docker
/
docs
mirror of https://github.com/docker/docs.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

HD patch (#15923)

This commit is contained in:
Allie Sadler 2022-10-20 10:06:42 +01:00 committed by GitHub
parent 3a9998620a
commit 442300bc47
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
4 changed files with 8 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
desktop/hardened-desktop/enhanced-container-isolation/faq.md
View File

@ -32,7 +32,7 @@ containers securely. For more information, see [Key features and benefits](featu
#### Will all privileged container workloads run with Enhanced Container Isolation? #### Will all privileged container workloads run with Enhanced Container Isolation?
No. Privileged container workloads that wish to access global kernel resources, for example non-namespaced, inside the Docker Desktop Linux VM won't No. Privileged container workloads, or non-namespaced workloads, that wish to access global kernel resources inside the Docker Desktop Linux VM won't
work. For example, you can't use a privileged container to load a kernel module. work. For example, you can't use a privileged container to load a kernel module.
#### Why not just restrict usage of the `--privileged` flag? #### Why not just restrict usage of the `--privileged` flag?

4
desktop/hardened-desktop/enhanced-container-isolation/features-benefits.md
View File

@ -191,8 +191,8 @@ mount: permission denied (are you root?)
``` ```
Since the `$HOME` directory was mounted into the container's `/mnt` directory as Since the `$HOME` directory was mounted into the container's `/mnt` directory as
read-only, it can't be changed from within the container to read-write. This read-only, it can't be changed from within the container to read-write, even if the container process has the capability to do so. This
ensures container processes use `mount`, or `umount`, to breach the container's ensures container processes can't use `mount`, or `umount`, to breach the container's
root filesystem. root filesystem.
Note however that in the example above the container can still create mounts Note however that in the example above the container can still create mounts

2
desktop/hardened-desktop/enhanced-container-isolation/how-eci-works.md
View File

@ -11,7 +11,7 @@ keywords: set up, enhanced container isolation, rootless, security
Enhanced Container Isolation hardens container isolation using the [Sysbox Enhanced Container Isolation hardens container isolation using the [Sysbox
container runtime](https://github.com/nestybox/sysbox). Sysbox is a fork of the container runtime](https://github.com/nestybox/sysbox). Sysbox is a fork of the
standard OCI runc runtime that was modified to enhance container isolation and standard OCI runc runtime that was modified to enhance container isolation and
workloads. For more details see [Under the covers](#under-the-hood). workloads. For more details see [Under the hood](#under-the-hood).
Starting with version 4.13, Docker Desktop includes a customized version of Starting with version 4.13, Docker Desktop includes a customized version of
Sysbox. Sysbox.

8
desktop/hardened-desktop/enhanced-container-isolation/index.md
View File

@ -82,7 +82,7 @@ When Enhanced Container Isolation is enabled, users see that containers run with
To check, run: To check, run:
``` ```
$ docker run -it --rm alpine / # cat /proc/self/uid_map $ docker run --rm alpine cat /proc/self/uid_map
``` ```
The following output displays: The following output displays:
@ -105,9 +105,9 @@ With Enhanced Container Isolation, if a process were to escape the container, it
Since Enhanced Container Isolation [uses the Sysbox container runtime](how-eci-works.md) embedded in the Docker Desktop Linux VM, another way to determine if a container is running with Enhanced Container Isolation is by using `docker inspect`: Since Enhanced Container Isolation [uses the Sysbox container runtime](how-eci-works.md) embedded in the Docker Desktop Linux VM, another way to determine if a container is running with Enhanced Container Isolation is by using `docker inspect`:
``` {% highlight liquid %}
docker inspect --format='{{.HostConfig.Runtime}}' my_container docker inspect --format={% raw %}'{{.HostConfig.Runtime}}'{% endraw %} my_container
``` {% endhighlight %}
It outputs: It outputs: