az confcom acipolicygen

Create a Confidential Container Security Policy for ACI. Azure CLI extensions reference

28 options Its page in the Azure CLI extensions reference

Options

28 in the Azure CLI extensions reference

Show its 28 options

--allow-kubeproxyInclude the ACI kube-proxy image-attached fragment reference in a Linux VN2 policy

--approve-wildcards, -yWhen enabled, all prompts for using wildcards in environment variables are automatically approved

--debug-modeWhen enabled, the generated security policy adds the ability to use /bin/sh or /bin/bash to debug the container.

--diff, -dWhen combined with an input ARM Template file (or YAML file for Virtual Node policy generation), verifies the policy present in the ARM Template under "ccePolicy" and the containers within the file are compatible.

--disable-stdioWhen enabled, the containers in the container group do not have access to stdio

--enable-stdioEnable the standard io streams to leave the container

--exclude-default-fragments, -eWhen enabled, the default fragments are not included in the generated policy.

--faster-hashingWhen enabled, the hashing algorithm used to generate the policy is faster but less memory efficient

--fragments-json, -jPath to JSON file containing fragment information to use for generating a policy.

--imageInput image name

--include-fragments, -fWhen enabled, the path specified by --fragments-json will be used to pull fragments from an OCI registry or locally and include them in the generated policy

--infrastructure-svnMinimum Allowed Software Version Number for Infrastructure Fragment

--input, -iInput JSON config file

--omit-idWhen enabled, the generated policy will not contain the ID field.

--outraw-pretty-printOutput policy in clear text and pretty print format

--outrawOutput policy in clear text compact JSON instead of default base64 format

--parameters, -pInput parameters file to optionally accompany an ARM Template

--platformTarget platform for policy generation (linux/amd64 or windows/amd64).

--prerelease-policy-apiGenerate a policy using the latest bundled prerelease policy API, framework version, and fragments.

--print-existing-policyWhen enabled, the existing security policy that is present in the ARM Template is printed to the command line, and no new security policy is generated

--print-policyWhen enabled, the generated security policy is printed to the command line instead of injected into the input ARM Template

--save-to-file, -sSave output policy to given file path

--skip-win-ver-checkWhen enabled, skips the host Windows version check in dmverity-vhd while hashing Windows images.

--tarPath to either a tarball containing image layers or a JSON file containing paths to tarballs of image layers

--template-file, -aInput ARM Template file

--validate-sidecar, -vValidate that the image used to generate the CCE Policy for a sidecar container will be allowed by its generated policy

--virtual-node-yamlInput YAML file for Virtual Node policy generation

--with-containersContainer definitions to include in the policy