projects / mirror_lxc.git / blame
| Commit | Line | Data |
|---|---|---|
| 5b99af00 SG |
1 | # Default configuration shared by all containers |
| 2 | ||
| 3 | # Setup the LXC devices in /dev/lxc/ | |
| 4 | lxc.devttydir = lxc | |
| 5 | ||
| 6 | # Allow for 1024 pseudo terminals | |
| 7 | lxc.pts = 1024 | |
| 8 | ||
| 9 | # Setup 4 tty devices | |
| 10 | lxc.tty = 4 | |
| 11 | ||
| 12 | # Drop some harmful capabilities | |
| 4845c17a | 13 | lxc.cap.drop = mac_admin mac_override sys_time sys_module sys_rawio |
| 5b99af00 SG |
14 | |
| 15 | # Set the pivot directory | |
| 16 | lxc.pivotdir = lxc_putold | |
| 17 | ||
| 18 | # Ensure hostname is changed on clone | |
| 19 | lxc.hook.clone = @LXCHOOKDIR@/clonehostname | |
| 20 | ||
| 21 | # CGroup whitelist | |
| 22 | lxc.cgroup.devices.deny = a | |
| 23 | ## Allow any mknod (but not reading/writing the node) | |
| 24 | lxc.cgroup.devices.allow = c *:* m | |
| 25 | lxc.cgroup.devices.allow = b *:* m | |
| 26 | ## Allow specific devices | |
| de9a4bfc SG |
27 | ### /dev/null |
| 28 | lxc.cgroup.devices.allow = c 1:3 rwm | |
| 29 | ### /dev/zero | |
| 30 | lxc.cgroup.devices.allow = c 1:5 rwm | |
| 31 | ### /dev/full | |
| 32 | lxc.cgroup.devices.allow = c 1:7 rwm | |
| 33 | ### /dev/tty | |
| 34 | lxc.cgroup.devices.allow = c 5:0 rwm | |
| 35 | ### /dev/console | |
| 36 | lxc.cgroup.devices.allow = c 5:1 rwm | |
| 37 | ### /dev/ptmx | |
| 38 | lxc.cgroup.devices.allow = c 5:2 rwm | |
| 39 | ### /dev/random | |
| 40 | lxc.cgroup.devices.allow = c 1:8 rwm | |
| 41 | ### /dev/urandom | |
| 42 | lxc.cgroup.devices.allow = c 1:9 rwm | |
| 43 | ### /dev/pts/* | |
| 44 | lxc.cgroup.devices.allow = c 136:* rwm | |
| a38e3e32 | 45 | ### fuse |
| 46 | lxc.cgroup.devices.allow = c 10:229 rwm | |
| 6e39e4cb | 47 | |
| f24a52d5 SG |
48 | # Setup the default mounts |
| 49 | lxc.mount.auto = cgroup:mixed proc:mixed sys:mixed | |
| a38e3e32 | 50 | lxc.mount.entry = /sys/fs/fuse/connections sys/fs/fuse/connections none bind,optional 0 0 |
| f24a52d5 | 51 | |
| 6e39e4cb SG |
52 | # Blacklist some syscalls which are not safe in privileged |
| 53 | # containers | |
| 54 | lxc.seccomp = @LXCTEMPLATECONFIG@/common.seccomp | |
| 4662c6de SG |
55 | |
| 56 | # Lastly, include all the configs from @LXCTEMPLATECONFIG@/common.conf.d/ | |
| 57 | lxc.include = @LXCTEMPLATECONFIG@/common.conf.d/ |