# Merge networking with primary kernel to allow fuelgauged to talk between its vendor and builtin battery charging modules (none)
lxc.net.0.type = none

lxc.rootfs.path = dir:/var/lib/lxc/android/rootfs

lxc.tty.dir = lxc
lxc.tty.max = 4
lxc.pty.max = 1024
lxc.arch = arm64

# Drop some harmful capabilities, but not all of them
#lxc.cap.drop = mac_admin mac_override sys_time sys_module sys_rawio
lxc.cap.drop = mac_admin mac_override

# Don't blacklist some syscalls which are not safe in privileged containers, but are needed by android init
#lxc.seccomp.profile = /usr/share/lxc/config/common.seccomp

lxc.hook.pre-start = /var/lib/lxc/android/pre-start.sh

lxc.init.cmd = /init

lxc.apparmor.profile = unconfined
lxc.autodev = 0

lxc.hook.mount = /usr/share/lxcfs/lxc.mount.hook
lxc.hook.post-stop = /usr/share/lxcfs/lxc.reboot.hook

lxc.mount.entry = tmpfs dev tmpfs nosuid 0 0
lxc.mount.entry = /dev/__properties__ dev/__properties__ bind bind,create=dir 0 0
lxc.mount.entry = /dev/binderfs dev/binderfs bind bind,create=dir,optional 0 0
lxc.mount.entry = /dev/socket dev/socket bind bind,create=dir 0 0
lxc.mount.entry = proc proc proc nodev,noexec,nosuid 0 0
lxc.mount.entry = sys sys sysfs nodev,noexec,nosuid 0 0
#lxc.mount.entry = tmp tmp tmpfs nodev,noexec,nosuid 0 0
lxc.mount.entry = /data data bind bind 0 0
#lxc.mount.entry = /vendor vendor bind rbind 0 0
lxc.mount.entry = /mnt mnt bind rbind 0 0
lxc.mount.entry = /apex apex bind bind,optional 0 0
lxc.mount.entry = /odm odm bind bind,optional 0 0