Open
Description
Running any docker image with --privileged is far from ideal.
When the operator executes docker run --privileged, Docker will enable access to all devices on the host as well as set some configuration in AppArmor or SELinux to allow the container nearly all the same access to the host as processes running outside containers on the host.
I started looking at running the guix image without --privileged:
guix environment: error: build failed: cloning builder process: Operation not permittedAdding --cap-add=SYS_ADMIN, which is also far from ideal, see "CAP_SYS_ADMIN: the new root", solved that, but lead to:
guix environment: error: build failed: while setting up the build environment: cannot set loopback interface flags: Operation not permittedSo I added --cap-add=NET_ADMIN. I'm now at:
guix environment: error: build failed: while setting up the build environment: cannot pivot old root directory onto '/gnu/store/380c843hbacsr4dvj9dpqb5dw11x60dd-ca-certificate-bundle.drv.chroot/real-root': Operation not permittedMetadata
Metadata
Assignees
Labels
No labels