opensource/podman
1
0
Fork 0
mirror of https://github.com/containers/podman.git synced 2025-10-25 10:16:43 +08:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #23384 from edsantiago/root-namespace

Browse Source 
CI: enable root user namespaces
This commit is contained in:
openshift-merge-bot[bot]
2024-08-01 10:32:16 +00:00
committed by GitHub
parent 5d10f77da5 7bb3b83c17
commit 803ef5c16f
6 changed files with 31 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
libpod/container_internal.go
View File

@ -2374,7 +2374,7 @@ func (c *Container) setupOCIHooks(ctx context.Context, config *spec.Spec) (map[s
// the container's mountpoint directly from the storage.
// Otherwise, it returns an intermediate mountpoint that is accessible to anyone.
func (c *Container) getRootPathForOCI() (string, error) {
if hasCurrentUserMapped(c) {
if hasCurrentUserMapped(c) || c.config.RootfsMapping != nil {
return c.state.Mountpoint, nil
}
return c.getIntermediateMountpointUser()

2
libpod/oci_conmon_common.go
View File

@ -183,7 +183,7 @@ func hasCurrentUserMapped(ctr *Container) bool {
// CreateContainer creates a container.
func (r *ConmonOCIRuntime) CreateContainer(ctr *Container, restoreOptions *ContainerCheckpointOptions) (int64, error) {
if !hasCurrentUserMapped(ctr) {
if !hasCurrentUserMapped(ctr) || ctr.config.RootfsMapping != nil {
// if we are running a non privileged container, be sure to umount some kernel paths so they are not
// bind mounted inside the container at all.
hideFiles := !ctr.config.Privileged && !rootless.IsRootless()