From: Luca Boccassi Date: Tue, 16 Nov 2021 22:44:06 +0000 (+0000) Subject: CONTAINER_INTERFACE: clarify that /proc/sys can be writable with namespacing X-Git-Tag: v250-rc1~227 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=cc970310a47d553c1232be579caf1ae2a54640db;p=thirdparty%2Fsystemd.git CONTAINER_INTERFACE: clarify that /proc/sys can be writable with namespacing When user and network namespaces are enabled, the kernel makes the global keys read-only, and makes the namespaced ones available for the guest already. --- diff --git a/docs/CONTAINER_INTERFACE.md b/docs/CONTAINER_INTERFACE.md index 54b94e23424..9ca991cab50 100644 --- a/docs/CONTAINER_INTERFACE.md +++ b/docs/CONTAINER_INTERFACE.md @@ -22,10 +22,12 @@ manager, please consider supporting the following interfaces. (that file overrides whatever is pre-initialized by the container manager). 2. Make sure to pre-mount `/proc/`, `/sys/`, and `/sys/fs/selinux/` before - invoking systemd, and mount `/proc/sys/`, `/sys/`, and `/sys/fs/selinux/` - read-only in order to prevent the container from altering the host kernel's - configuration settings. (As a special exception, if your container has - network namespaces enabled, feel free to make `/proc/sys/net/` writable). + invoking systemd, and mount `/sys/`, `/sys/fs/selinux/` and `/proc/sys/` + read-only (the latter via e.g. a read-only bind mount on itself) in order + to prevent the container from altering the host kernel's configuration + settings. (As a special exception, if your container has network namespaces + enabled, feel free to make `/proc/sys/net/` writable. If it also has user, ipc, + uts and pid namespaces enabled, the entire `/proc/sys` can be left writable). systemd and various other subsystems (such as the SELinux userspace) have been modified to behave accordingly when these file systems are read-only. (It's OK to mount `/sys/` as `tmpfs` btw, and only mount a subset of its