summaryrefslogtreecommitdiff
path: root/gnu
diff options
context:
space:
mode:
Diffstat (limited to 'gnu')
-rw-r--r--gnu/system/file-systems.scm40
1 files changed, 40 insertions, 0 deletions
diff --git a/gnu/system/file-systems.scm b/gnu/system/file-systems.scm
index b33f826b45..a06c173a70 100644
--- a/gnu/system/file-systems.scm
+++ b/gnu/system/file-systems.scm
@@ -45,6 +45,7 @@
%control-groups
%base-file-systems
+ %container-file-systems
mapped-device
mapped-device?
@@ -198,6 +199,45 @@ initrd code."
%immutable-store)
%control-groups))
+;; File systems for Linux containers differ from %base-file-systems in that
+;; they impose additional restrictions such as no-exec or need different
+;; options to function properly.
+;;
+;; The file system flags and options conform to the libcontainer
+;; specification:
+;; https://github.com/docker/libcontainer/blob/master/SPEC.md#filesystem
+(define %container-file-systems
+ (list
+ ;; Psuedo-terminal file system.
+ (file-system
+ (device "none")
+ (mount-point "/dev/pts")
+ (type "devpts")
+ (flags '(no-exec no-suid))
+ (needed-for-boot? #t)
+ (create-mount-point? #t)
+ (check? #f)
+ (options "newinstance,ptmxmode=0666,mode=620"))
+ ;; Shared memory file system.
+ (file-system
+ (device "tmpfs")
+ (mount-point "/dev/shm")
+ (type "tmpfs")
+ (flags '(no-exec no-suid no-dev))
+ (options "mode=1777,size=65536k")
+ (needed-for-boot? #t)
+ (create-mount-point? #t)
+ (check? #f))
+ ;; Message queue file system.
+ (file-system
+ (device "mqueue")
+ (mount-point "/dev/mqueue")
+ (type "mqueue")
+ (flags '(no-exec no-suid no-dev))
+ (needed-for-boot? #t)
+ (create-mount-point? #t)
+ (check? #f))))
+
;;;