On a normal system, the container runtime (e.g. docker or containerd) needs to have great power because you don't know what users want to do and you need it to just work. We don't have that same requirement. We know what users are going to do and so we can refine things down. So far I've found that container_runtime_t can:
On a normal system, the container runtime (e.g. docker or containerd) needs to have great power because you don't know what users want to do and you need it to just work. We don't have that same requirement. We know what users are going to do and so we can refine things down. So far I've found that container_runtime_t can: