1 files changed, 10 insertions, 37 deletions

diff --git a/runsc/boot/config.go b/runsc/boot/config.go
index 8564c502d..6f1eb9a41 100644
--- a/runsc/boot/config.go
+++ b/runsc/boot/config.go
@@ -19,43 +19,9 @@ import (
 	"strconv"
 	"strings"
 
-	"gvisor.googlesource.com/gvisor/pkg/sentry/watchdog"
+	"gvisor.dev/gvisor/pkg/sentry/watchdog"
 )
 
-// PlatformType tells which platform to use.
-type PlatformType int
-
-const (
-	// PlatformPtrace runs the sandbox with the ptrace platform.
-	PlatformPtrace PlatformType = iota
-
-	// PlatformKVM runs the sandbox with the KVM platform.
-	PlatformKVM
-)
-
-// MakePlatformType converts type from string.
-func MakePlatformType(s string) (PlatformType, error) {
-	switch s {
-	case "ptrace":
-		return PlatformPtrace, nil
-	case "kvm":
-		return PlatformKVM, nil
-	default:
-		return 0, fmt.Errorf("invalid platform type %q", s)
-	}
-}
-
-func (p PlatformType) String() string {
-	switch p {
-	case PlatformPtrace:
-		return "ptrace"
-	case PlatformKVM:
-		return "kvm"
-	default:
-		return fmt.Sprintf("unknown(%d)", p)
-	}
-}
-
 // FileAccessType tells how the filesystem is accessed.
 type FileAccessType int
 
@@ -187,7 +153,7 @@ type Config struct {
 	LogPackets bool
 
 	// Platform is the platform to run on.
-	Platform PlatformType
+	Platform string
 
 	// Strace indicates that strace should be enabled.
 	Strace bool
@@ -226,6 +192,12 @@ type Config struct {
 	// to the same underlying network device. This allows netstack to better
 	// scale for high throughput use cases.
 	NumNetworkChannels int
+
+	// Rootless allows the sandbox to be started with a user that is not root.
+	// Defense is depth measures are weaker with rootless. Specifically, the
+	// sandbox and Gofer process run as root inside a user namespace with root
+	// mapped to the caller's user.
+	Rootless bool
 }
 
 // ToFlags returns a slice of flags that correspond to the given Config.
@@ -241,7 +213,7 @@ func (c *Config) ToFlags() []string {
 		"--overlay=" + strconv.FormatBool(c.Overlay),
 		"--network=" + c.Network.String(),
 		"--log-packets=" + strconv.FormatBool(c.LogPackets),
-		"--platform=" + c.Platform.String(),
+		"--platform=" + c.Platform,
 		"--strace=" + strconv.FormatBool(c.Strace),
 		"--strace-syscalls=" + strings.Join(c.StraceSyscalls, ","),
 		"--strace-log-size=" + strconv.Itoa(int(c.StraceLogSize)),
@@ -250,6 +222,7 @@ func (c *Config) ToFlags() []string {
 		"--profile=" + strconv.FormatBool(c.ProfileEnable),
 		"--net-raw=" + strconv.FormatBool(c.EnableRaw),
 		"--num-network-channels=" + strconv.Itoa(c.NumNetworkChannels),
+		"--rootless=" + strconv.FormatBool(c.Rootless),
 	}
 	if c.TestOnlyAllowRunAsCurrentUserWithoutChroot {
 		// Only include if set since it is never to be used by users.