dotcloud/docker — pull request #5903 by alexlarsson (2014-05-19 07:55:25+00:00)
Title: Make /proc writable, but not /proc/sys and /proc/sysrq-trigger

Some applications want to write to /proc. For instance:

docker run -it centos groupadd foo

Gives: groupadd: failure while writing changes to /etc/group

And strace reveals why:

open("/proc/self/task/13/attr/fscreate", O_RDWR) = -1 EROFS (Read-only file system)

I've looked at what other systems do, and systemd-nspawn makes /proc read-write
and /proc/sys readonly, while lxc allows "proc:mixed" which does the same,
plus it makes /proc/sysrq-trigger also readonly.

The later seems like a prudent idea, so we follows lxc proc:mixed.

Docker-DCO-1.1-Signed-off-by: Alexander Larsson (github: alexlarsson)