| 123456789101112131415161718192021222324252627282930313233343536373839 |
- # This derives from the global common config
- lxc.include = /usr/share/lxc/config/common.conf
- # Capabilities
- # Uncomment these if you don't run anything that needs the capability, and
- # would like the container to run with less privilege.
- #
- # Dropping sys_admin disables container root from doing a lot of things
- # that could be bad like re-mounting lxc fstab entries rw for example,
- # but also disables some useful things like being able to nfs mount, and
- # things that are already namespaced with ns_capable() kernel checks, like
- # hostname(1).
- # lxc.cap.drop = sys_admin
- # lxc.cap.drop = net_raw # breaks dhcp/ping
- # lxc.cap.drop = setgid # breaks login (initgroups/setgroups)
- # lxc.cap.drop = dac_read_search # breaks login (pam unix_chkpwd)
- # lxc.cap.drop = setuid # breaks sshd,nfs statd
- # lxc.cap.drop = audit_control # breaks sshd (set_loginuid failed)
- # lxc.cap.drop = audit_write
- lxc.cap.drop = sys_nice sys_pacct sys_rawio
- # Default mount entries
- lxc.mount.entry = /sys/kernel/debug sys/kernel/debug none bind,optional 0 0
- lxc.mount.entry = /sys/kernel/security sys/kernel/security none bind,optional 0 0
- lxc.mount.entry = /sys/fs/pstore sys/fs/pstore none bind,optional 0 0
- lxc.mount.entry = mqueue dev/mqueue mqueue rw,relatime,create=dir,optional 0 0
- # Extra cgroup device access
- ## rtc
- lxc.cgroup.devices.allow = c 254:0 rm
- ## tun
- lxc.cgroup.devices.allow = c 10:200 rwm
- ## hpet
- lxc.cgroup.devices.allow = c 10:228 rwm
- ## kvm
- lxc.cgroup.devices.allow = c 10:232 rwm
- ## To use loop devices, copy the following line to the container's
- ## configuration file (uncommented).
- #lxc.cgroup.devices.allow = b 7:* rwm
|
