diff options
| author | Daniel Baumann <daniel.baumann@progress-linux.org> | 2019-02-17 17:40:15 +0000 |
|---|---|---|
| committer | Daniel Baumann <daniel.baumann@progress-linux.org> | 2019-02-23 16:29:28 +0000 |
| commit | 13175dfc19dbac8d7024f3f5fb3d838a4bc7a0a1 (patch) | |
| tree | a033edc5f91aa71f29e5f5688d56ac6f48c97d26 /share/doc/HOST-SETUP.txt | |
| parent | Adding upstream version 20180825. (diff) | |
| download | open-infrastructure-compute-tools-13175dfc19dbac8d7024f3f5fb3d838a4bc7a0a1.tar.xz open-infrastructure-compute-tools-13175dfc19dbac8d7024f3f5fb3d838a4bc7a0a1.zip | |
Adding upstream version 20190222.upstream/20190222
Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>
Diffstat (limited to 'share/doc/HOST-SETUP.txt')
| -rw-r--r-- | share/doc/HOST-SETUP.txt | 39 |
1 files changed, 29 insertions, 10 deletions
diff --git a/share/doc/HOST-SETUP.txt b/share/doc/HOST-SETUP.txt index 74b7333..d2e4216 100644 --- a/share/doc/HOST-SETUP.txt +++ b/share/doc/HOST-SETUP.txt @@ -1,5 +1,5 @@ -container-tools: Host Setup -=========================== +compute-tools: Host Setup +========================= 1. Debian Packages @@ -180,14 +180,33 @@ iface br100 inet static EOF -4. Enabling container-shell +4. Enabling user namespace for unprivileged containers +------------------------------------------------------ + +Linux supports unprivileged containers with the user namespace. +By default the user namespace is disabled on Debian systems (see #898446). +To enable user namespace, edit the following file for a permant change: + + /etc/sysctl.d/zz-compute-tools.conf + sysctl -p + +or enable it manually with: + + echo 1 > /proc/sys/kernel/unprivileged_userns_clone + +Note that containers need to be started with the correct +configuration in /etc/compute-tools/container/config to run unpriviled +(private-users option). + + +5. Enabling container-shell --------------------------- -Managing containers requires root privileges. In order to allow unprivileged -users to manage containers without granting them privileges or accounts, -the container-shell can be used together with sudo and a container user. +Managing privileged containers requires root privileges. In order to allow +unprivileged users to manage privileged containers without granting them +privileges or accounts, the container-shell can be used together with sudo +and a container user. - sudo adduser --gecos "container-tools,,," \ - --home /var/lib/machines/container-tools \ - --shell /usr/bin/container-shell \ - --no-create-home container + sudo adduser --gecos "compute-tools,,," \ + --home /var/lib/open-infrastructure/container-shell \ + --shell /usr/bin/container-shell |