Struct LinuxContainerSecurityContext 

pub struct LinuxContainerSecurityContext {

    pub capabilities: Option<Capability>,
    pub privileged: bool,
    pub namespace_options: Option<NamespaceOption>,
    pub selinux_options: Option<SeLinuxOption>,
    pub run_as_user: Option<Int64Value>,
    pub run_as_group: Option<Int64Value>,
    pub run_as_username: String,
    pub readonly_rootfs: bool,
    pub supplemental_groups: Vec<i64>,
    pub no_new_privs: bool,
    pub masked_paths: Vec<String>,
    pub readonly_paths: Vec<String>,
    pub seccomp: Option<SecurityProfile>,
    pub apparmor: Option<SecurityProfile>,
    pub apparmor_profile: String,
    pub seccomp_profile_path: String,
}

LinuxContainerSecurityContext holds linux security configuration that will be applied to a container.

Fields

capabilities: Option<Capability>

Capabilities to add or drop.

privileged: bool

If set, run container in privileged mode. Privileged mode is incompatible with the following options. If privileged is set, the following features MAY have no effect:

1. capabilities
2. selinux_options
3. seccomp
4. apparmor

Privileged mode implies the following specific options are applied:

1. All capabilities are added.
2. Sensitive paths, such as kernel module paths within sysfs, are not masked.
3. Any sysfs and procfs mounts are mounted RW.
4. AppArmor confinement is not applied.
5. Seccomp restrictions are not applied.
6. The device cgroup does not restrict access to any devices.
7. All devices from the host’s /dev are available within the container.
8. SELinux restrictions are not applied (e.g. label=disabled).

namespace_options: Option<NamespaceOption>

Configurations for the container’s namespaces. Only used if the container uses namespace for isolation.

selinux_options: Option<SeLinuxOption>

SELinux context to be optionally applied.

run_as_user: Option<Int64Value>

UID to run the container process as. Only one of run_as_user and run_as_username can be specified at a time.

run_as_group: Option<Int64Value>

GID to run the container process as. run_as_group should only be specified when run_as_user or run_as_username is specified; otherwise, the runtime MUST error.

run_as_username: String

User name to run the container process as. If specified, the user MUST exist in the container image (i.e. in the /etc/passwd inside the image), and be resolved there by the runtime; otherwise, the runtime MUST error.

readonly_rootfs: bool

If set, the root filesystem of the container is read-only.

supplemental_groups: Vec<i64>

List of groups applied to the first process run in the container, in addition to the container’s primary GID.

no_new_privs: bool

no_new_privs defines if the flag for no_new_privs should be set on the container.

masked_paths: Vec<String>

masked_paths is a slice of paths that should be masked by the container runtime, this can be passed directly to the OCI spec.

readonly_paths: Vec<String>

readonly_paths is a slice of paths that should be set as readonly by the container runtime, this can be passed directly to the OCI spec.

seccomp: Option<SecurityProfile>

Seccomp profile for the container.

apparmor: Option<SecurityProfile>

AppArmor profile for the container.

apparmor_profile: String

👎Deprecated

AppArmor profile for the container, candidate values are:

• runtime/default: equivalent to not specifying a profile.
• unconfined: no profiles are loaded
• localhost/<profile_name>: profile loaded on the node (localhost) by name. The possible profile names are detailed at https://gitlab.com/apparmor/apparmor/-/wikis/AppArmor_Core_Policy_Reference

seccomp_profile_path: String

👎Deprecated

Seccomp profile for the container, candidate values are:

• runtime/default: the default profile for the container runtime
• unconfined: unconfined profile, ie, no seccomp sandboxing
• localhost/: the profile installed on the node. is the full path of the profile. Default: “”, which is identical with unconfined.

Trait Implementations

impl Clone for LinuxContainerSecurityContext

fn clone(&self) -> LinuxContainerSecurityContext

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for LinuxContainerSecurityContext

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for LinuxContainerSecurityContext

fn default() -> Self

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for LinuxContainerSecurityContext

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Message for LinuxContainerSecurityContext

fn encoded_len(&self) -> usize

Returns the encoded length of the message without a length delimiter.

fn clear(&mut self)

Clears the message, resetting all fields to their default.

fn encode(&self, buf: &mut impl BufMut) -> Result<(), EncodeError>

where Self: Sized,

Encodes the message to a buffer.

fn encode_to_vec(&self) -> Vec<u8>

where Self: Sized,

Encodes the message to a newly allocated buffer.

fn encode_length_delimited( &self, buf: &mut impl BufMut, ) -> Result<(), EncodeError>

where Self: Sized,

Encodes the message with a length-delimiter to a buffer.

fn encode_length_delimited_to_vec(&self) -> Vec<u8>

where Self: Sized,

Encodes the message with a length-delimiter to a newly allocated buffer.

fn decode(buf: impl Buf) -> Result<Self, DecodeError>

where Self: Default,

Decodes an instance of the message from a buffer.

fn decode_length_delimited(buf: impl Buf) -> Result<Self, DecodeError>

where Self: Default,

Decodes a length-delimited instance of the message from the buffer.

fn merge(&mut self, buf: impl Buf) -> Result<(), DecodeError>

where Self: Sized,

Decodes an instance of the message from a buffer, and merges it into self.

fn merge_length_delimited(&mut self, buf: impl Buf) -> Result<(), DecodeError>

where Self: Sized,

Decodes a length-delimited instance of the message from buffer, and merges it into self.

impl PartialEq for LinuxContainerSecurityContext

fn eq(&self, other: &LinuxContainerSecurityContext) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for LinuxContainerSecurityContext

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for LinuxContainerSecurityContext