interface KernelCapabilitiesProperty
Language | Type name |
---|---|
.NET | Amazon.CDK.AWS.ECS.CfnTaskDefinition.KernelCapabilitiesProperty |
Go | github.com/aws/aws-cdk-go/awscdk/v2/awsecs#CfnTaskDefinition_KernelCapabilitiesProperty |
Java | software.amazon.awscdk.services.ecs.CfnTaskDefinition.KernelCapabilitiesProperty |
Python | aws_cdk.aws_ecs.CfnTaskDefinition.KernelCapabilitiesProperty |
TypeScript | aws-cdk-lib » aws_ecs » CfnTaskDefinition » KernelCapabilitiesProperty |
The Linux capabilities to add or remove from the default Docker configuration for a container defined in the task definition.
For more information about the default capabilities and the non-default available capabilities, see Runtime privilege and Linux capabilities in the Docker run reference . For more detailed information about these Linux capabilities, see the capabilities(7) Linux manual page.
Example
// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import { aws_ecs as ecs } from 'aws-cdk-lib';
const kernelCapabilitiesProperty: ecs.CfnTaskDefinition.KernelCapabilitiesProperty = {
add: ['add'],
drop: ['drop'],
};
Properties
Name | Type | Description |
---|---|---|
add? | string[] | The Linux capabilities for the container that have been added to the default configuration provided by Docker. |
drop? | string[] | The Linux capabilities for the container that have been removed from the default configuration provided by Docker. |
add?
Type:
string[]
(optional)
The Linux capabilities for the container that have been added to the default configuration provided by Docker.
This parameter maps to CapAdd
in the Create a container section of the Docker Remote API and the --cap-add
option to docker run .
Tasks launched on AWS Fargate only support adding the
SYS_PTRACE
kernel capability.
Valid values: "ALL" | "AUDIT_CONTROL" | "AUDIT_WRITE" | "BLOCK_SUSPEND" | "CHOWN" | "DAC_OVERRIDE" | "DAC_READ_SEARCH" | "FOWNER" | "FSETID" | "IPC_LOCK" | "IPC_OWNER" | "KILL" | "LEASE" | "LINUX_IMMUTABLE" | "MAC_ADMIN" | "MAC_OVERRIDE" | "MKNOD" | "NET_ADMIN" | "NET_BIND_SERVICE" | "NET_BROADCAST" | "NET_RAW" | "SETFCAP" | "SETGID" | "SETPCAP" | "SETUID" | "SYS_ADMIN" | "SYS_BOOT" | "SYS_CHROOT" | "SYS_MODULE" | "SYS_NICE" | "SYS_PACCT" | "SYS_PTRACE" | "SYS_RAWIO" | "SYS_RESOURCE" | "SYS_TIME" | "SYS_TTY_CONFIG" | "SYSLOG" | "WAKE_ALARM"
drop?
Type:
string[]
(optional)
The Linux capabilities for the container that have been removed from the default configuration provided by Docker.
This parameter maps to CapDrop
in the Create a container section of the Docker Remote API and the --cap-drop
option to docker run .
Valid values: "ALL" | "AUDIT_CONTROL" | "AUDIT_WRITE" | "BLOCK_SUSPEND" | "CHOWN" | "DAC_OVERRIDE" | "DAC_READ_SEARCH" | "FOWNER" | "FSETID" | "IPC_LOCK" | "IPC_OWNER" | "KILL" | "LEASE" | "LINUX_IMMUTABLE" | "MAC_ADMIN" | "MAC_OVERRIDE" | "MKNOD" | "NET_ADMIN" | "NET_BIND_SERVICE" | "NET_BROADCAST" | "NET_RAW" | "SETFCAP" | "SETGID" | "SETPCAP" | "SETUID" | "SYS_ADMIN" | "SYS_BOOT" | "SYS_CHROOT" | "SYS_MODULE" | "SYS_NICE" | "SYS_PACCT" | "SYS_PTRACE" | "SYS_RAWIO" | "SYS_RESOURCE" | "SYS_TIME" | "SYS_TTY_CONFIG" | "SYSLOG" | "WAKE_ALARM"