diff options
| author | Daniel Baumann <daniel.baumann@open-infrastructure.net> | 2019-01-11 05:53:02 +0000 |
|---|---|---|
| committer | Daniel Baumann <daniel.baumann@open-infrastructure.net> | 2019-02-17 12:11:18 +0000 |
| commit | 053a1a06c7f3a14d55ca4b5eecbb086003bc4a1d (patch) | |
| tree | b7e36324ea3405993d8939810c719d067255e2f4 | |
| parent | Adding verbose output when using '-n ALL' options with container commands. (diff) | |
| download | compute-tools-053a1a06c7f3a14d55ca4b5eecbb086003bc4a1d.tar.xz compute-tools-053a1a06c7f3a14d55ca4b5eecbb086003bc4a1d.zip | |
Updating host-setup documentation for unpriviled containers.
Signed-off-by: Daniel Baumann <daniel.baumann@open-infrastructure.net>
| -rw-r--r-- | share/doc/HOST-SETUP.txt | 28 |
1 files changed, 24 insertions, 4 deletions
diff --git a/share/doc/HOST-SETUP.txt b/share/doc/HOST-SETUP.txt index 74b7333..8c915ef 100644 --- a/share/doc/HOST-SETUP.txt +++ b/share/doc/HOST-SETUP.txt @@ -180,12 +180,32 @@ iface br100 inet static EOF -4. Enabling container-shell +4. Enabling user namespace for unprivileged containers +------------------------------------------------------ + +Linux supports unprivileged containers with the user namespace. +By default the user namespace is disabled on Debian systems (see #898446). +To enable user namespace, edit the following file for a permant change: + + /etc/sysctl.d/zz-container-tools.conf + sysctl -p + +or enable it manually with: + + echo 1 > /proc/sys/kernel/unprivileged_userns_clone + +Note that containers need to be started with the correct +configuration in /etc/container-tools/config to run unpriviled +(private-users option). + + +5. Enabling container-shell --------------------------- -Managing containers requires root privileges. In order to allow unprivileged -users to manage containers without granting them privileges or accounts, -the container-shell can be used together with sudo and a container user. +Managing privileged containers requires root privileges. In order to allow +unprivileged users to manage privileged containers without granting them +privileges or accounts, the container-shell can be used together with sudo +and a container user. sudo adduser --gecos "container-tools,,," \ --home /var/lib/machines/container-tools \ |