kotovalexarian-likes-github/moby--moby
1
0
Fork 0
mirror of https://github.com/moby/moby.git synced 2022-11-09 12:21:53 -05:00
Code Releases Activity

Merge pull request #20907 from runcom/seccomp-docs

Browse source 
docs: security: seccomp: mention Docker needs seccomp build and check config
This commit is contained in:
Sebastiaan van Stijn 2016-03-03 12:10:54 +01:00
commit d83ad2f554
1 changed files with 11 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

16
docs/security/seccomp.md
View file

@ -16,10 +16,16 @@ restrict the actions available within the container. The `seccomp()` system
call operates on the seccomp state of the calling process. You can use this
feature to restrict your application's access.
This feature is available only if the kernel is configured with `CONFIG_SECCOMP`
enabled.
This feature is available only if Docker has been built with seccomp and the
kernel is configured with `CONFIG_SECCOMP` enabled. To check if your kernel
supports seccomp:
> **Note**: Seccomp profiles require seccomp 2.2.1 and are only
```bash
$ cat /boot/config-`uname -r` | grep CONFIG_SECCOMP=
CONFIG_SECCOMP=y
```
> **Note**: seccomp profiles require seccomp 2.2.1 and are only
> available starting with Debian 9 "Stretch", Ubuntu 15.10 "Wily", and
> Fedora 22. To use this feature on Ubuntu 14.04, Debian Wheezy, or
> Debian Jessie, you must download the [latest static Docker Linux binary](../installation/binaries.md).
@ -31,7 +37,7 @@ The default seccomp profile provides a sane default for running containers with
seccomp and disables around 44 system calls out of 300+. It is moderately protective while providing wide application
compatibility. The default Docker profile (found [here](https://github.com/docker/docker/blob/master/profiles/seccomp/default.json) has a JSON layout in the following form:
```
```json
{
"defaultAction": "SCMP_ACT_ERRNO",
"architectures": [
@ -49,7 +55,7 @@ compatibility. The default Docker profile (found [here](https://github.com/docke
"name": "accept4",
"action": "SCMP_ACT_ALLOW",
"args": []
}
},
...
]
}