6 ms·

I think you can already build Docker images via Docker within travis CI, because they somehow provide you (semi?-)privileged access to the required Linux cgroup

by miduil 8y ago

I think you can already build Docker images via Docker within travis CI, because they somehow provide you (semi?-)privileged access to the required Linux cgroup and namespace features. If you are running within a regular Docker container commands such as sysctl -w kernel.unprivileged_userns_clone=1 are not possible, due to /sys being read-only. Am I doing something wrong?

ihucos 8y ago
> I think you can already build Docker images via Docker within travis CI, [...] The nice think about plash is that you don't have to worry about "official" support. > [...] due to /sys being read-only. Dammit, no, so yeah, apparently unfortunately for regular docker containers (not privileged ones) you need to disable unsharing in plash (export PLASH_NO_UNSHARE=1). In that case the only requirements are chroot, a rudimentary mount binary and overlay OR unionfs-fuse and root access. So it should even run in BSD/Minix/macOS and stuff like that, BUT the mountpoints will not get cleaned up. For an instance running for a while that would be a problem, for a temporary docker container not.