From 06ab343bd7c113fe761631142dde4829e8aa4d40 Mon Sep 17 00:00:00 2001 From: Valentin Rothberg Date: Mon, 9 Jul 2018 08:50:52 +0200 Subject: podman/libpod: add default AppArmor profile Make users of libpod more secure by adding the libpod/apparmor package to load a pre-defined AppArmor profile. Large chunks of libpod/apparmor come from github.com/moby/moby. Also check if a specified AppArmor profile is actually loaded and throw an error if necessary. The default profile is loaded only on Linux builds with the `apparmor` buildtag enabled. Signed-off-by: Valentin Rothberg Closes: #1063 Approved by: rhatdan --- Dockerfile | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'Dockerfile') diff --git a/Dockerfile b/Dockerfile index 53db6a3bc..2a65d95a7 100644 --- a/Dockerfile +++ b/Dockerfile @@ -115,3 +115,7 @@ COPY test/policy.json /etc/containers/policy.json COPY test/redhat_sigstore.yaml /etc/containers/registries.d/registry.access.redhat.com.yaml WORKDIR /go/src/github.com/projectatomic/libpod + +# Wrap all commands in the "docker-in-docker" script to allow nested containers, +# and allow testing of apparmor. +ENTRYPOINT ["./hack/dind"] -- cgit v1.2.3-54-g00ecf