summaryrefslogtreecommitdiffstats
path: root/share/doc
diff options
context:
space:
mode:
authorDaniel Baumann <daniel.baumann@open-infrastructure.net>2019-01-11 05:53:02 +0000
committerDaniel Baumann <daniel.baumann@open-infrastructure.net>2019-01-11 05:53:02 +0000
commit0cac513abee96000182a54b6cff86289053f9bf3 (patch)
treeb7e36324ea3405993d8939810c719d067255e2f4 /share/doc
parentAdding verbose output when using '-n ALL' options with container commands. (diff)
downloadcompute-tools-0cac513abee96000182a54b6cff86289053f9bf3.tar.xz
compute-tools-0cac513abee96000182a54b6cff86289053f9bf3.zip
Updating host-setup documentation for unpriviled containers.
Signed-off-by: Daniel Baumann <daniel.baumann@open-infrastructure.net>
Diffstat (limited to 'share/doc')
-rw-r--r--share/doc/HOST-SETUP.txt28
1 files changed, 24 insertions, 4 deletions
diff --git a/share/doc/HOST-SETUP.txt b/share/doc/HOST-SETUP.txt
index 74b7333..8c915ef 100644
--- a/share/doc/HOST-SETUP.txt
+++ b/share/doc/HOST-SETUP.txt
@@ -180,12 +180,32 @@ iface br100 inet static
EOF
-4. Enabling container-shell
+4. Enabling user namespace for unprivileged containers
+------------------------------------------------------
+
+Linux supports unprivileged containers with the user namespace.
+By default the user namespace is disabled on Debian systems (see #898446).
+To enable user namespace, edit the following file for a permant change:
+
+ /etc/sysctl.d/zz-container-tools.conf
+ sysctl -p
+
+or enable it manually with:
+
+ echo 1 > /proc/sys/kernel/unprivileged_userns_clone
+
+Note that containers need to be started with the correct
+configuration in /etc/container-tools/config to run unpriviled
+(private-users option).
+
+
+5. Enabling container-shell
---------------------------
-Managing containers requires root privileges. In order to allow unprivileged
-users to manage containers without granting them privileges or accounts,
-the container-shell can be used together with sudo and a container user.
+Managing privileged containers requires root privileges. In order to allow
+unprivileged users to manage privileged containers without granting them
+privileges or accounts, the container-shell can be used together with sudo
+and a container user.
sudo adduser --gecos "container-tools,,," \
--home /var/lib/machines/container-tools \