github/containerd
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases 2 Wiki Activity
d6dbc4040b
containerd/contrib
History
Bjorn Neergaard 9a202e342b
seccomp: always allow name_to_handle_at 
This syscall is used by systemd to request unique internal names for
paths in the cgroup hierarchy from the kernel, and is overall innocuous.

Due to [previous][1] [mistakes][2] in moby/moby, it ended up attached to
`CAP_SYS_ADMIN`; however, it should not be filtered at all.

An in-depth analysis is available [at moby/moby][3].

  [1]: a01c4dc8f8 (diff-6c0d906dbef148d2060ed71a7461907e5601fea78866e4183835c60e5d2ff01aR1627-R1639)
  [2]: c1ca124682
  [3]: https://github.com/moby/moby/pull/45766#pullrequestreview-1493908145

Co-authored-by: Vitor Anjos <bartier@users.noreply.github.com>
Signed-off-by: Bjorn Neergaard <bjorn.neergaard@docker.com>
2023-06-28 05:50:24 -06:00
..
ansible upgrade registry.k8s.io/pause version 2023-05-28 07:59:10 +08:00
apparmor contrib/apparmor: remove code related to apparmor_parser version 2023-02-17 00:15:36 +01:00
autocomplete Fix zsh autocomplete script 2020-02-11 19:56:27 +08:00
aws Move snapshotters benchmark to a separate package 2019-04-02 14:42:21 -07:00
diffservice Add diffservice to contrib 2023-04-15 23:16:29 -07:00
Dockerfile.test.d contrib/Dockerfile.test: add "integration", "cri-integration", "critest" stages 2023-01-03 20:19:38 +09:00
fuzz pkg/cri/sbserver: experimental NRI integration for CRI. 2023-02-13 22:08:18 +02:00
gce Update gce contrib to use v2 by default 2023-03-15 09:18:16 -07:00
nvidia replace uses of os/exec with golang.org/x/sys/execabs 2021-08-25 18:11:09 +02:00
seccomp seccomp: always allow name_to_handle_at 2023-06-28 05:50:24 -06:00
snapshotservice Use mount.Target to specify subdirectory of rootfs mount 2023-01-27 09:51:58 +08:00
Dockerfile.test update go to go1.20.4, go1.19.9 2023-05-03 20:38:00 +02:00
README.md Add readme to contib 2017-09-18 11:47:27 -04:00

README.md

contrib

The contrib directory contains packages that do not belong in the core containerd packages but still contribute to overall containerd usability.

Package such as Apparmor or Selinux are placed in contrib because they are platform dependent and often require higher level tools and profiles to work.

Packaging and other built tools can be added to contrib to aid in packaging containerd for various distributions.

Testing

Code in the contrib directory may or may not have been tested in the normal test pipeline for core components.