Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Docs for sourcemage official image #354

Merged
merged 6 commits into from
Oct 20, 2015
Merged

Conversation

vaygr
Copy link
Contributor

@vaygr vaygr commented Oct 2, 2015

Request for docs for sourcemage official image pull request

@vaygr
Copy link
Contributor Author

vaygr commented Oct 19, 2015

Official image is already there, waiting for this PR for a nice page at the Docker Hub.

@tianon
Copy link
Member

tianon commented Oct 19, 2015

LGTM

@tianon
Copy link
Member

tianon commented Oct 19, 2015

Whoa one sec, just noticed that --privileged. That's going to need some explanation. 😉

@tianon
Copy link
Member

tianon commented Oct 19, 2015

There's got to be a way to make the package manager work with less than full --privileged. 😕

@tianon
Copy link
Member

tianon commented Oct 19, 2015

CastFS failed the sanity check, staging disabled!

Looks like it does work fine without --privileged, it just doesn't get the full benefit of "CastFS".

@tianon
Copy link
Member

tianon commented Oct 19, 2015

(Which I think is more OK in the case of Docker than in the normal desktop case since your installation ought to be happening in throw-away containers anyways, right?)

@tianon
Copy link
Member

tianon commented Oct 19, 2015

I successfully got CastFS to work with just --device /dev/fuse --cap-add SYS_ADMIN, which is better than --privileged (which gives full privileges to the entire host device hierarchy, for example), but still isn't great since SYS_ADMIN controls a lot more than just whether we can mount. Since it works without, I think I'd rather we not include it by default, and have CastFS notes in a separate section noting that there are security implications to granting these capabilities/privileges to the container.

@tianon
Copy link
Member

tianon commented Oct 19, 2015

This is also really important to note because in a Dockerfile, we have no way of adding devices or extra capabilities, so it's great that the following Dockerfile actually works: (just tested it! 👍)

FROM sourcemage
RUN cast tmux

…se --cap-add SYS_ADMIN' in the notes; added security warning
@vaygr
Copy link
Contributor Author

vaygr commented Oct 20, 2015

Got it.

Please see my latest commit which takes care of that.

@yosifkit
Copy link
Member

LGTM

@tianon
Copy link
Member

tianon commented Oct 20, 2015

Awesome, thanks! 👍

re-LGTM

tianon added a commit that referenced this pull request Oct 20, 2015
Docs for sourcemage official image
@tianon tianon merged commit 10fdad1 into docker-library:master Oct 20, 2015
@tianon
Copy link
Member

tianon commented Oct 20, 2015

🎈

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants