-
Notifications
You must be signed in to change notification settings - Fork 1.9k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
rkt driver disabling of signature validation is too broad #2026
Comments
Unless someone beats me to this, I think I can tackle the fix. I'm considering exposing more of the rkt cli arguments to the driver, beyond the scope of this particular issue. But for this issue, I'm thinking the following might work well: config {
image = "example.com/base/go-server:3cfc9529-55"
insecure_options = ["image","ondisk"]
} The |
@blalor Sounds good! Love to see some community love for the Rkt driver! |
Somewhat orthogonal to this specific issue, are there guidelines on changing the schema of a driver's config? Trying to think ahead about the consequences of adding or removing struct fields, or worst-case, what happens if a field changes type. |
Additions are fine to the schema. With renames a compatibility layer should be added for a release. Deletions are BC and need to be more carefully considered |
Doing some issue cleanup... this issue was fixed by #2695. (And in any event rkt is deprecated at this point!) |
I'm going to lock this issue because it has been closed for 120 days ⏳. This helps our maintainers find and focus on the active issues. |
Nomad v0.5.0
rkt Version: 1.19.0
If a task's
trust_prefix
is not specified, the rkt driver adds--insecure-options=all
to therun
command. This is very broad and disables many capabilities that probably aren't intended. Fromrkt run --help
:The various options are documented here.
seccomp
andcapabilities
should not be disabled when trust is not enabled.The text was updated successfully, but these errors were encountered: