opensource/podman
1
0
Fork 0
mirror of https://github.com/containers/podman.git synced 2025-10-17 11:14:40 +08:00
Code Issues Packages Projects Releases Wiki Activity

rootless: don't bind mount /sys/fs/cgroup/systemd in systemd mode

Browse Source 
it is not writeable by non-root users so there is no point in having
access to it from a container.

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
This commit is contained in:
Giuseppe Scrivano
2018-11-05 20:02:50 +01:00
parent 9150d69087
commit 11c5b0237b
1 changed files with 15 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
libpod/container_internal_linux.go
View File

@ -360,6 +360,9 @@ func (c *Container) setupSystemd(mounts []spec.Mount, g generate.Generator) erro
g.AddMount(tmpfsMnt)
}
// rootless containers have no write access to /sys/fs/cgroup, so don't
// add any mount into the container.
if !rootless.IsRootless() {
cgroupPath, err := c.CGroupPath()
if err != nil {
return err
@ -373,6 +376,7 @@ func (c *Container) setupSystemd(mounts []spec.Mount, g generate.Generator) erro
Options: []string{"bind", "private"},
}
g.AddMount(systemdMnt)
}
return nil
}