Skip to content

Commit

Permalink
Update README.md
Browse files Browse the repository at this point in the history
  • Loading branch information
kazuho committed May 20, 2015
1 parent 20a26fe commit 5c79551
Showing 1 changed file with 4 additions and 2 deletions.
6 changes: 4 additions & 2 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -7,10 +7,10 @@ It is by no means a container service, or tries to be.
It is a helper tool for running a program under a restricted environment, preventing it from making changes to other parts of the host even if gets cracked.

When invoked, it automatically setups the chroot environment by doing the following, and then executes the given command within the environment.
- remount system directories as read-only under the chroot directory tree
- __remount system directories as read-only__ under the chroot directory tree
- copy setting files (/etc/passwd, /etc/resolv.conf, etc.)

The tool by default does not expose the directories that likely contain user-data (e.g. /usr/local, /home, /root, /var).
The tool by default __does NOT expose directories that likely contain user-data__ (e.g. `/usr/local`, `/home`, `/var`).
Such directories should be exported explicitly to the jail by using the `--bind` option.

For example, if you have Apache HTTP server installed under `/usr/local/apache`, and want to run it under a jailed environment, simply run:
Expand All @@ -21,6 +21,8 @@ For example, if you have Apache HTTP server installed under `/usr/local/apache`,
/usr/local/apache/bin/httpd -c /usr/local/apache/conf/httpd.conf
```

For more information, consult `man jailing`.

INSTALLATION
------------

Expand Down

0 comments on commit 5c79551

Please sign in to comment.