mobi/moby
1
0
Fork 0
mirror of https://github.com/moby/moby.git synced 2025-12-04 19:23:06 +03:00
Code Activity

add docs and unconfined to run a container without the default seccomp profile

Browse Source 
Signed-off-by: Jessica Frazelle <acidburn@docker.com>
This commit is contained in:
Jessica Frazelle
2015-12-21 19:32:12 -08:00
parent a48fe62384
commit 15674c5fb7
4 changed files with 35 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
integration-cli/docker_cli_run_unix_test.go
View File

@@ -598,8 +598,20 @@ func (s *DockerSuite) TestRunSeccompProfileDenyCloneUserns(c *check.C) {
}
}
// TestRunSeccompAllowPrivCloneUserns checks that 'docker run userns-test'
// with a the default seccomp profile exits with operation not permitted.
// TestRunSeccompUnconfinedCloneUserns checks that
// 'docker run --security-opt seccomp:unconfined userns-test' allows creating a userns.
func (s *DockerSuite) TestRunSeccompUnconfinedCloneUserns(c *check.C) {
testRequires(c, SameHostDaemon, seccompEnabled, NotUserNamespace)
// make sure running w privileged is ok
runCmd := exec.Command(dockerBinary, "run", "--security-opt", "seccomp:unconfined", "userns-test", "id")
if out, _, err := runCommandWithOutput(runCmd); err != nil || !strings.Contains(out, "nobody") {
c.Fatalf("expected clone userns with --security-opt seccomp:unconfined to succeed, got %s: %v", out, err)
}
}
// TestRunSeccompAllowPrivCloneUserns checks that 'docker run --privileged userns-test'
// allows creating a userns.
func (s *DockerSuite) TestRunSeccompAllowPrivCloneUserns(c *check.C) {
testRequires(c, SameHostDaemon, seccompEnabled, NotUserNamespace)