opensource/podman
1
0
Fork 0
mirror of https://github.com/containers/podman.git synced 2025-06-19 16:33:24 +08:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #1761 from giuseppe/rootless-systemd

Browse Source 
rootless: don't bind mount /sys/fs/cgroup/systemd in systemd mode
This commit is contained in:
OpenShift Merge Robot
2018-11-07 08:58:33 -08:00
committed by GitHub
parent 90662c2fa3 f813881b81
commit 1e4e33b41f
1 changed files with 23 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

34
libpod/container_internal_linux.go
View File

@ -360,19 +360,31 @@ func (c *Container) setupSystemd(mounts []spec.Mount, g generate.Generator) erro
g.AddMount(tmpfsMnt)
}
cgroupPath, err := c.CGroupPath()
if err != nil {
return err
}
sourcePath := filepath.Join("/sys/fs/cgroup/systemd", cgroupPath)
// rootless containers have no write access to /sys/fs/cgroup, so don't
// add any mount into the container.
if !rootless.IsRootless() {
cgroupPath, err := c.CGroupPath()
if err != nil {
return err
}
sourcePath := filepath.Join("/sys/fs/cgroup/systemd", cgroupPath)
systemdMnt := spec.Mount{
Destination: "/sys/fs/cgroup/systemd",
Type: "bind",
Source: sourcePath,
Options: []string{"bind", "private"},
systemdMnt := spec.Mount{
Destination: "/sys/fs/cgroup/systemd",
Type: "bind",
Source: sourcePath,
Options: []string{"bind", "private"},
}
g.AddMount(systemdMnt)
} else {
systemdMnt := spec.Mount{
Destination: "/sys/fs/cgroup/systemd",
Type: "bind",
Source: "/sys/fs/cgroup/systemd",
Options: []string{"bind", "nodev", "noexec", "nosuid"},
}
g.AddMount(systemdMnt)
}
g.AddMount(systemdMnt)
return nil
}