diff options
Diffstat (limited to 'content/posts/linux-oci-containers-as-jails/index.md')
| -rw-r--r-- | content/posts/linux-oci-containers-as-jails/index.md | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/content/posts/linux-oci-containers-as-jails/index.md b/content/posts/linux-oci-containers-as-jails/index.md index 722a233..7aa44e6 100644 --- a/content/posts/linux-oci-containers-as-jails/index.md +++ b/content/posts/linux-oci-containers-as-jails/index.md @@ -156,9 +156,9 @@ immich-server: removed Now, define the jail properly with a `jail.conf`, taking inspiration from the Handbook. You can also use `bastille`, `iocage` or any other jail manager/wrapper to do this. The goal here is to set up a normal Linux userland with the expected dev nodes as well as special filesystems like `/proc` and `/sys`. -Mount also any directories that are used during runtime, i.e. those that are handled by volume or bind mounts when using OCI containers. +Mount also any directories that are used during runtime, i.e. those that are handled by volume or bind mounts when using OCI containers. Note that the jail does not need any of the `allow.mount.*` directives, since the mount syscalls happen on the host side. -Note that the jail does not need any of the `allow.mount.*` directives, since the mount syscalls happen on the host side. +Remember to set the devfs ruleset to a suitable value in the `devfs_ruleset` directive, which affects the `/dev` mount, as well as the fstab-style `/linux/dev` mount. Edit as needed: @@ -173,7 +173,7 @@ immich-server { allow.raw_sockets; exec.clean; mount.devfs; - devfs_ruleset = 4; # Ensure that you use a devfs ruleset that exposes all basic devices + devfs_ruleset = 4; # Ensure that you use a devfs ruleset that exposes all basic devices enforce_statfs = 1; # Allow the jail to see what's mounted # HOSTNAME/PATH @@ -185,7 +185,7 @@ immich-server { interface = lan0; # LINUX SPECIAL MOUNTS - mount += "devfs $path/linux/dev devfs rw 0 0"; + mount += "devfs $path/linux/dev devfs rw,ruleset=4 0 0"; mount += "tmpfs $path/linux/dev/shm tmpfs rw,size=1g,mode=1777 0 0"; mount += "fdescfs $path/linux/dev/fd fdescfs rw,linrdlnk 0 0"; mount += "linprocfs $path/linux/proc linprocfs rw 0 0"; |