-
-
Add the security options to the `nerdctl run`.
- [x] [Seccomp security profiles for Docker](https://docs.docker.com/engine/security/seccomp/)
- [x] [AppArmor security profiles for Docker](https:…
-
Both the default apparmor and seccomp profiles contain restrictions for **mount**. While seccomp allows it for CAP_SYS_ADMIN, apparmor blocks it altogether: https://github.com/moby/moby/blob/2eb…
-
**Description**
A custom SECCOMP profile can be used to block a container from exiting by denying it access to the `exit_group` and/or `exit` system calls, effectively trapping it on an endless exi…
pjbgf updated
4 years ago
-
The "--privileged" flag does a lot "under the hood"; apart from enabling all capabilities, it also disables apparmor profiles, seccomp profiles, etc.
We should document exactly what the flag does, so…
-
**What is the problem you're trying to solve**
When running a container which requires a custom (seccomp) security profile this needs to be stored in a separate file. It would be nice if this can be …
-
When this project first began, it focused on enumerating binaries' capabilities. It's since grown in two ways:
- We've shifted capability detection to focus on those that may be used maliciously
-…
-
Hi,
Currently, there is no way to update security profiles loaded into containers. We can only specify security profiles for seccomp/apparmor/SELinux during `docker run` using `--security-opt `. Bu…
-
### Bug and expected behavior
After a recent update of `firejail` I am no longer getting any audio from Firefox.
### No profile and disabling firejail
- What changed calling `firejail --nopro…
-
Some users make use of seccomp profiles, but the default unrestricted PSP does not allow to set the profile. It would make sense if the following annotation was added to this PSP by default per what t…