Skip to content

Commit

Permalink
dockerfile: adjust args and docs
Browse files Browse the repository at this point in the history
  • Loading branch information
lucab committed Aug 16, 2017
1 parent c40247d commit 620ef5c
Show file tree
Hide file tree
Showing 2 changed files with 3 additions and 3 deletions.
2 changes: 1 addition & 1 deletion Dockerfile
Original file line number Diff line number Diff line change
Expand Up @@ -4,4 +4,4 @@ MAINTAINER "Luca Bruno <[email protected]>"

COPY target/x86_64-unknown-linux-musl/release/fxe /

CMD ["/fxe", "/ns/mnt"]
CMD ["/fxe", "/proc/1/ns/mnt"]
4 changes: 2 additions & 2 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -31,7 +31,7 @@ To try it, simply do a `make run`:
```
$ make run
docker run --privileged --pid=host -v /proc/1/ns/:/ns quay.io/lucab/fxe:latest
docker run --privileged --pid=host quay.io/lucab/fxe:latest /fxe /proc/1/ns/mnt
filename: /lib/modules/4.11.0-1-amd64/kernel/lib/crc16.ko
description: CRC16 calculations
Expand All @@ -41,7 +41,7 @@ intree: Y
vermagic: 4.11.0-1-amd64 SMP mod_unload modversions
```

This will use `/proc/1/ns/mnt` as the host mount-namespace target, which should be bind-mounted inside the container.
This will use `/proc/1/ns/mnt` as the host mount-namespace target. Other targets can be used, as long as they are bind-mounted inside the container.

The `--privileged` flag is a shortcut to add `CAP_SYS_ADMIN` and `CAP_SYS_CHROOT` (required by `setns(2)`) and to prevent the default SECCOMP filter to block it. Both can be allowed with finer granularity settings (this is left as an exercise).

Expand Down

0 comments on commit 620ef5c

Please sign in to comment.