containers.conf: add privileged field to containers table

[vrothberg]

As requested in containers/podman/issues/20000, add a privileged field to the containers table in containers.conf. I was hesitant to add such a field at first (for security reasons) but I understand that such a field can come in handy when using modules - certain workloads require a privileged container.

@flouthoc @giuseppe @rhatdan PTAL

[Luap99]

Dup of #1678?! And the same question, is it really to much work to set the proper security options one by one instead of using the big hammer?

[vrothberg]

Oh boy, I didn't see the other PR at all.

is it really to much work to set the proper security options one by one instead of using the big hammer?

As mentioned in the commit message, I am not a huge fan either. But in some cases it probably is too much work or too complex. In many cases the users are not developers/SWEs. I prefer to have some "modules" using privileged than users developing the habit to always use the --privileged flag.

@rhatdan, I don't mind using your PR or this one. I plumbed this one here into Podman in containers/podman#20252.

[rhatdan]

LGTM
But I would suggest a little stronger language in the man page.

I had

Run all containers in privileged mode. The privileged field should almost
never be set, containers running in privileged mode have no separation from
the host other then namespaces. This means they can easily break out of
confinement.

[vrothberg]

Updated. Tried integrating @rhatdan's text with the other one (that I took from Podman's man page). Will update Podman's man page as well when doing the final vendor.

[Luap99]

LGTM

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: Luap99, vrothberg

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [Luap99,vrothberg]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[rhatdan]

/lgtm