{"action":"created","issue":{"url":"https://api.github.com/repos/docker/swarmkit/issues/1722","repository_url":"https://api.github.com/repos/docker/swarmkit","labels_url":"https://api.github.com/repos/docker/swarmkit/issues/1722/labels{/name}","comments_url":"https://api.github.com/repos/docker/swarmkit/issues/1722/comments","events_url":"https://api.github.com/repos/docker/swarmkit/issues/1722/events","html_url":"https://github.com/docker/swarmkit/pull/1722","id":186443277,"number":1722,"title":"api: add support for security profiles","user":{"login":"stevvooe","id":120601,"avatar_url":"https://avatars.githubusercontent.com/u/120601?v=3","gravatar_id":"","url":"https://api.github.com/users/stevvooe","html_url":"https://github.com/stevvooe","followers_url":"https://api.github.com/users/stevvooe/followers","following_url":"https://api.github.com/users/stevvooe/following{/other_user}","gists_url":"https://api.github.com/users/stevvooe/gists{/gist_id}","starred_url":"https://api.github.com/users/stevvooe/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/stevvooe/subscriptions","organizations_url":"https://api.github.com/users/stevvooe/orgs","repos_url":"https://api.github.com/users/stevvooe/repos","events_url":"https://api.github.com/users/stevvooe/events{/privacy}","received_events_url":"https://api.github.com/users/stevvooe/received_events","type":"User","site_admin":false},"labels":[{"id":332130246,"url":"https://api.github.com/repos/docker/swarmkit/labels/status/0-triage","name":"status/0-triage","color":"ededed","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":13,"created_at":"2016-11-01T01:38:15Z","updated_at":"2016-11-08T21:47:26Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/docker/swarmkit/pulls/1722","html_url":"https://github.com/docker/swarmkit/pull/1722","diff_url":"https://github.com/docker/swarmkit/pull/1722.diff","patch_url":"https://github.com/docker/swarmkit/pull/1722.patch"},"body":"We define the basis for a profile-based security dispatch. We put\r\nforward a model, based on existing `--privileged` flag that can be\r\nextended in the future to support more complex workflows.\r\n\r\nThe first aspect is to allow the container runtime to select a security\r\nprofile, keyed by name. We introduce two profiles, \"default\" and\r\n\"privileged\" corresponding to the currently available control we have\r\ntoday. We will extend this model to support more complex scenarios, with\r\nmore granular control, in the future.\r\n\r\nWe balance this model with a Node security profile ACL that can select\r\nwhich profiles can be run on a node. Users can add and remove items from\r\nthis ACL to control which security levels can run on a given node. We\r\ndefine the empty list to be allowing the \"Default\" security profile.\r\n\r\nTo support future interaction, we also define that profiles are\r\nadditive. This means that the capability of a set of profiles is a union\r\nof all the specified profiles.\r\n\r\nSigned-off-by: Stephen J Day <stephen.day@docker.com>\r\n\r\n@mgoelzer @justincormack @icecrime @aluzzardi @crosbymichael"},"comment":{"url":"https://api.github.com/repos/docker/swarmkit/issues/comments/259269903","html_url":"https://github.com/docker/swarmkit/pull/1722#issuecomment-259269903","issue_url":"https://api.github.com/repos/docker/swarmkit/issues/1722","id":259269903,"user":{"login":"stevvooe","id":120601,"avatar_url":"https://avatars.githubusercontent.com/u/120601?v=3","gravatar_id":"","url":"https://api.github.com/users/stevvooe","html_url":"https://github.com/stevvooe","followers_url":"https://api.github.com/users/stevvooe/followers","following_url":"https://api.github.com/users/stevvooe/following{/other_user}","gists_url":"https://api.github.com/users/stevvooe/gists{/gist_id}","starred_url":"https://api.github.com/users/stevvooe/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/stevvooe/subscriptions","organizations_url":"https://api.github.com/users/stevvooe/orgs","repos_url":"https://api.github.com/users/stevvooe/repos","events_url":"https://api.github.com/users/stevvooe/events{/privacy}","received_events_url":"https://api.github.com/users/stevvooe/received_events","type":"User","site_admin":false},"created_at":"2016-11-08T21:47:26Z","updated_at":"2016-11-08T21:47:26Z","body":"After some discussion, the idea came up that requiring an update to _every_ Node's ACL would be expensive. It might be better to introduce an ACL object that specifies the profiles allowed and the nodes to which it applies, such that when new nodes come on line that can have the ACL automatically apply or be matched via some mechanism, such as labeling."}}
{"actor":{"display_login":"stevvooe"}}