NAME

syd-oci - OCI container runtime

SYNOPSIS

syd-oci [OPTIONS] [COMMAND]

DESCRIPTION

syd-oci is an OCI container runtime implementation for syd(1).

All common subcommands are supported: create, start, state, kill, delete, pause, resume, exec, run, list, ps, spec, events, features, update. Checkpoint/restore support is planned in the near future. See the respective youki issue, https://github.com/youki-dev/youki/issues/142, for more information.

INTEGRATION

syd-oci is a thin wrapper around youki(1) that integrates the syd(1) sandbox into containers. It is compatible with docker(1) and podman(1). To get syd-oci, you should build syd(1) with the oci feature. To use syd-oci with docker(1) you have two options: Either start dockerd(8) manually with the option --add-runtime=syd-oci=/bin/syd-oci, and do for example docker run -it --runtime=syd-oci alpine when starting containers, or add the following snippet to your /etc/docker/daemon.json file:

{
"runtimes": { "syd-oci": { "path": "/bin/syd-oci" } },
"default-runtime": "syd-oci"
}

You may need to adapt the path to syd-oci depending on your installation. To use with podman(1) is similar, just pass --runtime=/bin/syd-oci as an option to podman run.

CONFIGURATION

The configuration directory of syd-oci is one of the following:

For system-wide containers: /etc/syd/oci
For rootless containers, one of the following:
- ${XDG_CONFIG_HOME}/syd/oci where XDG_CONFIG_HOME is usually ~/.config.
- ${HOME}/.syd/oci if XDG_CONFIG_HOME is not set.

syd-oci attempts to configure the syd(1) sandbox in the following order, and parses the first file or profile it locates and stops processing, the environment variable SYD_OCI_NO_CONFIG may be set to skip to the final step:

If hostname and domainname is defined for the container, try to load ${SYD_CONFIG_DIR}/${hostname}.${domainname}.syd-3.
If domainname is defined for the container, try to load ${SYD_CONFIG_DIR}/${domainname}.syd-3.
If hostname is defined for the container, try to load ${SYD_CONFIG_DIR}/${hostname}.syd-3.
Try to load ${SYD_CONFIG_DIR}/default.syd-3
Load the builtin oci profile. This profile is designed to be combined with pandora(1) and learning mode. See syd-cat -p oci for the list of rules.

SYD_CONFIG_DIR in the items above refer to the configuration directory. Refer to syd(5) for the syntax of syd(1) configuration files and syd(2) for a list of configuration items syd(1) understands. A vim(1) syntax highlighting file is also provided to easily edit syd(1) configuration files. Use syd-cat file.syd-3 to check a syd(1) configuration file for syntax errors.

Located configuration is recorded verbatim at create in org.exherbo.syd.config annotation of the container, from which the sandbox is initialized thereafter, so exec processes share the sandbox rules of the init process.

Finally, note that include directives are not supported in syd-oci configuration files. This is to ensure main process and exec processes share the same sandbox rules.

AUTHORS