burble/nomad-driver-containerd
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Add seccomp support.

Browse Source
This commit is contained in:
Shishir Mahajan 2020-08-27 15:26:23 -07:00
parent 26383601f7
commit ac817ceaf3
No known key found for this signature in database
GPG Key ID: D41782E7688DEC4A
2 changed files with 9 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
containerd/containerd.go
View File

@ -24,6 +24,7 @@ import (
"github.com/containerd/containerd" "github.com/containerd/containerd"
"github.com/containerd/containerd/cio" "github.com/containerd/containerd/cio"
"github.com/containerd/containerd/contrib/seccomp"
"github.com/containerd/containerd/oci" "github.com/containerd/containerd/oci"
specs "github.com/opencontainers/runtime-spec/specs-go" specs "github.com/opencontainers/runtime-spec/specs-go"
) )
@ -65,6 +66,12 @@ func (d *Driver) createContainer(image containerd.Image, containerName, containe
opts = append(opts, oci.WithPrivileged) opts = append(opts, oci.WithPrivileged)
} }
// Enable default seccomp profile.
// Allowed syscalls for the default seccomp profile: https://github.com/containerd/containerd/blob/master/contrib/seccomp/seccomp_default.go#L51-L390
if config.Seccomp {
opts = append(opts, seccomp.WithDefaultProfile())
}
// Launch container in read-only mode. // Launch container in read-only mode.
if config.ReadOnlyRootfs { if config.ReadOnlyRootfs {
opts = append(opts, oci.WithRootFSReadonly()) opts = append(opts, oci.WithRootFSReadonly())

2
containerd/driver.go
View File

@ -92,6 +92,7 @@ var (
"cap_drop": hclspec.NewAttr("cap_drop", "list(string)", false), "cap_drop": hclspec.NewAttr("cap_drop", "list(string)", false),
"devices": hclspec.NewAttr("devices", "list(string)", false), "devices": hclspec.NewAttr("devices", "list(string)", false),
"privileged": hclspec.NewAttr("privileged", "bool", false), "privileged": hclspec.NewAttr("privileged", "bool", false),
"seccomp": hclspec.NewAttr("seccomp", "bool", false),
"readonly_rootfs": hclspec.NewAttr("readonly_rootfs", "bool", false), "readonly_rootfs": hclspec.NewAttr("readonly_rootfs", "bool", false),
"host_network": hclspec.NewAttr("host_network", "bool", false), "host_network": hclspec.NewAttr("host_network", "bool", false),
"mounts": hclspec.NewBlockList("mounts", hclspec.NewObject(map[string]*hclspec.Spec{ "mounts": hclspec.NewBlockList("mounts", hclspec.NewObject(map[string]*hclspec.Spec{
@ -140,6 +141,7 @@ type TaskConfig struct {
CapAdd []string `codec:"cap_add"` CapAdd []string `codec:"cap_add"`
CapDrop []string `codec:"cap_drop"` CapDrop []string `codec:"cap_drop"`
Devices []string `codec:"devices"` Devices []string `codec:"devices"`
Seccomp bool `codec:"seccomp"`
Privileged bool `codec:"privileged"` Privileged bool `codec:"privileged"`
ReadOnlyRootfs bool `codec:"readonly_rootfs"` ReadOnlyRootfs bool `codec:"readonly_rootfs"`
HostNetwork bool `codec:"host_network"` HostNetwork bool `codec:"host_network"`