container/startup-options¶
Caller-supplied startup flags for a container created by the generic containerStart action.
A direct array of strings giving extra flags to pass to container
create for this specific containerStart call. For example, to pass
--network host, the value should be ["--network", "host"].
These options occupy the same layer that a machine's
docker-context/startup-options and context/startup-options occupy on
the machine-bound runner path, but for a containerStart caller there is
no machine to read them from, so they are supplied directly here instead.
Host-level options from the plugin object's own
docker-context/host-startup-options Config value are still applied
afterwards, and therefore still win: they encode flags a particular
host needs before any container will run correctly there at all (rootless
podman userns mapping, SELinux --security-opt, cgroup driver quirks),
and a caller must not be able to override them. Nothing de-duplicates
flags across the two layers -- if both set conflicting flags, the
container runtime's own last-wins behavior decides, and the host layer is
last.
The default is an empty array.
Security: the right to set this is equivalent to root on the plugin
host. These flags reach container create unmodified and are not
filtered, so a caller can pass ["--privileged"], ["--pid", "host"],
["--userns", "host"], ["-v", "/:/host"] or any other engine flag,
and any one of those is a complete escape from the container onto the
host that runs dr-provision. Appending the host layer afterwards does
not constrain this: nothing cancels --privileged.
Treat the claim that authorizes containerStart as a host-root claim,
not as an ordinary container-management permission. Anyone who can
invoke the action can already do anything the plugin's own account can
do on that machine, so scope the claim to the operators you would trust
with root there, and do not hand it to a caller whose input comes from
somewhere less trusted than that.
Objects that Reference container/startup-options¶
Not used in current content packs
Objects used by container/startup-options¶
Not used in current content packs