39 lines
1.1 KiB
Text
39 lines
1.1 KiB
Text
|
|
lxc.net.0.type = empty
|
|
|
|
lxc.rootfs.path = dir:/var/lib/lxc/android/rootfs
|
|
|
|
#lxc.tty.dir = lxc
|
|
lxc.tty.dir =
|
|
lxc.tty.max = 4
|
|
lxc.pty.max = 1024
|
|
lxc.arch = arm64
|
|
|
|
# Drop some harmful capabilities
|
|
lxc.cap.drop = mac_admin mac_override sys_time sys_module sys_rawio
|
|
|
|
# Blacklist some syscalls which are not safe in privileged containers
|
|
lxc.seccomp.profile = /usr/share/lxc/config/common.seccomp
|
|
|
|
lxc.hook.pre-start = /var/lib/lxc/android/pre-start.sh
|
|
|
|
#this might not be needed?
|
|
#lxc.init_cmd = /init
|
|
|
|
lxc.apparmor.profile = unconfined
|
|
lxc.autodev = 0
|
|
|
|
|
|
lxc.hook.mount = /usr/share/lxcfs/lxc.mount.hook
|
|
lxc.hook.post-stop = /usr/share/lxcfs/lxc.reboot.hook
|
|
|
|
|
|
lxc.mount.entry = tmpfs dev tmpfs nosuid 0 0
|
|
lxc.mount.entry = /dev/__properties__ dev/__properties__ bind bind,create=dir 0 0
|
|
lxc.mount.entry = /dev/socket dev/socket bind bind,create=dir 0 0
|
|
lxc.mount.entry = proc proc proc nodev,noexec,nosuid 0 0
|
|
lxc.mount.entry = sys sys sysfs nodev,noexec,nosuid 0 0
|
|
#lxc.mount.entry = tmp tmp tmpfs nodev,noexec,nosuid 0 0
|
|
#lxc.mount.entry = /android/data data bind bind 0 0
|
|
lxc.mount.entry = /vendor vendor bind rbind 0 0
|
|
lxc.mount.entry = /mnt mnt bind rbind 0 0
|