mirror of
https://github.com/podman-container-tools/podman.git
synced 2026-10-22 22:07:37 +00:00
d92650a922
to more closely mimic docker default behavior, the --layers cli option is set to true by default for podman. the buildah environment variable of BUILDAH_LAYERS is still honored and will override the command line input. this should be considered in place of PR #1383. Many thanks for Scott McCarty for inspiring this welcome change. Signed-off-by: baude <bbaude@redhat.com> Closes: #1422 Approved by: rhatdan
35 lines
951 B
Go
35 lines
951 B
Go
// +build seccomp,linux
|
|
|
|
package buildah
|
|
|
|
import (
|
|
"io/ioutil"
|
|
|
|
"github.com/opencontainers/runtime-spec/specs-go"
|
|
"github.com/pkg/errors"
|
|
seccomp "github.com/seccomp/containers-golang"
|
|
)
|
|
|
|
func setupSeccomp(spec *specs.Spec, seccompProfilePath string) error {
|
|
switch seccompProfilePath {
|
|
case "unconfined":
|
|
spec.Linux.Seccomp = nil
|
|
case "":
|
|
seccompConfig, err := seccomp.GetDefaultProfile(spec)
|
|
if err != nil {
|
|
return errors.Wrapf(err, "loading default seccomp profile failed")
|
|
}
|
|
spec.Linux.Seccomp = seccompConfig
|
|
default:
|
|
seccompProfile, err := ioutil.ReadFile(seccompProfilePath)
|
|
if err != nil {
|
|
return errors.Wrapf(err, "opening seccomp profile (%s) failed", seccompProfilePath)
|
|
}
|
|
seccompConfig, err := seccomp.LoadProfile(string(seccompProfile), spec)
|
|
if err != nil {
|
|
return errors.Wrapf(err, "loading seccomp profile (%s) failed", seccompProfilePath)
|
|
}
|
|
spec.Linux.Seccomp = seccompConfig
|
|
}
|
|
return nil
|
|
}
|