mirror of
https://github.com/flatcar/scripts.git
synced 2026-05-04 11:51:14 +02:00
d42574d094
We have long run with the ipc, network, and pid sandboxes disabled in the belief that these did not work in a container even if it was privileged. I suspect it really did work back then, but it certainly does work now regardless. update_sdk_container_image uses Portage in an unprivileged docker build environment, so it is still necessary to disable these here. However, this can be done more easily through the environment, and the regular sandbox should work fine. Signed-off-by: James Le Cuirot <jlecuirot@microsoft.com>
18 lines
697 B
Docker
18 lines
697 B
Docker
ARG BASE
|
|
|
|
FROM ${BASE}
|
|
COPY --chown=sdk:sdk sdk_container/ /mnt/host/source
|
|
COPY --chown=sdk:sdk . /mnt/host/source/src/scripts
|
|
|
|
RUN chown sdk:sdk /mnt/host/source
|
|
RUN FEATURES="-ipc-sandbox -network-sandbox -pid-sandbox" \
|
|
/home/sdk/sdk_entry.sh ./update_chroot --toolchain_boards="amd64-usr arm64-usr"
|
|
|
|
RUN /home/sdk/sdk_entry.sh ./setup_board --board="arm64-usr" --regen_configs
|
|
RUN /home/sdk/sdk_entry.sh ./setup_board --board="amd64-usr" --regen_configs
|
|
|
|
# Clean up ephemeral key directory variables that were added during build
|
|
RUN sed -i -e '/export MODULE_SIGNING_KEY_DIR=/d' \
|
|
-e '/export MODULES_SIGN_KEY=/d' \
|
|
-e '/export MODULES_SIGN_CERT=/d' /home/sdk/.bashrc
|