ceamac/slocker-lite
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Make bwrap's --unshare-xxx namespaces configurable via global.unshare-*

Browse Source 
Adds six global.unshare-{user,ipc,pid,net,uts,cgroup} config-file keys
(1/on/yes/true or 0/off/no/false, case-insensitive, default on) that
gate whether -r/--run requests each bwrap --unshare-xxx flag when the
kernel also supports it. Replaces the previous hardcoded skip of
--unshare-net, which is now policy-driven like the other five types
and defaults to enabled -- preparation for real network namespace
isolation (slirp4netns) next, on this same branch.
This commit is contained in:
Viorel Munteanu
2026-08-30 09:15:39 +00:00
parent 33cd97fdc8
commit c70abb56a9
7 changed files with 239 additions and 55 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+22 -7
View File
@@ -167,17 +167,32 @@ organized into sections:
```yaml
global:
log-level: debug
unshare-user: on
unshare-ipc: on
unshare-pid: on
unshare-net: on
unshare-uts: on
unshare-cgroup: on
volumes:
mydata: /home/user/slocker-volumes/mydata
```
`global.log-level` is the only standing preference supported today (one-shot
commands like `--mount`/`--run`/`--user` don't belong in a config file). An explicit
`--log-level` on the command line always overrides the config file. The `volumes`
section is managed by `-v/--volume` (see above) rather than hand-edited — it's what
`-r/--run`'s own `-v` usage looks named volumes up in. A missing config file is fine
either way (nothing is overridden, and one gets created the first time
`-v/--volume` is used).
`global.log-level` sets the default log verbosity (an explicit `--log-level` on
the command line always overrides it). The six `global.unshare-<type>` keys
control whether `-r/--run` requests the matching bwrap `--unshare-xxx` flag
(only namespace types the running kernel actually supports are ever affected
either way) — each accepts `1`/`on`/`yes`/`true` or `0`/`off`/`no`/`false`,
case-insensitively, and defaults to `on` (enabled) when unset, so the block
above is also the default with nothing configured. **Note on `unshare-net`**:
with no `slirp4netns`-style setup yet implemented, leaving it enabled (the
default) means a sandboxed container currently has no network access at all —
set `unshare-net: off` if you need the sandbox to see the host's network in
the meantime. No other long options belong in a config file (one-shot
commands like `--mount`/`--run`/`--user` don't). The `volumes` section is
managed by `-v/--volume` (see above) rather than hand-edited — it's what
`-r/--run`'s own `-v` usage looks named volumes up in. A missing config file
is fine either way (nothing is overridden, and one gets created the first
time `-v/--volume` is used).
## How it works