config/templates/common.conf.in

   1 # Default configuration shared by all containers
   2
   3 # Setup the LXC devices in /dev/lxc/
   4 lxc.devttydir = lxc
   5
   6 # Allow for 1024 pseudo terminals
   7 lxc.pts = 1024
   8
   9 # Setup 4 tty devices
  10 lxc.tty = 4
  11
  12 # Drop some harmful capabilities
  13 lxc.cap.drop = mac_admin mac_override sys_time sys_module sys_rawio
  14
  15 # Set the pivot directory
  16 lxc.pivotdir = lxc_putold
  17
  18 # Ensure hostname is changed on clone
  19 lxc.hook.clone = @LXCHOOKDIR@/clonehostname
  20
  21 # CGroup whitelist
  22 lxc.cgroup.devices.deny = a
  23 ## Allow any mknod (but not reading/writing the node)
  24 lxc.cgroup.devices.allow = c *:* m
  25 lxc.cgroup.devices.allow = b *:* m
  26 ## Allow specific devices
  27 ### /dev/null
  28 lxc.cgroup.devices.allow = c 1:3 rwm
  29 ### /dev/zero
  30 lxc.cgroup.devices.allow = c 1:5 rwm
  31 ### /dev/full
  32 lxc.cgroup.devices.allow = c 1:7 rwm
  33 ### /dev/tty
  34 lxc.cgroup.devices.allow = c 5:0 rwm
  35 ### /dev/console
  36 lxc.cgroup.devices.allow = c 5:1 rwm
  37 ### /dev/ptmx
  38 lxc.cgroup.devices.allow = c 5:2 rwm
  39 ### /dev/random
  40 lxc.cgroup.devices.allow = c 1:8 rwm
  41 ### /dev/urandom
  42 lxc.cgroup.devices.allow = c 1:9 rwm
  43 ### /dev/pts/*
  44 lxc.cgroup.devices.allow = c 136:* rwm
  45 ### fuse
  46 lxc.cgroup.devices.allow = c 10:229 rwm
  47
  48 # Setup the default mounts
  49 lxc.mount.auto = cgroup:mixed proc:mixed sys:mixed
  50 lxc.mount.entry = /sys/fs/fuse/connections sys/fs/fuse/connections none bind,optional 0 0
  51
  52 # Blacklist some syscalls which are not safe in privileged
  53 # containers
  54 lxc.seccomp = @LXCTEMPLATECONFIG@/common.seccomp
  55
  56 # Lastly, include all the configs from @LXCTEMPLATECONFIG@/common.conf.d/
  57 lxc.include = @LXCTEMPLATECONFIG@/common.conf.d/