Skip to content

Commit ad7f9e4

Browse files
AkihiroSudaAkihiroSuda
committed
Add features.md to formalize the runc features JSON
Add `features.md` and `features-linux.md`, to formalize the `runc features` JSON that was introduced in runc v1.1. A runtime caller MAY use this JSON to detect the features implemented by the runtime. The spec corresponds to https://github.com/opencontainers/runc/blob/1b747a43f0f57e31619f0dc9289a73beaf52ee0e/types/features/features.go (opencontainers/runc PR 3296, opencontainers/runc PR 3310) Signed-off-by: Akihiro Suda <[email protected]>
1 parent c2389c3 commit ad7f9e4

12 files changed

+946
-6
lines changed

Diff for: ‎Makefile

+2
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,8 @@ DOC_FILES := \
3030
config.md \
3131
config-linux.md \
3232
config-solaris.md \
33+
features.md \
34+
features-linux.md \
3335
glossary.md
3436

3537
default: docs

Diff for: ‎features-linux.md

+183
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,183 @@
1+
# <a name="linuxFeatures" />Linux Features Document
2+
3+
This document describes the [Linux-specific section](features.md#platform-specific-configuration) of the [features document](features.md).
4+
5+
## <a name="linuxFeaturesNamespaces" />Namespaces
6+
7+
* **`namespaces`** (array of strings, OPTIONAL) The recognized names of the namespaces, including namespaces that might not be supported by the host operating system.
8+
The runtime MUST recognize the elements in this array as the [`type` of `linux.namespaces` objects in `config.json`](config-linux.md#namespaces).
9+
10+
### Example
11+
12+
```json
13+
"namespaces": [
14+
"cgroup",
15+
"ipc",
16+
"mount",
17+
"network",
18+
"pid",
19+
"user",
20+
"uts"
21+
]
22+
```
23+
24+
## <a name="linuxFeaturesCapabilities" />Capabilities
25+
26+
* **`capabilities`** (array of strings, OPTIONAL) The recognized names of the capabilities, including capabilities that might not be supported by the host operating system.
27+
The runtime MUST recognize the elements in this array in the [`process.capabilities` object of `config.json`](config.md#linux-process).
28+
29+
### Example
30+
31+
```json
32+
"capabilities": [
33+
"CAP_CHOWN",
34+
"CAP_DAC_OVERRIDE",
35+
"CAP_DAC_READ_SEARCH",
36+
"CAP_FOWNER",
37+
"CAP_FSETID",
38+
"CAP_KILL",
39+
"CAP_SETGID",
40+
"CAP_SETUID",
41+
"CAP_SETPCAP",
42+
"CAP_LINUX_IMMUTABLE",
43+
"CAP_NET_BIND_SERVICE",
44+
"CAP_NET_BROADCAST",
45+
"CAP_NET_ADMIN",
46+
"CAP_NET_RAW",
47+
"CAP_IPC_LOCK",
48+
"CAP_IPC_OWNER",
49+
"CAP_SYS_MODULE",
50+
"CAP_SYS_RAWIO",
51+
"CAP_SYS_CHROOT",
52+
"CAP_SYS_PTRACE",
53+
"CAP_SYS_PACCT",
54+
"CAP_SYS_ADMIN",
55+
"CAP_SYS_BOOT",
56+
"CAP_SYS_NICE",
57+
"CAP_SYS_RESOURCE",
58+
"CAP_SYS_TIME",
59+
"CAP_SYS_TTY_CONFIG",
60+
"CAP_MKNOD",
61+
"CAP_LEASE",
62+
"CAP_AUDIT_WRITE",
63+
"CAP_AUDIT_CONTROL",
64+
"CAP_SETFCAP",
65+
"CAP_MAC_OVERRIDE",
66+
"CAP_MAC_ADMIN",
67+
"CAP_SYSLOG",
68+
"CAP_WAKE_ALARM",
69+
"CAP_BLOCK_SUSPEND",
70+
"CAP_AUDIT_READ",
71+
"CAP_PERFMON",
72+
"CAP_BPF",
73+
"CAP_CHECKPOINT_RESTORE"
74+
]
75+
```
76+
77+
## <a name="linuxFeaturesCgroup" />Cgroup
78+
79+
**`cgroup`** (object, OPTIONAL) represents the runtime's implementation status of cgroup managers.
80+
Irrelevant to the cgroup version of the host operating system.
81+
82+
* **`v1`** (bool, OPTIONAL) represents whether the runtime supports cgroup v1.
83+
* **`v2`** (bool, OPTIONAL) represents whether the runtime supports cgroup v2.
84+
* **`systemd`** (bool, OPTIONAL) represents whether the runtime supports system-wide systemd cgroup manager.
85+
* **`systemdUser`** (bool, OPTIONAL) represents whether the runtime supports user-scoped systemd cgroup manager.
86+
87+
### Example
88+
89+
```json
90+
"cgroup": {
91+
"v1": true,
92+
"v2": true,
93+
"systemd": true,
94+
"systemdUser": true
95+
}
96+
```
97+
98+
## <a name="linuxFeaturesSeccomp" />Seccomp
99+
100+
**`seccomp`** (object, OPTIONAL) represents the runtime's implementation status of seccomp.
101+
Irrelevant to the kernel version of the host operating system.
102+
103+
* **`enabled`** (bool, OPTIONAL) represents whether the runtime supports seccomp.
104+
* **`actions`** (array of strings, OPTIONAL) The recognized names of the seccomp actions.
105+
The runtime MUST recognize the elements in this array in the [`syscalls[].action` property of the `linux.seccomp` object in `config.json`](config-linux.md#seccomp).
106+
* **`operators`** (array of strings, OPTIONAL) The recognized names of the seccomp operators.
107+
The runtime MUST recognize the elements in this array in the [`syscalls[].args[].op` property of the `linux.seccomp` object in `config.json`](config-linux.md#seccomp).
108+
* **`archs`** (array of strings, OPTIONAL) The recognized names of the seccomp architectures.
109+
The runtime MUST recognize the elements in this array in the [`architectures` property of the `linux.seccomp` object in `config.json`](config-linux.md#seccomp).
110+
111+
### Example
112+
113+
```json
114+
"seccomp": {
115+
"enabled": true,
116+
"actions": [
117+
"SCMP_ACT_ALLOW",
118+
"SCMP_ACT_ERRNO",
119+
"SCMP_ACT_KILL",
120+
"SCMP_ACT_LOG",
121+
"SCMP_ACT_NOTIFY",
122+
"SCMP_ACT_TRACE",
123+
"SCMP_ACT_TRAP"
124+
],
125+
"operators": [
126+
"SCMP_CMP_EQ",
127+
"SCMP_CMP_GE",
128+
"SCMP_CMP_GT",
129+
"SCMP_CMP_LE",
130+
"SCMP_CMP_LT",
131+
"SCMP_CMP_MASKED_EQ",
132+
"SCMP_CMP_NE"
133+
],
134+
"archs": [
135+
"SCMP_ARCH_AARCH64",
136+
"SCMP_ARCH_ARM",
137+
"SCMP_ARCH_MIPS",
138+
"SCMP_ARCH_MIPS64",
139+
"SCMP_ARCH_MIPS64N32",
140+
"SCMP_ARCH_MIPSEL",
141+
"SCMP_ARCH_MIPSEL64",
142+
"SCMP_ARCH_MIPSEL64N32",
143+
"SCMP_ARCH_PPC",
144+
"SCMP_ARCH_PPC64",
145+
"SCMP_ARCH_PPC64LE",
146+
"SCMP_ARCH_S390",
147+
"SCMP_ARCH_S390X",
148+
"SCMP_ARCH_X32",
149+
"SCMP_ARCH_X86",
150+
"SCMP_ARCH_X86_64"
151+
]
152+
}
153+
```
154+
155+
## <a name="linuxFeaturesApparmor" />AppArmor
156+
157+
**`apparmor`** (object, OPTIONAL) represents the runtime's implementation status of AppArmor.
158+
Irrelevant to the availability of AppArmor on the host operating system.
159+
160+
* **`enabled`** (bool, OPTIONAL) represents whether the runtime supports AppArmor.
161+
162+
### Example
163+
164+
```json
165+
"apparmor": {
166+
"enabled": true
167+
}
168+
```
169+
170+
## <a name="linuxFeaturesApparmor" />SELinux
171+
172+
**`selinux`** (object, OPTIONAL) represents the runtime's implementation status of SELinux.
173+
Irrelevant to the availability of SELinux on the host operating system.
174+
175+
* **`enabled`** (bool, OPTIONAL) represents whether the runtime supports AppArmor.
176+
177+
### Example
178+
179+
```json
180+
"selinux": {
181+
"enabled": true
182+
}
183+
```

0 commit comments

Comments
 (0)