Merge pull request #1761 from giuseppe/rootless-systemd

rootless: don't bind mount /sys/fs/cgroup/systemd in systemd mode
This commit is contained in:
OpenShift Merge Robot
2018-11-07 08:58:33 -08:00
committed by GitHub

View File

@ -360,6 +360,9 @@ func (c *Container) setupSystemd(mounts []spec.Mount, g generate.Generator) erro
g.AddMount(tmpfsMnt) g.AddMount(tmpfsMnt)
} }
// rootless containers have no write access to /sys/fs/cgroup, so don't
// add any mount into the container.
if !rootless.IsRootless() {
cgroupPath, err := c.CGroupPath() cgroupPath, err := c.CGroupPath()
if err != nil { if err != nil {
return err return err
@ -373,6 +376,15 @@ func (c *Container) setupSystemd(mounts []spec.Mount, g generate.Generator) erro
Options: []string{"bind", "private"}, Options: []string{"bind", "private"},
} }
g.AddMount(systemdMnt) g.AddMount(systemdMnt)
} else {
systemdMnt := spec.Mount{
Destination: "/sys/fs/cgroup/systemd",
Type: "bind",
Source: "/sys/fs/cgroup/systemd",
Options: []string{"bind", "nodev", "noexec", "nosuid"},
}
g.AddMount(systemdMnt)
}
return nil return nil
} }