mirror of
https://github.com/moby/moby.git
synced 2022-11-09 12:21:53 -05:00
4c43566925
docker will run the process(es) within the container with an SELinux label and will label all of the content within the container with mount label. Any temporary file systems created within the container need to be mounted with the same mount label. The user can override the process label by specifying -Z With a string of space separated options. -Z "user=unconfined_u role=unconfined_r type=unconfined_t level=s0" Would cause the process label to run with unconfined_u:unconfined_r:unconfined_t:s0" By default the processes will run execute within the container as svirt_lxc_net_t. All of the content in the container as svirt_sandbox_file_t. The process mcs level is based of the PID of the docker process that is creating the container. If you run the container in --priv mode, the labeling will be disabled. Docker-DCO-1.1-Signed-off-by: Dan Walsh <dwalsh@redhat.com> (github: rhatdan)
96 lines
3.4 KiB
Docker
96 lines
3.4 KiB
Docker
# This file describes the standard way to build Docker, using docker
|
|
#
|
|
# Usage:
|
|
#
|
|
# # Assemble the full dev environment. This is slow the first time.
|
|
# docker build -t docker .
|
|
#
|
|
# # Mount your source in an interactive container for quick testing:
|
|
# docker run -v `pwd`:/go/src/github.com/dotcloud/docker --privileged -i -t docker bash
|
|
#
|
|
# # Run the test suite:
|
|
# docker run --privileged docker hack/make.sh test
|
|
#
|
|
# # Publish a release:
|
|
# docker run --privileged \
|
|
# -e AWS_S3_BUCKET=baz \
|
|
# -e AWS_ACCESS_KEY=foo \
|
|
# -e AWS_SECRET_KEY=bar \
|
|
# -e GPG_PASSPHRASE=gloubiboulga \
|
|
# docker hack/release.sh
|
|
#
|
|
# Note: Apparmor used to mess with privileged mode, but this is no longer
|
|
# the case. Therefore, you don't have to disable it anymore.
|
|
#
|
|
|
|
docker-version 0.6.1
|
|
FROM ubuntu:13.10
|
|
MAINTAINER Tianon Gravi <admwiggin@gmail.com> (@tianon)
|
|
|
|
# Packaged dependencies
|
|
RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -yq \
|
|
apt-utils \
|
|
aufs-tools \
|
|
automake \
|
|
btrfs-tools \
|
|
build-essential \
|
|
curl \
|
|
dpkg-sig \
|
|
git \
|
|
iptables \
|
|
libapparmor-dev \
|
|
libcap-dev \
|
|
libsqlite3-dev \
|
|
mercurial \
|
|
reprepro \
|
|
ruby1.9.1 \
|
|
ruby1.9.1-dev \
|
|
s3cmd=1.1.0* \
|
|
--no-install-recommends
|
|
|
|
# Get and compile LXC 0.8 (since it is the most stable)
|
|
RUN git clone --no-checkout https://github.com/lxc/lxc.git /usr/local/lxc && cd /usr/local/lxc && git checkout -q lxc-0.8.0
|
|
RUN cd /usr/local/lxc && ./autogen.sh && ./configure --disable-docs && make && make install
|
|
|
|
# Get lvm2 source for compiling statically
|
|
RUN git clone --no-checkout https://git.fedorahosted.org/git/lvm2.git /usr/local/lvm2 && cd /usr/local/lvm2 && git checkout -q v2_02_103
|
|
# see https://git.fedorahosted.org/cgit/lvm2.git/refs/tags for release tags
|
|
# note: we don't use "git clone -b" above because it then spews big nasty warnings about 'detached HEAD' state that we can't silence as easily as we can silence them using "git checkout" directly
|
|
|
|
# Compile and install lvm2
|
|
RUN cd /usr/local/lvm2 && ./configure --enable-static_link && make device-mapper && make install_device-mapper
|
|
# see https://git.fedorahosted.org/cgit/lvm2.git/tree/INSTALL
|
|
|
|
# Install Go
|
|
RUN curl -s https://go.googlecode.com/files/go1.2.1.src.tar.gz | tar -v -C /usr/local -xz
|
|
ENV PATH /usr/local/go/bin:$PATH
|
|
ENV GOPATH /go:/go/src/github.com/dotcloud/docker/vendor
|
|
RUN cd /usr/local/go/src && ./make.bash --no-clean 2>&1
|
|
|
|
# Compile Go for cross compilation
|
|
ENV DOCKER_CROSSPLATFORMS linux/386 linux/arm darwin/amd64 darwin/386 freebsd/amd64 freebsd/386 freebsd/arm
|
|
# (set an explicit GOARM of 5 for maximum compatibility)
|
|
ENV GOARM 5
|
|
RUN cd /usr/local/go/src && bash -xc 'for platform in $DOCKER_CROSSPLATFORMS; do GOOS=${platform%/*} GOARCH=${platform##*/} ./make.bash --no-clean 2>&1; done'
|
|
|
|
# Grab Go's cover tool for dead-simple code coverage testing
|
|
RUN go get code.google.com/p/go.tools/cmd/cover
|
|
|
|
# TODO replace FPM with some very minimal debhelper stuff
|
|
RUN gem install --no-rdoc --no-ri fpm --version 1.0.2
|
|
|
|
# Setup s3cmd config
|
|
RUN /bin/echo -e '[default]\naccess_key=$AWS_ACCESS_KEY\nsecret_key=$AWS_SECRET_KEY' > /.s3cfg
|
|
|
|
# Set user.email so crosbymichael's in-container merge commits go smoothly
|
|
RUN git config --global user.email 'docker-dummy@example.com'
|
|
|
|
VOLUME /var/lib/docker
|
|
WORKDIR /go/src/github.com/dotcloud/docker
|
|
ENV DOCKER_BUILDTAGS apparmor selinux
|
|
|
|
# Wrap all commands in the "docker-in-docker" script to allow nested containers
|
|
ENTRYPOINT ["hack/dind"]
|
|
|
|
# Upload docker source
|
|
ADD . /go/src/github.com/dotcloud/docker
|