buildkit

mirror of https://github.com/moby/buildkit.git synced 2026-06-30 19:57:39 +00:00

Files

Akihiro Suda 3a91b50be1 rootless: update docs and examples

Fix issue 5763

- Discourage `--oci-worker-no-process-sandbox`, due to the leakage of
  the processes (by design).
  Instead, encourage setting `systempaths=unconfined` in `docker run`.
  This corresponds to `securityContext.procMount: Unmasked` in Kubernetes,
  however, the configuration is hard on Kubernetes, as it has to be used
  in conjunction with `hostUsers: false`.

- Remove `--device /dev/fuse`, as fuse-overlayfs is no longer used typically.

- Use the new Kubernetes struct for AppArmor

- Add a hint about `kernel.apparmor_restrict_unprivileged_userns`

- Remove `$` from command snippets for ease of copypasting

- Make `job.*.yaml` more practical

- Add `*.userns.yaml`. Needs `UserNamespaceSupport` feature gate to be enabled.

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>

2025-02-21 16:57:53 +09:00

attestations

docs: add front matter title to attestation docs

2024-10-16 17:38:54 +02:00

dev

docs: use gh alert syntax for callouts

2024-08-16 11:14:14 +02:00

reference

docs: fix up named context docs

2024-01-16 16:26:59 -08:00

annotations.md

docs: index annotations fail if index is not produced