Skip to content

Reasons that can't use runc-dmz #4158

New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

#

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

Jump to bottom
Open
lifubang opened this issue Jan 1, 2024 · 0 comments
Open

Reasons that can't use runc-dmz #4158

lifubang opened this issue Jan 1, 2024 · 0 comments

Comments

@lifubang
Copy link
Member

lifubang commented Jan 1, 2024

When we were introducing dmz to runc, we have realized that there were 3 reasons we should disable runc-dmz:

  1. runc-dmz does not play well with selinux #4057, fixed by Add selinux-vs-dmz test case and a workaround #4053.
  2. The container process has a CAP_SYS_PTRACE ability, fixed by nsexec: cloned binary rework #3987.
  3. If the container process is not root and the capabilities are not in the ambient set #4125, will be fixed by dmz: don't use runc-dmz in complicated capability setups #4137.

Maybe there are some more scenarios that can't use runc-dmz, please provide to help us improve or deprecate it. Thanks.
# for free to join this conversation on GitHub. Already have an account? # to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@lifubang