You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
must be modified to add this runtime. If you want it to be invoked every time a container is
48
61
created, you should also make it the default runtime (instead of `runc`).
49
62
50
-
If you are not using a custom OCI runtime like `crun` or `youki`, you can omit the `--oi-runtime-path`
51
-
option, as it defaults to `runc`, the default runtime included with Docker.
63
+
If you are not using an alternative OCI runtime such as [`crun`](https://github.com/containers/crun) or [`youki`](https://github.com/containers/youki), you can omit the `--oi-runtime-path`
64
+
option, as it defaults to `runc`, the default runtime bundled with Docker.
52
65
53
66
#### Example `/etc/docker/daemon.json` contents
54
67
@@ -65,36 +78,55 @@ option, as it defaults to `runc`, the default runtime included with Docker.
65
78
}
66
79
}
67
80
```
81
+
The Docker daemon must be restarted (`systemctl restart docker.service`) in order to apply changes to this configuration file.
68
82
69
-
Even if you set `oci-interceptor` as the default runtime, you can still bypass it while running a container via`docker run --runtime=runc`.
83
+
Note that if you set `oci-interceptor` as the default runtime, you can still bypass it for a specific container by specifying`docker run --runtime=runc`.
70
84
71
-
While it is not possible to override `runtimeArgs`using a `docker run` option, you could specify several different "runtimes" (with different `runtimeArgs`) and switch between them using `docker run --runtime=<name>`.
85
+
While it is not possible to override `runtimeArgs`with a `docker run` option, you could specify multiple interceptor "runtimes" (with different flags) and switch between them using `docker run --runtime=<name>`.
72
86
73
87
## Supported Customizations
74
88
75
-
### Readonly networking mounts
89
+
### Read-only networking mounts
76
90
77
-
Works around the fact that Docker mounts the following files as read/write by default (https://github.com/moby/moby/issues/41991):
91
+
Works around the fact that Docker mounts the following files as read/write by default:
78
92
79
93
-`/etc/hosts`
80
94
-`/etc/hostname`
81
95
-`/etc/resolv.conf`
82
96
83
97
When XFS project quotas are used to [restrict a container's writable layer
84
98
size](https://github.com/moby/moby/pull/24771), these files provide an escape hatch for malicious
85
-
users to fill the graph storage volume. This can be circumvented by manually mounting readonly files
86
-
over these paths, but in that case Docker can no longer manage the container's DNS configuration.
99
+
users to fill the host storage volume.
100
+
101
+
This can usually only be circumvented by manually creating read-only bind mounts over these paths (in which case Docker can no longer manage the container's DNS configuration) or by making the entire rootfs read-only (which severely constrains the workloads possible inside the container).
102
+
103
+
To avoid this issue, specify the `--oi-readonly-networking-mounts` flag. This modifies these mounts to be read-only, preventing writes from inside the container.
104
+
105
+
#### Related issues
106
+
107
+
- Workaround for [moby#13152](https://github.com/moby/moby/issues/41991), [moby#41991](https://github.com/moby/moby/issues/41991) (without custom bind mounts or making entire rootfs readonly)
Allows specifying default environment variable values for containers without using `docker run --env` or `--env-file`.
113
+
114
+
Use `--oi-env <NAME=VALUE>` to set a default for an environment variable. This will not take precedence over a value explicitly specified via `docker run --env` or `--env-file`.
115
+
116
+
Alternatively, use `--oi-env-force <NAME=VALUE>` to force an certain value even when otherwise specified via `docker run --env` or `--env-file`.
87
117
88
-
To avoid this issue, specify the `--oi-readonly-networking-mounts` flag, which automatically modifies
89
-
these mounts to be read-only, preventing writes from inside the container.
118
+
#### Related issues
119
+
- Workaround for [moby#16699](https://github.com/moby/moby/issues/16699) (supports arbitrary environment variables, not only proxy config)
120
+
- Solution for https://stackoverflow.com/questions/33775075/how-to-set-default-docker-environment-variables
121
+
- Solution for https://stackoverflow.com/questions/50644143/dockerd-set-default-environment-variable-for-all-containers
90
122
91
123
### Debug output
92
124
93
-
Specify the `--oi-write-debug-output` flag to write original, parsed, and modified container configs to the directory specified by`--oi-debug-output-dir` (default `/var/log/oci-interceptor`).
125
+
Specify the `--oi-write-debug-output` flag to write original, parsed, and modified container configs to the directory specified as`--oi-debug-output-dir` (default `/var/log/oci-interceptor`).
94
126
95
-
These filenames will have the format:
127
+
The resulting files will be named:
96
128
-`<container_hostname>_original.json` (the original config)
97
129
-`<container_hostname>_parsed.json` (the parsed config)
98
130
-`<container_hostname>_modified.json` (the modified config, only written if modification occurred)
99
131
100
-
Additionally, forwarded calls to the underlying OCI runtime will be appended to the file `runtime_calls.txt` within this directory.
132
+
Additionally, forwarded calls to the underlying OCI runtime will be appended to the file `runtime_calls.txt` within the debug output directory.
0 commit comments