kotovalexarian-likes-github/moby--moby
1
0
Fork 0
mirror of https://github.com/moby/moby.git synced 2022-11-09 12:21:53 -05:00
Code Releases Activity
moby--moby/contrib/syscall-test/Dockerfile

17 lines
643 B
Text
Raw Normal View History

Dockerfile: frozen images: update to bullseye, remove buildpack-dep Update the frozen images to also be based on Debian bullseye. Using the "slim" variant (which looks to have all we're currently using), and remove the buildpack-dep frozen image. The buildpack-dep image is quite large, and it looks like we only use it to compile some C binaries, which should work fine on a regular debian image; docker build -t debian:bullseye-slim-gcc -<<EOF FROM debian:bullseye-slim RUN apt-get update && apt-get install -y gcc libc6-dev --no-install-recommends EOF docker image ls REPOSITORY TAG IMAGE ID CREATED SIZE debian bullseye-slim-gcc 1851750242af About a minute ago 255MB buildpack-deps bullseye fe8fece98de2 2 days ago 834MB Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2021-08-19 17:40:38 -04:00
FROM debian:bullseye-slim
RUN apt-get update && apt-get install -y gcc libc6-dev --no-install-recommends
add more seccomp profile tests Signed-off-by: Jessica Frazelle <acidburn@docker.com>
2015-12-30 14:20:23 -05:00
COPY . /usr/src/
WORKDIR /usr/src/
RUN gcc -g -Wall -static userns.c -o /usr/bin/userns-test \
&& gcc -g -Wall -static ns.c -o /usr/bin/ns-test \
Use runc version built without ambient capabilities Until we can support existing behaviour with `sudo` disable ambient capabilities in runc build. Add tests that non root user cannot use default capabilities, and that capabilities are working as expected. Test for #27590 Update runc. Signed-off-by: Justin Cormack <justin.cormack@docker.com>
2016-10-21 08:34:37 -04:00
&& gcc -g -Wall -static acct.c -o /usr/bin/acct-test \
&& gcc -g -Wall -static setuid.c -o /usr/bin/setuid-test \
&& gcc -g -Wall -static setgid.c -o /usr/bin/setgid-test \
&& gcc -g -Wall -static socket.c -o /usr/bin/socket-test \
Revert "Block obsolete socket families in the default seccomp profile" This reverts commit 7e3a596a63fd8d0ab958132901b6ded81f8b44c0. Unfortunately, it was pointed out in https://github.com/moby/moby/pull/29076#commitcomment-21831387 that the `socketcall` syscall takes a pointer to a struct so it is not possible to use seccomp profiles to filter it. This means these cannot be blocked as you can use `socketcall` to call them regardless, as we currently allow 32 bit syscalls. Users who wish to block these should use a seccomp profile that blocks all 32 bit syscalls and then just block the non socketcall versions. Signed-off-by: Justin Cormack <justin.cormack@docker.com>
2017-05-09 09:21:19 -04:00
&& gcc -g -Wall -static raw.c -o /usr/bin/raw-test
Add a test that the default seccomp profile allows execution of 32 bit binaries While testing #24510 I noticed that 32 bit syscalls were incorrectly being blocked and we did not have a test for this, so adding one. This is only tested on amd64 as it is the only architecture that reliably supports 32 bit code execution, others only do sometimes. There is no 32 bit libc in the buildpack-deps so we cannot build 32 bit C code easily so use the simplest assembly program which just calls the exit syscall. Signed-off-by: Justin Cormack <justin.cormack@docker.com>
2016-07-27 13:42:34 -04:00
RUN [ "$(uname -m)" = "x86_64" ] && gcc -s -m32 -nostdlib exit32.s -o /usr/bin/exit32-test || true
Copy permalink