io-uring support

[omegacoleman]

I'm currently using containers for my workzone, and I'm just getting my hands on the new io-uring thingy in kernel 5.1 here

And then I noticed that docker currently blocks the io-uring related requests :

/code/liburing/examples on  master! ⌚ 10:14:17
$ ./io_uring-test io_uring-test.c
queue_init: Operation not permitted

While this test program runs without a problem on the host machine (I'm using a fedora30 host with docker-machine --drive generic)

So I thought this would be the place to suggest this feature

[cpuguy83]

This likely needs to be added to the seccomp profile here: https://github.com/moby/moby/blob/master/profiles/seccomp/default.json

Note you can provide your own seccomp profile to unblock yourself.
docker run --sec-opt seccomp:/path/to/profile.json

You can also set the default profile as a daemon option:

--secomp-profile=/path/to/profile.json

[omegacoleman]

This likely needs to be added to the seccomp profile here: https://github.com/moby/moby/blob/master/profiles/seccomp/default.json

Note you can provide your own seccomp profile to unblock yourself.
docker run --sec-opt seccomp:/path/to/profile.json

You can also set the default profile as a daemon option:

--secomp-profile=/path/to/profile.json

Thanks so much ur comment points me to the right way.

However the upstream hasn't included support for io-uring yet, but I already PRed it: seccomp/libseccomp#157

Plus there's a few typo: --security-opt not --sec-opt, and --seccomp-profile not --secomp-profile

Currently I workaound the problem by just allow every system call to pass:

{
	"defaultAction": "SCMP_ACT_ALLOW",
	...,
	"syscalls": []
}

But this config is highly unsafe under production circumstances.

I think this could be put on hold until the upsteam gain uring support, then I could add it to the default config.

[thaJeztah]

for future visitors; these were removed again in;

• seccomp: block io_uring_* syscalls in default profile #46762
• and in containerd: Update RuntimeDefault seccomp profile to disallow io_uring related syscalls containerd/containerd#9320