diff options
| author | Adam Ierymenko <adam.ierymenko@gmail.com> | 2015-10-09 10:14:45 -0700 |
|---|---|---|
| committer | Adam Ierymenko <adam.ierymenko@gmail.com> | 2015-10-09 10:14:45 -0700 |
| commit | 9a2565115119f4c56bada376974ed77c6b2661c7 (patch) | |
| tree | 7c937e4e94c548aad1dce3987e66f0c54093a858 /examples | |
| parent | c2bbec2f050da996f660f2ae28b365330ebff633 (diff) | |
| download | infinitytier-9a2565115119f4c56bada376974ed77c6b2661c7.tar.gz infinitytier-9a2565115119f4c56bada376974ed77c6b2661c7.zip | |
.
Diffstat (limited to 'examples')
| -rw-r--r-- | examples/docker/README.md | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/examples/docker/README.md b/examples/docker/README.md index 4dae52f3..fbc93481 100644 --- a/examples/docker/README.md +++ b/examples/docker/README.md @@ -5,4 +5,4 @@ This is a simple Docker example using ZeroTier One in normal tun/tap mode. It us This is not a very secure way to load an identity secret, but it's useful for testing since it allows you to repeatedly launch Docker containers with the same identity. For production we'd recommend using something like Hashicorp Vault, or modifying main.sh to leave identities unspecified and allow the container to generate a new identity at runtime. Then you could script approval of containers using the controller API, approving them as they launch, etc. (We are working on better ways of doing mass provisioning.) -To use in normal tun/tap mode with Docker, containers must be run with the options "--device=/dev/net/tun --cap-add=NET_ADMIN". The main.sh script supplied here will complain and exit if these options are not present (no /dev/net/tun device). +To use in normal tun/tap mode with Docker, containers must be run with the options "--device=/dev/net/tun --privileged". The main.sh script supplied here will complain and exit if these options are not present (no /dev/net/tun device). |