Closed levshukovv closed 1 year ago
Hi there!
For the pivot_root
syscall itself, you'll need the CAP_SYS_ADMIN
capability, as you've already figured out.
On top of that, Docker also by default applies a seccomp policy, which interferes here. See the docs, pivot_root
is explicitly disallowed by default.
You can either continue with --privileged
(Sandbox2 is the only layer then), or try and add --security-opt seccomp=unconfined
to disable seccomp.
Thank you for the so fast reply!
Hi colleagues!
I want to use sandbox2 inside docker container. To understand what capabilities I need to use I have build tools (andboxed_api/sandbox2/examples)/tool) and want to run it inside container
Dockerfile: FROM mcr.microsoft.com/devcontainers/cpp:ubuntu-22.04 COPY sandbox2tool sandbox2tool
How I tried to run docker container and it did not work:
If I run docker image with --privileged flag it works without any issue.