podman/oci-umount
Watch
1
0
Fork
You've already forked oci-umount
 0
mirror of https://github.com/containers/oci-umount synced 2026-07-21 14:03:59 +00:00
Code Issues Projects Releases Packages Wiki Activity
No description
289 commits 1 branch 4 tags 322 KiB
  • C 94.3%
  • Makefile 3.9%
  • M4 1.8%
Find a file
Exact
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Daniel J Walsh 9443ab9aeb
 Merge pull request #50 from TomSweeneyRedHat/sec 
Add Security Policy
2020-05-11 10:55:58 -04:00
doc Add manpages for .conf files 2019-01-28 08:55:45 -05:00
src Merge pull request #44 from jnovy/leak 2019-09-27 15:26:28 +02:00
.dir-locals.el .dir-locals.el: Tell Emacs we're using linux kernel style 2016-05-12 10:45:16 -04:00
.gitignore Fixup the name of files to ignore in .gitignore 2016-09-23 11:54:08 -07:00
CODE-OF-CONDUCT.md Add Code of Conduct 2020-02-08 17:41:00 -05:00
configure.ac bump for 2.5 2019-02-01 11:44:08 -05:00
INSTALL autotools: Add default INSTALL COPYING files 2015-11-10 12:38:20 -05:00
LICENSE Rename COPYING to LICENSE 2015-11-23 17:46:21 -05:00
Makefile.am Add manpages for .conf files 2019-01-28 08:55:45 -05:00
oci-umount-options.conf Provide a knob log_level to control verbosity of messages 2017-11-07 12:47:42 -05:00
oci-umount.conf oci-umount.conf: add CRI-O paths 2018-02-28 16:55:58 +01:00
oci-umount.json Hooks are fired off via stage not stages 2017-12-19 13:29:40 +00:00
oci-umount.spec bump for 2.5 2019-02-01 11:44:08 -05:00
README.md README.md: Update with current build instructions 2017-06-07 10:55:18 -04:00
SECURITY.md Add Security Policy 2020-05-09 16:51:32 -04:00

README.md

OCI Umount

oci-umount is a OCI hook program that will umount any file systems listed in /etc/oci-umount.conf file before starting a container. The goal with this tool is to help prevent container mount space leaking into other containers.

This project produces a golang that can be used with container runtimes and runc (with minor code changes). If you clone this branch and build/install umount.go, a binary will be placed in /usr/libexec/oci/hooks.d named oci-umount. You can change this location by editing HOOKSDIR in the Makefile.

With minor changes to upstream docker code, this binary will be executed when starting a containers via prestart hooks.

Running runc containers with this executable, oci-umount() is called just before a container is started and after it is provisioned.

This doc assumes you are running at least docker version 1.12 with the dockerhooks patch. Also, place this project in your GOPATH.

To build, install, clean-up:

First, clone this branch in your GOPATH, then:

autoreconf -i

./configure --libexecdir=/usr/libexec/oci/hooks.d/

make

make install

make clean