Update README.md

This commit is contained in:
Jess Frazelle 2016-04-15 22:09:15 -07:00 committed by Jess Frazelle
parent 3cf304f3e1
commit 0ae930df26

View file

@ -1,7 +1,17 @@
# binctr # binctr
Create fully static, including rootfs embedded, binaries that pop you directly Create fully static, including rootfs embedded, binaries that pop you directly
into a container. Can be run by an unprivileged user. into a container. **Can be run by an unprivileged user.**
This is based off a crazy idea from [@crosbymichael](https://github.com/crosbymichael) who first embedded an image in a binary :D
**NOTE**
You may have noticed you can't file an issue. That's because this is using a crazy
person's (aka my) fork of libcontainer
and until I get the patches into upstream there's no
way in hell I'm fielding issues from whoever is crazy
enough to try this.
### Building ### Building
@ -31,14 +41,14 @@ $ make static IMAGE=nginx
Static container created at: ./bin/nginx Static container created at: ./bin/nginx
Run with ./bin/nginx Run with ./bin/nginx
$ ./bin/nginx nginx -g daemon off $ ./bin/nginx nginx -g "daemon off;"
# But we have no networking! Don't worry we can fix this # But we have no networking! Don't worry we can fix this
# Let's install my super cool binary for setting up networking in a container # Let's install my super cool binary for setting up networking in a container
$ go get github.com/jfrazelle/netns $ go get github.com/jfrazelle/netns
# now we can all this as a prestart hook # now we can add this as a prestart hook
$ ./bin/nginx --hook prestart:netns nginx -g daemon off $ ./bin/nginx --hook prestart:netns nginx -g "daemon off;"
# let's get the ip file # let's get the ip file
$ cat .ip $ cat .ip
@ -84,9 +94,16 @@ $ ./bin/alpine -h
print version and exit print version and exit
``` ```
## Cool things
The binary spawned does NOT need to oversee the container process if you
run in detached mode with a PID file. You can have it watched by the user mode
systemd so that this binary is really just the launcher :)
## Caveats ## Caveats
**Caps the binary needs TO UNPACK AND SET THE RIGHT PERMS ON THE ROOTFS FOR THE USERNS USER** **Caps the binary needs to unpack and set
the right perms on the roofs for the userns user**
- **CAP_CHOWN**: chown the rootfs to the userns user - **CAP_CHOWN**: chown the rootfs to the userns user
- **CAP_FOWNER**: chmod rootfs - **CAP_FOWNER**: chmod rootfs