diff --git a/AUTHORS b/AUTHORS index 9a0d8ecc5..214c87ce2 100644 --- a/AUTHORS +++ b/AUTHORS @@ -120,6 +120,7 @@ Marko Mikulicic Markus Fix Martin Redmond Matt Apperson +Mathieu Le Marec - Pasquet Matt Bachmann Matthew Mueller Maxim Treskin diff --git a/docs/sources/installation/kernel.rst b/docs/sources/installation/kernel.rst index bc8440fe2..b9abdc272 100644 --- a/docs/sources/installation/kernel.rst +++ b/docs/sources/installation/kernel.rst @@ -25,6 +25,7 @@ If you cannot or do not want to use the "official" kernels, here is some technical background about the features (both optional and mandatory) that docker needs to run successfully. + Linux version 3.8 or above -------------------------- @@ -39,6 +40,15 @@ The symptoms include: - kernel crash causing the machine to freeze for a few minutes, or even completely. +Additionally, kernels prior 3.4 did not implement ``reboot_pid_ns``, +which means that the ``reboot()`` syscall could reboot the host machine, +instead of terminating the container. To work around that problem, +LXC userland tools (since version 0.8) automatically drop the ``SYS_BOOT`` +capability when necessary. Still, if you run a pre-3.4 kernel with pre-0.8 +LXC tools, be aware that containers can reboot the whole host! This is +not something that Docker wants to address in the short term, since you +shouldn't use kernels prior 3.8 with Docker anyway. + While it is still possible to use older kernels for development, it is really not advised to do so. diff --git a/lxc_template.go b/lxc_template.go index aacca0b01..2ba286742 100644 --- a/lxc_template.go +++ b/lxc_template.go @@ -120,7 +120,7 @@ lxc.aa_profile = unconfined # (Note: 'lxc.cap.keep' is coming soon and should replace this under the # security principle 'deny all unless explicitly permitted', see # http://sourceforge.net/mailarchive/message.php?msg_id=31054627 ) -lxc.cap.drop = audit_control audit_write mac_admin mac_override mknod setpcap sys_admin sys_boot sys_module sys_nice sys_pacct sys_rawio sys_resource sys_time sys_tty_config +lxc.cap.drop = audit_control audit_write mac_admin mac_override mknod setpcap sys_admin sys_module sys_nice sys_pacct sys_rawio sys_resource sys_time sys_tty_config {{end}} # limits