: Michael Crosby <crosbymichael@gmail.com>
 2018-07-27 15:28:59 -04:00
Derek McGowan
3e657de3af
Document plugins 
Add plugins documentation to root.
Mention configuring proxy plugins and runtime plugins.

Signed-off-by: Derek McGowan <derek@mcgstyle.net>
 2018-07-25 23:28:09 -07:00
Michael Crosby
b949697a9c Add nvidia gpu support via libnvidia-container 
This adds nvidia gpu support via the libnvidia-container project and
`nvidia-container-cli`.

Signed-off-by: Michael Crosby <crosbymichael@gmail.com>
 2018-05-09 13:37:39 -04:00
Tom Godkin
fc8bce59b9 Use user-specific temp directory if set 
This allows non-privileged users to use containerd. This is part of a
larger track of work integrating containerd into Cloudfoundry's garden
with support for rootless.

[#156343575]

Signed-off-by: Claudia Beresford <cberesford@pivotal.io>
 2018-05-04 10:27:58 +01:00
Michael Crosby
606be14859
Merge pull request #2238 from tklauser/runc-libapparmor-dep 
Drop libapparmor dependency from runc build docs
 2018-03-30 10:18:34 -04:00
Tobias Klauser
a74903a307 Drop libapparmor dependency from runc build docs 
As of opencontainers/runc@db093f621f runc
no longer depends on libapparmor thus libapparmor-dev no longer needs to
be installed to build it. Adjust the documentation accordingly.

Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
 2018-03-29 09:18:45 +02:00
Justin Cormack
9435aeeb30
The set of bounding capabilities is the largest group 
No capabilities can be granted outside the bounding set, so there
is no point looking at any other set for the largest scope.

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
 2018-03-28 17:36:46 -07:00
Phil Estes
6aa612dfc2
Update recommended versions to Go 1.10 
To match build requirements for containerd now that we are using 1.10.

Signed-off-by: Phil Estes <estesp@linux.vnet.ibm.com>
 2018-02-27 16:50:12 -08:00
Kunal Kushwaha
b12c3215a0 Licence header added 
Signed-off-by: Kunal Kushwaha <kushwaha_kunal_v7@lab.ntt.co.jp>
 2018-02-19 10:32:26 +09:00
Christopher Jones
8043f26651
[contrib] bump golang 
Use golang:1.9, which should get the latest 1.9.x version,
instead of using a specific tag.

Signed-off-by: Christopher Jones <tophj@linux.vnet.ibm.com>
 2018-02-16 08:23:35 -05:00
Justin Cormack
35be3d5127 Remove a really confusing fallthrough 
This is so confusing, and not needed.

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
 2018-02-08 16:22:29 +00:00
Christopher Jones
051ac5dd63
running tests in a container 
This provides a dockerfile for building a container to run the containerd tests

Signed-off-by: Christopher Jones <tophj@linux.vnet.ibm.com>
 2018-01-30 14:44:30 -05:00
Michael Crosby
d179c61231 Revert "Use jsoniteer for faster json encoding/decoding" 
This reverts commit 4233b87b89.

Signed-off-by: Michael Crosby <crosbymichael@gmail.com>
 2018-01-29 15:47:48 -05:00
Michael Crosby
4233b87b89 Use jsoniteer for faster json encoding/decoding 
Signed-off-by: Michael Crosby <crosbymichael@gmail.com>
 2018-01-26 16:32:55 -05:00
Daniel Nephin
cdf62f69a1 Fix usage of oci in other packages. 
Signed-off-by: Daniel Nephin <dnephin@gmail.com>
 2017-11-27 16:16:17 -05:00
Mike Brown
120bb4cd47 fixes missing default permission 
Signed-off-by: Mike Brown <brownwm@us.ibm.com>
 2017-09-20 13:15:39 -05:00
Michael Crosby
58015abbd5 Add readme to contib 
Closes #1442

Signed-off-by: Michael Crosby <crosbymichael@gmail.com>
 2017-09-18 11:47:27 -04:00
Mike Brown
426650f21b adds seccomp helpers 
Signed-off-by: Mike Brown <brownwm@us.ibm.com>
 2017-09-13 13:11:30 -05:00
Michael Crosby
2b46989dbe Add default apparmor profile generation 
This adds default apparmor profile generation to the containerd client
so that profiles can be generated with a SpecOpt

Signed-off-by: Michael Crosby <crosbymichael@gmail.com>
 2017-08-29 12:03:24 -04:00