slimtoolkit / slimtoolkit/slim
auto-generated seccomp profile doesn't work
Open
Nobody has claimed this yet.
enhancement
WIP
- Dominant language
- Go
- Stars
- 23.4k
- Forks
- 840
- PR merge metrics
- No merged PRs in 30d
Description
$ sudo ./docker-slim p nginx:alpine
docker-slim[profile]: info=http.probe message='using default probe'
docker-slim[profile]: state=started
docker-slim[profile]: info=params target=nginx:alpine
docker-slim[profile]: state=image.inspection.start
docker-slim[profile]: info=image id=sha256:55ceb2abad47854d182034514057b038a6e50e9d029ba152bd713d535ed39603 size.bytes=21137785 size.human=21 MB
docker-slim[profile]: state=image.inspection.done
docker-slim[profile]: state=container.inspection.start
docker-slim[profile]: info=container status=created id=adb10d2f8e69cda92a5f35b92d4f21f70c6268c4c053f99170aadce284add001
docker-slim[profile]: info=cmd.startmonitor status=sent
docker-slim[profile]: info=event.startmonitor.done status=received
docker-slim[build]: info=container name=dockerslimk_29216_20190805070200 id=adb10d2f8e69cda92a5f35b92d4f21f70c6268c4c053f99170aadce284add001 target.port.list=[32799] target.port.info=[80/tcp => 0.0.0.0:32799] message='YOU CAN USE THESE PORTS TO INTERACT WITH THE CONTAINER'
docker-slim[profile]: state=http.probe.starting message='WAIT FOR HTTP PROBE TO FINISH'
docker-slim[profile]: info=prompt message='USER INPUT REQUIRED, PRESS <ENTER> WHEN YOU ARE DONE USING THE CONTAINER'
docker-slim[profile]: state=http.probe.running
docker-slim[profile]: info=http.probe.call status=200 method=GET target=http://127.0.0.1:32799/ attempt=1 time=2019-08-05T07:02:12Z
docker-slim[profile]: info=http.probe.summary total=1 failures=0 successful=1
docker-slim[profile]: state=http.probe.done
docker-slim[profile]: state=container.inspection.finishing
docker-slim[profile]: state=container.inspection.artifact.processing
docker-slim[profile]: state=container.inspection.done
docker-slim[profile]: state=completed
docker-slim[profile]: state=done
$ docker run --rm -p 80:80 --security-opt seccomp=./.docker-slim-state/images/55ceb2abad47854d182034514057b038a6e50e9d029ba152bd713d535ed39603/artifacts/nginx-seccomp.json nginx:alpine
docker: Error response from daemon: cannot start a stopped process: unknown.
- docker-slim version: 1.25.3
- Docker version: moby/moby@11e48badcb
- OS: Ubuntu 19.04
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce the profiling command for nginx:alpine and inspect the generated .docker-slim-state/images/55ceb2abad47854d182034514057b038a6e50e9d029ba152bd713d535ed39603/artifacts/nginx-seccomp.json. Compare its behavior with the docker run command using --security-opt seccomp; done means the container starts successfully with the generated profile.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker, go
- Domain
- devops, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100