From 6b317756e88456d58a4fd4c176b3ea4e6654096d Mon Sep 17 00:00:00 2001 From: Ayush Ranjan Date: Thu, 18 May 2023 11:25:25 -0700 Subject: [PATCH] Make directfs the default in runsc. Directfs is a filesystem optimization that allows the sandbox process to access the container filesystem directly. The involvement of the filesystem proxy (gofer) is reduced substantially. If this change breaks you, please let us know via GitHub Issues. To unbreak, use --directfs=false. PiperOrigin-RevId: 533193050 --- runsc/config/flags.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/runsc/config/flags.go b/runsc/config/flags.go index da4eba4ea..5366600b7 100644 --- a/runsc/config/flags.go +++ b/runsc/config/flags.go @@ -100,7 +100,7 @@ func RegisterFlags(flagSet *flag.FlagSet) { flagSet.Int("fdlimit", -1, "Specifies a limit on the number of host file descriptors that can be open. Applies separately to the sentry and gofer. Note: each file in the sandbox holds more than one host FD open.") flagSet.Int("dcache", -1, "Set the global dentry cache size. This acts as a coarse-grained control on the number of host FDs simultaneously open by the sentry. If negative, per-mount caches are used.") flagSet.Bool("iouring", false, "TEST ONLY; Enables io_uring syscalls in the sentry. Support is experimental and very limited.") - flagSet.Bool("directfs", false, "directly access the container filesystems from the sentry. Sentry runs with higher privileges.") + flagSet.Bool("directfs", true, "directly access the container filesystems from the sentry. Sentry runs with higher privileges.") // Flags that control sandbox runtime behavior: network related. flagSet.Var(networkTypePtr(NetworkSandbox), "network", "specifies which network to use: sandbox (default), host, none. Using network inside the sandbox is more secure because it's isolated from the host network.")