From 92c664b0dc1f8c644f09a6d6f56b0753c5b4186f Mon Sep 17 00:00:00 2001
From: David Karlsson <35727626+dvdksn@users.noreply.github.com>
Date: Thu, 23 Nov 2023 14:13:24 +0100
Subject: [PATCH] docs: move info about --security-opt to docker run reference
Signed-off-by: David Karlsson <35727626+dvdksn@users.noreply.github.com>
---
docs/reference/commandline/run.md | 57 ++++++++++++++++++++++++++++-
docs/reference/run.md | 59 -------------------------------
2 files changed, 56 insertions(+), 60 deletions(-)
diff --git a/docs/reference/commandline/run.md b/docs/reference/commandline/run.md
index 5e905e2730..3deaf5fd60 100644
--- a/docs/reference/commandline/run.md
+++ b/docs/reference/commandline/run.md
@@ -1206,7 +1206,62 @@ in the image, or `SIGTERM` if the image has no `STOPSIGNAL` defined.
### Optional security options (--security-opt)
-On Windows, you can use this flag to specify the `credentialspec` option.
+| Option | Description |
+|:------------------------------------------|:--------------------------------------------------------------------------|
+| `--security-opt="label=user:USER"` | Set the label user for the container |
+| `--security-opt="label=role:ROLE"` | Set the label role for the container |
+| `--security-opt="label=type:TYPE"` | Set the label type for the container |
+| `--security-opt="label=level:LEVEL"` | Set the label level for the container |
+| `--security-opt="label=disable"` | Turn off label confinement for the container |
+| `--security-opt="apparmor=PROFILE"` | Set the apparmor profile to be applied to the container |
+| `--security-opt="no-new-privileges=true"` | Disable container processes from gaining new privileges |
+| `--security-opt="seccomp=unconfined"` | Turn off seccomp confinement for the container |
+| `--security-opt="seccomp=profile.json"` | White-listed syscalls seccomp Json file to be used as a seccomp filter |
+
+The `--security-opt` flag lets you override the default labeling scheme for a
+container. Specifying the level in the following command allows you to share
+the same content between containers.
+
+```console
+$ docker run --security-opt label=level:s0:c100,c200 -it fedora bash
+```
+
+> **Note**
+>
+> Automatic translation of MLS labels isn't supported.
+
+To disable the security labeling for a container entirely, you can use
+`label=disable`:
+
+```console
+$ docker run --security-opt label=disable -it ubuntu bash
+```
+
+If you want a tighter security policy on the processes within a container, you
+can specify a custom `type` label. The following example runs a container
+that's only allowed to listen on Apache ports:
+
+```console
+$ docker run --security-opt label=type:svirt_apache_t -it ubuntu bash
+```
+
+> **Note**
+>
+> You would have to write policy defining a `svirt_apache_t` type.
+
+To prevent your container processes from gaining additional privileges, you can
+use the following command:
+
+```console
+$ docker run --security-opt no-new-privileges -it ubuntu bash
+```
+
+This means that commands that raise privileges such as `su` or `sudo` will no longer work.
+It also causes any seccomp filters to be applied later, after privileges have been dropped
+which may mean you can have a more restrictive set of filters.
+For more details, see the [kernel documentation](https://www.kernel.org/doc/Documentation/prctl/no_new_privs.txt).
+
+On Windows, you can use the `--security-opt` flag to specify the `credentialspec` option.
The `credentialspec` must be in the format `file://spec.txt` or `registry://keyname`.
### Stop container with timeout (--stop-timeout)
diff --git a/docs/reference/run.md b/docs/reference/run.md
index b460e714ef..5f2356d90f 100644
--- a/docs/reference/run.md
+++ b/docs/reference/run.md
@@ -241,65 +241,6 @@ $ echo $?
3
```
-## Security configuration
-
-| Option | Description |
-|:------------------------------------------|:--------------------------------------------------------------------------|
-| `--security-opt="label=user:USER"` | Set the label user for the container |
-| `--security-opt="label=role:ROLE"` | Set the label role for the container |
-| `--security-opt="label=type:TYPE"` | Set the label type for the container |
-| `--security-opt="label=level:LEVEL"` | Set the label level for the container |
-| `--security-opt="label=disable"` | Turn off label confinement for the container |
-| `--security-opt="apparmor=PROFILE"` | Set the apparmor profile to be applied to the container |
-| `--security-opt="no-new-privileges=true"` | Disable container processes from gaining new privileges |
-| `--security-opt="seccomp=unconfined"` | Turn off seccomp confinement for the container |
-| `--security-opt="seccomp=profile.json"` | White-listed syscalls seccomp Json file to be used as a seccomp filter |
-
-
-You can override the default labeling scheme for each container by specifying
-the `--security-opt` flag. Specifying the level in the following command
-allows you to share the same content between containers.
-
-```console
-$ docker run --security-opt label=level:s0:c100,c200 -it fedora bash
-```
-
-> **Note**
->
-> Automatic translation of MLS labels is not currently supported.
-
-To disable the security labeling for this container versus running with the
-`--privileged` flag, use the following command:
-
-```console
-$ docker run --security-opt label=disable -it fedora bash
-```
-
-If you want a tighter security policy on the processes within a container,
-you can specify an alternate type for the container. You could run a container
-that is only allowed to listen on Apache ports by executing the following
-command:
-
-```console
-$ docker run --security-opt label=type:svirt_apache_t -it centos bash
-```
-
-> **Note**
->
-> You would have to write policy defining a `svirt_apache_t` type.
-
-If you want to prevent your container processes from gaining additional
-privileges, you can execute the following command:
-
-```console
-$ docker run --security-opt no-new-privileges -it centos bash
-```
-
-This means that commands that raise privileges such as `su` or `sudo` will no longer work.
-It also causes any seccomp filters to be applied later, after privileges have been dropped
-which may mean you can have a more restrictive set of filters.
-For more details, see the [kernel documentation](https://www.kernel.org/doc/Documentation/prctl/no_new_privs.txt).
-
## Specify an init process
You can use the `--init` flag to indicate that an init process should be used as