5 Commits

Author	SHA1	Message	Date
Eiichi Tsukata	cac0cea03f	drop CAP_SYSLOG capability ... Kernel capabilities for privileged syslog operations are currently splitted into CAP_SYS_ADMIN and CAP_SYSLOG since the following commit: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=ce6ada35bdf710d16582cc4869c26722547e6f11 This patch drops CAP_SYSLOG to prevent containers from messing with host's syslog (e.g. `dmesg -c` clears up host's printk ring buffer). Closes #5491 Docker-DCO-1.1-Signed-off-by: Eiichi Tsukata <devel@etsukata.com> (github: Etsukata) Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)	2014-05-01 11:43:55 -07:00
Tianon Gravi	d5d62ff955	Close extraneous file descriptors in containers ... Without this patch, containers inherit the open file descriptors of the daemon, so my "exec 42>&2" allows us to "echo >&42 some nasty error with some bad advice" directly into the daemon log. :) Also, "hack/dind" was already doing this due to issues caused by the inheritance, so I'm removing that hack too since this patch obsoletes it by generalizing it for all containers. Docker-DCO-1.1-Signed-off-by: Andrew Page <admwiggin@gmail.com> (github: tianon)	2014-04-29 16:45:28 -06:00
Michael Crosby	81e5026a6a	No not mount sysfs by default for non privilged containers ... Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)	2014-04-24 10:35:20 -07:00
Michael Crosby	0779a8c328	Add lxc support for restricting proc ... Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)	2014-04-24 10:35:20 -07:00
Alexander Larsson	359b7df5d2	Rename runtime/* to daemon/* ... Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)	2014-04-17 14:43:01 -07:00