netbird/gvisor
0
0
Fork 0
mirror of https://github.com/netbirdio/gvisor.git synced 2026-05-22 17:12:49 -07:00
Code Issues Packages Projects Releases Wiki Activity

Allow --overlay2 flag to be overridden by annotations.

Browse Source 
This flag does not have security implications. It is a performance optimization

Updates #9834

PiperOrigin-RevId: 707207603
This commit is contained in:
Ayush Ranjan
2024-12-17 12:38:54 -08:00
committed by gVisor bot
parent 5fdedb5276
commit afdd74ad64
1 changed files with 3 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
runsc/config/flags.go
+3 -1
View File
@@ -42,6 +42,7 @@ const (
flagNetDisconnectOK = "net-disconnect-ok" flagNetDisconnectOK = "net-disconnect-ok"
flagReproduceNFTables = "reproduce-nftables" flagReproduceNFTables = "reproduce-nftables"
flagOCISeccomp = "oci-seccomp" flagOCISeccomp = "oci-seccomp"
flagOverlay2 = "overlay2"
) )
// RegisterFlags registers flags used to populate Config. // RegisterFlags registers flags used to populate Config.
@@ -112,7 +113,7 @@ func RegisterFlags(flagSet *flag.FlagSet) {
flagSet.Var(fileAccessTypePtr(FileAccessExclusive), "file-access", "specifies which filesystem validation to use for the root mount: exclusive (default), shared.") flagSet.Var(fileAccessTypePtr(FileAccessExclusive), "file-access", "specifies which filesystem validation to use for the root mount: exclusive (default), shared.")
flagSet.Var(fileAccessTypePtr(FileAccessShared), "file-access-mounts", "specifies which filesystem validation to use for volumes other than the root mount: shared (default), exclusive.") flagSet.Var(fileAccessTypePtr(FileAccessShared), "file-access-mounts", "specifies which filesystem validation to use for volumes other than the root mount: shared (default), exclusive.")
flagSet.Bool("overlay", false, "DEPRECATED: use --overlay2=all:memory to achieve the same effect") flagSet.Bool("overlay", false, "DEPRECATED: use --overlay2=all:memory to achieve the same effect")
flagSet.Var(defaultOverlay2(), "overlay2", "wrap mounts with overlayfs. Format is {mount}:{medium}, where 'mount' can be 'root' or 'all' and medium can be 'memory', 'self' or 'dir=/abs/dir/path' in which filestore will be created. 'none' will turn overlay mode off.") flagSet.Var(defaultOverlay2(), flagOverlay2, "wrap mounts with overlayfs. Format is {mount}:{medium}, where 'mount' can be 'root' or 'all' and medium can be 'memory', 'self' or 'dir=/abs/dir/path' in which filestore will be created. 'none' will turn overlay mode off.")
flagSet.Bool("fsgofer-host-uds", false, "DEPRECATED: use host-uds=all") flagSet.Bool("fsgofer-host-uds", false, "DEPRECATED: use host-uds=all")
flagSet.Var(hostUDSPtr(HostUDSNone), flagHostUDS, "controls permission to access host Unix-domain sockets. Values: none|open|create|all, default: none") flagSet.Var(hostUDSPtr(HostUDSNone), flagHostUDS, "controls permission to access host Unix-domain sockets. Values: none|open|create|all, default: none")
flagSet.Var(hostFifoPtr(HostFifoNone), "host-fifo", "controls permission to access host FIFOs (or named pipes). Values: none|open, default: none") flagSet.Var(hostFifoPtr(HostFifoNone), "host-fifo", "controls permission to access host FIFOs (or named pipes). Values: none|open, default: none")
@@ -177,6 +178,7 @@ var overrideAllowlist = map[string]struct {
flagHostUDS: {}, flagHostUDS: {},
flagNetDisconnectOK: {}, flagNetDisconnectOK: {},
flagReproduceNFTables: {}, flagReproduceNFTables: {},
flagOverlay2: {},
flagOCISeccomp: {check: checkOciSeccomp}, flagOCISeccomp: {check: checkOciSeccomp},
} }