buildkit

Author	SHA1	Message	Date
Tonis Tiigi	c8190b1518	lint: enable golint Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>	2020-07-19 09:28:24 -07:00
Sebastiaan van Stijn	932c39505b	use containerd/sys to detect UserNamespaces The implementation in libcontainer/system is quite complicated, and we only use it to detect if user-namespaces are enabled. In addition, the implementation in containerd uses a sync.Once, so that detection (and reading/parsing `/proc/self/uid_map`) is only performed once. Signed-off-by: Sebastiaan van Stijn <github@gone.nl>	2020-06-15 12:51:20 +02:00
Tonis Tiigi	8f52339933	dockerfile: add test for whitelisted devices Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>	2020-01-30 18:43:04 -08:00
Tonis Tiigi	572a2b5718	entitlements: mount loop devices relative to next free device Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>	2020-01-30 13:47:44 -08:00
Tonis Tiigi	fc186a8b89	oci: mount whitelist of devices on insecure security mode Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>	2020-01-30 13:07:29 -08:00