{"action":"created","issue":{"url":"https://api.github.com/repos/moby/moby/issues/36597","repository_url":"https://api.github.com/repos/moby/moby","labels_url":"https://api.github.com/repos/moby/moby/issues/36597/labels{/name}","comments_url":"https://api.github.com/repos/moby/moby/issues/36597/comments","events_url":"https://api.github.com/repos/moby/moby/issues/36597/events","html_url":"https://github.com/moby/moby/issues/36597","id":305277559,"number":36597,"title":"[proposal]: option to not mask or set read-only paths in /proc","user":{"login":"jessfraz","id":1445228,"avatar_url":"https://avatars2.githubusercontent.com/u/1445228?v=4","gravatar_id":"","url":"https://api.github.com/users/jessfraz","html_url":"https://github.com/jessfraz","followers_url":"https://api.github.com/users/jessfraz/followers","following_url":"https://api.github.com/users/jessfraz/following{/other_user}","gists_url":"https://api.github.com/users/jessfraz/gists{/gist_id}","starred_url":"https://api.github.com/users/jessfraz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jessfraz/subscriptions","organizations_url":"https://api.github.com/users/jessfraz/orgs","repos_url":"https://api.github.com/users/jessfraz/repos","events_url":"https://api.github.com/users/jessfraz/events{/privacy}","received_events_url":"https://api.github.com/users/jessfraz/received_events","type":"User","site_admin":false},"labels":[{"id":73641990,"url":"https://api.github.com/repos/moby/moby/labels/area/runtime","name":"area/runtime","color":"fbca04","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":7,"created_at":"2018-03-14T18:26:30Z","updated_at":"2018-03-14T21:11:55Z","closed_at":null,"author_association":"CONTRIBUTOR","body":"I would like to create a feature that is an option to disable the masked paths and read-only paths for /proc.\r\n\r\nThe purpose is for nesting user namespaced rootless containers _inside_ a docker container without setting `--privileged`\r\n\r\nIt would solve the following bug:\r\nhttps://github.com/opencontainers/runc/issues/1658#issuecomment-373122073\r\n\r\nReproducible here (the dockerfile lives here: https://github.com/jessfraz/dockerfiles/tree/master/runc-rootless):\r\n\r\n```console\r\n$ docker run --rm -it --security-opt seccomp=unconfined --security-opt apparmor=unconfined r.j3ss.co/runc-rootless\r\ncontainer_linux.go:297: starting container process caused \"process_linux.go:402: container init caused \\\"rootfs_linux.go:58: mounting \\\\\\\"proc\\\\\\\" to rootfs \\\\\\\"/home/user/rootfs\\\\\\\" at \\\\\\\"/proc\\\\\\\" caused \\\\\\\"operation not permitted\\\\\\\"\\\"\"\r\n```\r\n\r\nIf I turn off the masked paths and readonly paths then this will work and I can fulfill my use case and sleep at night. I am more than happy to write it in a way that you choose and file a PR.\r\n\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/moby/moby/issues/comments/373176289","html_url":"https://github.com/moby/moby/issues/36597#issuecomment-373176289","issue_url":"https://api.github.com/repos/moby/moby/issues/36597","id":373176289,"user":{"login":"n4ss","id":5625058,"avatar_url":"https://avatars2.githubusercontent.com/u/5625058?v=4","gravatar_id":"","url":"https://api.github.com/users/n4ss","html_url":"https://github.com/n4ss","followers_url":"https://api.github.com/users/n4ss/followers","following_url":"https://api.github.com/users/n4ss/following{/other_user}","gists_url":"https://api.github.com/users/n4ss/gists{/gist_id}","starred_url":"https://api.github.com/users/n4ss/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/n4ss/subscriptions","organizations_url":"https://api.github.com/users/n4ss/orgs","repos_url":"https://api.github.com/users/n4ss/repos","events_url":"https://api.github.com/users/n4ss/events{/privacy}","received_events_url":"https://api.github.com/users/n4ss/received_events","type":"User","site_admin":false},"created_at":"2018-03-14T21:11:55Z","updated_at":"2018-03-14T21:11:55Z","author_association":"NONE","body":"@jessfraz we're already looking to find a way to deprecate `--privileged` and adjust the granularity of the security configuration through the \"docker entitlements\" + security profiles for images. Disabling the access on host resources is part of these.\r\n\r\nWe have a working POC on `docker run` and `docker build`:\r\n- Entitlements manager & implementations -> https://github.com/moby/libentitlement\r\n- CLI integration -> https://github.com/n4ss/cli/tree/entitlements-poc-2\r\n- Daemon integration -> https://github.com/n4ss/moby/tree/poc-entitlements-moby-2\r\n\r\n\r\nThis will most likely be the thing that you want (and eventually non-experimental) with the following command:\r\n```shell\r\n$ docker run --entitlements=\"host.devices=admin\" jessfraz/iknowwhatimdoing:seriously\r\n```\r\n\r\nI hope to get that out asap (waiting for more community input among other things), but in the meantime yeah I agree that a flag doing that would be great. The experimental aspect allows to remove the flag when the entitlements are available (and have it earlier available I guess).\r\n\r\n\r\n"}}
{"actor":{"display_login":"n4ss"}}