github.com/akerouanton/docker@v1.11.0-rc3/oci/defaults_linux.go (about) 1 package oci 2 3 import ( 4 "os" 5 "runtime" 6 7 "github.com/opencontainers/specs/specs-go" 8 ) 9 10 func sPtr(s string) *string { return &s } 11 func rPtr(r rune) *rune { return &r } 12 func iPtr(i int64) *int64 { return &i } 13 func u32Ptr(i int64) *uint32 { u := uint32(i); return &u } 14 func fmPtr(i int64) *os.FileMode { fm := os.FileMode(i); return &fm } 15 16 // DefaultSpec returns default oci spec used by docker. 17 func DefaultSpec() specs.Spec { 18 s := specs.Spec{ 19 Version: specs.Version, 20 Platform: specs.Platform{ 21 OS: runtime.GOOS, 22 Arch: runtime.GOARCH, 23 }, 24 } 25 s.Mounts = []specs.Mount{ 26 { 27 Destination: "/proc", 28 Type: "proc", 29 Source: "proc", 30 Options: []string{"nosuid", "noexec", "nodev"}, 31 }, 32 { 33 Destination: "/dev", 34 Type: "tmpfs", 35 Source: "tmpfs", 36 Options: []string{"nosuid", "strictatime", "mode=755"}, 37 }, 38 { 39 Destination: "/dev/pts", 40 Type: "devpts", 41 Source: "devpts", 42 Options: []string{"nosuid", "noexec", "newinstance", "ptmxmode=0666", "mode=0620", "gid=5"}, 43 }, 44 { 45 Destination: "/sys", 46 Type: "sysfs", 47 Source: "sysfs", 48 Options: []string{"nosuid", "noexec", "nodev", "ro"}, 49 }, 50 { 51 Destination: "/sys/fs/cgroup", 52 Type: "cgroup", 53 Source: "cgroup", 54 Options: []string{"ro", "nosuid", "noexec", "nodev"}, 55 }, 56 { 57 Destination: "/dev/mqueue", 58 Type: "mqueue", 59 Source: "mqueue", 60 Options: []string{"nosuid", "noexec", "nodev"}, 61 }, 62 } 63 64 s.Process.Capabilities = []string{ 65 "CAP_CHOWN", 66 "CAP_DAC_OVERRIDE", 67 "CAP_FSETID", 68 "CAP_FOWNER", 69 "CAP_MKNOD", 70 "CAP_NET_RAW", 71 "CAP_SETGID", 72 "CAP_SETUID", 73 "CAP_SETFCAP", 74 "CAP_SETPCAP", 75 "CAP_NET_BIND_SERVICE", 76 "CAP_SYS_CHROOT", 77 "CAP_KILL", 78 "CAP_AUDIT_WRITE", 79 } 80 81 s.Linux = specs.Linux{ 82 Namespaces: []specs.Namespace{ 83 {Type: "mount"}, 84 {Type: "network"}, 85 {Type: "uts"}, 86 {Type: "pid"}, 87 {Type: "ipc"}, 88 }, 89 Devices: []specs.Device{ 90 { 91 Type: "c", 92 Path: "/dev/zero", 93 Major: 1, 94 Minor: 5, 95 FileMode: fmPtr(0666), 96 UID: u32Ptr(0), 97 GID: u32Ptr(0), 98 }, 99 { 100 Type: "c", 101 Path: "/dev/null", 102 Major: 1, 103 Minor: 3, 104 FileMode: fmPtr(0666), 105 UID: u32Ptr(0), 106 GID: u32Ptr(0), 107 }, 108 { 109 Type: "c", 110 Path: "/dev/urandom", 111 Major: 1, 112 Minor: 9, 113 FileMode: fmPtr(0666), 114 UID: u32Ptr(0), 115 GID: u32Ptr(0), 116 }, 117 { 118 Type: "c", 119 Path: "/dev/random", 120 Major: 1, 121 Minor: 8, 122 FileMode: fmPtr(0666), 123 UID: u32Ptr(0), 124 GID: u32Ptr(0), 125 }, 126 { 127 Type: "c", 128 Path: "/dev/fuse", 129 Major: 10, 130 Minor: 229, 131 FileMode: fmPtr(0666), 132 UID: u32Ptr(0), 133 GID: u32Ptr(0), 134 }, 135 }, 136 Resources: &specs.Resources{ 137 Devices: []specs.DeviceCgroup{ 138 { 139 Allow: false, 140 Access: sPtr("rwm"), 141 }, 142 { 143 Allow: true, 144 Type: sPtr("c"), 145 Major: iPtr(1), 146 Minor: iPtr(5), 147 Access: sPtr("rwm"), 148 }, 149 { 150 Allow: true, 151 Type: sPtr("c"), 152 Major: iPtr(1), 153 Minor: iPtr(3), 154 Access: sPtr("rwm"), 155 }, 156 { 157 Allow: true, 158 Type: sPtr("c"), 159 Major: iPtr(1), 160 Minor: iPtr(9), 161 Access: sPtr("rwm"), 162 }, 163 { 164 Allow: true, 165 Type: sPtr("c"), 166 Major: iPtr(1), 167 Minor: iPtr(8), 168 Access: sPtr("rwm"), 169 }, 170 { 171 Allow: true, 172 Type: sPtr("c"), 173 Major: iPtr(5), 174 Minor: iPtr(0), 175 Access: sPtr("rwm"), 176 }, 177 { 178 Allow: true, 179 Type: sPtr("c"), 180 Major: iPtr(5), 181 Minor: iPtr(1), 182 Access: sPtr("rwm"), 183 }, 184 { 185 Allow: false, 186 Type: sPtr("c"), 187 Major: iPtr(10), 188 Minor: iPtr(229), 189 Access: sPtr("rwm"), 190 }, 191 }, 192 }, 193 } 194 195 return s 196 }