From a5ecd7a84a93da8761b396fae2eee95301b3d6ff Mon Sep 17 00:00:00 2001 From: hengyunabc Date: Fri, 14 Aug 2026 02:31:32 +0000 Subject: [PATCH] Prettified Code! --- site/docs/doc/docker.md | 16 ++++++++-------- site/docs/en/doc/docker.md | 16 ++++++++-------- 2 files changed, 16 insertions(+), 16 deletions(-) diff --git a/site/docs/doc/docker.md b/site/docs/doc/docker.md index 3e3641957..9b57eb944 100644 --- a/site/docs/doc/docker.md +++ b/site/docs/doc/docker.md @@ -197,14 +197,14 @@ spec: 目标 HotSpot 支持 root 客户端时，为了覆盖首次 attach、不同权限的临时目录和 `stop` 清理，建议显式保留下面四项 capability。 -| 配置或 capability | 用途 | -| --- | --- | -| `shareProcessNamespace: true` | 让 sidecar 能看到应用 JVM 的 PID 和 `/proc/` | -| `runAsUser: 0` | 在目标 HotSpot 支持 root 客户端时通过跨 UID 校验 | -| `SYS_PTRACE` | 通过 ptrace access check 读取 `/proc/`，并访问 `/proc//root` 和 mount namespace 信息 | -| `KILL` | UID 不同时向尚未启动 attach listener 的 JVM 发送 `SIGQUIT` | -| `DAC_OVERRIDE` | 连接目标用户拥有的 `0600` attach socket，并写入目标容器的临时目录 | -| `CHOWN` | 把复制到目标容器的 Arthas Home 交给目标用户，使 `stop` 可以清理该目录 | +| 配置或 capability | 用途 | +| ----------------------------- | ---------------------------------------------------------------------------------------------- | +| `shareProcessNamespace: true` | 让 sidecar 能看到应用 JVM 的 PID 和 `/proc/` | +| `runAsUser: 0` | 在目标 HotSpot 支持 root 客户端时通过跨 UID 校验 | +| `SYS_PTRACE` | 通过 ptrace access check 读取 `/proc/`，并访问 `/proc//root` 和 mount namespace 信息 | +| `KILL` | UID 不同时向尚未启动 attach listener 的 JVM 发送 `SIGQUIT` | +| `DAC_OVERRIDE` | 连接目标用户拥有的 `0600` attach socket，并写入目标容器的临时目录 | +| `CHOWN` | 把复制到目标容器的 Arthas Home 交给目标用户，使 `stop` 可以清理该目录 | 下面是跨 UID 场景的 `securityContext` 片段。它不需要 `privileged: true`、`SYS_ADMIN`、`hostPID` 或 `hostPath`。 diff --git a/site/docs/en/doc/docker.md b/site/docs/en/doc/docker.md index 386f35eb0..55930a8a7 100644 --- a/site/docs/en/doc/docker.md +++ b/site/docs/en/doc/docker.md @@ -197,14 +197,14 @@ If the sidecar and application JVM use different UIDs, the sidecar must run as U When the target HotSpot accepts a root client, explicitly retain the following four capabilities to support the initial attach, temporary directories with restrictive permissions, and cleanup by `stop`. -| Setting or capability | Purpose | -| --- | --- | -| `shareProcessNamespace: true` | Makes the application JVM's PID and `/proc/` visible to the sidecar | -| `runAsUser: 0` | Passes the cross-UID check when the target HotSpot accepts root clients | -| `SYS_PTRACE` | Passes ptrace access checks for `/proc/`, `/proc//root`, and mount namespace information | -| `KILL` | Sends `SIGQUIT` across UIDs when the target JVM's attach listener has not started | -| `DAC_OVERRIDE` | Connects to the target user's `0600` attach socket and writes to the target container's temporary directory | -| `CHOWN` | Gives the copied Arthas Home to the target user so that `stop` can remove it | +| Setting or capability | Purpose | +| ----------------------------- | ----------------------------------------------------------------------------------------------------------- | +| `shareProcessNamespace: true` | Makes the application JVM's PID and `/proc/` visible to the sidecar | +| `runAsUser: 0` | Passes the cross-UID check when the target HotSpot accepts root clients | +| `SYS_PTRACE` | Passes ptrace access checks for `/proc/`, `/proc//root`, and mount namespace information | +| `KILL` | Sends `SIGQUIT` across UIDs when the target JVM's attach listener has not started | +| `DAC_OVERRIDE` | Connects to the target user's `0600` attach socket and writes to the target container's temporary directory | +| `CHOWN` | Gives the copied Arthas Home to the target user so that `stop` can remove it | The following `securityContext` fragment is for a cross-UID sidecar. It does not require `privileged: true`, `SYS_ADMIN`, `hostPID`, or `hostPath`.