libpod: Use platform-specific mount type for volume mounts

[NO NEW TESTS NEEDED]

Signed-off-by: Doug Rabson <dfr@rabson.org>
This commit is contained in:
Doug Rabson
2022-08-27 13:49:43 +01:00
parent c1a86a8c4c
commit 0889215d83
3 changed files with 12 additions and 3 deletions

View File

@ -18,6 +18,7 @@ import (
butil "github.com/containers/buildah/util"
"github.com/containers/common/pkg/apparmor"
cutil "github.com/containers/common/pkg/util"
"github.com/containers/podman/v4/libpod/define"
"github.com/containers/podman/v4/pkg/annotations"
"github.com/containers/podman/v4/pkg/lookup"
"github.com/containers/podman/v4/pkg/rootless"
@ -174,7 +175,7 @@ func (c *Container) generateSpec(ctx context.Context) (*spec.Spec, error) {
g.AddMount(overlayMount)
} else {
volMount := spec.Mount{
Type: "bind",
Type: define.TypeBind,
Source: mountPoint,
Destination: namedVol.Dest,
Options: namedVol.Options,
@ -220,10 +221,10 @@ func (c *Container) generateSpec(ctx context.Context) (*spec.Spec, error) {
// Add bind mounts to container
for dstPath, srcPath := range c.state.BindMounts {
newMount := spec.Mount{
Type: "bind",
Type: define.TypeBind,
Source: srcPath,
Destination: dstPath,
Options: []string{"bind", "rprivate"},
Options: bindOptions,
}
if c.IsReadOnly() && dstPath != "/dev/shm" {
newMount.Options = append(newMount.Options, "ro", "nosuid", "noexec", "nodev")

View File

@ -51,6 +51,10 @@ import (
"golang.org/x/sys/unix"
)
var (
bindOptions = []string{}
)
// Network stubs to decouple container_internal_freebsd.go from
// networking_freebsd.go so they can be reviewed separately.
func (r *Runtime) createNetNS(ctr *Container) (netJail string, q map[string]types.StatusBlock, retErr error) {

View File

@ -56,6 +56,10 @@ import (
"golang.org/x/sys/unix"
)
var (
bindOptions = []string{"bind", "rprivate"}
)
func (c *Container) mountSHM(shmOptions string) error {
if err := unix.Mount("shm", c.config.ShmDir, "tmpfs", unix.MS_NOEXEC|unix.MS_NOSUID|unix.MS_NODEV,
label.FormatMountLabel(shmOptions, c.config.MountLabel)); err != nil {