From 1296cfd77772ac6398001a193f82a80334f52f5e Mon Sep 17 00:00:00 2001 From: Shishir Mahajan Date: Wed, 31 Mar 2021 14:29:05 -0700 Subject: [PATCH] Update README.md. --- README.md | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index d4ca9d8..92579c8 100644 --- a/README.md +++ b/README.md @@ -77,7 +77,7 @@ will launch the job.
More detailed instructions are in the [`example README.md`](https://github.com/Roblox/nomad-driver-containerd/tree/master/example) -## Supported options +## Supported Options **Driver Config** @@ -92,8 +92,8 @@ More detailed instructions are in the [`example README.md`](https://github.com/R Valid options for `containerd_runtime` (Driver Config). -- `io.containerd.runc.v1`: runc runtime that supports a single container. -- `io.containerd.runc.v2` (Default): runc runtime that supports multiple containers per shim. +- `io.containerd.runc.v1`: `runc` runtime that supports a single container. +- `io.containerd.runc.v2` (Default): `runc` runtime that supports multiple containers per shim. - `io.containerd.runsc.v1`: `gVisor` is an OCI compliant container runtime which provides better security than `runc`. They achieve this by implementing a user space kernel written in go, which implements a substantial portion of the Linux system call interface. For more details, please check their [`official documentation`](https://gvisor.dev/docs/) - `sysbox-runc`: `sysbox-runc` is another container runtime that runs a system container which will have system services like systemd (init system), docker, kubernetes already running inside that system container. This will allow you to have a container that is more akin to a VM, and you can launch other containers inside that system container. This also provides better security than `runc` as they run their system container in a user namespace and use shiftfs filesystem to shift UIDs/GIDs. For more details, please check their [`official documentation`](https://www.nestybox.com) @@ -112,6 +112,7 @@ Valid options for `containerd_runtime` (Driver Config). | **seccomp** | bool | no | Enable default seccomp profile. List of [`allowed syscalls`](https://github.com/containerd/containerd/blob/master/contrib/seccomp/seccomp_default.go#L51-L395). | | **seccomp_profile** | string | no | Path to custom seccomp profile. `seccomp` must be set to `true` in order to use `seccomp_profile`. The default `docker` seccomp profile found [`here`](https://github.com/moby/moby/blob/master/profiles/seccomp/default.json) can be used as a reference, and modified to create a custom seccomp profile. | | **readonly_rootfs** | bool | no | Container root filesystem will be read-only. | +| **runtime** | string | no | A string representing a configured runtime to pass to containerd. This is equivalent to the `--runtime` argument in the docker CLI. | | **host_network** | bool | no | Enable host network. This is equivalent to `--net=host` in docker. | | **extra_hosts** | []string | no | A list of hosts, given as host:IP, to be added to /etc/hosts. | | **cap_add** | []string | no | Add individual capabilities. |