Codebase list golang-github-opencontainers-specs / b16e5a2
Import upstream version 1.0.2.114.g494a5a6 Debian Janitor 1 year, 6 months ago
12 changed file(s) with 86 addition(s) and 46 deletion(s). Raw diff Collapse all Expand all
+1
-1
CODEOWNERS less more
0 * @crosbymichael @cyphar @dqminh @giuseppe @hqhq @mrunalp @tianon @vbatts
0 * @AkihiroSuda @crosbymichael @cyphar @dqminh @giuseppe @hqhq @kolyshkin @mrunalp @thaJeztah @tianon @vbatts
+1
-1
GOVERNANCE.md less more
6666
6767 > [runtime-spec adopted]: Tag 0647920 as 1.0.0-rc (+6 -0 #3)
6868
69 [charter]: https://www.opencontainers.org/about/governance
69 [charter]: https://github.com/opencontainers/tob/blob/main/CHARTER.md
+3
-0
MAINTAINERS less more
55 Qiang Huang <h.huangqiang@huawei.com> (@hqhq)
66 Aleksa Sarai <asarai@suse.de> (@cyphar)
77 Giuseppe Scrivano <gscrivan@redhat.com> (@giuseppe)
8 Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp> (@AkihiroSuda)
9 Kir Kolyshkin <kolyshkin@gmail.com> (@kolyshkin)
10 Sebastiaan van Stijn <github@gone.nl> (@thaJeztah)
+1
-1
RELEASES.md less more
4747 For example if a breaking change is introduced in v1.0.0-rc2 then the series would end with v1.0.0-rc4 and v1.0.0.
4848 * Minor and patch releases SHOULD be made on an as-needed basis.
4949
50 [charter]: https://www.opencontainers.org/about/governance
50 [charter]: https://github.com/opencontainers/tob/blob/main/CHARTER.md
5151
5252 ## Checklist
5353
+6
-0
config-linux.md less more
335335 To disable it, specify a value of `true`.
336336 * **`useHierarchy`** *(bool, OPTIONAL)* - enables or disables hierarchical memory accounting.
337337 If enabled (`true`), child cgroups will share the memory limits of this cgroup.
338 * **`checkBeforeUpdate`** *(bool, OPTIONAL)* - enables container memory usage check before setting a new limit.
339 If enabled (`true`), runtime MAY check if a new memory limit is lower than the current usage, and MUST
340 reject the new limit. Practically, when cgroup v1 is used, the kernel rejects the limit lower than the
341 current usage, and when cgroup v2 is used, an OOM killer is invoked. This setting can be used on
342 cgroup v2 to mimic the cgroup v1 behavior.
338343
339344 #### Example
340345
700705 * `SECCOMP_FILTER_FLAG_TSYNC`
701706 * `SECCOMP_FILTER_FLAG_LOG`
702707 * `SECCOMP_FILTER_FLAG_SPEC_ALLOW`
708 * `SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV`
703709
704710 * **`listenerPath`** *(string, OPTIONAL)* - specifies the path of UNIX domain socket over which the runtime will send the [container process state](#containerprocessstate) data structure when the `SCMP_ACT_NOTIFY` action is used.
705711 This socket MUST use `AF_UNIX` domain and `SOCK_STREAM` type.
+12
-0
config.md less more
352352
353353 ```json
354354 "hostname": "mrsdalloway"
355 ```
356
357 ## <a name="configDomainname" />Domainname
358
359 * **`domainname`** (string, OPTIONAL) specifies the container's domainname as seen by processes running inside the container.
360 On Linux, for example, this will change the domainname in the [container](glossary.md#container-namespace) [UTS namespace][uts-namespace.7].
361 Depending on your [namespace configuration](config-linux.md#namespaces), the container UTS namespace may be the [runtime](glossary.md#runtime-namespace) [UTS namespace][uts-namespace.7].
362
363 ### Example
364
365 ```json
366 "domainname": "foobarbaz.test"
355367 ```
356368
357369 ## <a name="configPlatformSpecificConfiguration" />Platform-specific configuration
+41
-41
meeting.ics less more
0 BEGIN:VCALENDAR
1 VERSION:2.0
2 PRODID:-//Open Containers Initiative//Developer Meeting//EN
3 BEGIN:VTIMEZONE
4 TZID:America/Los_Angeles
5 LAST-MODIFIED:20050809T050000Z
6 BEGIN:STANDARD
7 DTSTART:20071104T020000
8 RRULE:FREQ=YEARLY;BYMONTH=11;BYDAY=1SU
9 TZOFFSETFROM:-0700
10 TZOFFSETTO:-0800
11 TZNAME:PST
12 END:STANDARD
13 BEGIN:DAYLIGHT
14 DTSTART:20070311T020000
15 RRULE:FREQ=YEARLY;BYMONTH=3;BYDAY=2SU
16 TZOFFSETFROM:-0800
17 TZOFFSETTO:-0700
18 TZNAME:PDT
19 END:DAYLIGHT
20 END:VTIMEZONE
21 BEGIN:VEVENT
22 UID:tdc-meeting@opencontainers.org
23 DTSTAMP:20180628T170000Z
24 DTSTART;TZID=America/Los_Angeles:20170906T140000
25 RRULE:FREQ=MONTHLY;INTERVAL=1;BYDAY=1WE
26 RDATE;TZID=America/Los_Angeles:20180110T140000
27 EXDATE;TZIP=America/Los_Angeles:20180103T140000
28 RDATE;TZID=America/Los_Angeles:20180711T140000
29 EXDATE;TZIP=America/Los_Angeles:20180704T140000
30 DURATION:PT1H
31 SUMMARY:OCI TDC Meeting
32 DESCRIPTION;ALTREP="https://github.com/opencontainers/runtime-spec#
33 meetings":Open Containers Initiative Developer Meeting\n
34 https://github.com/opencontainers/runtime-spec#meetings\n
35 Web: https://www.uberconference.com/opencontainers\n
36 Audio-only: +1 415 968 0849 (no PIN needed)
37 LOCATION:https://www.uberconference.com/opencontainers
38 URL:https://github.com/opencontainers/runtime-spec/blob/master/meeting.ics
39 END:VEVENT
40 END:VCALENDAR
0 BEGIN:VCALENDAR
1 VERSION:2.0
2 PRODID:-//Open Containers Initiative//Developer Meeting//EN
3 BEGIN:VTIMEZONE
4 TZID:America/Los_Angeles
5 LAST-MODIFIED:20050809T050000Z
6 BEGIN:STANDARD
7 DTSTART:20071104T020000
8 RRULE:FREQ=YEARLY;BYMONTH=11;BYDAY=1SU
9 TZOFFSETFROM:-0700
10 TZOFFSETTO:-0800
11 TZNAME:PST
12 END:STANDARD
13 BEGIN:DAYLIGHT
14 DTSTART:20070311T020000
15 RRULE:FREQ=YEARLY;BYMONTH=3;BYDAY=2SU
16 TZOFFSETFROM:-0800
17 TZOFFSETTO:-0700
18 TZNAME:PDT
19 END:DAYLIGHT
20 END:VTIMEZONE
21 BEGIN:VEVENT
22 UID:tdc-meeting@opencontainers.org
23 DTSTAMP:20180628T170000Z
24 DTSTART;TZID=America/Los_Angeles:20170906T140000
25 RRULE:FREQ=MONTHLY;INTERVAL=1;BYDAY=1WE
26 RDATE;TZID=America/Los_Angeles:20180110T140000
27 EXDATE;TZIP=America/Los_Angeles:20180103T140000
28 RDATE;TZID=America/Los_Angeles:20180711T140000
29 EXDATE;TZIP=America/Los_Angeles:20180704T140000
30 DURATION:PT1H
31 SUMMARY:OCI TDC Meeting
32 DESCRIPTION;ALTREP="https://github.com/opencontainers/runtime-spec#
33 meetings":Open Containers Initiative Developer Meeting\n
34 https://github.com/opencontainers/runtime-spec#meetings\n
35 Web: https://www.uberconference.com/opencontainers\n
36 Audio-only: +1 415 968 0849 (no PIN needed)
37 LOCATION:https://www.uberconference.com/opencontainers
38 URL:https://github.com/opencontainers/runtime-spec/blob/master/meeting.ics
39 END:VEVENT
40 END:VCALENDAR
+3
-0
schema/config-linux.json less more
168168 },
169169 "useHierarchy": {
170170 "type": "boolean"
171 },
172 "checkBeforeUpdate": {
173 "type": "boolean"
171174 }
172175 }
173176 },
+3
-0
schema/config-schema.json less more
3232 "$ref": "defs.json#/definitions/annotations"
3333 },
3434 "hostname": {
35 "type": "string"
36 },
37 "domainname": {
3538 "type": "string"
3639 },
3740 "mounts": {
+2
-1
schema/defs-linux.json less more
6969 "enum": [
7070 "SECCOMP_FILTER_FLAG_TSYNC",
7171 "SECCOMP_FILTER_FLAG_LOG",
72 "SECCOMP_FILTER_FLAG_SPEC_ALLOW"
72 "SECCOMP_FILTER_FLAG_SPEC_ALLOW",
73 "SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV"
7374 ]
7475 },
7576 "SeccompOperators": {
+3
-1
schema/test/config/good/spec-example.json less more
6262 "readonly": true
6363 },
6464 "hostname": "slartibartfast",
65 "domainname": "foobarbaz.test",
6566 "mounts": [
6667 {
6768 "destination": "/proc",
268269 "kernelTCP": -1,
269270 "swappiness": 0,
270271 "disableOOMKiller": false,
271 "useHierarchy": false
272 "useHierarchy": false,
273 "checkBeforeUpdate": false
272274 },
273275 "cpu": {
274276 "shares": 1024,
+10
-0
specs-go/config.go less more
1111 Root *Root `json:"root,omitempty"`
1212 // Hostname configures the container's hostname.
1313 Hostname string `json:"hostname,omitempty"`
14 // Domainname configures the container's domainname.
15 Domainname string `json:"domainname,omitempty"`
1416 // Mounts configures additional mounts (on top of Root).
1517 Mounts []Mount `json:"mounts,omitempty"`
1618 // Hooks configures callbacks for container lifecycle events.
316318 DisableOOMKiller *bool `json:"disableOOMKiller,omitempty"`
317319 // Enables hierarchical memory accounting
318320 UseHierarchy *bool `json:"useHierarchy,omitempty"`
321 // CheckBeforeUpdate enables checking if a new memory limit is lower
322 // than the current usage during update, and if so, rejecting the new
323 // limit.
324 CheckBeforeUpdate *bool `json:"checkBeforeUpdate,omitempty"`
319325 }
320326
321327 // LinuxCPU for Linux cgroup 'cpu' resource management
642648 // LinuxSeccompFlagSpecAllow can be used to disable Speculative Store
643649 // Bypass mitigation. (since Linux 4.17)
644650 LinuxSeccompFlagSpecAllow LinuxSeccompFlag = "SECCOMP_FILTER_FLAG_SPEC_ALLOW"
651
652 // LinuxSeccompFlagWaitKillableRecv can be used to switch to the wait
653 // killable semantics. (since Linux 5.19)
654 LinuxSeccompFlagWaitKillableRecv LinuxSeccompFlag = "SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV"
645655 )
646656
647657 // Additional architectures permitted to be used for system calls