mirror of
https://github.com/moby/moby.git
synced 2022-11-09 12:21:53 -05:00
39dae54a3f
Wraps the engine itself with an AppArmor policy. This restricts what may be done by applications we call out to, such as 'xz'. Significantly, this policy also restricts the policies to which a container may be spawned into. By default, users will be able to transition to an unconfined policy or any policy prefaced with 'docker-'. Local operators may add new local policies prefaced with 'docker-' without needing to modify this policy. Operators choosing to disable privileged containers will need to modify this policy to remove access to change_policy to unconfined. Signed-off-by: Eric Windisch <eric@windisch.us> |
||
|---|---|---|
| .. | ||
| apparmor | ||
| builder | ||
| completion | ||
| desktop-integration | ||
| docker-device-tool | ||
| host-integration | ||
| httpserver | ||
| init | ||
| mkimage | ||
| reprepro | ||
| syntax | ||
| udev | ||
| vagrant-docker | ||
| check-config.sh | ||
| dockerize-disk.sh | ||
| download-frozen-image.sh | ||
| mkimage-alpine.sh | ||
| mkimage-arch-pacman.conf | ||
| mkimage-arch.sh | ||
| mkimage-busybox.sh | ||
| mkimage-crux.sh | ||
| mkimage-debootstrap.sh | ||
| mkimage-rinse.sh | ||
| mkimage-yum.sh | ||
| mkimage.sh | ||
| mkseccomp.pl | ||
| mkseccomp.sample | ||
| nuke-graph-directory.sh | ||
| project-stats.sh | ||
| README | ||
| report-issue.sh | ||
| REVIEWERS | ||
The `contrib` directory contains scripts, images, and other helpful things which are not part of the core docker distribution. Please note that they could be out of date, since they do not receive the same attention as the rest of the repository.