Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Create a container image and associated script for building/running weaver without the need to install dependencies #18

Open
grantseltzer opened this issue Jan 21, 2020 · 1 comment

Comments

@grantseltzer
Copy link
Owner

grantseltzer commented Jan 21, 2020

I think the initial workflow should be as follows:

  • Run build script which creates a docker image containing all dependencies and the oster binary
  • Have a run script which emulates the oster CLI except under the hood runs oster inside the container with the correct permissions for accessing the kernel facilities

Also can have the run script run the build script if it hasn't been run yet.

@grantseltzer
Copy link
Owner Author

grantseltzer commented Jan 23, 2020

This is also a prime opportunity to use Karn for generating a custom seccomp profile. If run inside the container (i.e. the run script) use the container runtime to enforce seccomp, if not use the karn library in code itself to enforce the privs.

@grantseltzer grantseltzer changed the title Create a container image and associated script for building/running oster without the need to install dependencies Create a container image and associated script for building/running weaver without the need to install dependencies Feb 6, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

1 participant