-
Notifications
You must be signed in to change notification settings - Fork 600
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
split tls-generate-certs.sh from dockerd-entrypoint.sh #168
Conversation
An alternative way is to just extend the current dockerd-entrypoint.sh to support rootless |
I think I'd like to understand more about the goal of running rootless |
Rootless protects the host from potential vulns of Docker, containerd, and runc |
But if it's running inside a |
No, it is just same as non-root on the host.
In other words, |
Or maybe it is less privileged than non-root-on-the-host, because it has fewer suid binaries (only |
Also, as a side effect, splitting the script will be helpful for testing issues like #171 |
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
rebased |
I'd rather not have a sprawl of many scripts and instead have one script that can do everything required for dind-related startup (root or not). |
The standard |
@tonistiigi @tiborvass Do you think the rootless image should be separated from |
It's going to be separate for (the `rootlesskit` and `vpnkit` binaries are
not exactly trivial in size).
I've got an alternate proposal to yours worked up, I just haven't had time
to actually open it as a PR for you to review yet. Hoping to get that open
ASAP (either tonight or tomorrow).
|
closing in favor of #174 |
Signed-off-by: Akihiro Suda akihiro.suda.cz@hco.ntt.co.jp
so that it can be called from dind-rootless (#165) entrypoint script