mirror of
https://github.com/opencontainers/runtime-spec.git
synced 2026-02-05 18:45:18 +01:00
afdbcb8545
This uses FreeBSD jails to implement container isolation. Signed-off-by: Doug Rabson <dfr@rabson.org>
379 lines
11 KiB
JSON
379 lines
11 KiB
JSON
{
|
|
"definitions": {
|
|
"PersonalityDomain": {
|
|
"type": "string",
|
|
"enum": [
|
|
"LINUX",
|
|
"LINUX32"
|
|
]
|
|
},
|
|
"Personality": {
|
|
"type": "object",
|
|
"properties": {
|
|
"domain": {
|
|
"$ref": "#/definitions/PersonalityDomain"
|
|
},
|
|
"flags": {
|
|
"$ref": "defs.json#/definitions/ArrayOfStrings"
|
|
}
|
|
}
|
|
},
|
|
"RootfsPropagation": {
|
|
"type": "string",
|
|
"enum": [
|
|
"private",
|
|
"shared",
|
|
"slave",
|
|
"unbindable"
|
|
]
|
|
},
|
|
"SeccompArch": {
|
|
"type": "string",
|
|
"enum": [
|
|
"SCMP_ARCH_X86",
|
|
"SCMP_ARCH_X86_64",
|
|
"SCMP_ARCH_X32",
|
|
"SCMP_ARCH_ARM",
|
|
"SCMP_ARCH_AARCH64",
|
|
"SCMP_ARCH_LOONGARCH64",
|
|
"SCMP_ARCH_M68K",
|
|
"SCMP_ARCH_MIPS",
|
|
"SCMP_ARCH_MIPS64",
|
|
"SCMP_ARCH_MIPS64N32",
|
|
"SCMP_ARCH_MIPSEL",
|
|
"SCMP_ARCH_MIPSEL64",
|
|
"SCMP_ARCH_MIPSEL64N32",
|
|
"SCMP_ARCH_PPC",
|
|
"SCMP_ARCH_PPC64",
|
|
"SCMP_ARCH_PPC64LE",
|
|
"SCMP_ARCH_S390",
|
|
"SCMP_ARCH_S390X",
|
|
"SCMP_ARCH_SH",
|
|
"SCMP_ARCH_SHEB",
|
|
"SCMP_ARCH_PARISC",
|
|
"SCMP_ARCH_PARISC64",
|
|
"SCMP_ARCH_RISCV64"
|
|
]
|
|
},
|
|
"SeccompAction": {
|
|
"type": "string",
|
|
"enum": [
|
|
"SCMP_ACT_KILL",
|
|
"SCMP_ACT_KILL_PROCESS",
|
|
"SCMP_ACT_KILL_THREAD",
|
|
"SCMP_ACT_TRAP",
|
|
"SCMP_ACT_ERRNO",
|
|
"SCMP_ACT_TRACE",
|
|
"SCMP_ACT_ALLOW",
|
|
"SCMP_ACT_LOG",
|
|
"SCMP_ACT_NOTIFY"
|
|
]
|
|
},
|
|
"SeccompFlag": {
|
|
"type": "string",
|
|
"enum": [
|
|
"SECCOMP_FILTER_FLAG_TSYNC",
|
|
"SECCOMP_FILTER_FLAG_LOG",
|
|
"SECCOMP_FILTER_FLAG_SPEC_ALLOW",
|
|
"SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV"
|
|
]
|
|
},
|
|
"SeccompOperators": {
|
|
"type": "string",
|
|
"enum": [
|
|
"SCMP_CMP_NE",
|
|
"SCMP_CMP_LT",
|
|
"SCMP_CMP_LE",
|
|
"SCMP_CMP_EQ",
|
|
"SCMP_CMP_GE",
|
|
"SCMP_CMP_GT",
|
|
"SCMP_CMP_MASKED_EQ"
|
|
]
|
|
},
|
|
"SyscallArg": {
|
|
"type": "object",
|
|
"properties": {
|
|
"index": {
|
|
"$ref": "defs.json#/definitions/uint32"
|
|
},
|
|
"value": {
|
|
"$ref": "defs.json#/definitions/uint64"
|
|
},
|
|
"valueTwo": {
|
|
"$ref": "defs.json#/definitions/uint64"
|
|
},
|
|
"op": {
|
|
"$ref": "#/definitions/SeccompOperators"
|
|
}
|
|
},
|
|
"required": [
|
|
"index",
|
|
"value",
|
|
"op"
|
|
]
|
|
},
|
|
"Syscall": {
|
|
"type": "object",
|
|
"properties": {
|
|
"names": {
|
|
"type": "array",
|
|
"items": {
|
|
"type": "string"
|
|
},
|
|
"minItems": 1
|
|
},
|
|
"action": {
|
|
"$ref": "#/definitions/SeccompAction"
|
|
},
|
|
"errnoRet": {
|
|
"$ref": "defs.json#/definitions/uint32"
|
|
},
|
|
"args": {
|
|
"type": "array",
|
|
"items": {
|
|
"$ref": "#/definitions/SyscallArg"
|
|
}
|
|
}
|
|
},
|
|
"required": [
|
|
"names",
|
|
"action"
|
|
]
|
|
},
|
|
"Major": {
|
|
"description": "major device number",
|
|
"$ref": "defs.json#/definitions/int64"
|
|
},
|
|
"Minor": {
|
|
"description": "minor device number",
|
|
"$ref": "defs.json#/definitions/int64"
|
|
},
|
|
"FileType": {
|
|
"description": "Type of a block or special character device",
|
|
"type": "string",
|
|
"pattern": "^[cbup]$"
|
|
},
|
|
"Device": {
|
|
"type": "object",
|
|
"required": [
|
|
"type",
|
|
"path"
|
|
],
|
|
"properties": {
|
|
"type": {
|
|
"$ref": "#/definitions/FileType"
|
|
},
|
|
"path": {
|
|
"$ref": "defs.json#/definitions/FilePath"
|
|
},
|
|
"fileMode": {
|
|
"$ref": "defs.json#/definitions/FileMode"
|
|
},
|
|
"major": {
|
|
"$ref": "#/definitions/Major"
|
|
},
|
|
"minor": {
|
|
"$ref": "#/definitions/Minor"
|
|
},
|
|
"uid": {
|
|
"$ref": "defs.json#/definitions/UID"
|
|
},
|
|
"gid": {
|
|
"$ref": "defs.json#/definitions/GID"
|
|
}
|
|
}
|
|
},
|
|
"NetDevice": {
|
|
"type": "object",
|
|
"properties": {
|
|
"name": {
|
|
"type": "string"
|
|
}
|
|
}
|
|
},
|
|
"weight": {
|
|
"$ref": "defs.json#/definitions/uint16"
|
|
},
|
|
"blockIODevice": {
|
|
"type": "object",
|
|
"properties": {
|
|
"major": {
|
|
"$ref": "#/definitions/Major"
|
|
},
|
|
"minor": {
|
|
"$ref": "#/definitions/Minor"
|
|
}
|
|
},
|
|
"required": [
|
|
"major",
|
|
"minor"
|
|
]
|
|
},
|
|
"blockIODeviceWeight": {
|
|
"type": "object",
|
|
"allOf": [
|
|
{
|
|
"$ref": "#/definitions/blockIODevice"
|
|
},
|
|
{
|
|
"type": "object",
|
|
"properties": {
|
|
"weight": {
|
|
"$ref": "#/definitions/weight"
|
|
},
|
|
"leafWeight": {
|
|
"$ref": "#/definitions/weight"
|
|
}
|
|
}
|
|
}
|
|
]
|
|
},
|
|
"blockIODeviceThrottle": {
|
|
"allOf": [
|
|
{
|
|
"$ref": "#/definitions/blockIODevice"
|
|
},
|
|
{
|
|
"type": "object",
|
|
"properties": {
|
|
"rate": {
|
|
"$ref": "defs.json#/definitions/uint64"
|
|
}
|
|
}
|
|
}
|
|
]
|
|
},
|
|
"DeviceCgroup": {
|
|
"type": "object",
|
|
"properties": {
|
|
"allow": {
|
|
"type": "boolean"
|
|
},
|
|
"type": {
|
|
"type": "string"
|
|
},
|
|
"major": {
|
|
"$ref": "#/definitions/Major"
|
|
},
|
|
"minor": {
|
|
"$ref": "#/definitions/Minor"
|
|
},
|
|
"access": {
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": [
|
|
"allow"
|
|
]
|
|
},
|
|
"MemoryPolicyMode": {
|
|
"type": "string",
|
|
"enum": [
|
|
"MPOL_DEFAULT",
|
|
"MPOL_BIND",
|
|
"MPOL_INTERLEAVE",
|
|
"MPOL_WEIGHTED_INTERLEAVE",
|
|
"MPOL_PREFERRED",
|
|
"MPOL_PREFERRED_MANY",
|
|
"MPOL_LOCAL"
|
|
]
|
|
},
|
|
"MemoryPolicyFlag": {
|
|
"type": "string",
|
|
"enum": [
|
|
"MPOL_F_NUMA_BALANCING",
|
|
"MPOL_F_RELATIVE_NODES",
|
|
"MPOL_F_STATIC_NODES"
|
|
]
|
|
},
|
|
"NetworkInterfacePriority": {
|
|
"type": "object",
|
|
"properties": {
|
|
"name": {
|
|
"type": "string"
|
|
},
|
|
"priority": {
|
|
"$ref": "defs.json#/definitions/uint32"
|
|
}
|
|
},
|
|
"required": [
|
|
"name",
|
|
"priority"
|
|
]
|
|
},
|
|
"Rdma": {
|
|
"type": "object",
|
|
"properties": {
|
|
"hcaHandles": {
|
|
"$ref": "defs.json#/definitions/uint32"
|
|
},
|
|
"hcaObjects": {
|
|
"$ref": "defs.json#/definitions/uint32"
|
|
}
|
|
}
|
|
},
|
|
"NamespaceType": {
|
|
"type": "string",
|
|
"enum": [
|
|
"mount",
|
|
"pid",
|
|
"network",
|
|
"uts",
|
|
"ipc",
|
|
"user",
|
|
"cgroup",
|
|
"time"
|
|
]
|
|
},
|
|
"NamespaceReference": {
|
|
"type": "object",
|
|
"properties": {
|
|
"type": {
|
|
"$ref": "#/definitions/NamespaceType"
|
|
},
|
|
"path": {
|
|
"$ref": "defs.json#/definitions/FilePath"
|
|
}
|
|
},
|
|
"required": [
|
|
"type"
|
|
]
|
|
},
|
|
"TimeOffsets": {
|
|
"type": "object",
|
|
"properties": {
|
|
"secs": {
|
|
"$ref": "defs.json#/definitions/int64"
|
|
},
|
|
"nanosecs": {
|
|
"$ref": "defs.json#/definitions/uint32"
|
|
}
|
|
}
|
|
},
|
|
"SchedulerPolicy": {
|
|
"type": "string",
|
|
"enum": [
|
|
"SCHED_OTHER",
|
|
"SCHED_FIFO",
|
|
"SCHED_RR",
|
|
"SCHED_BATCH",
|
|
"SCHED_ISO",
|
|
"SCHED_IDLE",
|
|
"SCHED_DEADLINE"
|
|
]
|
|
},
|
|
"SchedulerFlag": {
|
|
"type": "string",
|
|
"enum": [
|
|
"SCHED_FLAG_RESET_ON_FORK",
|
|
"SCHED_FLAG_RECLAIM",
|
|
"SCHED_FLAG_DL_OVERRUN",
|
|
"SCHED_FLAG_KEEP_POLICY",
|
|
"SCHED_FLAG_KEEP_PARAMS",
|
|
"SCHED_FLAG_UTIL_CLAMP_MIN",
|
|
"SCHED_FLAG_UTIL_CLAMP_MAX"
|
|
]
|
|
}
|
|
}
|
|
}
|