firecracker-microvm/firecracker
GitHub で見るInvestigate running the jailer with reduced set of capabilities
Open
#1,190 opened on 2019年7月22日
Good first issuePriority: LowStatus: ParkedType: Enhancement
Repository metrics
- Stars
- (34,348 stars)
- PR merge metrics
- (平均マージ 3d 17h) (30d で 67 merged PRs)
説明
We currently start the jailer as the superuser (i.e. using sudo), and rely on the fact the process will deprivilege itself before exec-ing into Firecracker. It would be interesting to know if we can run the jailer using a more restricted set of capabilities instead of full superuser mode.