5 commits

Author	SHA1	Message	Date
Michael Crosby	3c215ba410	Merge pull request #4059 from alexlarsson/no-netadmin-caps ... lxc: Drop NET_ADMIN capability in non-privileged containers	2014-02-11 14:20:34 -05:00
Alexander Larsson	02fddffd51	lxc: Drop NET_ADMIN capability in non-privileged containers ... With this capability set the container can e.g. change the ip address of his devices to that of another container on the docker0 bridge. In a quick test I was able to listen to a port on a different ip than the one docker assigned me, but was not able to hijack an open port redirection that another container had open. Maybe its possible with some more knowledge of networking though. Anyway, network setup is meant to be handled by docker, not the apps, so I believe denying this is generally in the spirit of docker, and it closes down potential security issues. Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)	2014-02-11 11:17:34 +01:00
Tianon Gravi	ee93f6185b	Move UserLookup functionality into a separate pkg/user submodule that implements proper parsing of /etc/passwd and /etc/group, and use that to add support for "docker run -u user:group" and for getting supplementary groups (if ":group" is not specified) ... Docker-DCO-1.1-Signed-off-by: Andrew Page <admwiggin@gmail.com> (github: tianon)	2014-01-31 20:15:24 -07:00
Michael Crosby	ca8dd73fbf	Small fixes to type names ... Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)	2014-01-17 17:42:22 -08:00
Guillaume J. Charmes	f7684ea7f6	Move docker init into drivers functions ... Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume.charmes@docker.com> (github: creack) Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume.charmes@docker.com> (github: crosbymichael)	2014-01-17 17:42:22 -08:00