https://wiki.alpinelinux.org/w/index.php?action=history&feed=atom&title=GVisor 2026-04-10T14:35:03Z Revision history for this page on the wiki MediaWiki 1.40.0 https://wiki.alpinelinux.org/w/index.php?title=GVisor&diff=28629&oldid=prev 2024-12-31T01:34:10Z

<p></p> <table style="background-color: #fff; color: #202122;" data-mw="interface"> <col class="diff-marker" /> <col class="diff-content" /> <col class="diff-marker" /> <col class="diff-content" /> <tr class="diff-title" lang="en"> <td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">← Older revision</td> <td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">Revision as of 01:34, 31 December 2024</td> </tr><tr><td colspan="2" class="diff-lineno" id="mw-diff-left-l28">Line 28:</td> <td colspan="2" class="diff-lineno">Line 28:</td></tr> <tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>kernel.yama.ptrace_scope=0</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>kernel.yama.ptrace_scope=0</div></td></tr> <tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>&lt;/nowiki&gt;}}</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>&lt;/nowiki&gt;}}</div></td></tr> <tr><td colspan="2" class="diff-side-deleted"></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins style="font-weight: bold; text-decoration: none;"></ins></div></td></tr> <tr><td colspan="2" class="diff-side-deleted"></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins style="font-weight: bold; text-decoration: none;">Now append, for &lt;code>docker run&lt;/code>, &lt;code>--runtime=runsc&lt;/code> </ins></div></td></tr> <tr><td colspan="2" class="diff-side-deleted"></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins style="font-weight: bold; text-decoration: none;"></ins></div></td></tr> <tr><td colspan="2" class="diff-side-deleted"></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins style="font-weight: bold; text-decoration: none;">Or for &lt;code>compose.yml&lt;/code>, do &lt;code>runtime: runsc&lt;/code></ins></div></td></tr> <tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br/></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br/></td></tr> <tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>[[Category:Security]]</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>[[Category:Security]]</div></td></tr> </table>

Pursuable1652 https://wiki.alpinelinux.org/w/index.php?title=GVisor&diff=28627&oldid=prev 2024-12-31T01:30:41Z

<p>Created page with &quot;== What is gVisor? == It is a kernel syscall implementation in the language Go. It helps isolate the kernel from the container. == How to implement gVisor == Run instructions on here: [https://gvisor.dev/docs/user_guide/install/ https://gvisor.dev/docs/user_guide/install/] {{cmd| &lt;nowiki&gt;( set -e ARCH=$(uname -m) URL=https://storage.googleapis.com/gvisor/releases/release/latest/${ARCH} wget ${URL}/runsc ${URL}/runsc.sha512 \ ${URL}/containerd-shim-runsc-v1...&quot;</p> <p><b>New page</b></p><div>== What is gVisor? ==<br /> It is a kernel syscall implementation in the language Go. It helps isolate the kernel from the container.<br /> <br /> == How to implement gVisor ==<br /> Run instructions on here: [https://gvisor.dev/docs/user_guide/install/ https://gvisor.dev/docs/user_guide/install/]<br /> <br /> {{cmd| &lt;nowiki&gt;(<br /> set -e<br /> ARCH=$(uname -m)<br /> URL=https://storage.googleapis.com/gvisor/releases/release/latest/${ARCH}<br /> wget ${URL}/runsc ${URL}/runsc.sha512 \<br /> ${URL}/containerd-shim-runsc-v1 ${URL}/containerd-shim-runsc-v1.sha512<br /> sha512sum -c runsc.sha512 \<br /> -c containerd-shim-runsc-v1.sha512<br /> rm -f *.sha512<br /> chmod a+rx runsc containerd-shim-runsc-v1<br /> doas mv runsc containerd-shim-runsc-v1 /usr/local/bin<br /> )&lt;/nowiki&gt;<br /> }}<br /> <br /> {{cmd| <br /> /usr/local/bin/runsc install<br /> }}<br /> <br /> Set sysctl to disable Yama ptrace scoping and increase max amount of namespaces (may increase surface of attack):<br /> {{cat|/etc/sysctl.conf|&lt;nowiki&gt;<br /> user.max_user_namespaces=7182 # Set however amount needed...<br /> kernel.yama.ptrace_scope=0<br /> &lt;/nowiki&gt;}}<br /> <br /> [[Category:Security]]</div>

Pursuable1652