caps

var Engine = []int{Chown, SetUID, SetGID, SetPCAP}

Engine is what a home with a device engine needs on top of its runtime's set. The engine's directory goes to its uid (Chown), its process drops to that uid and gid (SetUID, SetGID), and its bounding set is emptied before the exec (SetPCAP).

var ErrCannotNarrow = errors.New("caps: cannot narrow the bounding set without CAP_SETPCAP")

ErrCannotNarrow means the process holds capabilities outside the set but not CAP_SETPCAP, which dropping them needs.

var GVisor = []int{SetGID, SetUID, SysAdmin, SetFCAP}

GVisor is what the gVisor runtime needs, measured by running tests/integration/gvisor and the conformance suite under setpriv with each of the kernel's capabilities left out in turn. SysAdmin mounts the templates tmpfs and makes the sandbox's namespaces. Without any one of SetGID, SetUID and SetFCAP, runsc cannot fork and exec its gofer process (EPERM), and the measurement sees no further than that. Nothing else is needed. The sandbox's Sentry serves the fibers' syscalls, and CRIU is not involved, so SysPtrace, SysChroot, NetAdmin, SysTime and SysResource stay out.

var Hyperlight = []int{}

Hyperlight is what the Hyperlight runtime needs, measured the same way with the Rust helper on KVM. Nothing. The helper opens /dev/kvm by its file mode, and the guest is behind the hypervisor.

var Names = map[int]string{Chown: "CHOWN", DACOverride: "DAC_OVERRIDE", DACReadSearch: "DAC_READ_SEARCH", Kill: "KILL",
	SetGID: "SETGID", SetUID: "SETUID", SetPCAP: "SETPCAP", NetAdmin: "NET_ADMIN", SysChroot: "SYS_CHROOT", SysPtrace: "SYS_PTRACE",
	SysAdmin: "SYS_ADMIN", SysResource: "SYS_RESOURCE", SysTime: "SYS_TIME", SetFCAP: "SETFCAP"}

Names is how Kubernetes spells a capability in a container's capabilities.

var Proc = []int{SetPCAP, NetAdmin, SysChroot, SysPtrace, SysAdmin, SysResource, SysTime}

Proc is what the proc runtime needs, as hack/test/caps.sh measured it. SysAdmin covers namespaces and mounts. SysTime and SysChroot let CRIU restore a fiber's time and mount namespaces. NetAdmin is for TCP repair, and SetPCAP empties each fiber's bounding set. CRIU attaches to fibers it did not start, which Yama's default ptrace_scope 1 allows only with SysPtrace, and raises its own open-file limit (SysResource).

var Runc = append(append([]int{}, Proc...), Chown, DACOverride, SetGID, SetUID)

Runc is what the runc runtime needs, measured by running tests/integration/runc and the conformance suite under setpriv with each candidate left out. The grant's container runs in a user namespace, so its root is an unprivileged host uid and fiberd crosses that line in a few places. runc writes the mapped root's uid and gid maps (SetUID, SetGID) and chowns exec.fifo to it (Chown), and runc, criu and fiberd open files that uid owns with modes that keep root out (DACOverride, which covers what DAC_READ_SEARCH would). Kill is not needed, since fibers and the container's init are ended through their cgroups.