netbird/gvisor
0
0
Fork 0
mirror of https://github.com/netbirdio/gvisor.git synced 2026-05-22 17:12:49 -07:00
Code Issues Packages Projects Releases Wiki Activity

Make directfs the default in runsc.

Browse Source 
Directfs is a filesystem optimization that allows the sandbox process to access
the container filesystem directly. The involvement of the filesystem proxy
(gofer) is reduced substantially.

If this change breaks you, please let us know via GitHub Issues. To unbreak,
use --directfs=false.

PiperOrigin-RevId: 533193050
This commit is contained in:
Ayush Ranjan
2023-05-18 11:28:24 -07:00
committed by gVisor bot
parent ed528835f7
commit 6b317756e8
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
runsc/config/flags.go
+1 -1
View File
@@ -100,7 +100,7 @@ func RegisterFlags(flagSet *flag.FlagSet) {
flagSet.Int("fdlimit", -1, "Specifies a limit on the number of host file descriptors that can be open. Applies separately to the sentry and gofer. Note: each file in the sandbox holds more than one host FD open.")
flagSet.Int("dcache", -1, "Set the global dentry cache size. This acts as a coarse-grained control on the number of host FDs simultaneously open by the sentry. If negative, per-mount caches are used.")
flagSet.Bool("iouring", false, "TEST ONLY; Enables io_uring syscalls in the sentry. Support is experimental and very limited.")
flagSet.Bool("directfs", false, "directly access the container filesystems from the sentry. Sentry runs with higher privileges.")
flagSet.Bool("directfs", true, "directly access the container filesystems from the sentry. Sentry runs with higher privileges.")
// Flags that control sandbox runtime behavior: network related.
flagSet.Var(networkTypePtr(NetworkSandbox), "network", "specifies which network to use: sandbox (default), host, none. Using network inside the sandbox is more secure because it's isolated from the host network.")