134 lines
2.6 KiB
Go
134 lines
2.6 KiB
Go
|
package main
|
||
|
|
|
||
|
|
import (
|
||
|
|
"runtime"
|
||
|
|
|
||
|
|
"github.com/opencontainers/runtime-spec/specs-go"
|
||
|
|
)
|
||
|
|
|
||
|
|
var (
|
||
|
|
spec = &specs.Spec{
|
||
|
|
Version: specs.Version,
|
||
|
|
Platform: specs.Platform{
|
||
|
|
OS: runtime.GOOS,
|
||
|
|
Arch: runtime.GOARCH,
|
||
|
|
},
|
||
|
|
Root: specs.Root{
|
||
|
|
Path: "rootfs",
|
||
|
|
Readonly: true,
|
||
|
|
},
|
||
|
|
Process: specs.Process{
|
||
|
|
Terminal: true,
|
||
|
|
User: specs.User{},
|
||
|
|
Args: []string{
|
||
|
|
"sh",
|
||
|
|
},
|
||
|
|
Env: []string{
|
||
|
|
"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
|
||
|
|
"TERM=xterm",
|
||
|
|
},
|
||
|
|
Cwd: "/",
|
||
|
|
NoNewPrivileges: true,
|
||
|
|
Capabilities: []string{
|
||
|
|
"CAP_AUDIT_WRITE",
|
||
|
|
"CAP_KILL",
|
||
|
|
"CAP_NET_BIND_SERVICE",
|
||
|
|
},
|
||
|
|
Rlimits: []specs.Rlimit{
|
||
|
|
{
|
||
|
|
Type: "RLIMIT_NOFILE",
|
||
|
|
Hard: uint64(1024),
|
||
|
|
Soft: uint64(1024),
|
||
|
|
},
|
||
|
|
},
|
||
|
|
},
|
||
|
|
Hostname: "ctr",
|
||
|
|
Mounts: []specs.Mount{
|
||
|
|
{
|
||
|
|
Destination: "/proc",
|
||
|
|
Type: "proc",
|
||
|
|
Source: "proc",
|
||
|
|
Options: nil,
|
||
|
|
},
|
||
|
|
{
|
||
|
|
Destination: "/dev",
|
||
|
|
Type: "tmpfs",
|
||
|
|
Source: "tmpfs",
|
||
|
|
Options: []string{"nosuid", "strictatime", "mode=755", "size=65536k"},
|
||
|
|
},
|
||
|
|
{
|
||
|
|
Destination: "/dev/pts",
|
||
|
|
Type: "devpts",
|
||
|
|
Source: "devpts",
|
||
|
|
Options: []string{"nosuid", "noexec", "newinstance", "ptmxmode=0666", "mode=0620", "gid=5"},
|
||
|
|
},
|
||
|
|
{
|
||
|
|
Destination: "/dev/shm",
|
||
|
|
Type: "tmpfs",
|
||
|
|
Source: "shm",
|
||
|
|
Options: []string{"nosuid", "noexec", "nodev", "mode=1777", "size=65536k"},
|
||
|
|
},
|
||
|
|
{
|
||
|
|
Destination: "/dev/mqueue",
|
||
|
|
Type: "mqueue",
|
||
|
|
Source: "mqueue",
|
||
|
|
Options: []string{"nosuid", "noexec", "nodev"},
|
||
|
|
},
|
||
|
|
{
|
||
|
|
Destination: "/sys",
|
||
|
|
Type: "sysfs",
|
||
|
|
Source: "sysfs",
|
||
|
|
Options: []string{"nosuid", "noexec", "nodev", "ro"},
|
||
|
|
},
|
||
|
|
{
|
||
|
|
Destination: "/sys/fs/cgroup",
|
||
|
|
Type: "cgroup",
|
||
|
|
Source: "cgroup",
|
||
|
|
Options: []string{"nosuid", "noexec", "nodev", "relatime", "ro"},
|
||
|
|
},
|
||
|
|
},
|
||
|
|
Linux: specs.Linux{
|
||
|
|
MaskedPaths: []string{
|
||
|
|
"/proc/kcore",
|
||
|
|
"/proc/latency_stats",
|
||
|
|
"/proc/timer_stats",
|
||
|
|
"/proc/sched_debug",
|
||
|
|
},
|
||
|
|
ReadonlyPaths: []string{
|
||
|
|
"/proc/asound",
|
||
|
|
"/proc/bus",
|
||
|
|
"/proc/fs",
|
||
|
|
"/proc/irq",
|
||
|
|
"/proc/sys",
|
||
|
|
"/proc/sysrq-trigger",
|
||
|
|
},
|
||
|
|
Resources: &specs.Resources{
|
||
|
|
Devices: []specs.DeviceCgroup{
|
||
|
|
{
|
||
|
|
Allow: false,
|
||
|
|
Access: sPtr("rwm"),
|
||
|
|
},
|
||
|
|
},
|
||
|
|
},
|
||
|
|
Namespaces: []specs.Namespace{
|
||
|
|
{
|
||
|
|
Type: "pid",
|
||
|
|
},
|
||
|
|
{
|
||
|
|
Type: "ipc",
|
||
|
|
},
|
||
|
|
{
|
||
|
|
Type: "uts",
|
||
|
|
},
|
||
|
|
{
|
||
|
|
Type: "user",
|
||
|
|
},
|
||
|
|
{
|
||
|
|
Type: "mount",
|
||
|
|
},
|
||
|
|
},
|
||
|
|
Seccomp: defaultSeccompProfile,
|
||
|
|
},
|
||
|
|
}
|
||
|
|
)
|