lxc: Bindmount /etc/skel in all containers.

[matthijs/servers/tika.git] / var / lib / lxc / template / config

diff --git a/var/lib/lxc/template/config b/var/lib/lxc/template/config
index aaaae21b6e62d177cedd9053b5a243881109f164..c891c663c6f1336c1b4101c72ee34d6fdb87b58d 100644 (file)
--- a/var/lib/lxc/template/config
+++ b/var/lib/lxc/template/config
@@ -1,8 +1,8 @@
 # Hostname
-lxc.utsname = template
+lxc.utsname = template.local
 
 # Use this root filesystem
-lxc.rootfs = /var/lib/lxc/template/rootfs
+lxc.rootfs = /containers/template
 
 # Log console output
 lxc.console = /var/log/lxc/template.lxc
@@ -50,6 +50,22 @@ lxc.cgroup.devices.allow = c 5:2 rwm
 lxc.cgroup.devices.allow = c 254:0 rwm
 
 # mounts (note that the second item in each list is the mount point, relative
-# to the rootfs)
+ to the rootfs)
 lxc.mount.entry=proc proc proc nodev,noexec,nosuid 0 0
 lxc.mount.entry=sysfs sys sysfs defaults  0 0
+lxc.mount.entry=/data/users data/users none defaults,bind 0 0
+lxc.mount.entry=/etc/skel etc/skel none defaults,bind,ro 0 0
+
+# Disallow module (un)loading
+lxc.cap.drop = sys_module
+# Disallow doing raw io
+lxc.cap.drop = sys_rawio
+# Disallow changing the clock
+lxc.cap.drop = sys_time
+# Disallow changing network settings
+lxc.cap.drop = net_admin
+# Disallow changing auditing settings
+lxc.cap.drop = audit_control
+# Disallow various admin tasks (probably has side-effects)
+lxc.cap.drop = sys_admin
+# sys_boot is always dropped by lxc-start