From 4585809848d15a7da67e7534c91babbcccae5f20 Mon Sep 17 00:00:00 2001 From: David Karlsson <35727626+dvdksn@users.noreply.github.com> Date: Fri, 5 Apr 2024 15:59:00 +0200 Subject: [PATCH] docs: add systempaths=unconfined security-opt Signed-off-by: David Karlsson <35727626+dvdksn@users.noreply.github.com> --- docs/reference/commandline/container_run.md | 1 + 1 file changed, 1 insertion(+) diff --git a/docs/reference/commandline/container_run.md b/docs/reference/commandline/container_run.md index 20729c083b..a18c67fdb5 100644 --- a/docs/reference/commandline/container_run.md +++ b/docs/reference/commandline/container_run.md @@ -1363,6 +1363,7 @@ in the image, or `SIGTERM` if the image has no `STOPSIGNAL` defined. | `--security-opt="seccomp=unconfined"` | Turn off seccomp confinement for the container | | `--security-opt="seccomp=builtin"` | Use the default (built-in) seccomp profile for the container. This can be used to enable seccomp for a container running on a daemon with a custom default profile set, or with seccomp disabled ("unconfined"). | | `--security-opt="seccomp=profile.json"` | White-listed syscalls seccomp Json file to be used as a seccomp filter | +| `--security-opt="systempaths=unconfined"` | Turn off confinement for system paths (masked paths, read-only paths) for the container | The `--security-opt` flag lets you override the default labeling scheme for a container. Specifying the level in the following command allows you to share