Documentation
¶
Overview ¶
Package ociinterceptor modifies an OCI runtime configuration before passing it to the real runtime.
The runtime-wrapper design and bundle discovery are adapted from picoCTF/oci-interceptor v0.2.2 at commit bcba3ad4a6f31be57659a9554a79fa5ad5efc7a6: https://github.com/picoCTF/oci-interceptor
The original project is available under the Apache License 2.0. This file is a modified implementation for cmgr, also distributed under cmgr's Apache License 2.0.
The runtime-wrapper design in this file is inspired by and adapted from picoCTF/oci-interceptor v0.2.2 at commit bcba3ad4a6f31be57659a9554a79fa5ad5efc7a6: https://github.com/picoCTF/oci-interceptor
The original project is available under the Apache License 2.0. This file is a modified implementation for cmgr, also distributed under cmgr's Apache License 2.0.
Index ¶
- Constants
- func FindBundlePath(arguments []string) (string, bool)
- func NormalizeTweaks(tweaks []string) ([]string, error)
- func RegisterRuntime(configPath string, runtimePath string, runcPath string, force bool) (bool, error)
- func RewriteBundle(bundle string) (bool, error)
- func RewriteConfig(original []byte) ([]byte, bool, error)
- func RunRegisterCommand(arguments []string, invokedExecutable string, stdout io.Writer, ...) int
- func RunRuntime(arguments []string, stdin io.Reader, stdout io.Writer, stderr io.Writer) int
- func RuntimeRegistrationCompatible(interceptorPath string, arguments []string) bool
Constants ¶
const ( // RuntimeName is the Docker runtime name cmgr selects for containers that // need a built-in seccomp tweak. RuntimeName = "cmgr-oci-interceptor" // TweakEnvironmentVariable carries the requested tweaks from cmgr to the // interceptor. The interceptor removes it from the OCI process environment // before starting the container. TweakEnvironmentVariable = "CMGR_OCI_INTERCEPTOR_SECCOMP_TWEAKS" // RuntimeProtocolArgument is registered with Docker as a fixed runtime // argument. It makes stale or incorrectly targeted runtime registrations // fail instead of silently launching a container without its requested // tweaks. RuntimeProtocolArgument = "--cmgr-interceptor-protocol=seccomp-v1" TweakAllowDisableASLR = "allow-disable-aslr" )
const ( // RegisterSubcommand adds cmgr-oci-interceptor to Docker's daemon // configuration. RegisterSubcommand = "register" // RegistrationCommand is the command shown when the Docker runtime is not // available. RegistrationCommand = "sudo " + RuntimeName + " " + RegisterSubcommand )
Variables ¶
This section is empty.
Functions ¶
func FindBundlePath ¶
FindBundlePath returns the OCI bundle passed to a runtime through runc's conventional -b or --bundle option.
func NormalizeTweaks ¶
NormalizeTweaks validates, sorts, and copies a list of tweak names.
func RegisterRuntime ¶
func RegisterRuntime( configPath string, runtimePath string, runcPath string, force bool, ) (bool, error)
RegisterRuntime safely merges cmgr's named runtime into a Docker daemon configuration. Existing unrelated daemon settings and runtimes are retained.
func RewriteBundle ¶
RewriteBundle applies any requested cmgr tweaks to config.json in bundle.
func RewriteConfig ¶
RewriteConfig consumes the cmgr control environment variable and applies the requested changes while retaining unrecognized OCI fields.
func RunRegisterCommand ¶
func RunRegisterCommand( arguments []string, invokedExecutable string, stdout io.Writer, stderr io.Writer, ) int
RunRegisterCommand registers cmgr-oci-interceptor as a named Docker runtime and reloads Docker so the change takes effect.
func RunRuntime ¶
RunRuntime rewrites a requested OCI bundle and forwards the invocation to the real OCI runtime.
func RuntimeRegistrationCompatible ¶
RuntimeRegistrationCompatible reports whether Docker is advertising the fail-closed runtime shape emitted by the registration command.
Types ¶
This section is empty.
Source Files