@@ -221,18 +221,6 @@ func setCapabilities(s *specs.Spec, c *container.Container) error {

 	return nil

 }

-func delNamespace(s *specs.Spec, nsType specs.NamespaceType) {

-	idx := -1

-	for i, n := range s.Linux.Namespaces {

-		if n.Type == nsType {

-			idx = i

-		}

-	}

-	if idx >= 0 {

-		s.Linux.Namespaces = append(s.Linux.Namespaces[:idx], s.Linux.Namespaces[idx+1:]...)

-	}

-}

-

 func setNamespaces(daemon *Daemon, s *specs.Spec, c *container.Container) error {

 	userNS := false

 	// user

@@ -283,7 +271,7 @@ func setNamespaces(daemon *Daemon, s *specs.Spec, c *container.Container) error

 			setNamespace(s, nsUser)

 		}

 	} else if c.HostConfig.IpcMode.IsHost() {

-		delNamespace(s, specs.NamespaceType("ipc"))

+		oci.RemoveNamespace(s, specs.NamespaceType("ipc"))

 	} else {

 		ns := specs.Namespace{Type: "ipc"}

 		setNamespace(s, ns)

@@ -304,14 +292,14 @@ func setNamespaces(daemon *Daemon, s *specs.Spec, c *container.Container) error

 			setNamespace(s, nsUser)

 		}

 	} else if c.HostConfig.PidMode.IsHost() {

-		delNamespace(s, specs.NamespaceType("pid"))

+		oci.RemoveNamespace(s, specs.NamespaceType("pid"))

 	} else {

 		ns := specs.Namespace{Type: "pid"}

 		setNamespace(s, ns)

 	}

 	// uts

 	if c.HostConfig.UTSMode.IsHost() {

-		delNamespace(s, specs.NamespaceType("uts"))

+		oci.RemoveNamespace(s, specs.NamespaceType("uts"))

 		s.Hostname = ""

 	}

@@ -16,6 +16,7 @@ keywords: "API, Usage, plugins, documentation, developer"

      will be rejected.

 -->

+

 # Plugin Config Version 0 of Plugin V2

 This document outlines the format of the V0 plugin configuration. The plugin

@@ -85,10 +86,6 @@ Config provides the base accessible fields for working with V0 plugin format

       	- **host**

       	- **none**

-- **`capabilities`** *array*

-

-   capabilities of the plugin (*Linux only*), see list [`here`](https://github.com/opencontainers/runc/blob/master/libcontainer/SPEC.md#security)

-

 - **`mounts`** *PluginMount array*

    mount of the plugin, struct consisting of the following fields, see [`MOUNTS`](https://github.com/opencontainers/runtime-spec/blob/master/config.md#mounts)

@@ -117,22 +114,6 @@ Config provides the base accessible fields for working with V0 plugin format

 	  options of the mount.

-- **`devices`** *PluginDevice array*

-

-    device of the plugin, (*Linux only*), struct consisting of the following fields, see [`DEVICES`](https://github.com/opencontainers/runtime-spec/blob/master/config-linux.md#devices)

-

-    - **`name`** *string*

-

-	  name of the device.

-

-    - **`description`** *string*

-

-      description of the device.

-

-    - **`path`** *string*

-

-	  path of the device.

-

 - **`env`** *PluginEnv array*

    env of the plugin, struct consisting of the following fields

@@ -165,6 +146,27 @@ Config provides the base accessible fields for working with V0 plugin format

 	  values of the args.

+- **`linux`** *PluginLinux*

+

+    - **`capabilities`** *string array*

+

+          capabilities of the plugin (*Linux only*), see list [`here`](https://github.com/opencontainers/runc/blob/master/libcontainer/SPEC.md#security)

+

+    - **`devices`** *PluginDevice array*

+

+          device of the plugin, (*Linux only*), struct consisting of the following fields, see [`DEVICES`](https://github.com/opencontainers/runtime-spec/blob/master/config-linux.md#devices)

+

+          - **`name`** *string*

+

+	      name of the device.

+

+          - **`description`** *string*

+

+              description of the device.

+

+          - **`path`** *string*

+

+              path of the device.

 ## Example Config

new file mode 100644

@@ -0,0 +1,16 @@

+package oci

+

+import specs "github.com/opencontainers/runtime-spec/specs-go"

+

+// RemoveNamespace removes the `nsType` namespace from OCI spec `s`

+func RemoveNamespace(s *specs.Spec, nsType specs.NamespaceType) {

+	idx := -1

+	for i, n := range s.Linux.Namespaces {

+		if n.Type == nsType {

+			idx = i

+		}

+	}

+	if idx >= 0 {

+		s.Linux.Namespaces = append(s.Linux.Namespaces[:idx], s.Linux.Namespaces[idx+1:]...)

+	}

+}

@@ -219,45 +219,45 @@ next:

 // ComputePrivileges takes the config file and computes the list of access necessary

 // for the plugin on the host.

 func (p *Plugin) ComputePrivileges() types.PluginPrivileges {

-	m := p.PluginObj.Config

+	c := p.PluginObj.Config

 	var privileges types.PluginPrivileges

-	if m.Network.Type != "null" && m.Network.Type != "bridge" {

+	if c.Network.Type != "null" && c.Network.Type != "bridge" {

 		privileges = append(privileges, types.PluginPrivilege{

 			Name:        "network",

-			Description: "",

-			Value:       []string{m.Network.Type},

+			Description: "permissions to access a network",

+			Value:       []string{c.Network.Type},

 		})

 	}

-	for _, mount := range m.Mounts {

+	for _, mount := range c.Mounts {

 		if mount.Source != nil {

 			privileges = append(privileges, types.PluginPrivilege{

 				Name:        "mount",

-				Description: "",

+				Description: "host path to mount",

 				Value:       []string{*mount.Source},

 			})

 		}

 	}

-	for _, device := range m.Linux.Devices {

+	for _, device := range c.Linux.Devices {

 		if device.Path != nil {

 			privileges = append(privileges, types.PluginPrivilege{

 				Name:        "device",

-				Description: "",

+				Description: "host device to access",

 				Value:       []string{*device.Path},

 			})

 		}

 	}

-	if m.Linux.DeviceCreation {

+	if c.Linux.DeviceCreation {

 		privileges = append(privileges, types.PluginPrivilege{

 			Name:        "device-creation",

-			Description: "",

+			Description: "allow creating devices inside plugin",

 			Value:       []string{"true"},

 		})

 	}

-	if len(m.Linux.Capabilities) > 0 {

+	if len(c.Linux.Capabilities) > 0 {

 		privileges = append(privileges, types.PluginPrivilege{

 			Name:        "capabilities",

-			Description: "",

-			Value:       m.Linux.Capabilities,

+			Description: "list of additional capabilities required",

+			Value:       c.Linux.Capabilities,

 		})

 	}

 	return privileges

@@ -318,12 +318,7 @@ func (p *Plugin) InitSpec(s specs.Spec, libRoot string) (*specs.Spec, error) {

 	if p.PluginObj.Config.Network.Type != "" {

 		// TODO: if net == bridge, use libnetwork controller to create a new plugin-specific bridge, bind mount /etc/hosts and /etc/resolv.conf look at the docker code (allocateNetwork, initialize)

 		if p.PluginObj.Config.Network.Type == "host" {

-			for i, n := range s.Linux.Namespaces {

-				if n.Type == "network" {

-					s.Linux.Namespaces = append(s.Linux.Namespaces[:i], s.Linux.Namespaces[i+1:]...)

-					break

-				}

-			}

+			oci.RemoveNamespace(&s, specs.NamespaceType("network"))

 		}

 		etcHosts := "/etc/hosts"

 		resolvConf := "/etc/resolv.conf"

@@ -402,8 +397,6 @@ func (p *Plugin) InitSpec(s specs.Spec, libRoot string) (*specs.Spec, error) {

 	s.Process.Cwd = cwd

 	s.Process.Env = envs

-	// TODO: what about duplicates?

-	// TODO: Should not need CAP_ prefix in manifest?

 	s.Process.Capabilities = append(s.Process.Capabilities, p.PluginObj.Config.Linux.Capabilities...)

 	return &s, nil