firecracker-microvm/firecracker
Investigate running the jailer with reduced set of capabilities
开放
#1,190 创建于 2019年7月22日
Good first issuePriority: LowStatus: ParkedType: Enhancement
仓库指标
- 星标
- (34,348 个星标)
- PR 合并指标
- (PR 指标待抓取)
描述
We currently start the jailer as the superuser (i.e. using sudo), and rely on the fact the process will deprivilege itself before exec-ing into Firecracker. It would be interesting to know if we can run the jailer using a more restricted set of capabilities instead of full superuser mode.