|
|
691.
|
|
|
Profiles
|
|
|
|
|
Профілі
|
|
Translated by
Yuri Chornoivan
|
|
|
|
Located in
serverguide/C/virtualization.xml:1417(title) serverguide/C/security.xml:1065(title)
|
|
|
692.
|
|
|
Profiles are named collections of configurations which may be applied to more than one container. For instance, all containers created with 'lxc launch', by default, include the 'default' profile, which provides a network interface 'eth0'.
|
|
|
|
|
(no translation yet)
|
|
|
|
Located in
serverguide/C/virtualization.xml:1419(para)
|
|
|
693.
|
|
|
To mask a device which would be inherited from a profile but which should not be in the final container, define a device by the same name but of type 'none':
|
|
|
|
|
(no translation yet)
|
|
|
|
Located in
serverguide/C/virtualization.xml:1426(para)
|
|
|
694.
|
|
|
lxc config device add c1 eth1 none
|
|
|
|
|
(no translation yet)
|
|
|
|
Located in
serverguide/C/virtualization.xml:1433(command)
|
|
|
695.
|
|
|
Nesting
|
|
|
|
|
(no translation yet)
|
|
|
|
Located in
serverguide/C/virtualization.xml:1439(title) serverguide/C/virtualization.xml:2031(title)
|
|
|
696.
|
|
|
Containers all share the same host kernel. This means that there is always an inherent trade-off between features exposed to the container and host security from malicious containers. Containers by default are therefore restricted from features needed to nest child containers. In order to run lxc or lxd containers under a lxd container, the 'security.nesting' feature must be set to true:
|
|
|
|
|
(no translation yet)
|
|
|
|
Located in
serverguide/C/virtualization.xml:1441(para)
|
|
|
697.
|
|
|
lxc config set container1 security.nesting true
|
|
|
|
|
(no translation yet)
|
|
|
|
Located in
serverguide/C/virtualization.xml:1451(command)
|
|
|
698.
|
|
|
Once this is done, container1 will be able to start sub-containers.
|
|
|
|
|
(no translation yet)
|
|
|
|
Located in
serverguide/C/virtualization.xml:1456(para)
|
|
|
699.
|
|
|
In order to run unprivileged (the default in LXD) containers nested under an unprivileged container, you will need to ensure a wide enough UID mapping. Please see the 'UID mapping' section below.
|
|
|
|
|
(no translation yet)
|
|
|
|
Located in
serverguide/C/virtualization.xml:1460(para)
|
|
|
700.
|
|
|
Docker
|
|
|
|
|
(no translation yet)
|
|
|
|
Located in
serverguide/C/virtualization.xml:1466(title)
|
