I would like to add two options to runc.

[rhatdan]

I want to be able to specify the rootfs and the config.json.

My thinking on this, is the ability to ship a default config.json inside of the image.
Currently if I want to do this, I need to do the following
If I have to do something like:

mkdir -p /run/myimage/rootfs
mount IMAGE /run/myimage/rootfs
cp /run/myimage/rootfs/root/config.hson /run/myimage
cd /run.myimage
runc start myapp

As opposed to

mkdir -p /run/myimage
mount IMAGE /run/myimage
runc start --config /run/myimage/root/config.json --rootfs /run/myimage myapp

I will prepare a patch to do this, but I wanted to see if this idea would fly before doing the work.

[rhatdan]

@crosbymichael @mrunalp PTAL

[cyphar]

I think there was quite a bit of discussion about this before and we decided against allowing to specify --config. IMO setting --rootfs is a non-starter because it would mean that the config.json no longer describes the container (which is very bad).

The other issue with making --config configurable is that the bundle path is defined by where the config.json is (which means that a lot of things will break like rootfs handling pretty quickly). I could see the usecase for a docker build -f-like option where you can provide a path within the bundle to use as config.json.

[rhatdan]

I would take either one, since they would allow me to do what I want without copying files out of the image.

[wking]

On Fri, Nov 04, 2016 at 08:29:26AM -0700, Daniel J Walsh wrote:

I would take either one, since they would allow me to do what I want
without copying files out of the image.

In image-spec, I've been pushing to include a runtime-spec config.json
as part of the image instead of the current image-spec-defined runtime
configuration (discussion in opencontainers/image-spec#87). I'd also
like to lift the restriction that config and rootfs be siblings in the
bundle root (opencontainers/runtime-spec#469). Longer term, I'd like
to have paths relative to the runtime/container working directory
instead of the config path (discussion in
opencontainers/runtime-spec#609). All of those would make your
use-case more convenient at a spec level, although there's no
guarantee that any land.

In the meantime, runC can do whatever it wants for extending the
spec'ed API ;).

[cyphar]

@rhatdan I'd wait to see what @crosbymichael has to say about it, I generally defer to him on questions of "what is probably a good idea". In particular, I can imagine this will cause some conflict with #1094.

[crosbymichael]

You can just set root.path in the spec to . to have the rootfs and config.json in the same dir without any changes.

I don't think we want to add anything to the runc api to promote this, as you know, its a huge information leakage to have the config inside the container and shipping runtime options/security settings/host info inside an image is a really bad idea. However, it will work as is today if you set the root.path = . so that should work for your usecase.