Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

buildah: Add an ADD_CAPABILITIES paramter #1084

Merged
merged 1 commit into from
Jun 21, 2024
Merged

buildah: Add an ADD_CAPABILITIES paramter #1084

merged 1 commit into from
Jun 21, 2024

Conversation

ralphbean
Copy link
Member

This is a rebase of #1017.

This corresponds to 'buildah build --cap-add=<value>'

One use case is when we want to do nested sandboxing within
the build, and need to set up a new mount namespace - in this case
we need ADD_CAPABILITIES=SYS_ADMIN. (Since we are running
buildah using --isolation=chroot.)

Related: #1014
Copy link
Contributor

@chmeliik chmeliik left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, just copying a comment from #1017

@lcarva @zregvart @simonbaird

For this feature, we would need a policy check that disallows the param by default but lets the policy author allowlist some specific capabilities. Is that feasible?

@ralphbean
Copy link
Member Author

I'd like to proceed without that policy check implemented yet - for external schedule pressure reasons. I'll make sure it gets followed up on: https://issues.redhat.com/browse/EC-678

@ralphbean ralphbean added this pull request to the merge queue Jun 21, 2024
Merged via the queue into main with commit 1eae5a2 Jun 21, 2024
7 checks passed
@ralphbean ralphbean deleted the pull/1017/head branch June 21, 2024 16:04
@arewm
Copy link
Member

arewm commented Jul 22, 2024

@ralphbean , do you know if this ever got documented?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants