Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Sfdk: Allow optional access to host devices. JB#59670 #549

Merged
merged 2 commits into from Jan 12, 2023
Merged

Conversation

martyone
Copy link
Member

No description provided.

Main motivation here is to get access to dynamically created loop and
LVM devices, which are needed for device image creation. It still needs
the '--privileged' option to actually allow accessing these devices
(controlled by the SAILFISH_SDK_DOCKER_RUN_PRIVILEGED env var). Or from
the other side: with the defauts it is hardly possible to screw
something up on the host through the bind-mounted /dev.
Copy link
Member

@vigejolla vigejolla left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM. But thinking a bit further, perhaps instead of using privileged, we could allow just the loop device access with --device-cgroup-rule="b 7:* rmw" ?

@martyone
Copy link
Member Author

Nice tip. Strange I never hit a reference on this option while looking for possible solutions. There is also a need to use LVM, which would need something more flexible for proper filtering - haven't checked yet.

@martyone martyone merged commit 6046f1a into master Jan 12, 2023
@martyone martyone deleted the jb59670 branch January 12, 2023 12:18
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants