diff --git a/Dockerfile b/Dockerfile index 18c8491..9f6774a 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,8 +1,8 @@ FROM registry.fedoraproject.org/fedora:26 -ENV VERSION=0 RELEASE=4 ARCH=x86_64 +ENV VERSION=0 RELEASE=5 ARCH=x86_64 LABEL com.redhat.component="docker" \ - name="docker" \ + name="$FGC/docker" \ version="$VERSION" \ release="$RELEASE.$DISTTAG" \ architecture="$ARCH" \ @@ -13,7 +13,8 @@ LABEL com.redhat.component="docker" \ RUN dnf install --setopt=tsflags=nodocs -y docker container-storage-setup container-selinux cloud-utils-growpart python-docker-py docker-novolume-plugin lvm2 iptables procps-ng xz oci-register-machine \ && rpm -V docker container-storage-setup container-selinux cloud-utils-growpart python-docker-py docker-novolume-plugin lvm2 iptables procps-ng xz oci-register-machine \ - && mkdir -p /usr/lib/modules && dnf clean all + && mkdir -p /usr/lib/modules /exports/hostfs/etc/docker \ + && dnf clean all RUN ln -s /usr/libexec/docker/docker-runc-current /usr/bin/docker-runc @@ -25,6 +26,8 @@ COPY set_mounts.sh / COPY config.json.template service.template tmpfiles.template /exports/ COPY daemon.json /exports/hostfs/etc/docker/container-daemon.json # https://github.com/rhatdan/oci-umount/issues/2 -RUN cp /etc/oci-umount.conf /exports/hostfs/etc +# Copy config if available +RUN (test -e /etc/oci-umount.conf && cp /etc/oci-umount.conf /exports/hostfs/etc) || true + CMD ["/usr/bin/init.sh"] diff --git a/config.json.template b/config.json.template index cd433c3..df3e4e5 100644 --- a/config.json.template +++ b/config.json.template @@ -295,17 +295,6 @@ "mode=755" ] }, - { - "type": "bind", - "source": "/usr/share/rhel", - "destination": "/usr/share/rhel", - "options": [ - "rprivate", - "rbind", - "ro", - "mode=755" - ] - }, { "type": "bind", "source": "${RUN_DIRECTORY}", @@ -381,7 +370,7 @@ ], "hooks": {}, "linux": { - "rootfsPropagation": "private", + "rootfsPropagation": "rslave", "resources": { "devices": [ { diff --git a/daemon.json b/daemon.json index ea5e789..445fe8a 100644 --- a/daemon.json +++ b/daemon.json @@ -1,6 +1,4 @@ - { - "authorization-plugins": ["rhel-push-plugin"], "default-runtime": "oci", "containerd": "/run/containerd.sock", "userland-proxy-path": "/usr/libexec/docker/docker-proxy-current", diff --git a/service.template b/service.template index f7784d4..79835de 100644 --- a/service.template +++ b/service.template @@ -6,6 +6,7 @@ After=network.target EnvironmentFile=-/etc/sysconfig/docker-storage EnvironmentFile=-/etc/sysconfig/docker-network Environment=GOTRACEBACK=crash +SELinuxContext=system_u:system_r:container_runtime_t:s0 ExecStartPre=/bin/sh $DESTDIR/rootfs/set_mounts.sh ExecStartPre=/bin/bash -c 'export -p > /run/docker-bash-env' ExecStart=$EXEC_START