1. docker
  2. Commit 24f978094dc5c9eae0ca60001b65256b2b30f2c8
Browse code

Updated sample config and README to match the default template for native execdriver.

Docker-DCO-1.1-Signed-off-by: Rohit Jnagal <jnagal@google.com> (github: rjnagal)

Rohit Jnagal authored on 2014/04/25 15:02:30
Showing 3 changed files
pkg/libcontainer/README.md
History View file @ 24f9780
... ... 
@@ -43,11 +43,11 @@ Sample `container.json` file:
43 43 
    "capabilities_mask" : [
44 44 
       {
45 45 
         "key": "SETPCAP",
46 
-        "enabled": true
46 
+        "enabled": false
47 47 
       },
48 48 
       {
49 49 
         "key": "SYS_MODULE",
50 
-        "enabled": true
50 
+        "enabled": false
51 51 
       },
52 52 
       {
53 53 
         "key": "SYS_RAWIO",
... ... 
@@ -55,27 +55,27 @@ Sample `container.json` file:
55 55 
       },
56 56 
       {
57 57 
         "key": "SYS_PACCT",
58 
-        "enabled": true
58 
+        "enabled": false
59 59 
       },
60 60 
       {
61 61 
         "key": "SYS_ADMIN",
62 
-        "enabled": true
62 
+        "enabled": false
63 63 
       },
64 64 
       {
65 65 
         "key": "SYS_NICE",
66 
-        "enabled": true
66 
+        "enabled": false
67 67 
       },
68 68 
       {
69 69 
         "key": "SYS_RESOURCE",
70 
-        "enabled": true
70 
+        "enabled": false
71 71 
       },
72 72 
       {
73 73 
         "key": "SYS_TIME",
74 
-        "enabled": true
74 
+        "enabled": false
75 75 
       },
76 76 
       {
77 77 
         "key": "SYS_TTY_CONFIG",
78 
-        "enabled": true
78 
+        "enabled": false
79 79 
       },
80 80 
       {
81 81 
         "key": "MKNOD",
... ... 
@@ -83,23 +83,23 @@ Sample `container.json` file:
83 83 
       },
84 84 
       {
85 85 
         "key": "AUDIT_WRITE",
86 
-        "enabled": true
86 
+        "enabled": false
87 87 
       },
88 88 
       {
89 89 
         "key": "AUDIT_CONTROL",
90 
-        "enabled": true
90 
+        "enabled": false
91 91 
       },
92 92 
       {
93 93 
         "key": "MAC_OVERRIDE",
94 
-        "enabled": true
94 
+        "enabled": false
95 95 
       },
96 96 
       {
97 97 
         "key": "MAC_ADMIN",
98 
-        "enabled": true
98 
+        "enabled": false
99 99 
       },
100 100 
       {
101 101 
         "key": "NET_ADMIN",
102 
-        "enabled": true
102 
+        "enabled": false
103 103 
       }
104 104 
    ],
105 105 
    "context" : {
pkg/libcontainer/container.json
History View file @ 24f9780
... ... 
@@ -32,11 +32,11 @@
32 32 
     "capabilities_mask": [
33 33 
     	{
34 34 
 	    "key": "SETPCAP",
35 
-       	    "enabled": true
35 
+       	    "enabled": false
36 36 
 	},
37 37 
     	{
38 38 
 	    "key": "SYS_MODULE",
39 
-            "enabled": true
39 
+            "enabled": false
40 40 
 	},
41 41 
 	{
42 42 
 	    "key": "SYS_RAWIO",
... ... 
@@ -44,27 +44,27 @@
44 44 
 	},
45 45 
 	{
46 46 
 	    "key": "SYS_PACCT",
47 
-            "enabled": true
47 
+            "enabled": false
48 48 
 	},
49 49 
 	{
50 50 
 	    "key": "SYS_ADMIN",
51 
-            "enabled": true
51 
+            "enabled": false
52 52 
 	},
53 53 
 	{
54 54 
 	    "key": "SYS_NICE",
55 
-            "enabled": true
55 
+            "enabled": false
56 56 
 	},
57 57 
 	{
58 58 
 	    "key": "SYS_RESOURCE",
59 
-            "enabled": true
59 
+            "enabled": false
60 60 
 	},
61 61 
 	{
62 62 
 	    "key": "SYS_TIME",
63 
-            "enabled": true
63 
+            "enabled": false
64 64 
 	},
65 65 
 	{
66 66 
 	    "key": "SYS_TTY_CONFIG",
67 
-            "enabled": true
67 
+            "enabled": false
68 68 
 	},
69 69 
 	{
70 70 
 	    "key": "MKNOD",
... ... 
@@ -72,23 +72,23 @@
72 72 
 	},
73 73 
 	{
74 74 
 	    "key": "AUDIT_WRITE",
75 
-            "enabled": true
75 
+            "enabled": false
76 76 
 	},
77 77 
 	{
78 78 
 	    "key": "AUDIT_CONTROL",
79 
-            "enabled": true
79 
+            "enabled": false
80 80 
 	},
81 81 
 	{
82 82 
 	    "key": "MAC_OVERRIDE",
83 
-            "enabled": true
83 
+            "enabled": false
84 84 
 	},
85 85 
 	{
86 86 
 	    "key": "MAC_ADMIN",
87 
-            "enabled": true
87 
+            "enabled": false
88 88 
 	},
89 89 
 	{
90 90 
 	    "key": "NET_ADMIN",
91 
-	    "enabled": true
91 
+	    "enabled": false
92 92 
        	}
93 93 
     ],
94 94 
     "networks": [{
pkg/libcontainer/container_test.go
History View file @ 24f9780
... ... 
@@ -15,8 +15,7 @@ func TestContainerJsonFormat(t *testing.T) {
15 15
16 16 
 	var container *Container
17 17 
 	if err := json.NewDecoder(f).Decode(&container); err != nil {
18 
-		t.Log("failed to decode container config")
19 
-		t.FailNow()
18 
+		t.Fatal("failed to decode container config")
20 19 
 	}
21 20 
 	if container.Hostname != "koye" {
22 21 
 		t.Log("hostname is not set")
... ... 
@@ -39,12 +38,22 @@ func TestContainerJsonFormat(t *testing.T) {
39 39 
 	}
40 40
41 41 
 	if !container.CapabilitiesMask.Contains("SYS_ADMIN") {
42 
-		t.Log("capabilities should contain SYS_ADMIN")
42 
+		t.Log("capabilities mask should contain SYS_ADMIN")
43 
+		t.Fail()
44 
+	}
45 
+
46 
+	if container.CapabilitiesMask.Get("SYS_ADMIN").Enabled {
47 
+		t.Log("SYS_ADMIN should not be enabled in capabilities mask")
48 
+		t.Fail()
49 
+	}
50 
+
51 
+	if !container.CapabilitiesMask.Get("MKNOD").Enabled {
52 
+		t.Log("MKNOD should be enabled in capabilities mask")
43 53 
 		t.Fail()
44 54 
 	}
45 55
46 56 
 	if container.CapabilitiesMask.Contains("SYS_CHROOT") {
47 
-		t.Log("capabitlies should not contain SYS_CHROOT")
57 
+		t.Log("capabilities mask should not contain SYS_CHROOT")
48 58 
 		t.Fail()
49 59 
 	}
50 60