2014-03-25 03:26:19 +00:00
|
|
|
# Default pivot location
|
|
|
|
|
|
|
|
|
|
# Default mount entries
|
|
|
|
|
lxc.mount.entry = proc proc proc nodev,noexec,nosuid 0 0
|
|
|
|
|
lxc.mount.entry = sysfs sys sysfs defaults 0 0
|
|
|
|
|
|
|
|
|
|
# Default console settings
|
2018-05-01 02:04:29 +00:00
|
|
|
lxc.tty.max = 4
|
|
|
|
|
lxc.pty.max = 1024
|
2014-03-25 03:26:19 +00:00
|
|
|
|
|
|
|
|
# Default capabilities
|
|
|
|
|
lxc.cap.drop = sys_module mac_admin mac_override sys_time
|
|
|
|
|
|
2015-07-14 15:12:21 +00:00
|
|
|
# Prevent systemd-journald from burning 100% of CPU
|
|
|
|
|
# See https://wiki.debian.org/LXC#Incompatibility_with_systemd
|
|
|
|
|
lxc.autodev = 1
|
|
|
|
|
|
2014-03-25 03:26:19 +00:00
|
|
|
# When using LXC with apparmor, the container will be confined by default.
|
|
|
|
|
# If you wish for it to instead run unconfined, copy the following line
|
|
|
|
|
# (uncommented) to the container's configuration file.
|
2018-05-01 02:04:29 +00:00
|
|
|
#lxc.apparmor.profile = unconfined
|
2014-03-25 03:26:19 +00:00
|
|
|
|
|
|
|
|
# To support container nesting on an Ubuntu host while retaining most of
|
|
|
|
|
# apparmor's added security, use the following two lines instead.
|
2018-05-01 02:04:29 +00:00
|
|
|
#lxc.apparmor.profile = lxc-container-default-with-nesting
|
2014-03-25 03:26:19 +00:00
|
|
|
#lxc.hook.mount = /usr/share/lxc/hooks/mountcgroups
|
|
|
|
|
|
|
|
|
|
# If you wish to allow mounting block filesystems, then use the following
|
|
|
|
|
# line instead, and make sure to grant access to the block device and/or loop
|
|
|
|
|
# devices below in lxc.cgroup.devices.allow.
|
2018-05-01 02:04:29 +00:00
|
|
|
#lxc.apparmor.profile = lxc-container-default-with-mounting
|
2014-03-25 03:26:19 +00:00
|
|
|
|
|
|
|
|
# Default cgroup limits
|
|
|
|
|
lxc.cgroup.devices.deny = a
|
|
|
|
|
## Allow any mknod (but not using the node)
|
|
|
|
|
lxc.cgroup.devices.allow = c *:* m
|
|
|
|
|
lxc.cgroup.devices.allow = b *:* m
|
|
|
|
|
## /dev/null and zero
|
|
|
|
|
lxc.cgroup.devices.allow = c 1:3 rwm
|
|
|
|
|
lxc.cgroup.devices.allow = c 1:5 rwm
|
|
|
|
|
## consoles
|
|
|
|
|
lxc.cgroup.devices.allow = c 5:0 rwm
|
|
|
|
|
lxc.cgroup.devices.allow = c 5:1 rwm
|
|
|
|
|
## /dev/{,u}random
|
|
|
|
|
lxc.cgroup.devices.allow = c 1:8 rwm
|
|
|
|
|
lxc.cgroup.devices.allow = c 1:9 rwm
|
|
|
|
|
## /dev/pts/*
|
|
|
|
|
lxc.cgroup.devices.allow = c 5:2 rwm
|
|
|
|
|
lxc.cgroup.devices.allow = c 136:* rwm
|
|
|
|
|
## rtc
|
|
|
|
|
lxc.cgroup.devices.allow = c 254:0 rm
|
|
|
|
|
## fuse
|
|
|
|
|
lxc.cgroup.devices.allow = c 10:229 rwm
|
|
|
|
|
## tun
|
|
|
|
|
lxc.cgroup.devices.allow = c 10:200 rwm
|
|
|
|
|
## full
|
|
|
|
|
lxc.cgroup.devices.allow = c 1:7 rwm
|
|
|
|
|
## hpet
|
|
|
|
|
lxc.cgroup.devices.allow = c 10:228 rwm
|
|
|
|
|
## kvm
|
|
|
|
|
lxc.cgroup.devices.allow = c 10:232 rwm
|
|
|
|
|
## To use loop devices, copy the following line to the container's
|
|
|
|
|
## configuration file (uncommented).
|
|
|
|
|
#lxc.cgroup.devices.allow = b 7:* rwm
|
