mirror of
https://github.com/containers/podman.git
synced 2025-06-21 01:19:15 +08:00
Merge pull request #1761 from giuseppe/rootless-systemd
rootless: don't bind mount /sys/fs/cgroup/systemd in systemd mode
This commit is contained in:
@ -360,6 +360,9 @@ func (c *Container) setupSystemd(mounts []spec.Mount, g generate.Generator) erro
|
|||||||
g.AddMount(tmpfsMnt)
|
g.AddMount(tmpfsMnt)
|
||||||
}
|
}
|
||||||
|
|
||||||
|
// rootless containers have no write access to /sys/fs/cgroup, so don't
|
||||||
|
// add any mount into the container.
|
||||||
|
if !rootless.IsRootless() {
|
||||||
cgroupPath, err := c.CGroupPath()
|
cgroupPath, err := c.CGroupPath()
|
||||||
if err != nil {
|
if err != nil {
|
||||||
return err
|
return err
|
||||||
@ -373,6 +376,15 @@ func (c *Container) setupSystemd(mounts []spec.Mount, g generate.Generator) erro
|
|||||||
Options: []string{"bind", "private"},
|
Options: []string{"bind", "private"},
|
||||||
}
|
}
|
||||||
g.AddMount(systemdMnt)
|
g.AddMount(systemdMnt)
|
||||||
|
} else {
|
||||||
|
systemdMnt := spec.Mount{
|
||||||
|
Destination: "/sys/fs/cgroup/systemd",
|
||||||
|
Type: "bind",
|
||||||
|
Source: "/sys/fs/cgroup/systemd",
|
||||||
|
Options: []string{"bind", "nodev", "noexec", "nosuid"},
|
||||||
|
}
|
||||||
|
g.AddMount(systemdMnt)
|
||||||
|
}
|
||||||
|
|
||||||
return nil
|
return nil
|
||||||
}
|
}
|
||||||
|
Reference in New Issue
Block a user