retoor/doos
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

AppArmor profile per binary path with install hint; verified network examples

Browse Source 
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
This commit is contained in:
retoor
2026-10-23 22:08:37 +02:00
co-authored by Claude Sonnet 5.5
parent 530582e826
commit c3ebf21e9c
11 changed files with 133 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
SPEC.md
+3 -1
View File
@@ -12,6 +12,7 @@ Authoritative description of behavior and limits. Code constants live in `src/sp
| `doos delete [--yes] NAME` | Dry run unless `--yes`. Refuses a running container. |
| `doos image list` | Installed images (SIZE, IDS) plus catalog entries marked `available`. |
| `doos image add [--sha256 HEX] SOURCE [NAME]` | Installs an image. See Images. |
| `doos apparmor` | Prints an AppArmor profile (named after the binary's path) that lets this binary use user namespaces. A start that fails with EPERM/EACCES while `apparmor_restrict_unprivileged_userns=1` prints the command to install it. |
| `doos image delete [--yes] NAME` | Dry run unless `--yes`. Refuses an image used by any container, even with `--yes`. |
`get-or-create` is accepted as an alias.
@@ -121,7 +122,8 @@ User, mount, pid, uts, ipc namespaces always; network namespace unless `host`. I
- `slirp`: private netns, `slirp4netns --configure --disable-host-loopback`, DNS 10.0.2.3, outbound only, host 127.0.0.1 unreachable.
- `none`: private netns with loopback only.
- `pasta`: private netns that behaves like the host network: addresses and routes mirrored, host loopback reachable, ports bound inside are forwarded to the host, DNS from the host's resolver. The host's abstract unix sockets are not shared. Needs `pasta`.
- `slirp` has no inbound path (nothing outside reaches a port served inside).
- `pasta`: private netns that behaves like the host network: addresses and routes mirrored, host loopback reachable, ports bound inside are forwarded to the host, DNS from the host's resolver. The host's abstract unix sockets are not shared. Needs `pasta`. Newly bound ports are picked up after about 2 s; only loopback and the default gateway address reach other containers' forwarded ports, not the host's public address.
- `host`: shares the host network namespace including its abstract unix sockets (explicit opt-in; a note recommends `pasta`).
## Safety rules