[Blueprint servercloud-p-lxc-sandboxing] Sandboxing for containers
Serge Hallyn
serge.hallyn at ubuntu.com
Mon Dec 19 17:35:00 UTC 2011
Blueprint changed by Serge Hallyn:
Whiteboard changed:
Status: not yet started
- The new candidate seccomp2 patch refuses execve, and is therefore not compatible with LXC. A general sandbox tool is still possible, and seccomp2 may later be extended to be usable with LXC.
+ The seccomp2 patch in the oneiric kernel supports execve, but is not yet upstream. There is a minijail0 POC general sandbox tool which works on precise and could be packaged. LXC support for seccomp2 should be possible.
Work Items:
[jjohansen] Get seccomp2 into ubuntu kernel or ppa for testing: DONE
- [serge-hallyn] Work with jjohansen/kees/upstream to design generic sandbox program: TODO
+ [serge-hallyn] Package minijail0: TODO
[serge-hallyn] Propose design for lxc integration to lxc-dev: TODO
[serge-hallyn] Implement prototype of lxc seccomp2 integration: TODO
[serge-hallyn] Write testcases for lxc seccomp2 integration: TODO
--
Sandboxing for containers
https://blueprints.launchpad.net/ubuntu/+spec/servercloud-p-lxc-sandboxing
More information about the Ubuntu-server-bugs
mailing list