Class: AWSCDK::ECS::CfnTaskDefinition::KernelCapabilitiesProperty

Inherits:

Jsii::Struct

• Object
• Jsii::Struct
• AWSCDK::ECS::CfnTaskDefinition::KernelCapabilitiesProperty

Defined in:

ecs/cfn_task_definition.rb

Overview

The Linux capabilities to add or remove from the default Docker configuration for a container defined in the task definition.

For more detailed information about these Linux capabilities, see the capabilities(7) Linux manual page.

The following describes how Docker processes the Linux capabilities specified in the add and drop request parameters. For information about the latest behavior, see Docker Compose: order of cap_drop and cap_add in the Docker Community Forum.

• When the container is a privleged container, the container capabilities are all of the default Docker capabilities. The capabilities specified in the add request parameter, and the drop request parameter are ignored.
• When the add request parameter is set to ALL, the container capabilities are all of the default Docker capabilities, excluding those specified in the drop request parameter.
• When the drop request parameter is set to ALL, the container capabilities are the capabilities specified in the add request parameter.
• When the add request parameter and the drop request parameter are both empty, the capabilities the container capabilities are all of the default Docker capabilities.
• The default is to first drop the capabilities specified in the drop request parameter, and then add the capabilities specified in the add request parameter.

See Also:

• http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ecs-taskdefinition-kernelcapabilities.html

Instance Attribute Summary

• #add ⇒ Array<String>^? readonly

  The Linux capabilities for the container that have been added to the default configuration provided by Docker.

• #drop ⇒ Array<String>^? readonly

  The Linux capabilities for the container that have been removed from the default configuration provided by Docker.

Class Method Summary

• .jsii_properties ⇒ Object

Instance Method Summary

• #initialize(add: nil, drop: nil) ⇒ KernelCapabilitiesProperty constructor

  A new instance of KernelCapabilitiesProperty.

• #to_jsii ⇒ Object

Constructor Details

#initialize(add: nil, drop: nil) ⇒ KernelCapabilitiesProperty

Returns a new instance of KernelCapabilitiesProperty.

Parameters:

• add (Array<String>, nil) (defaults to: nil) —

  The Linux capabilities for the container that have been added to the default configuration provided by Docker.

• drop (Array<String>, nil) (defaults to: nil) —

  The Linux capabilities for the container that have been removed from the default configuration provided by Docker.

# File 'ecs/cfn_task_definition.rb', line 2244

def initialize(add: nil, drop: nil)
  @add = add
  Jsii::Type.check_type(@add, JSON.parse(Base64.strict_decode64("eyJjb2xsZWN0aW9uIjp7ImVsZW1lbnR0eXBlIjp7InByaW1pdGl2ZSI6InN0cmluZyJ9LCJraW5kIjoiYXJyYXkifX0=")), "add") unless @add.nil?
  @drop = drop
  Jsii::Type.check_type(@drop, JSON.parse(Base64.strict_decode64("eyJjb2xsZWN0aW9uIjp7ImVsZW1lbnR0eXBlIjp7InByaW1pdGl2ZSI6InN0cmluZyJ9LCJraW5kIjoiYXJyYXkifX0=")), "drop") unless @drop.nil?
end

Instance Attribute Details

#add ⇒ Array<String>^? (readonly)

The Linux capabilities for the container that have been added to the default configuration provided by Docker.

This parameter maps to CapAdd in the docker container create command and the --cap-add option to docker run.

Tasks launched on AWS Fargate only support adding the SYS_PTRACE kernel capability.

Valid values: "ALL" | "AUDIT_CONTROL" | "AUDIT_WRITE" | "BLOCK_SUSPEND" | "CHOWN" | "DAC_OVERRIDE" | "DAC_READ_SEARCH" | "FOWNER" | "FSETID" | "IPC_LOCK" | "IPC_OWNER" | "KILL" | "LEASE" | "LINUX_IMMUTABLE" | "MAC_ADMIN" | "MAC_OVERRIDE" | "MKNOD" | "NET_ADMIN" | "NET_BIND_SERVICE" | "NET_BROADCAST" | "NET_RAW" | "SETFCAP" | "SETGID" | "SETPCAP" | "SETUID" | "SYS_ADMIN" | "SYS_BOOT" | "SYS_CHROOT" | "SYS_MODULE" | "SYS_NICE" | "SYS_PACCT" | "SYS_PTRACE" | "SYS_RAWIO" | "SYS_RESOURCE" | "SYS_TIME" | "SYS_TTY_CONFIG" | "SYSLOG" | "WAKE_ALARM"

Returns:

• (Array<String>, nil)

See Also:

• http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ecs-taskdefinition-kernelcapabilities.html#cfn-ecs-taskdefinition-kernelcapabilities-add

# File 'ecs/cfn_task_definition.rb', line 2261

def add
  @add
end

#drop ⇒ Array<String>^? (readonly)

The Linux capabilities for the container that have been removed from the default configuration provided by Docker.

This parameter maps to CapDrop in the docker container create command and the --cap-drop option to docker run.

Valid values: "ALL" | "AUDIT_CONTROL" | "AUDIT_WRITE" | "BLOCK_SUSPEND" | "CHOWN" | "DAC_OVERRIDE" | "DAC_READ_SEARCH" | "FOWNER" | "FSETID" | "IPC_LOCK" | "IPC_OWNER" | "KILL" | "LEASE" | "LINUX_IMMUTABLE" | "MAC_ADMIN" | "MAC_OVERRIDE" | "MKNOD" | "NET_ADMIN" | "NET_BIND_SERVICE" | "NET_BROADCAST" | "NET_RAW" | "SETFCAP" | "SETGID" | "SETPCAP" | "SETUID" | "SYS_ADMIN" | "SYS_BOOT" | "SYS_CHROOT" | "SYS_MODULE" | "SYS_NICE" | "SYS_PACCT" | "SYS_PTRACE" | "SYS_RAWIO" | "SYS_RESOURCE" | "SYS_TIME" | "SYS_TTY_CONFIG" | "SYSLOG" | "WAKE_ALARM"

Returns:

• (Array<String>, nil)

See Also:

• http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ecs-taskdefinition-kernelcapabilities.html#cfn-ecs-taskdefinition-kernelcapabilities-drop

# File 'ecs/cfn_task_definition.rb', line 2270

def drop
  @drop
end

Class Method Details

.jsii_properties ⇒ Object

# File 'ecs/cfn_task_definition.rb', line 2272

def self.jsii_properties
  {
    :add => "add",
    :drop => "drop",
  }
end

Instance Method Details

#to_jsii ⇒ Object

# File 'ecs/cfn_task_definition.rb', line 2279

def to_jsii
  result = {}
  result.merge!({
    "add" => @add,
    "drop" => @drop,
  })
  result.compact
end