Skip to content

L
lxc
Commit d665d89a by brauner Committed by Stéphane Graber
Options

config: Allow all containers to use fuse

This enables containers to mount fuse filesystems per default. The mount is designed to be safe. Hence, it can be enabled per default in common.conf. It will lead to a cleaner boot for some unprivileged systemd-based containers. Signed-off-by: 's avatarChristian Brauner <christianvanbrauner@gmail.com> Acked-by: 's avatarStéphane Graber <stgraber@ubuntu.com>
parent 7efe6f67
Showing with 3 additions and 14 deletions
config/templates/common.conf.in
...@@ -42,9 +42,12 @@ lxc.cgroup.devices.allow = c 1:8 rwm ...@@ -42,9 +42,12 @@ lxc.cgroup.devices.allow = c 1:8 rwm
lxc.cgroup.devices.allow = c 1:9 rwm lxc.cgroup.devices.allow = c 1:9 rwm
### /dev/pts/* ### /dev/pts/*
lxc.cgroup.devices.allow = c 136:* rwm lxc.cgroup.devices.allow = c 136:* rwm
### fuse
lxc.cgroup.devices.allow = c 10:229 rwm
# Setup the default mounts # Setup the default mounts
lxc.mount.auto = cgroup:mixed proc:mixed sys:mixed lxc.mount.auto = cgroup:mixed proc:mixed sys:mixed
lxc.mount.entry = /sys/fs/fuse/connections sys/fs/fuse/connections none bind,optional 0 0
# Blacklist some syscalls which are not safe in privileged # Blacklist some syscalls which are not safe in privileged
# containers # containers
......
config/templates/debian.common.conf.in
...@@ -4,9 +4,6 @@ lxc.include = @LXCTEMPLATECONFIG@/common.conf ...@@ -4,9 +4,6 @@ lxc.include = @LXCTEMPLATECONFIG@/common.conf
# Doesn't support consoles in /dev/lxc/ # Doesn't support consoles in /dev/lxc/
lxc.devttydir = lxc.devttydir =
# Default mount entries
lxc.mount.entry = /sys/fs/fuse/connections sys/fs/fuse/connections none bind,optional 0 0
# When using LXC with apparmor, the container will be confined by default. # When using LXC with apparmor, the container will be confined by default.
# If you wish for it to instead run unconfined, copy the following line # If you wish for it to instead run unconfined, copy the following line
# (uncommented) to the container's configuration file. # (uncommented) to the container's configuration file.
...@@ -24,8 +21,6 @@ lxc.mount.entry = /sys/fs/fuse/connections sys/fs/fuse/connections none bind,opt ...@@ -24,8 +21,6 @@ lxc.mount.entry = /sys/fs/fuse/connections sys/fs/fuse/connections none bind,opt
# Extra cgroup device access # Extra cgroup device access
## rtc ## rtc
lxc.cgroup.devices.allow = c 254:0 rm lxc.cgroup.devices.allow = c 254:0 rm
## fuse
lxc.cgroup.devices.allow = c 10:229 rwm
## tun ## tun
lxc.cgroup.devices.allow = c 10:200 rwm lxc.cgroup.devices.allow = c 10:200 rwm
## hpet ## hpet
......
config/templates/gentoo.common.conf.in
...@@ -12,8 +12,6 @@ lxc.devttydir = ...@@ -12,8 +12,6 @@ lxc.devttydir =
# Extra cgroup device access # Extra cgroup device access
## rtc ## rtc
lxc.cgroup.devices.allow = c 254:0 rm lxc.cgroup.devices.allow = c 254:0 rm
## fuse
lxc.cgroup.devices.allow = c 10:229 rwm
## tun ## tun
lxc.cgroup.devices.allow = c 10:200 rwm lxc.cgroup.devices.allow = c 10:200 rwm
## hpet ## hpet
......
config/templates/openwrt.common.conf.in
...@@ -34,8 +34,6 @@ lxc.cgroup.devices.allow = c 5:2 rwm ...@@ -34,8 +34,6 @@ lxc.cgroup.devices.allow = c 5:2 rwm
lxc.cgroup.devices.allow = c 136:* rwm lxc.cgroup.devices.allow = c 136:* rwm
## rtc ## rtc
lxc.cgroup.devices.allow = c 254:0 rm lxc.cgroup.devices.allow = c 254:0 rm
## fuse
lxc.cgroup.devices.allow = c 10:229 rwm
## tun ## tun
lxc.cgroup.devices.allow = c 10:200 rwm lxc.cgroup.devices.allow = c 10:200 rwm
## dev/tty0 ## dev/tty0
......
config/templates/plamo.common.conf.in
...@@ -7,5 +7,3 @@ lxc.devttydir = ...@@ -7,5 +7,3 @@ lxc.devttydir =
# Extra cgroup device access # Extra cgroup device access
## rtc ## rtc
lxc.cgroup.devices.allow = c 254:0 rm lxc.cgroup.devices.allow = c 254:0 rm
## fuse
lxc.cgroup.devices.allow = c 10:229 rwm
config/templates/ubuntu.common.conf.in
...@@ -2,7 +2,6 @@ ...@@ -2,7 +2,6 @@
lxc.include = @LXCTEMPLATECONFIG@/common.conf lxc.include = @LXCTEMPLATECONFIG@/common.conf
# Default mount entries # Default mount entries
lxc.mount.entry = /sys/fs/fuse/connections sys/fs/fuse/connections none bind,optional 0 0
lxc.mount.entry = /sys/kernel/debug sys/kernel/debug none bind,optional 0 0 lxc.mount.entry = /sys/kernel/debug sys/kernel/debug none bind,optional 0 0
lxc.mount.entry = /sys/kernel/security sys/kernel/security none bind,optional 0 0 lxc.mount.entry = /sys/kernel/security sys/kernel/security none bind,optional 0 0
lxc.mount.entry = /sys/fs/pstore sys/fs/pstore none bind,optional 0 0 lxc.mount.entry = /sys/fs/pstore sys/fs/pstore none bind,optional 0 0
...@@ -28,8 +27,6 @@ lxc.mount.entry = /sys/fs/pstore sys/fs/pstore none bind,optional 0 0 ...@@ -28,8 +27,6 @@ lxc.mount.entry = /sys/fs/pstore sys/fs/pstore none bind,optional 0 0
# Extra cgroup device access # Extra cgroup device access
## rtc ## rtc
lxc.cgroup.devices.allow = c 254:0 rm lxc.cgroup.devices.allow = c 254:0 rm
## fuse
lxc.cgroup.devices.allow = c 10:229 rwm
## tun ## tun
lxc.cgroup.devices.allow = c 10:200 rwm lxc.cgroup.devices.allow = c 10:200 rwm
## hpet ## hpet
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment