|
|
@@ -0,0 +1,39 @@
|
|
|
+# This derives from the global common config
|
|
|
+lxc.include = /usr/share/lxc/config/common.conf
|
|
|
+
|
|
|
+# Capabilities
|
|
|
+# Uncomment these if you don't run anything that needs the capability, and
|
|
|
+# would like the container to run with less privilege.
|
|
|
+#
|
|
|
+# Dropping sys_admin disables container root from doing a lot of things
|
|
|
+# that could be bad like re-mounting lxc fstab entries rw for example,
|
|
|
+# but also disables some useful things like being able to nfs mount, and
|
|
|
+# things that are already namespaced with ns_capable() kernel checks, like
|
|
|
+# hostname(1).
|
|
|
+# lxc.cap.drop = sys_admin
|
|
|
+# lxc.cap.drop = net_raw # breaks dhcp/ping
|
|
|
+# lxc.cap.drop = setgid # breaks login (initgroups/setgroups)
|
|
|
+# lxc.cap.drop = dac_read_search # breaks login (pam unix_chkpwd)
|
|
|
+# lxc.cap.drop = setuid # breaks sshd,nfs statd
|
|
|
+# lxc.cap.drop = audit_control # breaks sshd (set_loginuid failed)
|
|
|
+# lxc.cap.drop = audit_write
|
|
|
+lxc.cap.drop = sys_nice sys_pacct sys_rawio
|
|
|
+
|
|
|
+# Default mount entries
|
|
|
+lxc.mount.entry = /sys/kernel/debug sys/kernel/debug none bind,optional 0 0
|
|
|
+lxc.mount.entry = /sys/kernel/security sys/kernel/security none bind,optional 0 0
|
|
|
+lxc.mount.entry = /sys/fs/pstore sys/fs/pstore none bind,optional 0 0
|
|
|
+lxc.mount.entry = mqueue dev/mqueue mqueue rw,relatime,create=dir,optional 0 0
|
|
|
+
|
|
|
+# Extra cgroup device access
|
|
|
+## rtc
|
|
|
+lxc.cgroup.devices.allow = c 254:0 rm
|
|
|
+## tun
|
|
|
+lxc.cgroup.devices.allow = c 10:200 rwm
|
|
|
+## hpet
|
|
|
+lxc.cgroup.devices.allow = c 10:228 rwm
|
|
|
+## kvm
|
|
|
+lxc.cgroup.devices.allow = c 10:232 rwm
|
|
|
+## To use loop devices, copy the following line to the container's
|
|
|
+## configuration file (uncommented).
|
|
|
+#lxc.cgroup.devices.allow = b 7:* rwm
|
daisuke