openstack
/
tripleo-heat-templates
Code Issues Proposed changes

Run the swift_rsync container unprivileged 

The container still needs the NET_BIND_SERVICE linux capability to
bind to the rsync port.

Change-Id: Iecc73e968113b8dca1de3b755751b56f414a3328
Closes-Bug: #1864986
Resolves: rhbz#1807841
This commit is contained in:
Grzegorz Grasza 2020-02-27 11:42:03 +01:00
parent 6ba727a493
commit 1572a975d8
1 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
deployment/swift/swift-storage-container-puppet.yaml
View File

@ -557,7 +557,9 @@ outputs:
restart: always
healthcheck:
test: /openstack/healthcheck
privileged: true
privileged: false
cap_add:
- NET_BIND_SERVICE
volumes:
list_concat:
- {get_attr: [ContainersCommon, volumes]}