unprivileged Docker 内部的气泡包装

DEVICES='--device=/dev/rtc' for dev in /dev/*; do test -h $dev && echo "Not shared: $(ls -l $dev)" || true test -d $dev -o -h $dev || DEVICES="$DEVICES --device=$dev" test -d $dev && DEVICES="$DEVICES -v=$dev:$dev" || true done Not shared: lrwxrwxrwx 1 root root 11 Apr 1 08:58 /dev/core -> /proc/kcore Not shared: lrwxrwxrwx 1 root root 13 Apr 1 08:58 /dev/fd -> /proc/self/fd Not shared: lrwxrwxrwx 1 root root 12 Apr 1 08:58 /dev/initctl -> /run/initctl Not shared: lrwxrwxrwx 1 root root 28 Apr 1 08:58 /dev/log -> /run/systemd/journal/dev-log Not shared: lrwxrwxrwx 1 root root 4 Apr 1 08:58 /dev/rtc -> rtc0 Not shared: lrwxrwxrwx 1 root root 15 Apr 1 08:58 /dev/stderr -> /proc/self/fd/2 Not shared: lrwxrwxrwx 1 root root 15 Apr 1 08:58 /dev/stdin -> /proc/self/fd/0 Not shared: lrwxrwxrwx 1 root root 15 Apr 1 08:58 /dev/stdout -> /proc/self/fd/1 ZZTERM7ZZ run
--cap-add SYS_CHROOT
--cap-add SYS_ADMIN
--cap-add SETUID
--cap-add SETGID
--cap-add SYS_PTRACE
--cap-add NET_ADMIN
--cap-add AUDIT_WRITE
--cap-add CHOWN
--cap-add DAC_OVERRIDE
--cap-add FOWNER
--cap-add FSETID
--cap-add KILL
--cap-add MKNOD
--cap-add …