Linux-specific Container Configuration

The Linux container specification uses various kernel features like namespaces, cgroups, capabilities, LSM, and file system jails to fulfill the spec. Additional information is needed for Linux over the default spec configuration in order to configure these various kernel features.

Capabilities

Capabilities is an array that specifies Linux capabilities that can be provided to the process inside the container. Valid values are the strings for capabilities defined in the man page

   "capabilities": [
        "CAP_AUDIT_WRITE",
        "CAP_KILL",
        "CAP_NET_BIND_SERVICE"
    ]

User namespace mappings

    "uidMappings": [
        {
            "hostID": 1000,
            "containerID": 0,
            "size": 10
        }
    ],
    "gidMappings": [
        {
            "hostID": 1000,
            "containerID": 0,
            "size": 10
        }
    ]

uid/gid mappings describe the user namespace mappings from the host to the container. The mappings represent how the bundle rootfs expects the user namespace to be setup and the runtime SHOULD NOT modify the permissions on the rootfs to realize the mapping. hostID is the starting uid/gid on the host to be mapped to containerID which is the starting uid/gid in the container and size refers to the number of ids to be mapped. There is a limit of 5 mappings which is the Linux kernel hard limit.

Default Devices and File Systems

The Linux ABI includes both syscalls and several special file paths. Applications expecting a Linux environment will very likely expect these files paths to be setup correctly.

The following devices and filesystems MUST be made available in each application's filesystem

Path	Type	Notes
/proc	procfs
/sys	sysfs
/dev/null	device
/dev/zero	device
/dev/full	device
/dev/random	device
/dev/urandom	device
/dev/tty	device
/dev/console	device
/dev/pts	devpts
/dev/ptmx	device	Bind-mount or symlink of /dev/pts/ptmx
/dev/shm	tmpfs