From 6c6e6ff6e013dcf9da7440753edd255b0fb4d3ed Mon Sep 17 00:00:00 2001 From: Hannah Cooper Date: Thu, 19 Mar 2026 02:04:24 +0000 Subject: [PATCH] GITBOOK-21: BE-12696 Add support for docker run --security-opt --- .../assets/2.40.0-docker-security-settings.png | Bin 0 -> 49279 bytes user/docker/containers/advanced.md | 17 +++++++++-------- user/docker/host/setup.md | 9 +++++---- 3 files changed, 14 insertions(+), 12 deletions(-) create mode 100644 .gitbook/assets/2.40.0-docker-security-settings.png diff --git a/.gitbook/assets/2.40.0-docker-security-settings.png b/.gitbook/assets/2.40.0-docker-security-settings.png new file mode 100644 index 0000000000000000000000000000000000000000..068085c8d0110d6271b11caf7999204fcddc022f GIT binary patch literal 49279 zcmd43WmFtX)W3^+a1Wl~?(V^Z!!Wo7cXtQ`3m$?6mkjRiE(z{#!QEZ&aL!52dEfuK z>)sFd!)2{m(^Fl$WOsG-uBU#@XC(!xS4f0N5D*ZrWTfAzKtMogKtMp6Bfx=EJfD{h z!9TPt#Ko0l#Kp;!9PLaktW6*wXujCQ$jd<~V+XH{A(C@sYhhy#vh`#i7|)35N{{ws z%8)jlMn#VE==NfSCool|31>blr373ZehS@ze}@k9g)uDGsfMs*cysaG-u-wp74PIH z;dU-c<_BI^zIY`ruDZB(=m-3F2wgFpfGr1gT?)ijD>sfZ^3R@}p zl(QY(0QW`5VS0l4rfMs+Zz2{@$s)0e)I*S$-;h*V(5y8Y9XpSFJI?N%GfOBA&Nb5mT*%*4BpG)BStZRSJC5Zut zWS==|rO@{--5moLp9+IA$}r4P&;4P6zbr4rAOCRU+^fY1hetn;v#(jt9Tndll1WUb zs)kewl&iCx{<+5Etu*e8&UL!!D`E)J=+gVUjYhjyWaSW(Xu^1NIp3m6MhRN`QoskKXyN&&e350+CNAT{4VF6iIcITg}t+doh{i*xrRn|F3y4!6fYJ1`TM(_Chivh)@1ASPq)AwWPUlr z%*w>V{HJWNslZDrpOS^UiM8fC3mdR|z;y_*bFm2gmH+=Z^KXs+u>}5W$;r$6U(5fT z`QMi6P9~1xb~fNDorV6rGXEI=_vAl@0?aQx|BomBcJp7UU_T2X2{8Y;W1DK zH@7OeE-1Ne{8fH!DcL)fOh;IXK6l{t7b;4>_EhPgVyVO zk>zU|VLzju2#Y4u&Efovyz%KYFN?v^cqI~+qzo>}h;vM)AvRb|uY8pP}mdl?IrCNk`W zsUk>jrVR?l@)^_G(53IW7(wP^*>m%oJKpI!bF|`j9C7q!T-tndzX!kx7ZyU5BZ!~V zZVzAfC+_#Y=#0@ZtUQZ@z};$(dy>6nFPcZYlR9k9z5Vn)JZ8PKTbf3MJZ=1`>~{_s z!xoU<9TSb2arLTjf;Q3Ay8VCrsw{d_(Ps4@fv|v)F$sT(%e-3Qx#sOE-1> zoO%{tD4OB2E9duA^HeiFl8%=7B>W(4B5W;7NynwOn_12KHBT`^InfTj=t9->sWkQ% zIj>nq#>MWopt|nVUS0OjiEY}VD5kvQRaUx@JHNUKDMmikEH;-Nv35$IIol?iZ6V9) zBddPxO1P|I^5+y0|HRUHkZ9BWBMTt@v-4rwK}npvarV8n&1*s5Y5QJJh_Td(_>5N}RtvPQJlu7%R|iLoZ5IzU~2sFDN|mw?%4dTrPr~Zw01@ioD08IlhE_cPb}Hww-tL| znex5AVa9Q)!u1c>asdglQWsmDH1u=Zp63epm;f{xhp7&ISf~qbhj}Bdd*a%&j+(h@ z82w2?jG`SDQx$nC*2d*2_=lq^6*{zZDlBNc{L#*6q=JCM#*ym*ca$E>fhfT^ZZ}jH z;(iWn4MsVQ(l<1&N>l@J3}T8&h}e23Ev}EjvTzEoQe3hxpRHBb^Yn)Ls~sj>@0zWI z8;6d1ypJ3NE+)HQrO6AnQ0L<)q%ogFGFd@=`Uc(XhJ{ z=yJ!PYg)ZUo_Rwji0nU8i~W-9I-&aal} zEbbLkl){xZOO*TS!UJ zz`C6E#^as-6aZ9y>-K%u371ZxQ9j*Pw}u$d4cXGFGEGmz;^XC7iL;QYpq?z`h4ENr zLOoRo5KYss@cc9nD8e51)m|GVR^)L$W>;J4<86z|eNQl6nA+9*KKGjw-h^YViV;I5 zG5Q9X>mh$+oKS@Ps z$e78K6kxLuwbOy_Kd*~RDPR_V#!s|26wf^A*z;Tmpx;u-We@*M{5?V0A-oH9#Canr zU7;wx!~q|js$^q1Q(3_nOlOlEH(BrNl6>Fi$mhC-g43T7zQh`$-U#;M+}&uVD`%lv zDMwG32`Ld;kQJJCo61{7*)I5t%$+guy}%&Y*iP<(G%sqo-iv+}7!67WIxV3>)u95T zAPx_wO(mJU;XCmu$Dsg4ui$i&g zLkgjHuZu>d3FOoQeAKsCA;Ix8jUNeUvSSIsY7I0n6F07wZ4Q}Y6y(e(RBD!|b89jb zI1nhh-!+VNg_f8#}i27+dJ^4 zCp@3l8Y(3pf7rH{@l~r8RG*y{_(9+04~LX(zK?0=H-Q6C4YuFk z+$EcdQ}`kxy&?Hw&-{4VS5`Kar)UnRQL0yGoLOdEWF`sc6cMkCj%8Xy){0;iOrCpK zRzrSWB+wVei*-#DTU2b{7e)B6WYuHP*_DDBLH(m)wB19uOtYfbquzl&j5;FgNJT5k?%KkBN$@w zEk>Qv+8Z&J%M8EAlBgO?xFAHMREf}4^T7?VgD7S69Co8oZrKX|9>eu5;yt!SKJ@O1 zc9SG37o^L%A+%u=zml9Lx8s8Sbl)sSd(mZMWVC>4FW;#sOFw+fylU_RTRlRroPBlN zMBC?dttac-Iqt-hIJrf+9u^Gi2d#EwpDq;H(Ar{=Ut>r(I7%sODs_}3RIuyTy%}z10#RPho z?|o|_y9Mlc)<^i=l?G$7Ewd7kgyu@ADe z!8T1x`8i8i*-5V!3YUE2n~+!5o^iu<_(It5d3uJ?xygtqk)lReGDm(vDKEd>z|JpJ zhL4{--LlGBZ}o=sy2r`Nlaou#T4lcG8{7xUX((4wxu_oyQwfT&+^hXw%)HDs`+b-R z5q>A)2w`wW7OTFWhX;tgPkdSL@{d9$LF;*3L5L>nS;4e7<$Bf|JQ*$b(Mr}r+bj8~ zZR6c5Tc}-KrAkkWbW3pQn9+da9Hsi=x?P{J!ao=heDtyYoUdP0 zi1fbowYMT{b&e2B!}d^GTJOVXxJn+1gZ{Sxhh8$d+zYy>ZJ0jCjwO$ejLP{=3~j#D zR$C}^uTA4cl^f9QzX2TXYY*q8+>T&W^IV@SJrL?A%Lk#Ma(`Vtgp^n-S*BMY<4j|E zSIeQJxm-Y7W1wxW)N^V3tBf1!O=l~&?8*Leo_0O=i2D|~Q13r;#^-o|P2V&&H7L8J z(M?_Q?3SXkY=AiFe|6XBu#X7OApYg814VkKy)13Y&YPo^>*Ad_hC5kJ|Ff3x`0Y<2 ziut~~lpI89A=#f1p-JPI3KJSwNcXvh^~&F~_7y8!ym9Jvrb{AT$HeWVfITbx7N%7B zl}hG2uu~$!%bolrHhJjt)tZpcP?btnXxQ)d9s;sIOPe+eLp(X!v{$3ced$E~8(k(H zO+`(MP8IlH7{HR%qs~~AUpNBaE2yvncG7-!g+$XNEgTI1-juL>n+Sj`*7)fmnN!74 zZr<~mSX)zd@U}%T7!#J8foDfEp2oOiExvzzW2HW7i4E_l|2hzQZ{3nuL2`6c95UEN zb>z;;O;7*&12Q)muIm&M%h|!K&&Qd?J4sC#zb#792&lT_39}L1+Lp4xJI>fEnI@-{k;k|z<60YLlJxn>+r&04M!_V^)fOHd+)p zhE#;JR)o%Nsv|O;1o+c!pagiSTqG^a`+N2RKhzAMl!F3(hdh5pqb@J&`zTP{+kc(` zFN?K`|HS~}VY(enDCKE?hX5bZ-M7K$;BpuZ5|ZqX9Z&{bAH9XF=AZi7`4vUtirjn= z5Fma>zGCgNFR(yHwf|pOu z&oUp}o$^=_XL{tXmA@a?VEfgG_V7ezizEO2>b(udc>?tJW}isLa?F@hDX;gu4|bGk zRo7=^=liF5q7s5}_oS$BU)YoyE+v~)gs(NDtKlT}64ytc?a&A;p`YNQJ(TU)B~P^$MQCpqSYN}U=> z=G-f$Ph=HcBf2Ooy96;U`hNe4r4uao=u~u3`xT@9O}{!!XMA>0yI*8`&_{ab!#l>Q zl8sgw8lU;N=NcwizZW-!LNEY8R7W*B6??i&(6927#%$>Civ^{iXEN$Qp8{$?y8hfo z9hjT_!MZP@kG-V9W3F!X%}CqsUCDy0jQ7{K*?gS+stw~ohrN@mS|3{f=8-2e# z6F-~pj>mXexbl|DMT&b$kI6XsO0B7ZZR;M$8p^96t2pk&jJt*CN#cZFWJq!YL`ayj zkwv$u*h*(|r`OvTvK3-NZ66$HL+o^tTb`5YwlL{6%MId(@he7dSW28OKR*A8N@fYK zJrc;gFRtylKAK4STxBuxlyh;h%Rb-U=IVARXq_lYy4sk-cHv^Ct;@Y<|5jtpq{5@m zm(Pi5bj+k~n@V0^+Ufabz^3uJ3?{K`Ig?Zp{Gj&NXtwQ4f9x~gdf2?!ImMFw*6B2~ zvLCh_i(my)Kw8yrB~l8? z-xmnC=x2YFy-O{zzHx~h>5__$oU^&FcRgN)UZ}_+{w}H+(^s6j<3l8_+2JC!wnI4H z31x@hqa;SGMyPWZo}<~^d^sbM=3cHgNc{^4~t2&=y7rmL+ALJNCcM9nUx^X~N* zw2VyfvVVLXV%tTSgjKu6PGKj?zo>bu^5S%9_5R{u&dJBTE-3a`nnR-+%Vs>_yu8tp zHJW?~a;9UJrlv4neVq}ukJJJZ&xvocV!NHyM5asVUE+RdS%aUn(^V(syxUHoC4E%n zTGXix33u=Px@GZ><1eJe)_XD+%Z1rowZ{r;;#Y*X$ecF!jE1C8l*kq_xE}Ao_nLbh zq5*NyYh0$fkElRi6{o8?m$ z2{hqH1i&Bs$S@oKwQe@KJGeWclo<6C_f{Fom~G(+Ljm5c8w)TUOQj&a#Lu1QY@t#q zu}ycmBOKgnKBLy~sXV%o%Vw!)yi<3!%!@yabZ=Ov(eVxAMhHy*&sbJQ(FUitekBXp z#X?H5)7G<+W3!a=xtfCWwfi4ES9_vxzH0fYB+B9rsC_@D0$2 z7MD`#WR`L67>Itx;s9+)eg3csjW&E`v{gUf*vv*U9r6uT5yzXpq3?^lm7{gKT4SxB z`gZg5x5hq!0|lxkxgs?h8Tma8_1%k^hz7s$!b|Nb!-X<9m6Ae}0*4m5i;)CDj{R#K zZ0~2to=7b12CqVO2GF?AdCVmWd11y7;Z&yV zrWiK28;Z{6luJ^bfw0vRl1rO?iR>-rWV3^O{K4qh#09%kJ(hR0_v}ljcwW_^a=!D6eK-wH7GCfF} z-+Jh$i`cYW_wtVHhUiRw5F1AjJdFDHICXz4Q)6jts>r7M#oP^4FMDWBGYWETP86&n zr1lif)2E7uv-l#lR>mPZhve_}6#^HbMumlb6iJk~h4%+>02kNLwdar6M)MAhdIk-% zVc2|l91_6I!3I8E&W`>L4|gICISs&_%=vItF(fLTjSBSZfUTpe$Z3IU?+#QnvnvJY zP5o)>ip*sSo2{DC+fOm&H~Th)Qe=Cq?WpdMPZ|t?rAaHtKZXp&#=lmJ{bUW9++>ck zxf&vVtuRDu7;xjvz7sWUTjz61(XC?t?OfbJJasnE0=a%Tv2duus8`K|9III5F+@Qv zOsj4rWlYM2j@Atwn<&&ak&lIV-zsW8H9a2oIl8dO`m!)lqn{YHS0P#aGf)QqVrhG_ zT){-E!t|>Ox?1OGS+e?oQhKW9l=3slAtDm?TF__+7$=Q#>(_47lM91Hj<)J~5spaX zbb)4#mDyIf)i`K})di~g_aC|5r&Xz4E?~h8pC#{)^>Oni5u!M?CC1;m+R1^!HuKc| z>_F_>(1_E8;GtbupT|Tjq@2(o-lwo%%(VrNnxS@$jMOn7xeyQ9JO_{}*ADJlY&H(T zgnwy;=VRwNn0E`@Q)8B5Ij`F6t#3#EXi$#j_zuAPypL`zc=H2t!1SXSzy& z$uOS3)G_%w80C=Cm>~2$2Frh6ryfxb8)Y>gOw3@^D328d?^A@`POM{>YFAe{HBp5z zpM5Ze#a&CJgf@}B@6R^f+AsF|5$zRq|B3Zu<5gwP_+NLs!PweQpr}^MVgPF|5>f#! zup|>mFtS_ygITb z_V=XoHou?(#J*Fy(CN3x`4{JlaM{k42-PAtV|BA%$5P6F5CC0GlzS=4&2!LB9#N(f zC-6<}o3?ht%}^B6E8cX#H~c`th!d!nCrdgsd0(WE+`4KT&~0P_gUM`5R1+lk3d*V* z))i4~yfQ@vxfovQ-RbD%yNE-U+BxOrC>ufysMC;V9$nqwedJQ$60?+tJt{6-+^Zg> zfVqqUmA5&_!3G{WZj^|#^LemGng~W&0*0#$%uuiF7OOMP(3;4xKP#{Ms>)*Rja@_S zva+KaH9seTECHn#gOf?D;zu6MqxS^V3JmejJp(cBG%f}=0cRlC$8H}kwb#MkZW`>H;imbY_)y4!$jpurT4mvnt{MBC};qQsI9aY97LiQ?| z8w8yKB1-9jmXbaz@-@T`>h{Q69}-{bNR_@#I}+~u){&jH?*pVya<}5f#*V@th9bTj*>d7H>(TiRdlHzz|yHIT5glWS|_h7WVC16>hN_ zK=l#2!+mAYW??7WueX{nL69LrkeD7wh7CnuRx7>BWuBNhW(k@wDmvf0c-cK#U8491 zLM>L)D?e*gW<{cxkIR7t2X>!l$6qmqSRD)oiCh->3XixGa+{omAjg#3MGCf($;dG1o`=0|TA9y~PaZ5pEg~FKV=v^klyBBrX%*-~~r7 zZ2@wYe(7DvTTgjjn3k0_QpjbtE7Rikk`P!i3^@zjL9NLIt#!`t5+n|YgatoZ(cP~R zKFAWS{j4b5b_Ye`7%}wiaV0O9RXF0Dp|b)yYZ+Z;182HuW2pHV^&0$xqtYaS_UM?D z7abGlMT&@!3(v-NXgYL2!e7WynhvH7bO07^(SlBtcR*eA58)w2xH*o7i!(D7Jrv2I zHhk_I*sn+~iyS3D7xI=?Us+3*XAYmb2^r?0eb}`{+*3Jm_{8U+W>Ap*{f$o1c+07d*WZQZ_yH?e2w2xipMMJ*c>x zG}`68mWf6=jp}N}BnfPzvdtAb8js>Fp#KrX5S9oJ@SU&AHe*se%itMubSBZD?Zg0kU><|hvez}KO6n{tG2G^x-d+NDC*CdN zjUYCQh@ws{NudV_PP%Vf-osHCD5QE(!~L#3?V2PS+ga}7-^KuZPV-I8I$}V;Hg_V{ zv~m5DJ#&PEQzOIsQIWxnTFc$@-jb##!$`V~5IN28x|ci9__hxj7lE_X1++h@O#={C zNG>v^qzKgq(@%f56bOL$v-^|s0GWYL;kiB@vYQ7%uw7ltpvSZn?;B^@VD3_#pp+3BXx=pGytbTmdI50j4s|E-)-VX>M0b zEGra>2)B0!lGCQlygxgQ*N^Sa*HP-9f8ZH-op7G56BLxZfdO@l59#4>&hOdEp4W^vqSd?@@3xLVY0^V79i< z_=xl!RX?@1gq+FsU4tW}6w`mm4E09>&l)q5N}Ud|82)9PP>p$mO_$U>9`p^lqTF* zV6k)4yN2<%AAawlh#;5ru&J5-@KWZ&UVbOvxXr zg`Ndd{=RDwdd6bvr*<_vS<(rVNs(SW^b9FLuMa9qy^=CZ(!+-~*}>%q;qaT!uWX&U z^O!e(oFak{7~Wn)nck%y@d5WwOTo)Zh!>F#(Z4)Rto{F=A{`LTfBF*YNNM~p+(U=L zeSv^tNh)!F+(q`HVPXZ3`9FFeWW;xM~Et9XTryqt(8OALEOyKI5!yS}6e3?GiIqz!&`Yry z!EP~wVS>@g0!vE@x_|n7Rl2LD6&#=`c;O6Ii0ww|mTP(gI7Q2wY@;8;2$rszM&_M3 z>>oX}`DlRJ^EmEra2b?Kt!GW7z%vlH{QrP}>i1MK?_4b7@*F|P3u%ea;LApV=1;MH z1>8e=zlrsgYUVO$Z|wK$GuKUX>LyRuNq$BtTPzgZJ=-&^wA z32a<>ww@EG4BJpOenT;T!xiVjeIsxlUzJg8kC2F0wK)7dQBX zfElx+CQA#vEw16+c%z{H$JibaQLBT+)ss~rVUdeuti!C{6n^i?XO*^Nm!8p(m_*vu)*r%sI`EzRUBRX^E| z3ZiTR%oiB52jWyZMKR)dB#-|CtqNwLkfcpTQ>Smet|`E7c#<~HHG$9rCoij&6Cy??e{$|0e# zU-voR%L&9ZdfTpNu%$s%=7xc3AquJJe%b; zrpM?;=~r8c@jkE>SjlPFeh+#O5nW~=n83v5k;=Zm@;!yB4q~)+F9$GaM_^K4WCan` zK^5qf!rXEfmR@C{v=>4S5W|?bJuYToI(UXQc|I>SCi)uNc3hJxakxVIohiE%s8EW0yK-ljBih{AG)%Z(wW|zY4<)yWEkS<}6HehSEjWW;YLye8t;Dk5wUqV=I?q49 zIlD^7f2I;ToQ*!)x>5}rOI!8A<_EmLE0weAkEJas(GkRD6~blIFFWGxRSeJN^oZE{ ziyCSJobG2Ht3H`3;J=HyS(EAoKHVc5Ng%}v%E9fOn#eV_CuF_QRj2>Z)i3nDQT=^4 z_*d)BF2c${lBbmWMpdT}!291Q5jJSA<>1>C&)7Zh?J+bGE;yL()-PCit1q@%Lj4g| ztOR=y984=I*r7UxWJb!Lw~$nRXVN;sVH%kF<^;J%9t|%j#LpYtPct9z(aDL|7b;90 zj4$)8;QjcVFXC8fUzt%tw6*fr*<_dMH+rV|ZiM)2UNHO60F>tE>&!(o%9g%&N$*-#%ya`E8FChxLJnDNk0;h2$MB(wA|ET4S>sT=c}yT`H=uGd zjg;my=ItyA8x368OkrD{ieMD=?o>^UitTE!f2V5=#0 zkx&88uU}QJ>#mnYPya=A`^X<|W_JVKt6YcnRr9zacPU1G5VBauHg1(JV|g?8Dn9Dc z=K3_&WU2I=VPU^pe3P>=nEqMF_9TmM>LZRCO=P}PXEkgbtvDgTQ`@mPB}2vC)k%N^ z=CQs5a*$vglwCIO_g)5T;l9;@SXN_xl2)xL3q=7;9ck0bn=eTDln>qRn+bf>@?sr7 z4<+5_(P^*juP+9JL1UKAL;G^)k=41o>SysbTSx5};cG9=0=w(l!m@gOGciU-B`T&W zw%J-uLCdZTn)I@U3& z;%1Ak_>|5=^>`?i#rUx6cL$TV(h~M@ulZIRAis&52E)&+3vaXsO^e{kB0as!5n^Mf z+j_sY3W~@%-<1lZ=^Q6yzE0uTX}kG?eokLQ09n9{9PW@A|0_@-cQosR4cQh_-;Xj_ zi!bmV5-+jHJt8>zriUG11d{hU7Te}D`1}G#=EVNd)B&q5KO~ZzLrA3z|of7VS zNOa4clx_l}p1YFGaz(VI#{I_nF2VgW-I30uzX(srpqe@d&$lAxwUE9>oJ z7ZM}(j`e}i6ehJRLw_=F3EyA>FEMEK{u)oXdW@Qe`)`iy8@TdTb758^3B?=*v8s(6w7W&e zlA{gCi8rku))A4zd7tSu92rTVcgMeHTCBs-Y;GaZyU@l`DsRG+$72J=kcq-!qDTXW zbv_x@f9y+97HFWZH#7Y?l0a|sO2GM`I!uEjZ)~0Ph@ZwFP17G%U)mI4K<;b(xj%+0 ze!eg9+wo3^evt!8&*NAQdYwR=&G&&9kQ;Kp2S&e#o1|1n_$dQ@^&ui1or3ACzM0~3 zS$eh|_{Kq`h*}0U0Y)YQc@q?63}cxxKLH5MEifmtujyg;ftr8DiApKqN!ehdfUefS zkhWX?Id|7Z))KBQ2~fEDyTWFX8*NMpR7|9{Yf9~cEI{~&0n zeK7`Kpa>=vf`d;1bQfM6O?_#m8je{V5=oqrg3jlrD_FhO-YVqvIa7{bhWWa7G#c93 zt;82!bvg6zDVmZaJTOqwlNeu>z8fixAYk9P>OoGk`3puK_6*?l9|l9OchTtX%!?xE zxN4NuVkRwk)9=(4~|v3AV2I1g4-nS3CRmW1S{pXTNfT zc#wB40xKFGBwdP>lty)v2divO{c&obwN){;cM3!*I^n13z2AZF)X-FzVo#0CBSG+{ z(r=*B3DP-LRBh7FV-nN)!EIp_Kq(@(x``fy)K_rZf$Z-k*0;GTiYU>gnTlfMT1|!v z7XW|57!~b6jWd7?(x1hw3^Yz7lf(#9zOrvlh@7guTHE>NH`E$1dAkAG&3@ zjzuMdwb#>&YiHD0^;{NAns1#)f1*!4Y{qM9z!bA&9QH2;KedjI{xz z_6XQdw~4otsid|^w)!k~sPV3oH!Es7=n0kfA6o3EgrsIpAS8%}V{u-Kt^K+p0zhsl z&9B}$XfQ+FVHiB0$KCFU*2jM8(stdGdd+?8s+P9YU_^8hDHQRIMVmGaEALU%{xF__ zu=6KVMIt;n0;C%ls@LBxa_0mZqYr2-qJKCt`BDrK{6N|CKa8t8 z3CjjrU#|=EnsU;}S+2(bhPdXG1)8=9 zy-}EVA9rr2@;IyyI6CK5(CbZG?+%Rf5{f!+SKbI1kl##25GY7~-fNG@-S33PlEuLd zC|1f%VojOn-kLfDuVcCk$)x>G!!83g%_NYwYEvp#VvN5V{7mk$(h%Kk7l&sbTV?Bj z_g@VMioWwQfc=!6zi_9ueiK;XQ*SGjtF$FJ7yHrRAj20?`NKpNeTi58B?Ia8ih2tI zo$XLK-|!aKex_f&iyYp_v)0$_cZg$SHSrh;@EZ~_?29h;#+-kFUA=*W4n$q1*iN?D z5Ho|$$PfZ=gU{cx7==r1G-9{54e)0{U81L*9v(*RsGGx`tfqqmAZqs49BX(utI_8s zve;^;W{s$+>?_dc6|L0LMSYW2_o#&7j`n4AakPcK2u3ZVW251 zlnEggZ+R-D&T;vP82Lm14=+o%PwODA2~4k7Cvdy37Mi(%EqSK((*kCI!(zRjdX3#v zXa9cN$-Mf_7vpNZlJ(hl^|2`g3FjY!tZw)G3OE(tqJv+0B6CEiiJcCK(sOI8j>&83 zXo3m{IT16h%V^R_A`)g0g4P2(Kk60~G%(n_9Ls3FjMR+?ZN@RJ8$K=MNfRaqDf%&$vus2yx(aLWHtQ{O{&xD(h zmy6^(l+gRg+hqYCc`Qnk)x*eqUtTVufQKv&emZ@~N#MlYS514qa}f`%!});Ux^%_1 ztx38WF$%(GsMTpWE^JC7elX^Ka&l9rFsfYsZWL6@W4WT~>ed;?<#%eyIe>UX0L))D zLk>~SR3d<0ikw+J`i#(n$WN%Gc-rD-4@a-ddL za`91$KUXJ1=dkJusP})c)I=nPHB60jz+XfKmrfLZtur?hVfh8y4``u- zFBL9sj)D~{`XDD3>D~}zj*4p*HHsRH%hW%WlF8umZ{Lnl{JF1eJKTcvoz?z;RQJ3W ziK)Vh?{4!S{A<7o#@fYHbesQ@{bLSr((>*CbK1Y8zL*O90_fB`kiZ|dyqX41n&S7l z2c7@RU8i28ugUpw)L?GQ{NSek`cp?O3*WQNK>q>GLuF zX$MfAtZ@of*5h{`aMkwjR(l2#Ij-AXv|P?`4^a?ut3;!B#;Wk5Vm*DBTrcwDXdSHS zz;j;Vi@VS6RH|u|o0Lsl{E~V5oqsQ1BdGu=>Yk-o8Qx4Ob0q zYAl_J{QCyg?i_d4oUuphk=@a$`#?VG<3=$&TjBAah)i9erv`P;g`WtE7@KrZzhuY2 zK4|v&L$!k`ujR#dCvv^-327NIp`Ib3%7O98^)rq=g>DTf9GOOvb%A&P_sZ5AW-MTv z1s>zmxm~00eyuLI&;KE9{q;ua!y<{Cu782I(fCHAubQBjO7!d6hZ}jzsvQ_zRNw5g zc8U5banb1W5KhBtUxsB<-_teN!+Ed3Y{^Jjq0{yGN@0()IM+jdSyrQWc{itPqt$bA zyQ~>cOo?Lsw(#)YV?k%Iap|o%H6PcYxfM{ zGq$;d1QSZxFhaGidTj*n!1AozN!qWG*49tq{Cx_kAnm$OIB0fvZflbsU_lq>=0JQTuY}XL%VR&+QQM~` zA7&}j#9fO0p8qH1?6br1C_HyE+7$`AeK;_#Md@V+(|5n8 z2i}g@b?MQlkZ2PA#_xA-8H|dOqAgyiL^)s#-aM^u+$gj(KN{fxZDGE`Oaro00gsO!K zo(O95eedBl^J}6RS)@*bpE*Hn^uf!ETb;$)vWK-@@rmK9v9VSyd;-=+!9_jI;;e#>J%@O(hgGUp)Bf$a>aB8*312|bWBPVhk_2e%BPI9JuR_}n+u61s<^HbdjRa& zOdj$5+8;+MkKE@wz2-Wm@HSN>ERGt|cfzZH-99eabM9#7-6=xNnALHf*tXYyezj}G z7DeqJP=xa(=z&EOta$aL2@nU9>jGew08B#6)azPW`rbjrPm>k5^n^_gzf5HlsbF8o zB-MLuk?mo9Hfq(rF&^CmAnO$TQBwB-8xfdS&kxAz{LH>RINKOVizJ*bl?K0+i$nm8 zI_-1ccx>M2eHq*za&@&gpUh?=y&gk(bl=lnWR3V*TmorBWxZ4+{oukSZ>!ex(j`J- z(KzDu;)L(gg7SlsTOEA@KD~$2J#El2Dm~`TzMHO=YQlR981bak4smf9mtAN-K zJS#8AYY2yd0?C`y1y+R_dhHfjzDh=ucp&2a*F#qj@pr)pFCHRjgEWhrsbb)SJAVxCIoG+ug{PO?_Y{fm__k27GrwO z@3=SMR-1c@>^?UaK%+5rcUN2Jq;uAoOXIj*jepXQi5>Uj6{s|pE!&reLv58!Ys_F5 z(ErpU(WHx0wGLCKJ{6jq&jorDB7pzUM&%erTwYEXzn&3HZW%FHRbdW{RhT zn@0KJUF+CsKV9xj?o`}%aS7n{anlmK@!+4xlCO@)yRoFS`oO;T*penvksH33y{Vde zQMm`ZG<{i4mQx|_j@AO#b6*jQ2sc-wV+bf}B&iel6M_Qz1;Fznl2)EyugKCJqYmx7*W?OB3UHjs4_u|igz zvdPc@CaH{%=6*(sMCn(H63;(|``L)c*znOgYNf?fwYgVfeMZQ;ktzHk6W+i&= zrcdve|L}NpE#2~XGv7E$=;zJ=sdh`!cD})Npx8CSr+IZEMAMxG<$|Flakr)uL7Y`y zpR)e8WRat4H*3k-iT}#UJ7mj?9zWu)HF@acwmG3~9RZh9B+%s^IdBGz2z5O=$sq+O zGq`GbZ%@md3@t+%><;;?GKvXrR90FKt_#cL<)4;n)$FXb%0dUe`nfqDKJsCOrv)z{ zH*`&7P(r270U5M$rYczYzXP}j+~NfB&A;Xt729)*_S1}aE+i65DEtu6%WJioUf1ff z$mevxSoO8I^qln$sWEkaV=c~uN=mJ%5GV;9aEJ2-o``u4zn=W+4G^RV{^HXtEsUkl zyh0=7Dp^OdgAhS5l$WBe4G~x~+tLmG#!?{Qa=dJMFzR%+*5(gUTP}dE9C;6UfU&sW zF!yn?(ok1BVBU||AbI-k-fHLuliUszINK0Tfi==j$mr^GIe zqfX8rl!iB2-y=or_nd|6FiaVLNn(bAv@qPN~wfkEmo3f z5Oj2R(Ts&w!z%VcQKu?Us0nYPsXeGCF0VB*IY`7>k2F?v{w(+g&qR~6aK?;5s4cDh z?3G=QVuB%ogZyd@5LV%>Ci_%v2d46~+>juNVK>90(eo8?r<6vgl&nwJ=-ny>@u3xc`#A+82{Elu*=pN z)EW9pMB#cXw*#v9Tpzdxt5uMmcssd*6tFQto+tju#4n(u_?_NV6O>aJfN}l_iQ>?0 zh5C%odrxKQsezzx-pg3t2S!%=CJ4nM|N4%q0`b6CC|gb~pqJX-)f2k)3f&b2Nj8dJ zBfs+Xb71hdTH%72OkG!!cE;Q-NwaXYNWU;JKr_rwmTL=%4SYh z25C`O{!T37Ibw#9D>pu8H2y>C`>Z-JVzxzDw50-KWeMMR?LK#zCKm3!wRrvQvag1wP`D5(fp zX~AawoiY>cDvjF^(PCHcJyv%x4)$Yc0-3E*L!o*N4dEs%s6rMy{#D4J1(84&p0w$Y z?@p)QFtvH#kqdW7k5n}^25U?y>pyJeuiW9)eoN;4J~30KBEWMK&IF}j z;ctwXj%XY@PNwRtCjtcrMyjzuq9gt3+Rg0r6MGU(MLW1ovtFCxOqw;;U)?KWUs=_+ zzjR>iade|MMOAlZheyAl&v)2xnX~CAG?%VxR@Py`5pM%~!}?)zWr~K2GPt}I7B2W< zpx#SCgGTh2 zTKgdr7Npk$r0e)V0aX9BpW+HVbJ`p0o>e9sWlqneXXh4UWYN;z@{+7k!s6y9q$d5$ zZrl>J19ns;%`7J(aD9B$V4G8w`(5nI{Q(aR1f;!ocQ4`ef9$a%En|UcQV$U1A|2+_ zMgG1~*q-k2Vag0qafoOlVd$d8qKKQcRuFDiTRWveJjTlk>e~)K{Ns8VkOr6h(HR(I z7k)5^fiKnjxNr|n^H5!A!nfR;&}Jz7o(M}~0$By;n0r@u&lr3m7{q|$%ShYd!ZUrm z{u&f4G34Cpu^GYovVIAxO)uc`SffVkMfIB|d_-Br>kY1*=cI;Hm1=eq=+nZTV82^% zV$q3kyKF6DD4y6o1gALx*Jgx;_MU}1QqO*$ghLz%1A|BS<*k_OKLA{xzC9M>1%Wpv z?iF7L|3A@bwd=ICpCB6898 zQ^9n~K@_D^5I3vPPUAj}3re0`7!M8aGqrYem@n=+9xi-!R&_DG?R3|PEh_&S;|aV8 z3R6R!t#6AvHRV)9r$8*z-VE(m#b2$Dm^5@R(*acRWQ7dK-c-QAz*IqzyFRu#`Q)k&T3K8@^JoV!+B!+^5Av;WI)Ts$sAJDx$9S3$IIdi zk$z_Dn8>*|;<|J`Ebs9DiBm@&v)Z^~0FiDTzpuJ~h^VbN1k=UG5pJUfzql?oIAsRK&?-qYVJr zDiXG_8B~lPzWE;+X?+;a+*JU`4t66%3Q+y0>p!Tc=Uug7UMFx&kkLYajtO{y z4{pczsMB-BqjLL4AOTz`=<4vmFsL8JR{z8Ef#NtOK#M~$>m=}~{$NjGY=Gv9#B-4! zVnY3MOk}VCq9*IH`YMVD`Ol7`0|A5_y(KHb^=Bu(;sSszLEJ7mC;Fc)1NeUL#MyxgB28pt0*v1#$hFFuP=#ZY91?jlN|gB!~Ig3Il~`&$$9KUjlu)cg46O4TvC){(oV8Jvrb*w9Lh8c#_%I)#7$})X5qx)5u zHMdqo9mK~CtGPNIa zo)YgY4`sn0;NdLSni0LW$YZvTT1U;oXAH9daw;mxd?EL|g|F_EF=DJ}2^fgp_P#Mrj>OZ)*gy`-h-Fmh<3@g9O+57^sl#5zO*QG|g+=zBa=Olr)pG8$v{&=qnveqHm z&2)FSpg4yp6NWpN8DQbg+P;dMPcth8V$TfBNm%9S-brGq?x?wK&r9Y~rrU;1t6P!V z?kU7~YtaozYGW^5=k(|{Sdk}__s?-I;}?O<*HLO46BEt^#<`XND|Wm;;;B<-J)V_2 z0C(6^$hZ2eo;os|gf`{KmT9u2rKpnN0O$Ee?sdBZVii+@D{nR45@5UN&r!9{^`4>^vxzQUmqad4LC zEjK-nuCaK%*}~5>T+u>{OudBMTbjx|aKHM+(J^m|8SAxmC*$5GEO2*L6*b5BcEmMF zHmyPY*?K_=KsuQ#?~$|8gD;H+^$@>tS|DU{t9fROE;n7bmvV1FGP}F@U1g%u?v@pK zihG=0z)B7Xge`HhWT$v1IjZ*Du4T`B-^@ad4Z9N5XA3(eYA9S7V?SXoYmg;)cf7Rf z;k+UAUFmuWQZq%&hopRU&x^nid95*CV`^Z$I{gmAq?Vr|%Iu*an zP8WSVoT|rZyZM)P6OmDq%?pARd+g#+^RX#?oBaeB8?3ClD~j%or6{>x{-1t?0{2PM z|Kmw;dV8x7sp40g`I44t3^7X{hR%2V3^h65R(jXRYqCx-kNdHo`q}$+lQ++L@E=ve z?SE7WW$M;J6bTEa?Plq03UzSrX!vZ>3ZZ>i_E&{OFr5k?DWb=?qzO@(18_^a$ zc%CaL1)gVezaz}ZXzojia$HwcHMl!@54DMaOF?R)7eyYeEB*aQE)QH}!R9|~mD)JO zZES+`B!l2|0@*JY>MOaS#{OMHTjek2=jJHRI{kCHPSdNLj(xC?cH3*lI2QV*$klk6 zpYbI&ZFjMB+6|>dlaE2N?h$gGFsFMy8{XMUrb4fj3{1{Yc6=3I-6q^$FFb6$$Ph#} z7?WA^MW?9a$5rNQkrGO>VIRz=^Ixfy$bYqMHoJAth52OuA0}ISF?$Oz)UC#D-XpcL z(vm$O0&IRq&`NA+)zu;y|5vnPXQpe%5<-y{&^kB?erZ|sS}NeET!6Wzw6W&PtzObM zrf@D!ywFaVjwM&ph}%x5^@zoP^XS`D?LCB8`&2(@QPf=yoeMFY|AI2B80Ko`0F+6s z&YaGv(`cV<;M=;YvkvDM-!^TPne?+3NK%;(1zCmKB%55CEtEo6ACDqTT}`J?=6>xt zi9WA^g!x6 zq}%frrt`z;ilm7rjyn&3%^AWCOZD-hd;fvcx{ZGD*w2@qE&k2-z&xu)Pc;L}&z|*| z+ek#A5V@McbowGb&XkT)E53+n2g(eoiQ>YPqE8;T=LSSr3g{Bb>-kAJ{u6IDhQ^K@ zwo1-FNGR3$POOg0G-yhT|Axr=i|>k~p3ko$*HS_cR0WUP*r^ho$kHYFtd)dfg}wOV zMgF3vWy#AM(y(AIOuBl>jM1c?SraXf)AcyxwUrW&Sc9obb6UK`qIa61X=4B%Re8NU z=?nL6-C~}lOfGevIWG)S&8)p#f_nIsm!HvKiq2FfDzdH!(w6F@*gb{py-?2*$toHm zQgLA9%|nGFVJZ)?IH4v>7E!9^s8{W>%$6(r4+Ill@BL$HRK%IHig768)rX$JAPtEg zAAyQOwU%bZ;!>Ta0?d+ik+X3$FU}aCbsZ?_lBQt0dg3U zVHcwp4UAba)GDM`+2hjCcCQ2^^foZJdV zJy50G{~6C;-9;nsJ%*Muc8z2$6CT)mS(v{`b(7`-VAuJP_!OFAPXPd#if&0y%Q%r< zfcQYZW@s>0LbiNHAkBbLR7$766V4^S6VB_LNPwteoP7{U1YtuI0H>G&nSM~}`RyJT zH)9x$-3-$G?D9OT<0^>jtwQEPUgg|=x<@JM1;%}?jqnS#SfEhbYXJej@s<4;&dtGT zl~{j%AF)tgMz(wv1$Ais*Nf$DY^hD?jCoeD=aEHr2*%h@Qg8N~+C#a!f8bpAsXr4u zwzzfH>n#)P_aW~$+MTnq4v6f1EY24`1C;0dITWAN=FNT!7gV-(Yu_&9kEl1GB-l@V zic4yII2nW5%J@5ie04WOLj7NK)O(dbgVJm!to3a-(r0q1{kdpxc1f|tVv*8o*V9TFMT~qXf@OI4o|C5xwS}vq(k*oES)2r5)T)SCgFmUter&n%87^kF5}K&|uERas6lYyOj9VU=L|%N^ zRE>-!taDs-|aV>hEmu`LEh#q22;}{OJPWDNvh@)P^OT?^y`d#8+yO5Y0=d zYh92U0^!dulY12`%NE@Z=3&`KXm^ml2bf#gmbAlX23bL>Fke_@caeX#56+m~L`}r8 zV1~w;Tz)N)!%^qxM1%E0t$O%y_0vzC{tGzsaC{={(rfgPZHFm7@ctqoPPwWcFJZg- zZuZBF%Cn>U#xzE6uie|U3WH*`7k?el_Y{7NIQfj@;?Sm6!L^5Og`^bHfv}xaZTzDF6VbW6x*Lnd* zc_VOX=!2A*wg@*mw_;M0Hq!eb$t42u{~-mSBykEFK#!dByYQvLFK{q}vt zQSRd4&7@p=7K!USJ{Y26)3_*xYnR?68na#>u!3$wj)At9v#I3zGLSOkB2!OPAL!|( z15IEt(3E##X|@GBVh_T67i*Yn zb{rOGj5p}M6lK`_am~BKlS4U!g@(}fIXszhM3vLPdiDLcK0Ec0+>Wn^JaFN;s7pb! z2Evw~-QeP(y6phb`RsNhqYm3~R|)jYD8NNs%^wFZ&gst!+=6*gR~!P^*DW{}_Hqzut7Ii~cfH*V( zX*^8FX)>nT#v4OOzg+wj+P>97pC1-Pa?6aUBVd6?vX{}OgF+B`KF*l>ZGceWXr%3B z-FHy6?lNs~FCj1E0|WVCMV2*OvvLxeUVn3P1wbohM%#BLjNtY5dUMXg)z(lIAI3Vi z%#{jCEWYTQ%HViM7sV8(`b+CkeI}@0lqGTaiySfACVS=r0WnkX3{j^)S}6SDNB4oI z!VecnrxMV?a;hEkwiNo)cz!;lDD3rk*6cr<{W2nSt8EIeS_-l$;55((nPf^70)feJ zPR>!LDvQcnAC7&tQhn7ql{5zU9vDe%7;6SBrXER%?w@d8BBPuppMj_BB@O!|MdVvh z_w%QrPirxl$)ZjmC6ih$^EwjtPOQ09=;i2Fh%hGjs+3Bx*mljMFJ%H=Fi`{@+tk}9 z#_L?~62#^o+uBV@LFLq)>&C@OJ1*5z8;CRETiJXi4SeO5q(tb}@)v#VVPon#VwbA~ z2Dce7S4a`ByN&!`kf(ipz-t^>)Oupv@jOLUX`WK2q;12hHy>x-`}-C4mDBZ&O;6Pa z071yNl9$G{*oN`%y1}JIPoyPo-2Vt93%414S8lLlid(7a1Y<1vhK!I9YoH5a?hy8GxR6O zb#O$rpwwS_=W;!-pd&ZD=W!^ZAvgYsZTbD`kM4-p_N<*D*NYrkoALIV14}If?hUcP z?Am8t4^t>phugj z34VabF8iB+8PKygRMQo4rpVxQL6Ct@A>CmbeEpbGtES~%6bIieU?;Nfv7L!4`h*|_ z`G;7wx5Y!Wibtf^^5aU5ire@U&rLzAKfW7IVl>Io8DYEb|FT+WRa&}IlL%5n`Eu}Q zJN|uAh-0x!$=pMHY#$}UCfwT9VaNjECi{@Hm-d%?uc?hGF*=aS}` zbw+}z{a;u2rJWg7r`3=bWtYEqqxJaa2UF zFI0R>=V=DwK#cau5gCE`@htVg96#;7+Uf+n4$>8l<*z7;jt8 z;JqrTM^!tW)6kdGMLgEi4{$-)olWAJ)_FBzyF6e%*0?3e zxuuXh&*+%$Jxk3fuFriy1tOsW$0+IIK7B;b^lN7gCBET1E6=n14&GY(DydXsQ93Nr zfBSloVbGhcoxPhui{l$Qv*(Oa)E^fkd#xl~=Ypmu%&g@|)(cvEV^hc7l=kO%@puARt(PU{ zgsK!v@0*|VqQ{#b3i!U9HoJFWYxE+&cbo@J7CVekzmZLf0W!(Xr_2^J? z9c4*a3&q8wG%k~?r!}QR=3Hf?w9D3jiex%zOAAUl9YlVG%-y%5tMw;i)%R6K{f=Th z^)6INdEa_zig^&`u+)44B1ew8(gn-*rlMc$o{7^kMY(T!92 z7DiHV+iEv+jP`B2SDDfq=b18l6I>9>FB>Wy&Poc(#)oy7C zJa)SUJQ95;1t9LhskOFEurOsF7=~MsL}zk~w$iW-h9LOrig$3`a8lMI!vgu49_g9N zWzJap*mIIHZw%iLU`@+VOSSq*S*Y*J>*=ionFEayH~9seO%{u;f>}ce5O6*b5!0MPI{-jgoHLI z*G8i$G+|1g(;GFNN8VPZa!p(e7Og=D{UK(UH(r5p8XH3^e2+?$iA+j5x!y09Kcy5^ zSlw$XluR8@FLIAcpn#l7((_sBB4 z&7(Qq{o)u%prB}Zvj0m2lbWA6DmCxU`qv5Dug8bY4JY%l@u|XPz&^cYeHeRY^h=CV ze&fagf*kR2>865na&7ND^G&uyp{!A)=P4oH)e)#VhEMG+pJ*#fQM?Ps@)xwTgHWe| zLRPPJI7#!q9pjm0p?#gx`>rXb#l8(?rc#~Ul)G@X0{L$`dt<)b5m+i;nt}foUkc&% z{N+KgMNlQ^vFAtQU4@ju6JTJc>|2fOhnKRbUrdY#dNIUCkkJaL# z{9Ab4@qC$0!FAMaI_vv;-Ul??n9GWo(+gZVOB3Ik{cHv$%D?_1Y?(e#|9B%#JKuW$ zi3hisRmjyI0cg3`EUp&jorrzX!VyBkF3Ty58!WV0Et>AjzmSK@0PBDC^)s+MjtWzy zB+q*dVv_G=G#wW2ni~pamgmh_t+u{;+j8#C*175DA&)-fcfr7oz&m)@9)Qq;M)z}P zo=-%Es6?pA4Qi!&3Y-3_%g@+x_n3WusfG|`cOr>SyHQ$+-5SLnG*{_6%XngbYXqIU z>UsZ2=0qHiAU&V>bH#PbEqBzbO^>Rl{1Vc@la-)Ld#2JHdVf5#K{2TH#-voT&iG#E z&U(2_QbCyGdI@JAUGsWpUZ!xFjxc#5`1m3ZznH|E?O82Otu4c5*{3RjlUBXBToUd8 z?G84c=)^P6SZK@s&SZLoI@P_Gz5*g-E!d8RRy+uqhhCxVg#_I>dJWK?QTo0?$J&J-+vkRj;W@V* zjD%GXpNc>l9{bnn=GD^Tk7cc>QjzcE(pkk-2A++g1tM-&C0J}8ST|=%!(-;7Emsf< zAuJ9a?)Q(JBVLaw92I2(S`f!O+}acH@vv?luvm!rayV9;x(+aB5LbaIKW~ilI|M+d zA%|++*kbD^8X$(UI)XpTunNyc`ctnJs5k1!P?y$jGD0Wn3*$G-qp@XvyqYdJ2jEUh-^A;s5B)@z{rIqi!= zU>0Q|pM&lgC4so|aQd{{#iFdUF-Tl2oY6wKz@14a7O?Yu$pdX-3N!=Hpwr;6oe{bv zS?D2m62NP>Pf*L=qv%$vm;}25tc0bhB9kRQKxEVd>6CS(>slE^UTQLhIN)`q75sg- zGf=8{v|EXi3CPVxC{(k&3SCE4rS8B|C8ACIvc^lTTMOf~_ecb)<|;tctpBN)1lU{s z1Ts>{WKqv>+PVs1iVz11PWTb_AI?1XiFC%R0%6{a3<&hVNsi|~AK18v72rQWxun+u zz2Q2ENAv`Fn9}tJ88_{BaD$|nAu0qD6G>Psw2!lmhSh$12X}<3eC3@hp;JC%Yw!9d zX(>l{%dSfBi_RaoBXxYPmHaBf&1M0O+tl>MCU9R%0>!~41JH#JW5iE#4W=XIe$IjS zgiwJ{>(<;wFb_~7YEkKN1U{}8vl6^@5k4>#+0R=2VU}b5iZFw!ZFPJKBkI0x_^@8S zBg3~yID4meEW7n9c&5rl(v%s@=6e8!$Bw^sGcy*1{lS@9wzc zNpa}kkHsbdo`58WM%Vq>D};|K+MSKOCw4gn3QPDDQMefOt}E!%KZKa@SPN7ABy0aj8{^trd^0@Yhh6WGnbPH#PcG(s&9&QkSO9z27@sn;sQYaqx*o$B zn0hTE6{oz#f&tHwC|F_ztQ-G=BZS$r=03Q>y{CKEq!Y2j9)v#|xA{}wL-qm%#!lK~ zZ>fc_33q3_FI`5dZuKb$N#{D1gJ(Fxvjx|t5gCj?`qn{%>}ymMLYE=(UafkDTSgRXOcJTc{{NioD>Cs$>Cd<4DJ2-qdU8=xcau+ zjb9x^G@#}Pc`%rp`FbGGMN1M$DU#S&`xzUx7o|>FQHmvgs!-BS+XvpG3>-n{9#`k=Ri?CbNkW3iiizMI zgNraEAq)~p;7fy~Fsuc-|H>TNX!|A;BRXf`m=gEdqER=p;!L$r_;no3)hyK%&QUC+ z+E!9o(P>XSDXlx#myk_{j500{U^TpKE;|2nLFcNDLu3ok`Z(uxWluC|MboLLn7%+G z1QH2NFv1QUWdh}*pYdD-Jg9(eeaLm&=H4L0dfUgWsQc`$X3LW66s1oe(BBX@j@Odix$=8nmDU(ux=v(q6} z@Waivu-fi|_osXkg}4zJV~yA_Xm~?{1!yJ~(|zjTK5cmKeZ2-1jm-8}#fG7qyI(+PV_DP0O80-v zJ@MSW-#+`fQ*%2<;vXa6Hei z={MTahTN{H!qBnVCJRlH^N04lc*K14Ng?Xnmss5eWAOmnM?+nHL!lUGV7BQHS@W-o z5=d+kGhhPd^i8i-SG-vmoOrT#vnN?G2I9Re6af=g1QT3+_0Kw#=8j;ajMZ!?Lr0D> z?A9g4e$5b1i4)I5x#Y&dzLIpqrJ52)KJyZ;I7X-ZHZivG#%%C3hV_rUS??u<8r$2C zwNQgf&=epe26T!GR41~F=DerXZb%!?saYca(XsQcS5~DcK|Vw$)wGsce|&f4p2Kee z?Fb#5Nqq`a2<=@#+exA`#Tu%%gz`9xZRz17oXB$pYs{v%g}8F2?>ip4AZB5ZgE1TV3KDhgK~HiAKdXrpD^DzHB*cKaDC*&IqhA_dHVg|8<1sRnUn50aIjC$d3R_1lFtTgwj| zf^H)1+-bLLI#j9~9cR=>G6`cr&~ev<+>-Cy6oWI;b-XIFTfO?4yji868g+y0PWa}7 z!PRuB8tj{68y#y|Yr-J3AgO)%>ltoT%V0)$>|Of$Sp7Bs`hgHej^pi($YEAGhrlEEtArXU#(>**X` ztBoGKSt)Dz=cBrFy!lo0<{FDBa7p5$-ey9;lpi!lIdKt5h2U#Ha4*}}lDbBycZRxs zp>#saK&|J-1|y${NU{mJ?Eq(YVzmzHacN@!%r-FQ$NEa?=x$`CT_o5^xA*hF%_mz6 z-0L3<%S^<&dTijUO)&L2PfGIjIk05O1WWw`osOiv2AbA;`1hg&VX9=@aXWjwnEvO# zf`mN3RQwEVE6vL12-_VT^N$q_^$-oRB^7k*vG=Y<@BrQmPF3^@=Gs+1&rg9UMcy2x z5qYibKpdY~6yUss; zKf4K`m~O;kxQ3RE)%`0*rb=6c{qKJ_P8HcR*;jK8%!qKUH0a&TUWBU_~@xt%9b>c^K;xC~)77_>SG0X~;~x1`2`pQ)B(E1CS=_(_`~(iK55w9K z0^xElp;+_l=FJ_7$w|-Q>jzA5jH=<6123!kKBGV#g0^#c`Hm?pr_BR@nSkDU2XK6e z5PoTQ1h^I{@UHUJ`h(O5(3i>*(oc^$AJh$!A*uqQSlZ{|*s`kPqFSpV7?@`pAsKkU zg1T8?7$*}K;|9i7*xq}^?>T=jV(U981mS?Cs!Gqb>IvJzCwGTrb9XCTpoN+CE_-C| zbYsZMSI{q=M2hL@Q*39lcm;DbYUDXx;O{1P%9Xdvl_r(&uKDYT9 zO#KE?)rTtJ5_w9I>&BKL#q#o7qF9XLc=3imNR+>j^h1LR)qv$%Je>TOk22v3bb>Y{ z9ate38Wo*aNHLmsb$*Mbiry-S7U9d?*uxcWI1?5>`j?n`V}x*cN4x)A zuqX%{P3Ub0j2S9%<(92RNR%a%YLII&KmXk;8%$6cx8OUqo^kUq)z|KY7)4O`GhrFN zmq;FxA8)+?r-T?a?7tz@VR${Pwc?V~>HxK8k-qnDy!qz}(+7MH(74JB{YQJr9Td2h ztw{;Xw4@P$W_jCA{5iWMhiXOtFK&EIp1fl2@Gm*`PFS-M zRVaNRr?~wy#*k4k29er1MCaGzz4gLT=Kj$c|B_?u@b%Pqs)0Bq8heF5zZ^cc-R2%6 z|K*aMBb!OLmP=|@&sWOzoGcfXrB3Gq84rDlq|S29gm zdXm#}xb}Sh3}-v>;~a;su(ip4t8hZuBY|gu-OlobY4KwCccai!I6-R5PFKrqsZ1nacF~j6*+`D8Xb_Nrt@$0l^(0 zAuOOg5wGp|c!#1<@$sEi_}tnT(e%~UD#nY)Sl8f6cFzk;PCS=R!^^a^5ktu5GZ?^k zpy-9`vz;;#zy7p;nY>2;Qo;vIh_>mr*vn8&7qMAp`Uh_)w{q~&<>EScS0w2FG;Mpk z+L1@wWPbN6&@m9J1?tuT4m{t+cmL!shGlb}fGshovcCntJ^u)PRRO_oM{LHSLmaOcycdHrdal$#ew%iioxk;R zvxvF&FP_X}(}Bc}4TrA6ucSimk`{%~xHgOR66NJ~Br^=W^6<-iCG$WiJ^N=I|bT{G=m$;}yzWsx$`F6rU|76w`{+RQp9TjQ`6 z8op0S<{s-EES@##|Jt7^ostnAmhhF5SyOfDl@=2({d-mTc`NKie^_b&Xm4xoKWq;r zJEpqf-RIn5T<(4DJK#JKSy${qnwYc`Qsyz6*tYVZ+&jbiIMW#IZlZQervp_beN~H( z50$2eR%_D1bi`$Lk9~G^u%wLJ%Uphx=;pQ_!FU>Mw`CnJkTm$i%iJ=d&Mm@2%pR+=b#1E{v2{F8?0yI`@b|tF8Yrj}N*vT;23B;A||Rw<3ZQh>^;;*)NIJ6sjqE zSsHyhP2piKdaMd~5>KWpX^9Z`*!{sU-|R)-aTZaF=jLu;Nk_aVG@e`KBOCFs2?juR zlhFSSvXAz@_^byRQvV>-6v&7mu;6v@~9Q2lsD%w+yvghI2D z$Sc25NG7pc)SEZe`4>liDGo?0MCX7|q9KJ64=Aa8uh5Er+SaKPCEuTGh`0+5MSx$) zIUT}Re0Z{Tf7}vpq!*)nth9`%wB_!X>>zV~C$N7KaAIHQ46Jbc8t<+jXMg_3=|q8N z()z_T(7aQJbwK&?imb6$k~HTuyJqk9YG|_J^!5d118g~WfFs>iL59etZ8{WUs-U&&6*A*F3M1@#U`LlDV+L3ccc%AcIHaoS`JHu&7)!A0AWO`p94M&Z^4S z1UH&B2Mx}03SF;ilv{dRg_ARtnXYpT!Q!Wn$pu}#1J|4;$*eNKQE4~BqwFpOdh49Q z4e3^EX&;;o=uNc^;qghQ0k%)LgxBdZRnKzy^0hFJ$8kF%{fb6gBJhjaP_r*?g2ER! zL37hZIW;2i9&Nv6rg~O!35V8K=(BtCJ+f^#F%^}3mAEBd-64Up2l1I*_ZUk8Sj%sw zZt}jb7+s)YcOu)r(dU;Dw^#3T_z=_ft zl+ZP*XMP0t;|L<*ez4JQ{#ja6l-#8H-@NU^G@~aUE2eJ@oK6&u`7`DL9*&S8peCYA73EpftlhXA3$5FHFD5f z`Y~K{?Q>%V;ZV`#nop7C5i^VokOdgh866-skFC*Z=->LVi|TSuRA$TpLeQG)u^)%Q9K-)z_uUN>M5c^pJ~?N=$qV;up@15VgG_qQ!x;`#}OkG!HWK<944 zCTPN|>h%`X+9Xgd%@9TuHZ9s7e zi(vQ$k>@VkA=pIHT>I=EFBd+`hvX)lN3pI@Ej(gtXE@3KL!O*n@y^0SAiN>2T-1CJS_}5ri&?=qPzo_V?+#Fm zL#m>Z0EMYMV;^fhoOPK?Id$#Lgr$4bqS#HM{wF|*lD*_{D39UZwFuLbq$H-5oEZuty=7AY*>WxzP(fH`W5O^9}7H< zWXW9Py7UvcNuuIlb{oNoi;SD^aM=Ug!>-?1q_G9*bBoavs9Av%&bv0+OE9;VVq(Pc=?$!A&z$lLi&=Kq|8R_r4ZuKd#o@Jxqs0C$6{K_FB`1lH!8 z9$!>q)e1qRSLiOycEs_FC%*0WS5tN8R7bN^#%>+#6C1}J zlE&}@chr%52a6RAlE>8ay?bgCJLl{zE#eus7*QweKg){ahI`e)zRivSh7b&S#06?H zacDgT!+yE@;I?Y>Q+5@f@|5+{qw>>~r`Ng2z9XxzW6aQetZi3lN_&eL2xH0M7q`s} ziB)SmaI*N|a%bPD{MDS%7=#06I~9=_+(mo-es?C_>Got`q*>!n&nvGrHnU6Y`6RD~ ztVzSez?x9Dv?O0X+P5O@`W#u2wLo?Zyl%iG{I6tO^_50NkMLkp)lR`k^1F+IF0MtI z@&_{nP@)>KB7qMmxVfbp^7)Z_5^lr=NjxJhYmo1 zBLwz29A*u^okZaH-GEH}d`_}wt%5$|L%9%itB?@9XQZXn)I@Mh=DRnDZ!K9~(;4%V z=#A6sbj`my%*}Rl*vV&ILH^H@jRr!z56o zp+U{yX#Kpyof4s-r^MlQDt>M7y&Xa_6x*da`n|{1f|nryMI(KeI>$5=5=yHP|LLcf zN|}7Pp3@W*Qeu-~S`S@U9E%&b{!c)8aC_BlJ&-q-K?e7?@pOnTpbP7bb$ zmN=RL zW?{&o#@V0byRYotSJ|>zny3R0$Hvo0%_dfUhY$UXY%?6(s zjw_wyug0w!Eew<@*u$E>ObYf;Z{AJ^-$(?5G?a#(z2OqmA!JeX-B6*@VhV?mPt`$B<9vMa=SWwg zGiU>H90;zIB1Bn*-JrgmWInMpTBhz|Cyt-bx8R9CAq)MJ%@_?NY7?{=h9$pi?Af)_ z7*hrUsu^;@D=(2{`FJJ`m#N~_U5!(RRT~_H zz6kYu60~58K-2bCtup!t*E_-zk{#z)Z^jv_)CTbRArDzYS z?0FQEF9Ym%NAr{i6TcTPKhL&Ywz(cJA3YD?Lb5Zjd?dQoh`(c){@=9muSTI#28 zCl_4r{?~=0smgvV3<3Qt|5FZ!6iV~qDRmn$%~nS3c0N8Fph3A1Ny3w;YHa{r!d8&e zEsoLuvcHUa7jyZcc<0dee)tNk0AbbrWzCe+d&qr_$sW1iCq6PkO24u2j6YS$aOFBl za!;p)wU>>78i-*GQr1Aq#f!vif*7-;!z8p8e$Zh{^WOdgJ$m%ePP?i?!^(xB zIFi_uhsK78S(?X3i?wZ~S+*5!1HS1!9lXa7ZQGk0Y{M^*-0yBboCE+!&$W4d+$&pI zh89D_L>Z#k!pPgM{8%AEKj6hPb~g(+T@0i8l4vxQkC5IHYD|AuMub?16GcxTIvYFR zPfeNy0{X`jk&pZnYvwFFI6_U{TXaH-5V)2{J*Iglh>a=DbkT=|n$>fy`>VbX311t{ z)1g9_-76UjOt*Vjnv*Q42FJt-cM5kUM2BMPSxEZB?6FrKxsb&kI2RF5Lb{^*CN%gn z3S5>61EX`Uo-AYH@OH{4C@`m*@T@r{`?8MZs}Jt-l6>>JX`$24ZxkcKEDs|rHScrX z=I8YBil7@a@^lV{v?W&Nta|6Smj*@(>IAGEY>BtKFD4lpkFiL?Rx$&9*be0?wUpLJ z_s@-neV041-e6V>>r@chXc;`zzMg(-j2-YPQWCC_O^UC97i!BH$qr+t3b}hbU;Cav zp5Xq7v-oW-W>xh5tn>C8iscj>77ZVCl^yv$4@U?CxtA* zuKt2m6>7bjljk~yOf_4Wp4?IMFq^dEe$sF2y_zYj$-q6S5ht-lIC;kWlx3cy_M4v< z)cK@nZwY#q&>Im^b(iQc!eM;Zpv~@jCta;d-SL_{;B0h>nC|=J) zIUhXG%FD?;T+kO$`9zM69`DHM%}7}Cw;P7uROID;wUi&`4SZ*ueTC5e6mFv7Oo}uH zb!m8v`(J1|cNnKQwo)Dq}P*1pC&|{4Q+(jA7^SIRg8NT_a5Lh=K$_!X0^keqNw{K} zQ9Q>sxwo|SUeK&5b`7E-)u(m5Ip*k=^Z$ka1NqZ zFZ$#>a3C>#>pqGWq~cgStxbX$_6ZF2msIch3;qMXEGACkOg^r0m2EFPy>umQr|T|t zAP8%-(kN(`fVR5ghFYSePLfHZg_ddcA7Bo9iE0p}7q&UQ2?S(Gh_1pA{}<#P{$J!h zZx$%MrG9qy8%jTHLTx8)k``RstsIfukOLoDpCO)cD+!E_o8p_VdVp5s3#5WzxocEP!@P3O|3rU&|LMY zI9gIKBF7e8=8^twZd>U*C#YQB#UDE8>4?SpZ%A{Q7Tf=MybXZyDQFz>pXOo}e}L^X zi0W?rsk%^Mz6ay~$5#cgqTgo7{|n=vYhc4p`h__yECiS*UE)7Ma5j}%@oMdt<7uqE z<3`7au6>snZ4=M4>(&{88tDOLlpkn}ue79-eZZdorI!NTZxIwZKnEOH`5`C$vWqls z;9A+zXZ1%KW8HBfx;4RF?a{Z7R{Rape@auXO-OFB`>mw?9os6QY+wi-IR@s(y{ zls`zoh^(A8;*w>?MiCj&;#EJRONT#APaIj@zeYr=W9JHa$7DmB{j-S7^m6Q9b5Pff zztZtJhN}#n679k%&J(c3mO67E*uK7{J+=V7)2_BwKBl$a=^n;7(W`S#8@sDaQ|Qc4 z8_($jXZDdjp~;|(AU94GaO#}g^*O0LA4c7(v3?$0$M6TZS3ZueQ#)JAE-?T0GG-%1 zQ+U3JQME7~ww$w3{G-kjdUqWZc6^aAue?(lLw@x2wXnNo;JOAH8{0Vgt04E@A|$|K3O!SYUk7TxXnPQ8i_gNJ4P_) zCBj)+T-N?w%G~-j446@T(J}YsaUt#!U$I`PLO1YWW3==7Im;a9c%8*Ql~#i{N80lH zYwPYm^t=|J=krBxfxZ2ufRj%*qBSZN&XojVkVhOPj!t{GCnPL>&KVel;gI(_#x+mE z?Bmq`N|+*%%RO-gZv0Ai4ONV7u2!c6L&}h{T(CC1>jUJh(#Y zfV-GI^59%-i3SdM6=g;0li(14F-Xe{i)b8D$#*pz<-r_zt}bIfQl0BCZ^#{t1k`E2dJnceQXZU^ z@>?xB-?!@0cJ`1t0V4shED`+xN5H@Kz1f+NcpkYT_bjz`p3l&~#cWp=`HH8)8452> zNnekL;ju^*pG17oIh)3l^V68Ryw2?f$k9vD!5ko(}nkN=^5xeqOE2Z2ks8-sXU({cb z&<72wy-+i}hU1|;6mdWH$VleNQ{2_&`6@hS`6+jwfI(gJx#_2z6v3}xs#){~WK|h; z&Qr1y24jGrcNo`sa+)x9WXNRhOqLC$!~1~7`YSy`iMdM{tfizjg0-&Y0W(|N{9-~? z&x7V`z`T0l=iJG#4Pww~)V)5wKFy=rHSI#Cv{!%ho`8YV0-y1TvXX9B?;tFO)8HGS zm~fF{0dArYfS^~uW6L_!^izIFw0KkZ^|Ye+bmtqSw0=pc)RUp(p)s&lAJnuYJO%d&5luzL)s?e!RlLo-x2q`;9wC&7=EnI0ISZ5?H*&&`SeHEa-%Yi zat1ls$PI*Ud6PpOe$4lNb>df4Mi%^N&{Cmr=P?SXI&0~Y`~^a zx~H(~mGRr@GHm8ctGHxW*7Cy;STbmF)zxzlyuAKC=^!h^1b}q7=~^z(aP<86P)pNt zEZosxA_MM|Xa)8_W9zFuc>aP}`zj#*&nVTTdl+TBy(Yy4K>V3c)<-G^PA}DMRcj~RP z4eAhow;NLS;x$@r+sv%_|5zu{Jn-j|)wU}OHpxB{O3sa@5+SjpSMo<&DepKLDN;^~ zzp3#9);?u`s7pCPPUPZq(HZrObh6kJcvRw%g0DiB(mj8tEy+2Aw5bvJ6;$o;m$-ra+GVWFCi*8s8*RD6j$8Xwd zd!ljM@R?y=23$Rz_)kWZVM-6Dnokyp3k3l!F#Cz*(~+ZhWyW18?)q;EFmM}DSPJH+ zGX@NuS=C)Lzt}_Yn}l^VlLt)bJ@+w4Y-}0}oTqSpin64GvqUT*k}!!uC@ogN1QhzAxV=43DCA<7v1HKOUN7_OcAu4+*NYYMCp{86R5tcNxZ0aZ!{`=kkU0e^P$OO2MA(k z%D+7@Dcqu{~@+@ zRFt+(i~aPd>rWUI_pWvlY_Bb+>C8{-_2bHXyQ`SBd6T)_rC)uKY(+1tgrJWa@GLT< zm(&Vs>#sT`>`U*UW_vc{!TAkkLQF>xDfHZ3Y+lCX{K$?JPWfuzl8sQkf$fYcCIlgf zQeGH)Bw@c+QuE5t(03z|`dBh4T5?x1h0aG~cjVCy(JSO+JVMb0C@4`FlZ+ifSNx*` z-DLT^w+W<<>$9yoZe_DS93puSHqfhrK=&3=Ydwe=wPz~#V4g7>b$szMfKpH$Nv!qJ z*tef0o}{sRxjLdm?*Q&fLZKPc&tck^3!T4QuL@GvmG<^K%tq`tuUOgIc6$3-1#P9j z=~m`EptrQ^ND;K1rvUNhIdnSnT=V2T`+9eLv~_(OftRL#FZsc$QNSnKe#ylDg|dRG zZnU}4oX@U804)6sj9$@B)nNdM|V}^ncPUd{mT{sOlx0-;io?zXmQ9gV$ z{4ziBu6)O-4s;rjNA4?Z$<)zVT>8BJN}tdL{F(AQwpXdogFBC$Nn)fLAU5wNSIwGQ zkU_Ho8SH7~8n?$8O^^<76Dja0Z@Z7xY?7wV$U5ORn@e~h_hi*f6nI5%0jg~6VXj!2 zkHd!X_3(Ip<4~P<^QGFzc8tgv9r>sw8h3^+?PZiU<3i%RN-jZV$#2%`qbkg;WD~0* zn6Du4Enfa*RC|Y`h3cZ3cm|6TKUmUPbNWA*S{l~2vw%=^5<^bJqWEyxH2fz>5FCAa z9)1fc?MbF7mrahxYagQ7*I+3E7-=5=0`1P^K0My{a0y!rQLI!?ZnwC!>XZENuL+k< zkg*=^ zn|+YMQ5QKhOMT*pX36VU5hbqX1dn2w5e}#^P&O-Iy}|Xm8CEhVa1@sZZ`4fc)IXrG zgRt6dtd=uPc6zyTeOz?EH0)l&(YD>IwB7NXR%9(`jZ=lL&D7i>%pj!&C1ivH18^Kl z%iFGwrXuxtSbLZZW8!p*JC|^|AEuklTz$6syOzrUHSdxQ(V0qB8n$|~Y&CtcLNJfX z33D-iU>%0FW{KEU<%ZDs`rh1!cp3W7$%AZj^QfVU09?(L%fVL&WBZ3Hehe7k86YTR z6EE3PK<7Q)ze%+pZT*0bPShEphnqPp%Eujgk!n?SI^F3Zh0!+^+Gx>Mz;iDhgRxOs zU_K`u5nF^~F9n28xnK0f&tcBFY3lOCZ|_}1O-#ZLM||?5R|xbwL)kO_I;EfdR(hTXCM0W&yD4(*ob-^ox`hw?D>?izWd+!VlLfBwK!(Enp{|&^A;y`u7xp}%DYF6-v_Gy zW-N)r*cSYKL6MKYUs4^M_1(9MF%+RM&t~T?#%3SChM3yM0OM_3yPOdU)|#BIXhO|bftby zXCN6VBHXLBU&X|-Ick1|NPrn1?P4JJxRB>8-++P^d|EPvSwO>cpjby7I8piA3q;zEgGu@ZJUV z&}L9S$j(M$; zr02;mm>@i-!^RnKiEX04RGbO^iz8SG>#P6e+>#OFFp0S!As`meGW@AsfSIDmTdRdW z*M_Y=#Qma$13_UCvO(C4(gUeacpKWwO&4dm#t27o8r7f$rmy_N3MmnEo;0I1;15?1 zuaflfXgenjwmn9uS+0fyvH=rrWLE};6d=oLU;fX$x!%==9n`o56i<6qpN4tMc8MRg zGjE_q&HO=@*K}A8*VHG8)#E@nEo+e<2n)Y}(XiTwtUclS_6uHbobbrA$loUE0?sc; z^i8eQk$TMoPesEfw-P|=C{uX6^O_);REfl8Ur@pWlk}kGk^bfBnK1W2 zDn-JjPVk#w)bEQ49Ex5we`k+I2byQr|33Abo_9HDZvaXc_+1u1y=A1G01R1~K@*R+ zZG|;*X5ELC_ljvx8t7$c)rs|MA-5@=?HYSbIpRDnnF9 zP5R}yD#^;P#+e0ctY&BQr*3MQac~-$toXqC*tg(otr8<_z-|NRq}y=j@uv7jSZTmU zHo+ACvnKClBwahm?t!B|!8@5Pl_6s<_pYlBxddH>H$c%recMvtp}|Lvo>y&r5g(Cc zsbatVo8UFxBR@%%^}$Uiw{I4WU-y&dKb{`O6|D8zJw2drL;^UUr9Ni^|T8Zoz@V_(f9WVEwLrZ7ZhJQ zxHN9I3w8N1_ZC?fXApH%{2h+Y2hUc1HPB$uKiq*hO||agW7Y4y3XiLEek$DKX8@Ef z01X!-uO#Zuh-6RRYGhe|EE-v1GZ~T(Rj7I+c&X$Ryxxkyb9l5_0qGZYY5*^a9c%4N z_c+a`HQvt#{_KXHP|(fr$6gd&4XE3mow4H}~tzEqH0_c;6f8#Tt*uZPBR1CG%3dlq+|$l&-> zI#rh7V(G>4sm1KZozRWS=#}S{$<}3Y@AzPartl!3&Z%?*D}*z?)7BRmgN`5K1_WyM zRD1H&1Ao;t#Ir~RyL}SskFhZuV;U*g=6Idw$v}KP_$-+F5nzzsGqceT33m-VQ+u6~ zB=c?!BzVj!AwooFk6TpW8N7XX?^_CH6Q0IKbf!H!;T-lc^Yqv32{a0|5jvX+hu)rW?>21r7Za^~!zyo|@CCQxQS#;gSWd{DmHa zP{5^24#22DK~jn=PhF{J8ur;vT%lYIBiYO#6gsn|@%aMApH_49oep00K}D*wn#z{b zpQu1#)x)2e*sjeSZ_w#JRixWP-PzkO1u!mW%k6>=)dF5;=&zn<|` zqqaKdb19wKMo71`QFSt5hUToa_n`ck)r=IYla-vJeM(m9EzC7YcJW8KBQ={ z^beVY=As^o?HO6fJ-DCAuj^$JiU)!}H-6F@Wz0WP&B2LP2|DghcQF^qAbpl8Q(B!WO0j9S{EZa*-ss?vK)nfSPgJeF18I=Oin z$BB1a--d9x7mdlT_=o_{C4=lA3I`T>@S<3oVZyrQHh-!c^_0BcWeKKvhbxgHunMsdu!zLg13Fg6&RNm6uStwZOUM zN-wglz8#ED0Nw;eVQY+GlZ%q0rlr3|+iAX=H6rMF=^oTCC{N{-LQ1b3| z(cuH#2Kx^Y2Sy(SNC^mft>hO<_bkKR+RpF!pi_C*>pI6K{;Qo_gu`FuU?sl)tsi-t zGaDKQ$86e{o+D%vF_43?e_;9~mPSVZ(O-t7wgBb%7*v<~l9o10pk{wKXX|{jN^xk% zt!b#PtrHZcJRScy&-`=n28y;Gr45i^OeaSM>Npq*&?3+Y%4(u)!%>T$VbsTxPKr0k zcY|=jlNa`v0(i%Ils@EfnD}%k_y`;CG1imZhJp=Lya88|<`ZJf5t$)+O1wXk^`as7 zHZGG?V`!ghVw?iAk_c7F#;QpW*3xE@1My6iEu9`@_3_e=@|C4?R^|}I;dliN&#?oz z&~D3FeRw!O-RFvZzOOm0D3f{hN*3!#-5rz*PX*$cofv1jaOdZttG*O3qxc5hmkF^Z<)GCI?W33JtK6yoE?eX ze!aUO$TsKCqmAs|-!nr>NeiaUto22D@O+r7eK=mW?0HkL+w7$}gW!ic$(o9=0%<_l zA4w@r5b6>rOG*sP0GuvIyUQvt)0<~2!me=q3BEr@f@@0%$RSZ zF6{9*gUL2|GOrVcR~J+kR$G}^-+x)=p3$;=PU@31Z~#b$x*ZUYkK)A3?}fv4y`01K z4Z@xNYF%sAfSV{BmR&`BQA~pORDb&O@MltHGYA_EESp5@)*$;iV-z7i9jvC)=Opch z#VBlH?=oV!3@g}SL5b-xDSy2C357}ItHJjlt1U99NGa>Z7(|o!Sf5!Yd z_%BtsZob76sgIsj%Y_&1Lvh!uwC3ory&hRu#8D$&d1=dY7_nY2=dCX%Y^#&N3Ri$? zq*bz_hph4xg_tEx5c&4&OA6;l3oh#1a0%FjA2Karxl)QDD)`}{-3R>N9L_h`FK@f% zM|w)_^!rrKuuT!{#*m!ay3u2Wf1ZEj6MHC8_nFrOrAJy%{RteNO?t;TzgQ+`X$tSh z*@OusND7rT<{m4!OzPFSddHC=yMI;Sg;r$KCh{X9x#A{{=ptv-*bf9GA_ji`fwagM zcU4AYX13jS`$b zY<pF;Ak?Q;l*-Sw8i|g2M>rf93Hz?mIr880EJQ&jvelmT2G*b-mHQJg}n6B znk3;)$wj{KlRf@wj?0Y|47DZDhL#hej!6y=hxrs!!@8UXdWY#9o=3=FxA%zX;0}~k ztg-5LiRoaBWjH%!LV}H^``#{*xtY@gWBN{Sl%SckjYdggMbaoFh&ku}9g+(df|c35 zizg*NwKT5|k^{wxw|^52Ulsac?My!!5Cg$pRF@ZUmB?-jtMTzN-q|aM6iZjeA_vW*w$M8yaK#H$sSE`065gAtL{S zIaf@pW+bDjE#vxNS8@$2j;{{R;oOFZDRZF@PL6lZ{8TD3zqx{JUl~zQbHH0>`7StE zTG^%RCZd?}gw;G=yXxx`Jb7O(FsJ8m!Zf$WlM}#&_Hc5;#T1QbOHQ`dXdm9;w$3i1 zu?^Pi~%*(fODZ`(&u06N$k_SyX=`5HthocVu_Rpo-}L$KAbhfJGzY~4oT!! zs=Hg;lUK`SzAGfgFJDgkeCOLrD!ZF2A`}n|DZdKwvFG00s7O@$E*sQn>efPXbNeJFPH=b4J8=`3FIoC`4v3(_ab|-P)Ga{whm^@;IdqkB6X97miS~}d5JMvBPjG(ea@&E;q5-+5uO}WE23MN* zbuOK1pv(LEWAfWDKat*#*Z%+)f5``n7&qHN+FG9TL0724tvivFKwIFZK5Hx0GjaXu z!+RaC$g(~bC^P?i$o=&T)YlYE-9r>MEQHCTHz?(-2O3I+T9Uh&%kRf=zq}0+W2hb9 zWsdZhQ~=aEYS8LGI0hDs`k!E~-Wj{~PZWO2oB8R)EOmT=0Z#nkKlEqj^S^@d8Exfo zi2gGN+J5IUBs=vHUL_@wcvadWY09Lpiy?(d6#rs!!yG`J===X*aY~qQl>x@?6s3yyq#Wy&6-RLhYW0w?2oV8m0d@GGJ|4jQI`&HLd?q zocZ(JgVV&+O0M+yofmS0rSAhNl&ZFJ>=!QE`nD%1EAB} literal 0 HcmV?d00001 diff --git a/user/docker/containers/advanced.md b/user/docker/containers/advanced.md index f406f20f..4670aca4 100644 --- a/user/docker/containers/advanced.md +++ b/user/docker/containers/advanced.md @@ -106,14 +106,15 @@ This section lets you configure runtime options for your container, add or confi Here you can configure runtime options for the container. -| Field/Option | Overview | -| ------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -| Privileged mode | Enable this option to run the container in [privileged mode](https://docs.docker.com/engine/reference/run/#runtime-privilege-and-linux-capabilities). | -| Init | Enable this option to tell Docker that an init process should be used as PID 1 in the container. | -| Type | Select the runtime type to use to start the container. Options will depend on available runtimes on your Docker host. | -| Devices | Use this option to make devices on your Docker host available within the container. Click **add device** to add a new device, and define the **host** path for the device and the **container** path for where you want the device to appear within the container. | -| Sysctls | Use this option to specify sysctls to make available within the container. Click **add sysctl** to add a new sysctl, and set the **name** and **value** for your sysctl as required. | -| Shared memory size | Specify the size (in MB) of the shared memory device (`/dev/shm`) for the container. | +| Field/Option | Overview | +| ------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| Privileged mode | Enable this option to run the container in [privileged mode](https://docs.docker.com/engine/reference/run/#runtime-privilege-and-linux-capabilities). | +| Init | Enable this option to tell Docker that an init process should be used as PID 1 in the container. | +| Type | Select the runtime type to use to start the container. Options will depend on available runtimes on your Docker host. | +| Devices | Use this option to make devices on your Docker host available within the container. Click **add device** to add a new device, and define the **host** path for the device and the **container** path for where you want the device to appear within the container. | +| Sysctls |

Use this option to specify sysctls to make available within the container. Click add sysctl to add a new sysctl, and set the name and value for your sysctl as required.
This option can not be accessed by non-admin users by default, this can be changed in the Docker security settings.

| +| SecurityOpt | Use this option to state a [security option](https://docs.docker.com/reference/cli/docker/container/run/#security-opt) for your containers and stacks. Click **add security-opt** to add a new security option. This option can not be accessed by non-admin users by default, this can be changed in the [Docker security settings](../host/setup.md#docker-security-settings). | +| Shared memory size | Specify the size (in MB) of the shared memory device (`/dev/shm`) for the container. |
diff --git a/user/docker/host/setup.md b/user/docker/host/setup.md index 69087b61..f6a85aea 100644 --- a/user/docker/host/setup.md +++ b/user/docker/host/setup.md @@ -58,8 +58,6 @@ If this setting is enabled and an update is made to an application outside of th This section allows you to toggle assorted Docker-related security settings for the environment. -
- | Option | Overview | | -------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Hide bind mounts for non-administrators |

Prevents non-admin users within Portainer from using bind mounts when creating containers and/or services/stacks. When toggled on, the option to attach to a host file system path is removed for non-admin users.
This is applied by default.

| @@ -69,15 +67,18 @@ This section allows you to toggle assorted Docker-related security settings for | Hide device mappings for non-administrators |

Blocks users from mapping host devices into containers. Whilst the ability to map devices is generally used for good (e.g. mapping a GPU into a container), it can equally be used by non-trustworthy authorized users to map a physical storage device into a container. It is possible to mount /dev/sda1 into a container, and then from a console of that container, the user would have complete access to the sda1 device without restriction. By toggling this on, Portainer blocks the ability for non-admin users to map ANY devices into containers.
This is applied by default.

| | Hide container capabilities for non-administrators |

Toggle on to hide the Container capabilities tab for non-admin users when they are adding a container.
This is applied by default.

| | Hide sysctl settings for non-administrators |

Toggle on to stop non-admin users from using sysctl options, preventing them from recreating, duplicating or editing containers.
This is applied by default.

| +| Hide security-opt for non-administrators |

Toggle on to stop non-admin users from supplying security-opt options to containers and stacks.
This is applied by default.

| + +
## Other This section contains other assorted environment-specific settings. -
- | Option | Overview | | ------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Show GPU in the UI | Toggle on to enable GPU assignments in the Portainer UI. This adds additional processing to the container and stack listing pages, so if you are not using GPUs on your environment we recommend toggling this off. | | Add GPU |

When Show GPU in the UI is toggled on, click Add GPU to add GPUs to your environment for use by your containers.
To add a GPU, provide a name for the GPU and an index or UUID to reference the GPU.

| | Show an image(s) up to date indicator for Stacks, Services and Containers |

Toggle on to enable the new image indicator feature for this environment. Toggle off to disable the feature.

This feature is only available in Portainer Business Edition.

| + +