diff options
| author | OpenShift Merge Robot <openshift-merge-robot@users.noreply.github.com> | 2020-07-19 09:05:52 -0400 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2020-07-19 09:05:52 -0400 |
| commit | b7b8fce82693ae0f9ebb0561cd3e6c118ad35fe9 (patch) | |
| tree | 07b2eeede3dab0438ecdc7c40d0d337fd7826452 | |
| parent | d087adeb8716b7214ee925df749a34c8b3b01f4e (diff) | |
| parent | 94d9add4eb596670be6fe5c511b7d6068ff23923 (diff) | |
| download | podman-b7b8fce82693ae0f9ebb0561cd3e6c118ad35fe9.tar.gz podman-b7b8fce82693ae0f9ebb0561cd3e6c118ad35fe9.tar.bz2 podman-b7b8fce82693ae0f9ebb0561cd3e6c118ad35fe9.zip | |
Merge pull request #7011 from rhatdan/troubleshoot
document CAP_SYS_ADMIN required for systemd PrivateNetwork
| -rw-r--r-- | rootless.md | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/rootless.md b/rootless.md index e6f17a370..f94815606 100644 --- a/rootless.md +++ b/rootless.md @@ -17,7 +17,7 @@ can easily fail * As of Fedora 31 defaults to cgroup V2, which has full support of rootless cgroup management. Note this requires the --cgroup-manager within rootless containers to use systemd, which new containers will get by default. * Some system unit configuration options do not work in the rootless container * systemd fails to apply several options and failures are silently ignored (e.g. CPUShares, MemoryLimit). Should work on cgroup V2. - * Use of certain options will cause service startup failures (e.g. PrivateNetwork). + * Use of certain options will cause service startup failures (e.g. PrivateNetwork). The systemd services requiring `PrivateNetwork` can be made to work by passing `--cap-add SYS_ADMIN`, but the security implications should be carefully evaluated. In most cases, it's better to create an override.conf drop-in that sets `PrivateNetwork=no`. This also applies to containers run by root. * Can not share container images with CRI-O or other rootfull users * Difficult to use additional stores for sharing content * Does not work on NFS or parallel filesystem homedirs (e.g. [GPFS](https://www.ibm.com/support/knowledgecenter/en/SSFKCN/gpfs_welcome.html)) |