diff --git a/common/docs/containers.conf.5.md b/common/docs/containers.conf.5.md index f5203912bb..3ef98dfade 100644 --- a/common/docs/containers.conf.5.md +++ b/common/docs/containers.conf.5.md @@ -162,12 +162,14 @@ Path to the container-init binary, which forwards signals and reaps processes within containers. Note that the container-init binary will only be used when the `--init` for podman-create and podman-run is set. -**ipcns**="private" +**ipcns**="shareable" Default way to to create a IPC namespace for the container. Options are: - `private` Create private IPC Namespace for the container. - `host` Share host IPC Namespace with the container. + `host` Share host IPC Namespace with the container. + `none` Create shareable IPC Namespace for the container without a private /dev/shm. + `private` Create private IPC Namespace for the container, other containers are not allowed to share it. + `shareable` Create shareable IPC Namespace for the container. **keyring**=true diff --git a/common/pkg/config/config_test.go b/common/pkg/config/config_test.go index f1f9b1f432..9d3dbe6fba 100644 --- a/common/pkg/config/config_test.go +++ b/common/pkg/config/config_test.go @@ -30,6 +30,7 @@ var _ = Describe("Config", func() { gomega.Expect(defaultConfig.Containers.PidsLimit).To(gomega.BeEquivalentTo(2048)) gomega.Expect(defaultConfig.Engine.ServiceTimeout).To(gomega.BeEquivalentTo(5)) gomega.Expect(defaultConfig.NetNS()).To(gomega.BeEquivalentTo("private")) + gomega.Expect(defaultConfig.IPCNS()).To(gomega.BeEquivalentTo("shareable")) gomega.Expect(defaultConfig.Engine.InfraImage).To(gomega.BeEquivalentTo("")) path, err := defaultConfig.ImageCopyTmpDir() gomega.Expect(err).To(gomega.BeNil()) diff --git a/common/pkg/config/containers.conf b/common/pkg/config/containers.conf index 1db2d704a6..48ea8263b4 100644 --- a/common/pkg/config/containers.conf +++ b/common/pkg/config/containers.conf @@ -133,10 +133,12 @@ default_sysctls = [ # Default way to to create an IPC namespace (POSIX SysV IPC) for the container # Options are: -# `private` Create private IPC Namespace for the container. -# `host` Share host IPC Namespace with the container. +# "host" Share host IPC Namespace with the container. +# "none" Create shareable IPC Namespace for the container without a private /dev/shm. +# "private" Create private IPC Namespace for the container, other containers are not allowed to share it. +# "shareable" Create shareable IPC Namespace for the container. # -#ipcns = "private" +#ipcns = "shareable" # keyring tells the container engine whether to create # a kernel keyring for use within the container. diff --git a/common/pkg/config/default.go b/common/pkg/config/default.go index 3255cff9d2..14858e967f 100644 --- a/common/pkg/config/default.go +++ b/common/pkg/config/default.go @@ -205,7 +205,7 @@ func DefaultConfig() (*Config, error) { HTTPProxy: true, Init: false, InitPath: "", - IPCNS: "private", + IPCNS: "shareable", LogDriver: defaultLogDriver(), LogSizeMax: DefaultLogSizeMax, NetNS: "private",