You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
We are currently offering the [Sysbox packages](https://github.com/nestybox/sysbox/releases)
62
-
for Ubuntu and Debian distributions. This means that for other distros you must [build and install Sysbox from source](https://github.com/nestybox/sysbox/blob/master/docs/developers-guide/build.md).
63
-
It's pretty easy though, since the Sysbox Makefile has targets that automate this process.
64
-
The build occurs entirely inside a container, so it won't mess up your host.
65
-
66
-
We are working on creating packaged versions for the other supported distros, and
67
-
expect to have them soon (ETA summer 2021).
68
-
69
-
## Sysbox Operational Modes
70
-
71
-
The Sysbox runtime relies on the kernel's user-namespace feature to secure
72
-
system containers. There are two approaches utilized by Sysbox to manage the
73
-
creation of these user-namespaces: `automatic` and `directed`.
74
-
75
-
It is important to highlight that this operational mode is per individual
76
-
container. That is, a container-manager (e.g. Docker, K8s/Cri-o, Podman, etc)
77
-
could instruct Sysbox to operate in `directed` mode for any given container.
78
-
79
-
What follows is a high-level description of what each of these modes accomplish;
80
-
refer to the [user-guide](./user-guide/security.md#user-namespace-id-mapping) for
81
-
more details.
82
-
83
-
### Automatic userns ID mapping
84
-
85
-
In this mode Sysbox automatically allocates the ID mappings to be used by the
86
-
container. By doing this, Sysbox enforces strong container isolation without
87
-
requiring the higher level container-manager to do this explicitly (e.g. without
88
-
enabling `userns-remap` mode in Docker).
89
-
90
-
Sysbox will only attempt to operate in this mode if the received container
91
-
specification omits ID mappings configuration.
92
-
93
-
Note that this mode requires the presence of the `shiftfs` kernel module, which
94
-
currently is only available on the Ubuntu Linux distribution -- with the exception
95
-
of Ubuntu-cloud images deployed in some Cloud Providers.
96
-
97
-
### Directed userns ID mapping
98
-
99
-
In this mode Sysbox relies on the container-manager selecting the desired ID
100
-
mappings.
101
-
102
-
In Docker's case this is accomplished by enabling the `userns-remap` feature
103
-
which, even though imposes certain [restrictions](https://docs.docker.com/engine/security/userns-remap/#user-namespace-known-limitations),
104
-
does not require `shiftfs` and therefore allows Sysbox support in a larger
105
-
number of distributions.
106
-
107
-
Refer to the Sysbox [installation guide](./user-guide/install.md#docker-userns-remap)
108
-
for more details.
27
+
- "Kernel upgrade" means a kernel upgrade may be required (Sysbox-EE requires a fairly new kernel). See [below](#kernel-upgrade-procedures) for more.
109
28
110
29
## Kernel Upgrade Procedures
111
30
@@ -125,7 +44,7 @@ $ sudo shutdown -r now
125
44
126
45
This one is only required when running Debian Buster.
127
46
128
-
```
47
+
```console
129
48
$ # Allow debian-backports utilization ...
130
49
131
50
$ echo deb http://deb.debian.org/debian buster-backports main contrib non-free | sudo tee /etc/apt/sources.list.d/buster-backports.list
@@ -138,34 +57,3 @@ $ sudo shutdown -r now
138
57
```
139
58
140
59
Refer to this [link](https://wiki.debian.org/HowToUpgradeKernel) for more details.
141
-
142
-
### Fedora Kernel Upgrade
143
-
144
-
This is only applicable to Fedora 31 release; more recent releases already
0 commit comments