Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Encrypted containers can be built unprivileged (1.2) #266

Merged
merged 1 commit into from
Mar 12, 2024
Merged

Encrypted containers can be built unprivileged (1.2) #266

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 2 additions & 4 deletions index.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,11 +44,9 @@ Container Signing & Encryption

{Project} allows containers to be signed using a PGP key. The
signature travels with the container image, allowing you to verify that
the image is unmodified at any time. Encryption of containers using
LUKS2 is also supported. Encrypted containers can be run without
the image is unmodified at any time. Encryption of containers
is also supported. Encrypted containers can be run without
decrypting them to disk first.
Using encrypted containers currently requires a setuid installation of
{Project}.

.. toctree::
:maxdepth: 1
Expand Down
5 changes: 2 additions & 3 deletions security_options.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -107,9 +107,8 @@ this keyword.
Building encrypted containers
*****************************

With {aProject} setuid installation it is possible to build and run
encrypted containers.
The containers are decrypted at runtime entirely in kernel space, meaning
{Project} can build and run encrypted containers.
The containers are decrypted at runtime entirely in memory, meaning
that no intermediate decrypted data is ever present on disk. See
:ref:`encrypted containers <encryption>` for more details.

Expand Down
Loading