Skip to content

Commit 98ea9db

Browse files
AkihiroSudaAkihiroSuda
committed
Add features.md to formalize the runc features JSON
Add `features.md` and `features-linux.md`, to formalize the `runc features` JSON that was introduced in runc v1.1.0-rc.1 . A runtime caller MAY use this JSON to detect the features implemented by the runtime. The spec corresponds to https://github.com/opencontainers/runc/blob/v1.1.0-rc.1/types/features/features.go (opencontainers/runc PR 3296, opencontainers/runc PR 3310) Differences from runc v1.1.0-rc.1: - Add `.linux.intelRdt.enabled` field - Add `.linux.cgroup.rdma` field Signed-off-by: Akihiro Suda <[email protected]>
1 parent 8958f93 commit 98ea9db

File tree

12 files changed

+988
-6
lines changed

12 files changed

+988
-6
lines changed

‎Makefile‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,8 @@ DOC_FILES := \
3030
config.md \
3131
config-linux.md \
3232
config-solaris.md \
33+
features.md \
34+
features-linux.md \
3335
glossary.md
3436

3537
default: docs

‎features-linux.md‎

Lines changed: 200 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,200 @@
1+
# <a name="linuxFeatures" />Linux Features Document
2+
3+
This document describes the [Linux-specific section](features.md#platform-specific-features) of the [features document](features.md).
4+
5+
## <a name="linuxFeaturesNamespaces" />Namespaces
6+
7+
* **`namespaces`** (array of strings, OPTIONAL) The recognized names of the namespaces, including namespaces that might not be supported by the host operating system.
8+
The runtime MUST recognize the elements in this array as the [`type` of `linux.namespaces` objects in `config.json`](config-linux.md#namespaces).
9+
10+
### Example
11+
12+
```json
13+
"namespaces": [
14+
"cgroup",
15+
"ipc",
16+
"mount",
17+
"network",
18+
"pid",
19+
"user",
20+
"uts"
21+
]
22+
```
23+
24+
## <a name="linuxFeaturesCapabilities" />Capabilities
25+
26+
* **`capabilities`** (array of strings, OPTIONAL) The recognized names of the capabilities, including capabilities that might not be supported by the host operating system.
27+
The runtime MUST recognize the elements in this array in the [`process.capabilities` object of `config.json`](config.md#linux-process).
28+
29+
### Example
30+
31+
```json
32+
"capabilities": [
33+
"CAP_CHOWN",
34+
"CAP_DAC_OVERRIDE",
35+
"CAP_DAC_READ_SEARCH",
36+
"CAP_FOWNER",
37+
"CAP_FSETID",
38+
"CAP_KILL",
39+
"CAP_SETGID",
40+
"CAP_SETUID",
41+
"CAP_SETPCAP",
42+
"CAP_LINUX_IMMUTABLE",
43+
"CAP_NET_BIND_SERVICE",
44+
"CAP_NET_BROADCAST",
45+
"CAP_NET_ADMIN",
46+
"CAP_NET_RAW",
47+
"CAP_IPC_LOCK",
48+
"CAP_IPC_OWNER",
49+
"CAP_SYS_MODULE",
50+
"CAP_SYS_RAWIO",
51+
"CAP_SYS_CHROOT",
52+
"CAP_SYS_PTRACE",
53+
"CAP_SYS_PACCT",
54+
"CAP_SYS_ADMIN",
55+
"CAP_SYS_BOOT",
56+
"CAP_SYS_NICE",
57+
"CAP_SYS_RESOURCE",
58+
"CAP_SYS_TIME",
59+
"CAP_SYS_TTY_CONFIG",
60+
"CAP_MKNOD",
61+
"CAP_LEASE",
62+
"CAP_AUDIT_WRITE",
63+
"CAP_AUDIT_CONTROL",
64+
"CAP_SETFCAP",
65+
"CAP_MAC_OVERRIDE",
66+
"CAP_MAC_ADMIN",
67+
"CAP_SYSLOG",
68+
"CAP_WAKE_ALARM",
69+
"CAP_BLOCK_SUSPEND",
70+
"CAP_AUDIT_READ",
71+
"CAP_PERFMON",
72+
"CAP_BPF",
73+
"CAP_CHECKPOINT_RESTORE"
74+
]
75+
```
76+
77+
## <a name="linuxFeaturesCgroup" />Cgroup
78+
79+
**`cgroup`** (object, OPTIONAL) represents the runtime's implementation status of cgroup managers.
80+
Irrelevant to the cgroup version of the host operating system.
81+
82+
* **`v1`** (bool, OPTIONAL) represents whether the runtime supports cgroup v1.
83+
* **`v2`** (bool, OPTIONAL) represents whether the runtime supports cgroup v2.
84+
* **`systemd`** (bool, OPTIONAL) represents whether the runtime supports system-wide systemd cgroup manager.
85+
* **`systemdUser`** (bool, OPTIONAL) represents whether the runtime supports user-scoped systemd cgroup manager.
86+
* **`rdma`** (bool, OPTIONAL) represents whether the runtime supports RDMA cgroup controller.
87+
88+
### Example
89+
90+
```json
91+
"cgroup": {
92+
"v1": true,
93+
"v2": true,
94+
"systemd": true,
95+
"systemdUser": true,
96+
"rdma": false
97+
}
98+
```
99+
100+
## <a name="linuxFeaturesSeccomp" />Seccomp
101+
102+
**`seccomp`** (object, OPTIONAL) represents the runtime's implementation status of seccomp.
103+
Irrelevant to the kernel version of the host operating system.
104+
105+
* **`enabled`** (bool, OPTIONAL) represents whether the runtime supports seccomp.
106+
* **`actions`** (array of strings, OPTIONAL) The recognized names of the seccomp actions.
107+
The runtime MUST recognize the elements in this array in the [`syscalls[].action` property of the `linux.seccomp` object in `config.json`](config-linux.md#seccomp).
108+
* **`operators`** (array of strings, OPTIONAL) The recognized names of the seccomp operators.
109+
The runtime MUST recognize the elements in this array in the [`syscalls[].args[].op` property of the `linux.seccomp` object in `config.json`](config-linux.md#seccomp).
110+
* **`archs`** (array of strings, OPTIONAL) The recognized names of the seccomp architectures.
111+
The runtime MUST recognize the elements in this array in the [`architectures` property of the `linux.seccomp` object in `config.json`](config-linux.md#seccomp).
112+
113+
### Example
114+
115+
```json
116+
"seccomp": {
117+
"enabled": true,
118+
"actions": [
119+
"SCMP_ACT_ALLOW",
120+
"SCMP_ACT_ERRNO",
121+
"SCMP_ACT_KILL",
122+
"SCMP_ACT_LOG",
123+
"SCMP_ACT_NOTIFY",
124+
"SCMP_ACT_TRACE",
125+
"SCMP_ACT_TRAP"
126+
],
127+
"operators": [
128+
"SCMP_CMP_EQ",
129+
"SCMP_CMP_GE",
130+
"SCMP_CMP_GT",
131+
"SCMP_CMP_LE",
132+
"SCMP_CMP_LT",
133+
"SCMP_CMP_MASKED_EQ",
134+
"SCMP_CMP_NE"
135+
],
136+
"archs": [
137+
"SCMP_ARCH_AARCH64",
138+
"SCMP_ARCH_ARM",
139+
"SCMP_ARCH_MIPS",
140+
"SCMP_ARCH_MIPS64",
141+
"SCMP_ARCH_MIPS64N32",
142+
"SCMP_ARCH_MIPSEL",
143+
"SCMP_ARCH_MIPSEL64",
144+
"SCMP_ARCH_MIPSEL64N32",
145+
"SCMP_ARCH_PPC",
146+
"SCMP_ARCH_PPC64",
147+
"SCMP_ARCH_PPC64LE",
148+
"SCMP_ARCH_S390",
149+
"SCMP_ARCH_S390X",
150+
"SCMP_ARCH_X32",
151+
"SCMP_ARCH_X86",
152+
"SCMP_ARCH_X86_64"
153+
]
154+
}
155+
```
156+
157+
## <a name="linuxFeaturesApparmor" />AppArmor
158+
159+
**`apparmor`** (object, OPTIONAL) represents the runtime's implementation status of AppArmor.
160+
Irrelevant to the availability of AppArmor on the host operating system.
161+
162+
* **`enabled`** (bool, OPTIONAL) represents whether the runtime supports AppArmor.
163+
164+
### Example
165+
166+
```json
167+
"apparmor": {
168+
"enabled": true
169+
}
170+
```
171+
172+
## <a name="linuxFeaturesApparmor" />SELinux
173+
174+
**`selinux`** (object, OPTIONAL) represents the runtime's implementation status of SELinux.
175+
Irrelevant to the availability of SELinux on the host operating system.
176+
177+
* **`enabled`** (bool, OPTIONAL) represents whether the runtime supports SELinux.
178+
179+
### Example
180+
181+
```json
182+
"selinux": {
183+
"enabled": true
184+
}
185+
```
186+
187+
## <a name="linuxFeaturesIntelRdt" />Intel RDT
188+
189+
**`intelRdt`** (object, OPTIONAL) represents the runtime's implementation status of Intel RDT.
190+
Irrelevant to the availability of Intel RDT on the host operating system.
191+
192+
* **`enabled`** (bool, OPTIONAL) represents whether the runtime supports Intel RDT.
193+
194+
### Example
195+
196+
```json
197+
"intelRdt": {
198+
"enabled": true
199+
}
200+
```

0 commit comments

Comments
 (0)