123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163 |
- #!/usr/bin/env bash
- cat <<EOF
- {
- "ociVersion": "1.0.0-rc1",
- "platform": {
- "os": "linux",
- "arch": "$ARCH"
- },
- "process": {
- "args": ["sh"],
- "terminal": false,
- "tty": false,
- "user": {
- "uid": $CONTAINER_UID,
- "gid": $CONTAINER_GID
- },
- "env": [
- "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
- "TERM=xterm"
- ],
- "cwd": "/",
- "capabilities": [
- "CAP_AUDIT_WRITE",
- "CAP_KILL",
- "CAP_NET_BIND_SERVICE"
- ],
- "rlimits": [
- {
- "type": "RLIMIT_NOFILE",
- "hard": 1024,
- "soft": 1024
- }
- ],
- "noNewPrivileges": true
- },
- "root": {
- "path": "$FULL_CONTAINER_PATH",
- "readonly": true
- },
- "mounts": [
- {
- "type": "bind",
- "source": "$FULL_DATA_PATH",
- "destination": "/data",
- "options": [ "rbind", "rw", "noexec" ]
- },
- {
- "destination": "/proc",
- "type": "proc",
- "source": "proc"
- },
- {
- "destination": "/dev",
- "type": "tmpfs",
- "source": "tmpfs",
- "options": [
- "nosuid",
- "strictatime",
- "mode=755",
- "size=65536k"
- ]
- },
- {
- "destination": "/dev/pts",
- "type": "devpts",
- "source": "devpts",
- "options": [
- "nosuid",
- "noexec",
- "newinstance",
- "ptmxmode=0666",
- "mode=0620",
- "gid=5"
- ]
- },
- {
- "destination": "/dev/shm",
- "type": "tmpfs",
- "source": "shm",
- "options": [
- "nosuid",
- "noexec",
- "nodev",
- "mode=1777",
- "size=65536k"
- ]
- },
- {
- "destination": "/dev/mqueue",
- "type": "mqueue",
- "source": "mqueue",
- "options": [
- "nosuid",
- "noexec",
- "nodev"
- ]
- },
- {
- "destination": "/sys",
- "type": "sysfs",
- "source": "sysfs",
- "options": [
- "nosuid",
- "noexec",
- "nodev",
- "ro"
- ]
- },
- {
- "destination": "/sys/fs/cgroup",
- "type": "cgroup",
- "source": "cgroup",
- "options": [
- "nosuid",
- "noexec",
- "nodev",
- "relatime",
- "ro"
- ]
- }
- ],
- "hooks": {},
- "linux": {
- "resources": {
- "devices": [
- {
- "allow": false,
- "access": "rwm"
- }
- ]
- },
- "namespaces": [
- {
- "type": "pid"
- },
- {
- "type": "ipc"
- },
- {
- "type": "mount"
- }
- ],
- "maskedPaths": [
- "/proc/kcore",
- "/proc/latency_stats",
- "/proc/timer_stats",
- "/proc/sched_debug"
- ],
- "readonlyPaths": [
- "/proc/asound",
- "/proc/bus",
- "/proc/fs",
- "/proc/irq",
- "/proc/sys",
- "/proc/sysrq-trigger"
- ]
- },
- "solaris": {
- "cappedCPU": {},
- "cappedMemory": {}
- }
- }
- EOF
|