config-linux.md
1
# <a name="linuxContainerConfiguration" />Linux Container Configuration
3
This document describes the schema for the [Linux-specific section](config.md#platform-specific-configuration) of the [container configuration](config.md).
4
The Linux container specification uses various kernel features like namespaces, cgroups, capabilities, LSM, and filesystem jails to fulfill the spec.
6
## <a name="configLinuxDefaultFilesystems" />Default Filesystems
7
8
The Linux ABI includes both syscalls and several special file paths.
9
Applications expecting a Linux environment will very likely expect these file paths to be setup correctly.
11
The following filesystems SHOULD be made available in each container's filesystem:
13
| Path | Type |
14
| -------- | ------ |
15
| /proc | [procfs][procfs] |
16
| /sys | [sysfs][sysfs] |
17
| /dev/pts | [devpts][devpts] |
18
| /dev/shm | [tmpfs][tmpfs] |
20
## <a name="configLinuxNamespaces" />Namespaces
21
22
A namespace wraps a global system resource in an abstraction that makes it appear to the processes within the namespace that they have their own isolated instance of the global resource.
23
Changes to the global resource are visible to other processes that are members of the namespace, but are invisible to other processes.
24
For more information, see the [namespaces(7)][namespaces.7_2] man page.
25
26
Namespaces are specified as an array of entries inside the `namespaces` root field.
27
The following parameters can be specified to setup namespaces:
28
29
* **`type`** *(string, REQUIRED)* - namespace type. The following namespace types are supported:
30
* **`pid`** processes inside the container will only be able to see other processes inside the same container.
31
* **`network`** the container will have its own network stack.
32
* **`mount`** the container will have an isolated mount table.
33
* **`ipc`** processes inside the container will only be able to communicate to other processes inside the same container via system level IPC.
34
* **`uts`** the container will be able to have its own hostname and domain name.
35
* **`user`** the container will be able to remap user and group IDs from the host to local users and groups within the container.
36
* **`cgroup`** the container will have an isolated view of the cgroup hierarchy.
38
* **`path`** *(string, OPTIONAL)* - path to namespace file in the [runtime mount namespace](glossary.md#runtime-namespace)
39
40
If a path is specified, that particular file is used to join that type of namespace.
41
If a namespace type is not specified in the `namespaces` array, the container MUST inherit the [runtime namespace](glossary.md#runtime-namespace) of that type.
42
If a `namespaces` field contains duplicated namespaces with same `type`, the runtime MUST error out.
43
44
###### Example
45
46
```json
47
"namespaces": [
48
{
49
"type": "pid",
50
"path": "/proc/1234/ns/pid"
51
},
52
{
53
"type": "network",
54
"path": "/var/run/netns/neta"
55
},
56
{
57
"type": "mount"
58
},
59
{
60
"type": "ipc"
61
},
62
{
63
"type": "uts"
64
},
65
{
66
"type": "user"
67
},
68
{
69
"type": "cgroup"
70
}
71
]
72
```
73
74
## <a name="configLinuxUserNamespaceMappings" />User namespace mappings
76
**`uidMappings`** (array of objects, OPTIONAL) describes the user namespace uid mappings from the host to the container.
77
**`gidMappings`** (array of objects, OPTIONAL) describes the user namespace gid mappings from the host to the container.
78
79
Each entry has the following structure:
81
* **`hostID`** *(uint32, REQUIRED)* - is the starting uid/gid on the host to be mapped to *containerID*.
82
* **`containerID`** *(uint32, REQUIRED)* - is the starting uid/gid in the container.
83
* **`size`** *(uint32, REQUIRED)* - is the number of ids to be mapped.
84
85
The runtime SHOULD NOT modify the ownership of referenced filesystems to realize the mapping.
86
Note that the number of mapping entries MAY be limited by the [kernel][user-namespaces].
88
###### Example
89
90
```json
91
"uidMappings": [
92
{
93
"hostID": 1000,
94
"containerID": 0,
95
"size": 32000
96
}
97
],
98
"gidMappings": [
99
{
100
"hostID": 1000,
101
"containerID": 0,
102
"size": 32000
103
}
104
]
105
```
106
107
## <a name="configLinuxDevices" />Devices
109
**`devices`** (array of objects, OPTIONAL) lists devices that MUST be available in the container.
110
The runtime may supply them however it likes (with [mknod][mknod.2], by bind mounting from the runtime mount namespace, etc.).
112
Each entry has the following structure:
114
* **`type`** *(string, REQUIRED)* - type of device: `c`, `b`, `u` or `p`.
115
More info in [mknod(1)][mknod.1].
116
* **`path`** *(string, REQUIRED)* - full path to device inside container.
117
If a [file][file.1] already exists at `path` that does not match the requested device, the runtime MUST generate an error.
118
* **`major, minor`** *(int64, REQUIRED unless `type` is `p`)* - [major, minor numbers][devices] for the device.
119
* **`fileMode`** *(uint32, OPTIONAL)* - file mode for the device.
120
You can also control access to devices [with cgroups](#device-whitelist).
121
* **`uid`** *(uint32, OPTIONAL)* - id of device owner.
122
* **`gid`** *(uint32, OPTIONAL)* - id of device group.
124
The same `type`, `major` and `minor` SHOULD NOT be used for multiple devices.
125
126
###### Example
127
128
```json
129
"devices": [
130
{
131
"path": "/dev/fuse",
132
"type": "c",
133
"major": 10,
134
"minor": 229,
135
"fileMode": 438,
136
"uid": 0,
137
"gid": 0
138
},
139
{
140
"path": "/dev/sda",
141
"type": "b",
142
"major": 8,
143
"minor": 0,
144
"fileMode": 432,
145
"uid": 0,
146
"gid": 0
147
}
148
]
149
```
150
151
###### <a name="configLinuxDefaultDevices" />Default Devices
152
153
In addition to any devices configured with this setting, the runtime MUST also supply:
154
155
* [`/dev/null`][null.4]
156
* [`/dev/zero`][zero.4]
157
* [`/dev/full`][full.4]
158
* [`/dev/random`][random.4]
159
* [`/dev/urandom`][random.4]
160
* [`/dev/tty`][tty.4]
161
* [`/dev/console`][console.4] is setup if terminal is enabled in the config by bind mounting the pseudoterminal slave to /dev/console.
162
* [`/dev/ptmx`][pts.4].
163
A [bind-mount or symlink of the container's `/dev/pts/ptmx`][devpts].
164
165
## <a name="configLinuxControlGroups" />Control groups
166
167
Also known as cgroups, they are used to restrict resource usage for a container and handle device access.
168
cgroups provide controls (through controllers) to restrict cpu, memory, IO, pids and network for the container.
169
For more information, see the [kernel cgroups documentation][cgroup-v1].
170
171
The path to the cgroups can be specified in the Spec via `cgroupsPath`.
172
`cgroupsPath` can be used to either control the cgroup hierarchy for containers or to run a new process in an existing container.
173
If `cgroupsPath` is:
174
* ... an absolute path (starting with `/`), the runtime MUST take the path to be relative to the cgroup mount point.
175
* ... a relative path (not starting with `/`), the runtime MAY interpret the path relative to a runtime-determined location in the cgroup hierarchy.
176
* ... not specified, the runtime MAY define the default cgroup path.
177
Runtimes MAY consider certain `cgroupsPath` values to be invalid, and MUST generate an error if this is the case.
178
If a `cgroupsPath` value is specified, the runtime MUST consistently attach to the same place in the cgroup hierarchy given the same value of `cgroupsPath`.
179
180
Implementations of the Spec can choose to name cgroups in any manner.
181
The Spec does not include naming schema for cgroups.
182
The Spec does not support per-controller paths for the reasons discussed in the [cgroupv2 documentation][cgroup-v2].
183
The cgroups will be created if they don't exist.
184
185
You can configure a container's cgroups via the `resources` field of the Linux configuration.
186
Do not specify `resources` unless limits have to be updated.
187
For example, to run a new process in an existing container without updating limits, `resources` need not be specified.
188
189
A runtime MUST at least use the minimum set of cgroup controllers required to fulfill the `resources` settings.
190
However, a runtime MAY attach the container process to additional cgroup controllers supported by the system.
191
192
###### Example
193
194
```json
195
"cgroupsPath": "/myRuntime/myContainer",
196
"resources": {
197
"memory": {
198
"limit": 100000,
199
"reservation": 200000
200
},
201
"devices": [
202
{
203
"allow": false,
204
"access": "rwm"
205
}
206
]
207
}
208
```
209
210
#### <a name="configLinuxDeviceWhitelist" />Device whitelist
212
**`devices`** (array of objects, OPTIONAL) configures the [device whitelist][cgroup-v1-devices].
213
The runtime MUST apply entries in the listed order.
214
215
Each entry has the following structure:
217
* **`allow`** *(boolean, REQUIRED)* - whether the entry is allowed or denied.
218
* **`type`** *(string, OPTIONAL)* - type of device: `a` (all), `c` (char), or `b` (block).
219
`null` or unset values mean "all", mapping to `a`.
220
* **`major, minor`** *(int64, OPTIONAL)* - [major, minor numbers][devices] for the device.
221
`null` or unset values mean "all", mapping to [`*` in the filesystem API][cgroup-v1-devices].
222
* **`access`** *(string, OPTIONAL)* - cgroup permissions for device.
223
A composition of `r` (read), `w` (write), and `m` (mknod).
224
225
###### Example
226
227
```json
228
"devices": [
229
{
230
"allow": false,
231
"access": "rwm"
232
},
233
{
234
"allow": true,
235
"type": "c",
236
"major": 10,
237
"minor": 229,
238
"access": "rw"
239
},
240
{
241
"allow": true,
242
"type": "b",
243
"major": 8,
244
"minor": 0,
245
"access": "r"
246
}
247
]
248
```
249
250
#### <a name="configLinuxDisableOutOfMemoryKiller" />Disable out-of-memory killer
251
252
`disableOOMKiller` contains a boolean (`true` or `false`) that enables or disables the Out of Memory killer for a cgroup.
253
If enabled (`false`), tasks that attempt to consume more memory than they are allowed are immediately killed by the OOM killer.
254
The OOM killer is enabled by default in every cgroup using the `memory` subsystem.
255
To disable it, specify a value of `true`.
256
For more information, see [the memory cgroup man page][cgroup-v1-memory].
258
* **`disableOOMKiller`** *(bool, OPTIONAL)* - enables or disables the OOM killer
259
260
###### Example
261
262
```json
263
"disableOOMKiller": false
264
```
265
266
#### <a name="configLinuxSetOomScoreAdj" />Set oom_score_adj
267
268
`oomScoreAdj` sets heuristic regarding how the process is evaluated by the kernel during memory pressure.
269
For more information, see [the proc filesystem documentation section 3.1][procfs].
270
This is a kernel/system level setting, where as `disableOOMKiller` is scoped for a memory cgroup.
271
For more information on how these two settings work together, see [the memory cgroup documentation section 10. OOM Contol][cgroup-v1-memory].
273
* **`oomScoreAdj`** *(int, OPTIONAL)* - adjust the oom-killer score
274
275
###### Example
276
277
```json
278
"oomScoreAdj": 100
279
```
280
281
#### <a name="configLinuxMemory" />Memory
283
**`memory`** (object, OPTIONAL) represents the cgroup subsystem `memory` and it's used to set limits on the container's memory usage.
284
For more information, see [the memory cgroup man page][cgroup-v1-memory].
285
286
The following parameters can be specified to setup the controller:
287
288
* **`limit`** *(uint64, OPTIONAL)* - sets limit of memory usage in bytes
290
* **`reservation`** *(uint64, OPTIONAL)* - sets soft limit of memory usage in bytes
292
* **`swap`** *(uint64, OPTIONAL)* - sets limit of memory+Swap usage
294
* **`kernel`** *(uint64, OPTIONAL)* - sets hard limit for kernel memory
296
* **`kernelTCP`** *(uint64, OPTIONAL)* - sets hard limit in bytes for kernel TCP buffer memory
298
* **`swappiness`** *(uint64, OPTIONAL)* - sets swappiness parameter of vmscan (See sysctl's vm.swappiness)
299
300
###### Example
301
302
```json
303
"memory": {
304
"limit": 536870912,
305
"reservation": 536870912,
306
"swap": 536870912,
307
"kernel": 0,
308
"kernelTCP": 0,
309
"swappiness": 0
310
}
311
```
312
313
#### <a name="configLinuxCPU" />CPU
315
**`cpu`** (object, OPTIONAL) represents the cgroup subsystems `cpu` and `cpusets`.
316
For more information, see [the cpusets cgroup man page][cgroup-v1-cpusets].
317
318
The following parameters can be specified to setup the controller:
319
320
* **`shares`** *(uint64, OPTIONAL)* - specifies a relative share of CPU time available to the tasks in a cgroup
322
* **`quota`** *(int64, OPTIONAL)* - specifies the total amount of time in microseconds for which all tasks in a cgroup can run during one period (as defined by **`period`** below)
324
* **`period`** *(uint64, OPTIONAL)* - specifies a period of time in microseconds for how regularly a cgroup's access to CPU resources should be reallocated (CFS scheduler only)
326
* **`realtimeRuntime`** *(int64, OPTIONAL)* - specifies a period of time in microseconds for the longest continuous period in which the tasks in a cgroup have access to CPU resources
328
* **`realtimePeriod`** *(uint64, OPTIONAL)* - same as **`period`** but applies to realtime scheduler only
330
* **`cpus`** *(string, OPTIONAL)* - list of CPUs the container will run in
332
* **`mems`** *(string, OPTIONAL)* - list of Memory Nodes the container will run in
333
334
###### Example
335
336
```json
337
"cpu": {
338
"shares": 1024,
339
"quota": 1000000,
340
"period": 500000,
341
"realtimeRuntime": 950000,
342
"realtimePeriod": 1000000,
343
"cpus": "2-3",
344
"mems": "0-7"
345
}
346
```
347
348
#### <a name="configLinuxBlockIO" />Block IO
350
**`blockIO`** (object, OPTIONAL) represents the cgroup subsystem `blkio` which implements the block IO controller.
351
For more information, see [the kernel cgroups documentation about blkio][cgroup-v1-blkio].
352
353
The following parameters can be specified to setup the controller:
354
355
* **`blkioWeight`** *(uint16, OPTIONAL)* - specifies per-cgroup weight. This is default weight of the group on all devices until and unless overridden by per-device rules. The range is from 10 to 1000.
357
* **`blkioLeafWeight`** *(uint16, OPTIONAL)* - equivalents of `blkioWeight` for the purpose of deciding how much weight tasks in the given cgroup has while competing with the cgroup's child cgroups. The range is from 10 to 1000.
359
* **`blkioWeightDevice`** *(array, OPTIONAL)* - specifies the list of devices which will be bandwidth rate limited. The following parameters can be specified per-device:
360
* **`major, minor`** *(int64, REQUIRED)* - major, minor numbers for device. More info in `man mknod`.
361
* **`weight`** *(uint16, OPTIONAL)* - bandwidth rate for the device, range is from 10 to 1000
362
* **`leafWeight`** *(uint16, OPTIONAL)* - bandwidth rate for the device while competing with the cgroup's child cgroups, range is from 10 to 1000, CFQ scheduler only
363
364
You must specify at least one of `weight` or `leafWeight` in a given entry, and can specify both.
365
366
* **`blkioThrottleReadBpsDevice`**, **`blkioThrottleWriteBpsDevice`**, **`blkioThrottleReadIOPSDevice`**, **`blkioThrottleWriteIOPSDevice`** *(array, OPTIONAL)* - specify the list of devices which will be IO rate limited.
367
The following parameters can be specified per-device:
368
* **`major, minor`** *(int64, REQUIRED)* - major, minor numbers for device. More info in `man mknod`.
369
* **`rate`** *(uint64, REQUIRED)* - IO rate limit for the device
370
371
###### Example
372
373
```json
374
"blockIO": {
375
"blkioWeight": 10,
376
"blkioLeafWeight": 10,
377
"blkioWeightDevice": [
378
{
379
"major": 8,
380
"minor": 0,
381
"weight": 500,
382
"leafWeight": 300
383
},
384
{
385
"major": 8,
386
"minor": 16,
387
"weight": 500
388
}
389
],
390
"blkioThrottleReadBpsDevice": [
391
{
392
"major": 8,
393
"minor": 0,
394
"rate": 600
395
}
396
],
397
"blkioThrottleWriteIOPSDevice": [
398
{
399
"major": 8,
400
"minor": 16,
401
"rate": 300
402
}
403
]
404
}
405
```
406
407
#### <a name="configLinuxHugePageLimits" />Huge page limits
409
**`hugepageLimits`** (array of objects, OPTIONAL) represents the `hugetlb` controller which allows to limit the
410
HugeTLB usage per control group and enforces the controller limit during page fault.
411
For more information, see the [kernel cgroups documentation about HugeTLB][cgroup-v1-hugetlb].
413
Each entry has the following structure:
415
* **`pageSize`** *(string, REQUIRED)* - hugepage size
417
* **`limit`** *(uint64, REQUIRED)* - limit in bytes of *hugepagesize* HugeTLB usage
418
419
###### Example
420
421
```json
422
"hugepageLimits": [
423
{
424
"pageSize": "2MB",
425
"limit": 209715200
426
}
427
]
428
```
429
430
#### <a name="configLinuxNetwork" />Network
432
**`network`** (object, OPTIONAL) represents the cgroup subsystems `net_cls` and `net_prio`.
433
For more information, see [the net\_cls cgroup man page][cgroup-v1-net-cls] and [the net\_prio cgroup man page][cgroup-v1-net-prio].
435
The following parameters can be specified to setup the controller:
437
* **`classID`** *(uint32, OPTIONAL)* - is the network class identifier the cgroup's network packets will be tagged with
439
* **`priorities`** *(array, OPTIONAL)* - specifies a list of objects of the priorities assigned to traffic originating from processes in the group and egressing the system on various interfaces.
440
The following parameters can be specified per-priority:
441
* **`name`** *(string, REQUIRED)* - interface name
442
* **`priority`** *(uint32, REQUIRED)* - priority applied to the interface
443
444
###### Example
445
446
```json
447
"network": {
448
"classID": 1048577,
449
"priorities": [
450
{
451
"name": "eth0",
452
"priority": 500
453
},
454
{
455
"name": "eth1",
456
"priority": 1000
457
}
458
]
459
}
460
```
461
462
#### <a name="configLinuxPIDS" />PIDs
464
**`pids`** (object, OPTIONAL) represents the cgroup subsystem `pids`.
465
For more information, see [the pids cgroup man page][cgroup-v1-pids].
467
The following parameters can be specified to setup the controller:
469
* **`limit`** *(int64, REQUIRED)* - specifies the maximum number of tasks in the cgroup
470
471
###### Example
472
473
```json
474
"pids": {
475
"limit": 32771
476
}
477
```
478
479
## <a name="configLinuxSysctl" />Sysctl
481
**`sysctl`** (object, OPTIONAL) allows kernel parameters to be modified at runtime for the container.
482
For more information, see the [sysctl(8)][sysctl.8] man page.
483
484
###### Example
485
486
```json
487
"sysctl": {
488
"net.ipv4.ip_forward": "1",
489
"net.core.somaxconn": "256"
490
}
491
```
492
493
## <a name="configLinuxSeccomp" />Seccomp
494
495
Seccomp provides application sandboxing mechanism in the Linux kernel.
496
Seccomp configuration allows one to configure actions to take for matched syscalls and furthermore also allows matching on values passed as arguments to syscalls.
497
For more information about Seccomp, see [Seccomp][seccomp] kernel documentation.
498
The actions, architectures, and operators are strings that match the definitions in seccomp.h from [libseccomp][] and are translated to corresponding values.
499
A valid list of constants as of libseccomp v2.3.2 is shown below.
500
501
Architecture Constants
502
* `SCMP_ARCH_X86`
503
* `SCMP_ARCH_X86_64`
504
* `SCMP_ARCH_X32`
505
* `SCMP_ARCH_ARM`
506
* `SCMP_ARCH_AARCH64`
507
* `SCMP_ARCH_MIPS`
508
* `SCMP_ARCH_MIPS64`
509
* `SCMP_ARCH_MIPS64N32`
510
* `SCMP_ARCH_MIPSEL`
511
* `SCMP_ARCH_MIPSEL64`
512
* `SCMP_ARCH_MIPSEL64N32`
513
* `SCMP_ARCH_PPC`
514
* `SCMP_ARCH_PPC64`
515
* `SCMP_ARCH_PPC64LE`
516
* `SCMP_ARCH_S390`
517
* `SCMP_ARCH_S390X`
518
* `SCMP_ARCH_PARISC`
519
* `SCMP_ARCH_PARISC64`
520
521
Action Constants:
522
* `SCMP_ACT_KILL`
523
* `SCMP_ACT_TRAP`
524
* `SCMP_ACT_ERRNO`
525
* `SCMP_ACT_TRACE`
526
* `SCMP_ACT_ALLOW`
527
528
Operator Constants:
529
* `SCMP_CMP_NE`
530
* `SCMP_CMP_LT`
531
* `SCMP_CMP_LE`
532
* `SCMP_CMP_EQ`
533
* `SCMP_CMP_GE`
534
* `SCMP_CMP_GT`
535
* `SCMP_CMP_MASKED_EQ`
536
537
###### Example
538
539
```json
540
"seccomp": {
541
"defaultAction": "SCMP_ACT_ALLOW",
542
"architectures": [
543
"SCMP_ARCH_X86",
544
"SCMP_ARCH_X32"
545
],
546
"syscalls": [
547
{
548
"names": [
549
"getcwd",
550
"chmod"
551
],
552
"action": "SCMP_ACT_ERRNO",
553
"comment": "stop exploit x"
554
}
555
]
556
}
557
```
558
559
## <a name="configLinuxRootfsMountPropagation" />Rootfs Mount Propagation
561
**`rootfsPropagation`** (string, OPTIONAL) sets the rootfs's mount propagation.
562
Its value is either slave, private, or shared.
563
The [Shared Subtrees][sharedsubtree] article in the kernel documentation has more information about mount propagation.
564
565
###### Example
566
567
```json
568
"rootfsPropagation": "slave",
569
```
570
571
## <a name="configLinuxMaskedPaths" />Masked Paths
573
**`maskedPaths`** (array of strings, OPTIONAL) will mask over the provided paths inside the container so that they cannot be read.
574
The values MUST be absolute paths in the [container namespace][container-namespace2].
575
576
###### Example
577
578
```json
579
"maskedPaths": [
580
"/proc/kcore"
581
]
582
```
583
584
## <a name="configLinuxReadonlyPaths" />Readonly Paths
586
**`readonlyPaths`** (array of strings, OPTIONAL) will set the provided paths as readonly inside the container.
587
The values MUST be absolute paths in the [container namespace][container-namespace2].
588
589
###### Example
590
591
```json
592
"readonlyPaths": [
593
"/proc/sys"
594
]
595
```
596
597
## <a name"configLinuxMountLabel" />Mount Label
599
**`mountLabel`** (string, OPTIONAL) will set the Selinux context for the mounts in the container.
600
601
###### Example
602
603
```json
604
"mountLabel": "system_u:object_r:svirt_sandbox_file_t:s0:c715,c811"
605
```
606
608
[container-namespace2]: glossary.md#container_namespace
610
[cgroup-v1]: https://www.kernel.org/doc/Documentation/cgroup-v1/cgroups.txt
611
[cgroup-v1-blkio]: https://www.kernel.org/doc/Documentation/cgroup-v1/blkio-controller.txt
612
[cgroup-v1-cpusets]: https://www.kernel.org/doc/Documentation/cgroup-v1/cpusets.txt
613
[cgroup-v1-devices]: https://www.kernel.org/doc/Documentation/cgroup-v1/devices.txt
614
[cgroup-v1-hugetlb]: https://www.kernel.org/doc/Documentation/cgroup-v1/hugetlb.txt
615
[cgroup-v1-memory]: https://www.kernel.org/doc/Documentation/cgroup-v1/memory.txt
616
[cgroup-v1-net-cls]: https://www.kernel.org/doc/Documentation/cgroup-v1/net_cls.txt
617
[cgroup-v1-net-prio]: https://www.kernel.org/doc/Documentation/cgroup-v1/net_prio.txt
618
[cgroup-v1-pids]: https://www.kernel.org/doc/Documentation/cgroup-v1/pids.txt
619
[cgroup-v2]: https://www.kernel.org/doc/Documentation/cgroup-v2.txt
620
[devices]: https://www.kernel.org/doc/Documentation/devices.txt
621
[devpts]: https://www.kernel.org/doc/Documentation/filesystems/devpts.txt
622
[file]: http://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap03.html#tag_03_164
623
[libseccomp]: https://github.com/seccomp/libseccomp
624
[procfs]: https://www.kernel.org/doc/Documentation/filesystems/proc.txt
625
[seccomp]: https://www.kernel.org/doc/Documentation/prctl/seccomp_filter.txt
626
[sharedsubtree]: https://www.kernel.org/doc/Documentation/filesystems/sharedsubtree.txt
627
[sysfs]: https://www.kernel.org/doc/Documentation/filesystems/sysfs.txt
628
[tmpfs]: https://www.kernel.org/doc/Documentation/filesystems/tmpfs.txt
629
630
[console.4]: http://man7.org/linux/man-pages/man4/console.4.html
631
[full.4]: http://man7.org/linux/man-pages/man4/full.4.html
632
[mknod.1]: http://man7.org/linux/man-pages/man1/mknod.1.html
633
[mknod.2]: http://man7.org/linux/man-pages/man2/mknod.2.html
634
[namespaces.7_2]: http://man7.org/linux/man-pages/man7/namespaces.7.html
635
[null.4]: http://man7.org/linux/man-pages/man4/null.4.html
636
[pts.4]: http://man7.org/linux/man-pages/man4/pts.4.html
637
[random.4]: http://man7.org/linux/man-pages/man4/random.4.html
638
[sysctl.8]: http://man7.org/linux/man-pages/man8/sysctl.8.html
639
[tty.4]: http://man7.org/linux/man-pages/man4/tty.4.html
640
[zero.4]: http://man7.org/linux/man-pages/man4/zero.4.html
641
[user-namespaces]: http://man7.org/linux/man-pages/man7/user_namespaces.7.html