Skip to content
This repository has been archived by the owner on Mar 9, 2022. It is now read-only.

sandbox: separate host accessing workload and privileged #866

Merged
merged 1 commit into from
Jul 26, 2018
Merged

sandbox: separate host accessing workload and privileged #866

merged 1 commit into from
Jul 26, 2018

Commits on Jul 26, 2018

  1. sandbox: separate host accessing workload and privileged 

    VM isolated runtimes can support privileged workloads. In this
scenario, access to the guest VM is provided instead of the host.
Based on this, allow untrusted runtimes to run privileged workloads.

If the workload is specifically asking for node PID/IPC/network, etc.,
then continue to require the trusted runtime.

This commit repurposes the hostPrivilegedSandbox utility function to
only check for node namespace checking.

Fixes: containerd#855

Signed-off-by: Eric Ernst <[email protected]>
    @Random-Liu
    Eric Ernst authored and Random-Liu committed Jul 26, 2018
    Configuration menu
    Copy the full SHA
    c037404 View commit details
    Browse the repository at this point in the history