diff options
| author | Valentin Rothberg <vrothberg@suse.com> | 2018-07-09 08:50:52 +0200 |
|---|---|---|
| committer | Atomic Bot <atomic-devel@projectatomic.io> | 2018-07-11 16:36:24 +0000 |
| commit | 06ab343bd7c113fe761631142dde4829e8aa4d40 (patch) | |
| tree | 0f38b5dd752683d59f9cfe335b748bf759a76a9c /Dockerfile | |
| parent | 84cfdb20617ac7a5a1138375599e28cdad26b824 (diff) | |
| download | podman-06ab343bd7c113fe761631142dde4829e8aa4d40.tar.gz podman-06ab343bd7c113fe761631142dde4829e8aa4d40.tar.bz2 podman-06ab343bd7c113fe761631142dde4829e8aa4d40.zip | |
podman/libpod: add default AppArmor profile
Make users of libpod more secure by adding the libpod/apparmor package
to load a pre-defined AppArmor profile. Large chunks of libpod/apparmor
come from github.com/moby/moby.
Also check if a specified AppArmor profile is actually loaded and throw
an error if necessary.
The default profile is loaded only on Linux builds with the `apparmor`
buildtag enabled.
Signed-off-by: Valentin Rothberg <vrothberg@suse.com>
Closes: #1063
Approved by: rhatdan
Diffstat (limited to 'Dockerfile')
| -rw-r--r-- | Dockerfile | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/Dockerfile b/Dockerfile index 53db6a3bc..2a65d95a7 100644 --- a/Dockerfile +++ b/Dockerfile @@ -115,3 +115,7 @@ COPY test/policy.json /etc/containers/policy.json COPY test/redhat_sigstore.yaml /etc/containers/registries.d/registry.access.redhat.com.yaml WORKDIR /go/src/github.com/projectatomic/libpod + +# Wrap all commands in the "docker-in-docker" script to allow nested containers, +# and allow testing of apparmor. +ENTRYPOINT ["./hack/dind"] |