mirror/nanobot
1
0
Fork 0
mirror of https://github.com/HKUDS/nanobot.git synced 2026-08-17 01:26:40 +03:00
Code Issues Packages Projects Releases Wiki Activity

test(docker): separate host bwrap requirements

Browse Source 
Co-authored-by: yu-xin-c <175149126+yu-xin-c@users.noreply.github.com>
This commit is contained in:
Xubin Ren
2026-08-13 02:13:51 +09:00
co-authored by yu-xin-c
parent b7f0ae95a9
commit 498070d036
3 changed files with 17 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/deployment.md
+3 -1
View File
@@ -175,7 +175,9 @@ docker compose -f docker-compose.yml -f docker-compose.bwrap.yml run --rm nanobo
The override adds `CAP_SYS_ADMIN` and disables AppArmor/seccomp confinement for the
container so bubblewrap can create its nested namespaces. It preserves
`no-new-privileges`. Use it only when the bwrap sandbox is enabled.
`no-new-privileges`. The host must also allow unprivileged user namespaces; the
override cannot bypass a host-level namespace restriction. Use it only when the
bwrap sandbox is enabled.
### Docker