opensource/podman
1
0
Fork 0
mirror of https://github.com/containers/podman.git synced 2025-06-21 01:19:15 +08:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #1761 from giuseppe/rootless-systemd

Browse Source 
rootless: don't bind mount /sys/fs/cgroup/systemd in systemd mode
This commit is contained in:
OpenShift Merge Robot
2018-11-07 08:58:33 -08:00
committed by GitHub
parent 90662c2fa3 f813881b81
commit 1e4e33b41f
1 changed files with 23 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
libpod/container_internal_linux.go
View File

@ -360,6 +360,9 @@ func (c *Container) setupSystemd(mounts []spec.Mount, g generate.Generator) erro
g.AddMount(tmpfsMnt) g.AddMount(tmpfsMnt)
} }
// rootless containers have no write access to /sys/fs/cgroup, so don't
// add any mount into the container.
if !rootless.IsRootless() {
cgroupPath, err := c.CGroupPath() cgroupPath, err := c.CGroupPath()
if err != nil { if err != nil {
return err return err
@ -373,6 +376,15 @@ func (c *Container) setupSystemd(mounts []spec.Mount, g generate.Generator) erro
Options: []string{"bind", "private"}, Options: []string{"bind", "private"},
} }
g.AddMount(systemdMnt) g.AddMount(systemdMnt)
} else {
systemdMnt := spec.Mount{
Destination: "/sys/fs/cgroup/systemd",
Type: "bind",
Source: "/sys/fs/cgroup/systemd",
Options: []string{"bind", "nodev", "noexec", "nosuid"},
}
g.AddMount(systemdMnt)
}
return nil return nil
} }