2014-03-24 07:16:40 +00:00
|
|
|
package template
|
2014-02-22 01:11:57 +00:00
|
|
|
|
|
|
|
import (
|
2014-06-11 02:58:15 +00:00
|
|
|
"github.com/docker/libcontainer"
|
|
|
|
"github.com/docker/libcontainer/apparmor"
|
|
|
|
"github.com/docker/libcontainer/cgroups"
|
2014-02-22 01:11:57 +00:00
|
|
|
)
|
|
|
|
|
2014-03-24 07:16:40 +00:00
|
|
|
// New returns the docker default configuration for libcontainer
|
2014-06-24 18:22:25 +00:00
|
|
|
func New() *libcontainer.Config {
|
|
|
|
container := &libcontainer.Config{
|
2014-05-17 00:44:10 +00:00
|
|
|
Capabilities: []string{
|
|
|
|
"CHOWN",
|
|
|
|
"DAC_OVERRIDE",
|
2014-05-19 16:45:52 +00:00
|
|
|
"FOWNER",
|
|
|
|
"MKNOD",
|
|
|
|
"NET_RAW",
|
|
|
|
"SETGID",
|
|
|
|
"SETUID",
|
2014-05-20 07:58:30 +00:00
|
|
|
"SETFCAP",
|
|
|
|
"SETPCAP",
|
|
|
|
"NET_BIND_SERVICE",
|
2014-06-03 01:23:47 +00:00
|
|
|
"SYS_CHROOT",
|
2014-06-07 22:18:18 +00:00
|
|
|
"KILL",
|
2014-02-22 01:11:57 +00:00
|
|
|
},
|
2014-05-05 19:34:21 +00:00
|
|
|
Namespaces: map[string]bool{
|
|
|
|
"NEWNS": true,
|
|
|
|
"NEWUTS": true,
|
|
|
|
"NEWIPC": true,
|
|
|
|
"NEWPID": true,
|
|
|
|
"NEWNET": true,
|
2014-02-22 01:11:57 +00:00
|
|
|
},
|
|
|
|
Cgroups: &cgroups.Cgroup{
|
2014-02-17 23:14:30 +00:00
|
|
|
Parent: "docker",
|
|
|
|
AllowAllDevices: false,
|
2014-02-22 01:11:57 +00:00
|
|
|
},
|
2014-06-23 23:43:43 +00:00
|
|
|
MountConfig: &libcontainer.MountConfig{},
|
|
|
|
Context: make(map[string]string),
|
2014-02-22 01:11:57 +00:00
|
|
|
}
|
2014-06-23 23:43:43 +00:00
|
|
|
|
2014-04-09 10:22:17 +00:00
|
|
|
if apparmor.IsEnabled() {
|
|
|
|
container.Context["apparmor_profile"] = "docker-default"
|
|
|
|
}
|
2014-06-23 23:43:43 +00:00
|
|
|
|
2014-04-02 13:07:11 +00:00
|
|
|
return container
|
2014-02-22 01:11:57 +00:00
|
|
|
}
|