doing it

driver/docker-container/driver.go

@@ -3,6 +3,7 @@ package docker
 import (
 	"bytes"
 	"context"
+	"fmt"
 	"io"
 	"net"
 	"os"
@@ -109,11 +110,10 @@ func (d *Driver) create(ctx context.Context, l progress.SubLogger) error {
 	if d.InitConfig.BuildkitFlags != nil {
 		cfg.Cmd = d.InitConfig.BuildkitFlags
 	}
-
 	useInit := true // let it cleanup exited processes created by BuildKit's container API
 	if err := l.Wrap("creating container "+d.Name, func() error {
 		hc := &container.HostConfig{
-			Privileged: true,
+			Privileged: false,
 			Mounts: []mount.Mount{
 				{
 					Type:   mount.TypeVolume,
@@ -135,19 +135,25 @@ func (d *Driver) create(ctx context.Context, l progress.SubLogger) error {
 					hc.CgroupParent = d.cgroupParent
 				}
 			}
-
 			secOpts, err := dockertypes.DecodeSecurityOptions(info.SecurityOptions)
 			if err != nil {
 				return err
 			}
 			for _, f := range secOpts {
+				fmt.Println(f)
 				if f.Name == "userns" {
 					hc.UsernsMode = "host"
 					break
 				}
 			}
-
+			//hc.SecurityOpt=["seccomp:unconfined" "apparmor:unconfined" "systempaths:unconfined"]
+			hc.SecurityOpt = append(hc.SecurityOpt, "seccomp=unconfined")
+			hc.SecurityOpt = append(hc.SecurityOpt, "apparmor=unconfined")
+			hc.SecurityOpt = append(hc.SecurityOpt, "systempaths=unconfined")
+			hc.Privileged = false
 		}
+		fmt.Println(cfg)
+		fmt.Println(hc)
 		_, err := d.DockerAPI.ContainerCreate(ctx, cfg, hc, &network.NetworkingConfig{}, nil, d.Name)
 		if err != nil && !errdefs.IsConflict(err) {
 			return err
@@ -273,6 +279,7 @@ func (d *Driver) run(ctx context.Context, cmd []string, stdout, stderr io.Writer
 	if resp.ExitCode != 0 {
 		return errors.Errorf("exit code %d", resp.ExitCode)
 	}
+	fmt.Println("did I get in here")
 	return nil
 }
 

driver/driver.go

@@ -2,6 +2,7 @@ package driver
 
 import (
 	"context"
+	"fmt"
 	"io"
 
 	"github.com/docker/buildx/store"
@@ -65,12 +66,15 @@ type Driver interface {
 }
 
 func Boot(ctx, clientContext context.Context, d *DriverHandle, pw progress.Writer) (*client.Client, error) {
+	fmt.Println("I don't like being confused")
 	try := 0
 	for {
+		fmt.Println("in the for...block?")
 		info, err := d.Info(ctx)
 		if err != nil {
 			return nil, err
 		}
+		fmt.Println("I think d.Info might be doing an out of band thing")
 		try++
 		if info.Status != Running {
 			if try > 2 {
@@ -80,7 +84,7 @@ func Boot(ctx, clientContext context.Context, d *DriverHandle, pw progress.Write
 				return nil, err
 			}
 		}
-
+		fmt.Println("before or after running")
 		c, err := d.Client(clientContext)
 		if err != nil {
 			if errors.Cause(err) == ErrNotRunning && try <= 2 {
@@ -88,6 +92,7 @@ func Boot(ctx, clientContext context.Context, d *DriverHandle, pw progress.Write
 			}
 			return nil, err
 		}
+		fmt.Println("before final return")
 		return c, nil
 	}
 }

driver/manager.go

@@ -56,6 +56,7 @@ type InitConfig struct {
 	BuildkitFlags    []string
 	Files            map[string][]byte
 	DriverOpts       map[string]string
+	SecurityOpts     map[string]string
 	Auth             Auth
 	Platforms        []specs.Platform
 	// ContextPathHash can be used for determining pods in the driver instance
@@ -104,7 +105,7 @@ func GetFactory(name string, instanceRequired bool) (Factory, error) {
 	return nil, errors.Errorf("failed to find driver %q", name)
 }
 
-func GetDriver(ctx context.Context, name string, f Factory, endpointAddr string, api dockerclient.APIClient, auth Auth, kcc KubeClientConfig, flags []string, files map[string][]byte, do map[string]string, platforms []specs.Platform, contextPathHash string) (*DriverHandle, error) {
+func GetDriver(ctx context.Context, name string, f Factory, endpointAddr string, api dockerclient.APIClient, auth Auth, kcc KubeClientConfig, flags []string, files map[string][]byte, do map[string]string, so map[string]string, platforms []specs.Platform, contextPathHash string) (*DriverHandle, error) {
 	ic := InitConfig{
 		EndpointAddr:     endpointAddr,
 		DockerAPI:        api,
@@ -112,6 +113,7 @@ func GetDriver(ctx context.Context, name string, f Factory, endpointAddr string,
 		Name:             name,
 		BuildkitFlags:    flags,
 		DriverOpts:       do,
+		SecurityOpts:     so,
 		Auth:             auth,
 		Platforms:        platforms,
 		ContextPathHash:  contextPathHash,