opensource/podman
1
0
Fork 0
mirror of https://github.com/containers/podman.git synced 2025-10-20 20:54:45 +08:00
Code Issues Packages Projects Releases Wiki Activity

rootless: don't bind mount /sys/fs/cgroup/systemd in systemd mode

Browse Source 
it is not writeable by non-root users so there is no point in having
access to it from a container.

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
This commit is contained in:
Giuseppe Scrivano
2018-11-05 20:02:50 +01:00
parent 9150d69087
commit 11c5b0237b
1 changed files with 15 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

26
libpod/container_internal_linux.go
View File

@ -360,19 +360,23 @@ func (c *Container) setupSystemd(mounts []spec.Mount, g generate.Generator) erro
g.AddMount(tmpfsMnt) g.AddMount(tmpfsMnt)
} }
cgroupPath, err := c.CGroupPath() // rootless containers have no write access to /sys/fs/cgroup, so don't
if err != nil { // add any mount into the container.
return err if !rootless.IsRootless() {
} cgroupPath, err := c.CGroupPath()
sourcePath := filepath.Join("/sys/fs/cgroup/systemd", cgroupPath) if err != nil {
return err
}
sourcePath := filepath.Join("/sys/fs/cgroup/systemd", cgroupPath)
systemdMnt := spec.Mount{ systemdMnt := spec.Mount{
Destination: "/sys/fs/cgroup/systemd", Destination: "/sys/fs/cgroup/systemd",
Type: "bind", Type: "bind",
Source: sourcePath, Source: sourcePath,
Options: []string{"bind", "private"}, Options: []string{"bind", "private"},
}
g.AddMount(systemdMnt)
} }
g.AddMount(systemdMnt)
return nil return nil
} }