<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<style type="text/css" style="display:none"><!-- p { margin-top: 0px; margin-bottom: 0px; }--></style>
</head>
<body dir="ltr" style="font-size:12pt;color:#000000;background-color:#FFFFFF;font-family:Calibri,Arial,Helvetica,sans-serif;">
Now CT starts in a new user namespace. This allows us
<div>* to remove our capabilities (CAP_VE_*)</div>
<div>* to improve security of our containers, because a process doesn't have privileges outside the container
<div><br>
</div>
<div>Here is a good article about user namespaces https://lwn.net/Articles/532593/<br>
</div>
<p><br>
</p>
<p><a href="https://jira.sw.ru/browse/PSBM-33304">https://jira.sw.ru/browse/PSBM-33304</a><br>
</p>
<p><br>
</p>
<p>Users should not notice these changes, everything should work as before.<br>
</p>
<p><br>
</p>
<p>Testing:<br>
</p>
<p>* need to execute tests to check security of containers<br>
</p>
<p>* execute all tests, because these changes are touching very general parts<br>
</p>
</div>
</body>
</html>