Run a --privileged docker container in an isolated environment

[kochia4]

Hi everyone!
I need to run a --privileged docker container in an isolated environment, at Kata Slack, they told me that nerdctl seems good option for that.
The docker image needs several kernel features to be enabled on the host:

modprobe binder_linux devices="binder,hwbinder,vndbinder"
modprobe ashmem_linux

and --privileged flag during docker run
The project is here: redroid
I'm interested if I can run the image with nerdctl to ensure the host safety and isolation?

[AkihiroSuda]

nerdctl run --runtime=io.containerd.kata.v2 --privileged --security-opt privileged-without-host-devices might be what you are looking for, but I don't think Kata is likely to support binder and ashmem.
Probably you'll need to fork Kata for your custom kernel config.