5 ms·
I don't understand this point: - Fully userspace containers, no need for elevated privileges The most basic Linux container is constructed with chroot and n
by jamescun 11y ago
I don't understand this point:
- Fully userspace containers, no need for elevated privileges
The most basic Linux container is constructed with chroot and namespaces, both of which require root privileges (or at least CAP_SYS_CHROOT and CAP_SYS_ADMIN respectively). Additionally managing layers with a union filesystem, unless utilising FUSE, will also require elevated privileges.
- the8472 11y agoIt can have root inside the new user namespace, which - i assume - is sufficient to chroot in its mount namespace.
- jamescun 11y agoA more extensive look at the code, it requires the host root user to set `kernel.unprivileged_userns_clone=1` after which Vagga can perform privileged operations as a "root" user inside a user namespace.
- tailhook 11y agoYes. But that's on debian (IIRC) kernel, i.e. the patched one. On stock kernel it requires CONFIG_USER_NS setting enabled, and it just works.