container/podman
container/podman
1
0
Fork 0
mirror of https://github.com/containers/podman synced 2024-10-20 17:23:30 +00:00
Code Issues Packages Projects Releases Wiki Activity

spec: bind mount /sys only for rootless containers

Browse source 
root can always mount a new instance.

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>

Closes: #1279
Approved by: rhatdan
This commit is contained in:
Giuseppe Scrivano 2018-08-15 17:08:27 +02:00 committed by Atomic Bot
parent 883aea51a3
commit 0ddb42b4f7
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
pkg/spec/spec.go
View file

@ -35,7 +35,7 @@ func CreateConfigToOCISpec(config *CreateConfig) (*spec.Spec, error) { //nolint
Options: []string{"nosuid", "noexec", "nodev", "rw"},
}
g.AddMount(sysMnt)
} else if !config.UsernsMode.IsHost() && config.NetMode.IsHost() {
} else if rootless.IsRootless() && !config.UsernsMode.IsHost() && config.NetMode.IsHost() {
addCgroup = false
g.RemoveMount("/sys")
sysMnt := spec.Mount{