container/podman
container/podman
1
0
Fork 0
mirror of https://github.com/containers/podman synced 2024-10-19 16:54:07 +00:00
Code Issues Packages Projects Releases Wiki Activity

Reveal information about container capabilities

Browse source 
I am often asked about the list of capabilities availabel to a container.
We should be listing this data in the inspect command for effective
capabilities and the bounding set.

Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>

Closes: #1335
Approved by: TomSweeneyRedHat
This commit is contained in:
Daniel J Walsh 2018-08-24 05:47:37 -04:00 committed by Atomic Bot
parent 16465007d0
commit e7fbf329c2
3 changed files with 9 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
docs/podman-inspect.1.md
View file

@ -96,6 +96,11 @@ overlay
size: 4405240
```
```
podman inspect --latest --format {{.EffectiveCaps}}
[CAP_CHOWN CAP_DAC_OVERRIDE CAP_FSETID CAP_FOWNER CAP_MKNOD CAP_NET_RAW CAP_SETGID CAP_SETUID CAP_SETFCAP CAP_SETPCAP CAP_NET_BIND_SERVICE CAP_SYS_CHROOT CAP_KILL CAP_AUDIT_WRITE]
```
## SEE ALSO
podman(1)

2
libpod/container_inspect.go
View file

@ -79,6 +79,8 @@ func (c *Container) getContainerInspectData(size bool, driverData *inspect.Data)
Name: config.Name,
Driver: driverData.Name,
MountLabel: config.MountLabel,
EffectiveCaps: spec.Process.Capabilities.Effective,
BoundingCaps: spec.Process.Capabilities.Bounding,
ProcessLabel: spec.Process.SelinuxLabel,
AppArmorProfile: spec.Process.ApparmorProfile,
ExecIDs: execIDs,

2
pkg/inspect/inspect.go
View file

@ -161,6 +161,8 @@ type ContainerInspectData struct {
MountLabel string `json:"MountLabel"`
ProcessLabel string `json:"ProcessLabel"`
AppArmorProfile string `json:"AppArmorProfile"`
EffectiveCaps []string `json:"EffectiveCaps"`
BoundingCaps []string `json:"BoundingCaps"`
ExecIDs []string `json:"ExecIDs"`
GraphDriver *Data `json:"GraphDriver"`
SizeRw int64 `json:"SizeRw,omitempty"`