docker
/
docs
mirror of https://github.com/docker/docs.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #6171 from crosbymichael/add-chroot 

Add SYS_CHROOT cap to unprivileged containers
This commit is contained in:
Victor Marmol 2014-06-02 18:33:34 -07:00
parent 3fb0870878 41f7cef2bd
commit 5bf4068d60
2 changed files with 13 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
daemon/execdriver/native/template/default_template.go
View File

@ -20,6 +20,7 @@ func New() *libcontainer.Container {
"SETFCAP", "SETFCAP",
"SETPCAP", "SETPCAP",
"NET_BIND_SERVICE", "NET_BIND_SERVICE",
"SYS_CHROOT",
}, },
Namespaces: map[string]bool{ Namespaces: map[string]bool{
"NEWNS": true, "NEWNS": true,

12
integration-cli/docker_cli_run_test.go
View File

@ -873,3 +873,15 @@ func TestThatCharacterDevicesActLikeCharacterDevices(t *testing.T) {
logDone("run - test that character devices work.") logDone("run - test that character devices work.")
} }
func TestRunUnprivilegedWithChroot(t *testing.T) {
cmd := exec.Command(dockerBinary, "run", "busybox", "chroot", "/", "true")
if _, err := runCommand(cmd); err != nil {
t.Fatal(err)
}
deleteAllContainers()
logDone("run - unprivileged with chroot")
}