doos 0.1.0: user-level overlayfs containers with slirp networking

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
2026-10-23 20:54:55 +02:00
commit 36f4f890c7
21 changed files with 1418 additions and 0 deletions
@@ -0,0 +1,11 @@
+# Allows doos to use unprivileged user namespaces on Ubuntu 24.04+ where
+# kernel.apparmor_restrict_unprivileged_userns=1 strips capabilities (mount, etc.)
+# from unknown binaries inside a new userns. Same pattern as /etc/apparmor.d/lxc-unshare.
+# The profile is unconfined apart from granting `userns`; confinement comes from doos itself.
+abi <abi/5.0>,
+include <tunables/global>
+
+profile doos /{usr/local/bin,home/*/projects/doos/build}/doos flags=(unconfined) {
+  userns,
+  @{exec_path} mr,
+}