diff --git a/docker.go b/docker.go index 90301c2..43a6adf 100644 --- a/docker.go +++ b/docker.go @@ -341,6 +341,7 @@ func commandDaemon(daemon Daemon) *exec.Cmd { args := []string{ "--data-root", daemon.StoragePath, "--host=unix:///var/run/docker.sock", + "--seccomp-profile=/etc/docker/default.json", } if daemon.StorageDriver != "" { diff --git a/docker/docker/Dockerfile.linux.amd64 b/docker/docker/Dockerfile.linux.amd64 index c39c578..761835d 100644 --- a/docker/docker/Dockerfile.linux.amd64 +++ b/docker/docker/Dockerfile.linux.amd64 @@ -2,5 +2,14 @@ FROM docker:19.03.8-dind ENV DOCKER_HOST=unix:///var/run/docker.sock +RUN apk --update add --virtual .build-deps curl && \ + mkdir -p /etc/docker/ && \ + curl -SsL -o /etc/docker/default.json https://raw.githubusercontent.com/moby/moby/19.03/profiles/seccomp/default.json && \ + sed -i 's/SCMP_ACT_ERRNO/SCMP_ACT_TRACE/g' /etc/docker/default.json && \ + chmod 600 /etc/docker/default.json && \ + apk del .build-deps && \ + rm -rf /var/cache/apk/* && \ + rm -rf /tmp/* + ADD release/linux/amd64/drone-docker /bin/ ENTRYPOINT ["/usr/local/bin/dockerd-entrypoint.sh", "/bin/drone-docker"] diff --git a/docker/docker/Dockerfile.linux.arm b/docker/docker/Dockerfile.linux.arm index 1a8d8b3..38c8992 100644 --- a/docker/docker/Dockerfile.linux.arm +++ b/docker/docker/Dockerfile.linux.arm @@ -2,5 +2,14 @@ FROM arm32v6/docker:19.03.8-dind ENV DOCKER_HOST=unix:///var/run/docker.sock +RUN apk --update add --virtual .build-deps curl && \ + mkdir -p /etc/docker/ && \ + curl -SsL -o /etc/docker/default.json https://raw.githubusercontent.com/moby/moby/19.03/profiles/seccomp/default.json && \ + sed -i 's/SCMP_ACT_ERRNO/SCMP_ACT_TRACE/g' /etc/docker/default.json && \ + chmod 600 /etc/docker/default.json && \ + apk del .build-deps && \ + rm -rf /var/cache/apk/* && \ + rm -rf /tmp/* + ADD release/linux/arm/drone-docker /bin/ ENTRYPOINT ["/usr/local/bin/dockerd-entrypoint.sh", "/bin/drone-docker"] diff --git a/docker/docker/Dockerfile.linux.arm64 b/docker/docker/Dockerfile.linux.arm64 index 2a70c6a..2604ea7 100644 --- a/docker/docker/Dockerfile.linux.arm64 +++ b/docker/docker/Dockerfile.linux.arm64 @@ -2,5 +2,14 @@ FROM arm64v8/docker:19.03.8-dind ENV DOCKER_HOST=unix:///var/run/docker.sock +RUN apk --update add --virtual .build-deps curl && \ + mkdir -p /etc/docker/ && \ + curl -SsL -o /etc/docker/default.json https://raw.githubusercontent.com/moby/moby/19.03/profiles/seccomp/default.json && \ + sed -i 's/SCMP_ACT_ERRNO/SCMP_ACT_TRACE/g' /etc/docker/default.json && \ + chmod 600 /etc/docker/default.json && \ + apk del .build-deps && \ + rm -rf /var/cache/apk/* && \ + rm -rf /tmp/* + ADD release/linux/arm64/drone-docker /bin/ ENTRYPOINT ["/usr/local/bin/dockerd-entrypoint.sh", "/bin/drone-docker"]