public/seccomp-sandbox
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

add a tracer container

Browse Source
This commit is contained in:
guochao 2023-11-21 19:37:15 +08:00
parent 38e771dc1d
commit d132a3d6b8
2 changed files with 15 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
README.md
View File

@ -55,6 +55,13 @@ cargo build
更新 syscall 列表后重新构建二进制会生成新的 sandbox。
### Generate syscalls within container
```bash
docker build -t x2t-sandbox:tracer -f ./build/Dockerfile.ubuntu-build-with-tracer --target runtime-tracer .
docker run -it --rm -v output-volume:/output -v some-other-programs:/programs x2t-sandbox -l /output/syscalls.txt /path/to/command /and/its/arguments
```
### Run

8
build/Dockerfile.ubuntu-build-with-tracer
View File

@ -5,6 +5,9 @@ ARG ONLYOFFICE_IMAGE=onlyoffice/documentserver:7.5
FROM ${REGISTRY}/${BASE_IMAGE} as base
FROM base as runtime-slim-base
RUN apt update && apt install libseccomp2 -y && rm -rf /var/apt
FROM ${REGISTRY}/${ONLYOFFICE_IMAGE} as runtime-base
RUN apt update && apt install libseccomp2 -y && rm -rf /var/apt
@ -19,6 +22,11 @@ WORKDIR /src
FROM builder-base as tracer-builder
RUN /root/.cargo/bin/cargo build --release --features tracing-mode
FROM runtime-slim-base as runtime-tracer
COPY --from=tracer-builder /src/target/release/x2t-sandbox /usr/local/bin/x2t-sandbox
ENTRYPOINT ["/usr/local/bin/x2t-sandbox"]
FROM runtime-base as tracer-generate-syscalls
COPY data /data
COPY --from=tracer-builder /src/target/release/x2t-sandbox /usr/local/bin/x2t-sandbox