genuinetools / img

Standalone, daemon-less, unprivileged Dockerfile and OCI compatible container image builder.
https://blog.jessfraz.com/post/building-container-images-securely-on-kubernetes/
MIT License
3.88k stars 230 forks source link

WIP: Readme revamp #287

Open kekoav opened 4 years ago

kekoav commented 4 years ago

Let's give the README a much-needed refresh. Let's collaborate on this to make img easier to use, and reduce the time for newcomers to get started.

Some of my goals here:

Resolves #251 .

Table of Contents

I'm experimenting with a depth of 3 to limit noise on the TOC.

markdown-toc --maxdepth 3 -i README.md

TODO

The following areas I still think are weak. I'm perusing common issues and looking for user gaps that could make adoption of img easier.

frezbo commented 4 years ago

@kekoav FYI, I was able to get img working on fedora 31 with cgroupsv2 just by creating a symlink for runc pointing to crun, which I did not expect at all to work. Not sure if it's worth mentioning in README

kekoav commented 4 years ago

@kekoav FYI, I was able to get img working on fedora 31 with cgroupsv2 just by creating a symlink for runc pointing to crun, which I did not expect at all to work. Not sure if it's worth mentioning in README

@frezbo That is very nice, does that change the security requirements necessary? Can we run with less privileges?

frezbo commented 4 years ago

I was running as a normal user in a fedora 31 VM.

codecov-io commented 4 years ago

Codecov Report

Merging #287 into master will not change coverage. The diff coverage is n/a.

Impacted file tree graph

@@          Coverage Diff           @@
##           master    #287   +/-   ##
======================================
  Coverage    0.00%   0.00%           
======================================
  Files          16      16           
  Lines        1006    1006           
======================================
  Misses       1006    1006           

Continue to review full report at Codecov.

Legend - Click here to learn more Δ = absolute <relative> (impact), ø = not affected, ? = missing data Powered by Codecov. Last update 89fb42e...49519e9. Read the comment docs.

ChrisTomAlx commented 4 years ago

docker run --rm -it --name img --volume "$(pwd):/home/user/src:ro" --workdir /home/user/src --volume "${HOME}/.docker:/root/.docker:ro" --security-opt seccomp=unconfined --security-opt apparmor=unconfined --security-opt systempaths=unconfined --entrypoint sh r.j3ss.co/img

This is exactly how I had to run it to make it work on docker toolbox for windows.. Just dropping it here in case it helps someone. As you can see I added the double quotes for the first --volume

kekoav commented 4 years ago

This is exactly how I had to run it to make it work on docker toolbox for windows.. Just dropping it here in case it helps someone. As you can see I added the double quotes for the first --volume

@ChrisTomAlx Updated to add quotes on both.