diff --git a/contrib/completion/bash/docker b/contrib/completion/bash/docker index 4bfeb88990..239cb652af 100644 --- a/contrib/completion/bash/docker +++ b/contrib/completion/bash/docker @@ -1358,6 +1358,7 @@ _docker_container_run() { --cpuset-mems --cpu-shares -c --device + --device-cgroup-rule --device-read-bps --device-read-iops --device-write-bps diff --git a/contrib/completion/fish/docker.fish b/contrib/completion/fish/docker.fish index 8833e8caa8..d3ebcf1837 100644 --- a/contrib/completion/fish/docker.fish +++ b/contrib/completion/fish/docker.fish @@ -121,6 +121,7 @@ complete -c docker -A -f -n '__fish_seen_subcommand_from create' -l cap-drop -d complete -c docker -A -f -n '__fish_seen_subcommand_from create' -l cidfile -d 'Write the container ID to the file' complete -c docker -A -f -n '__fish_seen_subcommand_from create' -l cpuset -d 'CPUs in which to allow execution (0-3, 0,1)' complete -c docker -A -f -n '__fish_seen_subcommand_from create' -l device -d 'Add a host device to the container (e.g. --device=/dev/sdc:/dev/xvdc:rwm)' +complete -c docker -A -f -n '__fish_seen_subcommand_from create' -l device-cgroup-rule -d 'Add a rule to the cgroup allowed devices list (e.g. --device-cgroup-rule="c 13:37 rwm")' complete -c docker -A -f -n '__fish_seen_subcommand_from create' -l dns -d 'Set custom DNS servers' complete -c docker -A -f -n '__fish_seen_subcommand_from create' -l dns-opt -d "Set custom DNS options (Use --dns-opt='' if you don't wish to set options)" complete -c docker -A -f -n '__fish_seen_subcommand_from create' -l dns-search -d "Set custom DNS search domains (Use --dns-search=. if you don't wish to set the search domain)" @@ -312,6 +313,7 @@ complete -c docker -A -f -n '__fish_seen_subcommand_from run' -l cidfile -d 'Wri complete -c docker -A -f -n '__fish_seen_subcommand_from run' -l cpuset -d 'CPUs in which to allow execution (0-3, 0,1)' complete -c docker -A -f -n '__fish_seen_subcommand_from run' -s d -l detach -d 'Detached mode: run the container in the background and print the new container ID' complete -c docker -A -f -n '__fish_seen_subcommand_from run' -l device -d 'Add a host device to the container (e.g. --device=/dev/sdc:/dev/xvdc:rwm)' +complete -c docker -A -f -n '__fish_seen_subcommand_from create' -l device-cgroup-rule -d 'Add a rule to the cgroup allowed devices list (e.g. --device-cgroup-rule="c 13:37 rwm")' complete -c docker -A -f -n '__fish_seen_subcommand_from run' -l dns -d 'Set custom DNS servers' complete -c docker -A -f -n '__fish_seen_subcommand_from run' -l dns-opt -d "Set custom DNS options (Use --dns-opt='' if you don't wish to set options)" complete -c docker -A -f -n '__fish_seen_subcommand_from run' -l dns-search -d "Set custom DNS search domains (Use --dns-search=. if you don't wish to set the search domain)" diff --git a/contrib/completion/zsh/_docker b/contrib/completion/zsh/_docker index 22e3a319cf..3eb8f94478 100644 --- a/contrib/completion/zsh/_docker +++ b/contrib/completion/zsh/_docker @@ -546,6 +546,7 @@ __docker_container_subcommand() { "($help)--cidfile=[Write the container ID to the file]:CID file:_files" "($help)--cpus=[Number of CPUs (default 0.000)]:cpus: " "($help)*--device=[Add a host device to the container]:device:_files" + "($help)*--device-cgroup-rule=[Add a rule to the cgroup allowed devices list]:device:cgroup: " "($help)*--device-read-bps=[Limit the read rate (bytes per second) from a device]:device:IO rate: " "($help)*--device-read-iops=[Limit the read rate (IO per second) from a device]:device:IO rate: " "($help)*--device-write-bps=[Limit the write rate (bytes per second) to a device]:device:IO rate: " diff --git a/docs/reference/commandline/create.md b/docs/reference/commandline/create.md index 253c72da70..3587e03fd0 100644 --- a/docs/reference/commandline/create.md +++ b/docs/reference/commandline/create.md @@ -44,6 +44,7 @@ Options: --cpuset-cpus string CPUs in which to allow execution (0-3, 0,1) --cpuset-mems string MEMs in which to allow execution (0-3, 0,1) --device value Add a host device to the container (default []) + --device-cgroup-rule value Add a rule to the cgroup allowed devices list --device-read-bps value Limit read rate (bytes per second) from a device (default []) --device-read-iops value Limit read rate (IO per second) from a device (default []) --device-write-bps value Limit write rate (bytes per second) to a device (default []) diff --git a/docs/reference/commandline/run.md b/docs/reference/commandline/run.md index 9bacea4b1f..3cddb9d374 100644 --- a/docs/reference/commandline/run.md +++ b/docs/reference/commandline/run.md @@ -48,6 +48,7 @@ Options: -d, --detach Run container in background and print container ID --detach-keys string Override the key sequence for detaching a container --device value Add a host device to the container (default []) + --device-cgroup-rule value Add a rule to the cgroup allowed devices list --device-read-bps value Limit read rate (bytes per second) from a device (default []) --device-read-iops value Limit read rate (IO per second) from a device (default []) --device-write-bps value Limit write rate (bytes per second) to a device (default []) diff --git a/man/docker-run.1.md b/man/docker-run.1.md index 4e03331521..804aa1309f 100644 --- a/man/docker-run.1.md +++ b/man/docker-run.1.md @@ -27,6 +27,7 @@ docker-run - Run a command in a new container [**-d**|**--detach**] [**--detach-keys**[=*[]*]] [**--device**[=*[]*]] +[**--device-cgroup-rule**[=*[]*]] [**--device-read-bps**[=*[]*]] [**--device-read-iops**[=*[]*]] [**--device-write-bps**[=*[]*]] @@ -246,6 +247,16 @@ See **config-json(5)** for documentation on using a configuration file. **--device**=[] Add a host device to the container (e.g. --device=/dev/sdc:/dev/xvdc:rwm) +**--device-cgroup-rule**=[] + Add a rule to the cgroup allowed devices list. + + The rule is expected to be in the format specified in the Linux kernel documentation (Documentation/cgroup-v1/devices.txt): + - type: `a` (all), `c` (char) or `b` (block) + - major and minor: either a number or `*` for all + - permission: a composition of `r` (read), `w` (write) and `m` (mknod) + + Example: `c 1:3 mr`: allow for character device with major `1` and minor `3` to be created (`m`) and read (`r`) + **--device-read-bps**=[] Limit read rate from a device (e.g. --device-read-bps=/dev/sda:1mb)