diff options
| author | Michal Rostecki <mrostecki@mirantis.com> | 2015-11-13 08:28:29 +0100 |
|---|---|---|
| committer | Michal Rostecki <michal.rostecki@gmail.com> | 2016-05-06 10:23:49 +0200 |
| commit | a5c1aa0b81db71fb2e293ad45c8dc920d07b8a20 (patch) | |
| tree | f550a9e033a6f6110b5a58d4ed1f26e10c18ea06 /ansible | |
| parent | bde5e732d5c67ef56874a0d85ab5293ba6ce0679 (diff) | |
| download | kolla-a5c1aa0b81db71fb2e293ad45c8dc920d07b8a20.tar.gz kolla-a5c1aa0b81db71fb2e293ad45c8dc920d07b8a20.zip | |
Run HAProxy in a chroot jail
It's impossible to drop root for the HAProxy container.
But HAProxy provides a possibility to use a chroot jail.
When attaching to the HAProxy container, we see that
the root directory is changed:
$ sudo docker exec -ti haproxy bash
(haproxy)[root@operator /]# ls -di /
259 /
Co-Authored-By: Vikram Hosakote <vhosakot@cisco.com>
Closes-Bug: #1552289
Change-Id: I9d55e9b741b8560cac53dc8b837a24a3029a4dc0
Diffstat (limited to 'ansible')
| -rw-r--r-- | ansible/roles/haproxy/templates/haproxy.cfg.j2 | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/ansible/roles/haproxy/templates/haproxy.cfg.j2 b/ansible/roles/haproxy/templates/haproxy.cfg.j2 index 72c52cab7..a6507ed20 100644 --- a/ansible/roles/haproxy/templates/haproxy.cfg.j2 +++ b/ansible/roles/haproxy/templates/haproxy.cfg.j2 @@ -1,5 +1,8 @@ {% set tls_bind_info = 'ssl crt /etc/haproxy/haproxy.pem' if kolla_enable_tls_external | bool else '' %} global + chroot /var/lib/haproxy + user haproxy + group haproxy daemon log /var/lib/kolla/heka/log local0 maxconn 4000 |