feat: Refine #298

docs/conf.py

@@ -32,7 +32,7 @@
 # Add any Sphinx extension module names here, as strings. They can be
 # extensions coming with Sphinx (named 'sphinx.ext.*') or your custom
 # ones.
-extensions = ['m2r2']
+extensions = ["m2r2"]
 
 # Add any paths that contain templates here, relative to this directory.
 templates_path = ["_templates"]
@@ -54,4 +54,4 @@
 # relative to this directory. They are copied after the builtin static files,
 # so a file named "default.css" will overwrite the builtin "default.css".
 html_static_path = []
-source_suffix = ['.rst', '.md']
+source_suffix = [".rst", ".md"]

setup.py

@@ -35,6 +35,7 @@
 
 MRACK_CONF = "mrack.conf"
 PROV_CONF = "provisioning-config.yaml"
+SECCOMP_JSON = "seccomp.json"
 
 setup(
     name="mrack",
@@ -52,7 +53,9 @@
     install_requires=reqs,
     scripts=["scripts/mrack"],
     package_data={
-        "mrack": [f"data/{datafile}" for datafile in [MRACK_CONF, PROV_CONF]]
+        "mrack": [
+            f"data/{datafile}" for datafile in [MRACK_CONF, PROV_CONF, SECCOMP_JSON]
+        ]
     },
     extras_require={
         "krb-owner": ["gssapi"],

src/mrack/data/provisioning-config.yaml

@@ -12,6 +12,10 @@ podman:
     # this will be used as prefix for the network name
     default_network: mrack
 
+    # Options to customize network creation
+    network_options:
+        - "--ipv6"
+
     # advanced podman options to be passed to every execution of podman run eg:
     # NOTE: when 'key' in podman_options has list assigned as value
     #       the option specidfied by the 'key' is added multiple times
@@ -21,7 +25,7 @@ podman:
         "--cap-add":
             - "ALL"
         # Allowed syscall list seccomp JSON file to be used as a seccomp filter
-        "--security-opt": "seccomp=src/mrack/data/seccomp.json"
+        "--security-opt": "seccomp=/etc/mrack/seccomp.json"
         # Mount a temporary filesystems (tmpfs) into a container
         "--tmpfs":
             - "/tmp"
@@ -30,8 +34,6 @@ podman:
         # Use /sys/fs/cgroup in container as read only volume
         "-v":
             - "/sys/fs/cgroup:/sys/fs/cgroup:ro"
-        # Adding ipv6 support to network
-        "--network": "enable_ipv6=true"
 
 virt:
     images: