hyperhq / runv

Hypervisor-based Runtime for OCI
Apache License 2.0
828 stars 129 forks source link

oci: support Masked Paths and Readonly Paths #552

Closed laijs closed 7 years ago

laijs commented 7 years ago

https://github.com/opencontainers/runtime-spec/blob/1c9ab429b8ca87cb484a54abbb1781821845edab/config-linux.md#masked-paths

Masked Paths

maskedPaths (array of strings, OPTIONAL) will mask over the provided paths inside the container so that they cannot be read. The values MUST be absolute paths in the container namespace.

Example

    "maskedPaths": [
        "/proc/kcore"
    ]

Readonly Paths

readonlyPaths (array of strings, OPTIONAL) will set the provided paths as readonly inside the container. The values MUST be absolute paths in the container namespace.

Example

    "readonlyPaths": [
        "/proc/sys"
    ]