opensource/podman
1
0
Fork 0
mirror of https://github.com/containers/podman.git synced 2025-08-05 19:02:37 +08:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #17127 from mupuf/tty_devices_for_all

Browse Source 
Make rootless privileged containers share the same tty devices as rootfull ones
This commit is contained in:
OpenShift Merge Robot
2023-01-17 05:07:56 -05:00
committed by GitHub
parent 07ba51d77a 8db2b4b733
commit abfca47d32
4 changed files with 48 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
docs/source/markdown/options/privileged.md
View File

@ -9,7 +9,9 @@ Give extended privileges to this container. The default is **false**.
By default, Podman containers are unprivileged (**=false**) and cannot, for
example, modify parts of the operating system. This is because by default a
container is only allowed limited access to devices. A "privileged" container
is given the same access to devices as the user launching the container.
is given the same access to devices as the user launching the container, with
the exception of virtual consoles (_/dev/tty\d+_) when running in systemd
mode (**--systemd=always**).
A privileged container turns off the security features that isolate the
container from the host. Dropped Capabilities, limited devices, read-only mount

1
docs/source/markdown/options/systemd.md
View File

@ -24,6 +24,7 @@ Running the container in systemd mode causes the following changes:
* Podman sets the default stop signal to **SIGRTMIN+3**.
* Podman sets **container_uuid** environment variable in the container to the
first 32 characters of the container id.
* Podman will not mount virtual consoles (_/dev/tty\d+_) when running with **--privileged**.
This allows systemd to run in a confined container without any modifications.