summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorOpenShift Merge Robot <openshift-merge-robot@users.noreply.github.com>2020-10-02 07:53:37 -0400
committerGitHub <noreply@github.com>2020-10-02 07:53:37 -0400
commit08755e59b60df8e183a70cdbe90d7424a2fb91f4 (patch)
treefe9c360d6ed17e216612457ec592e3a93077fd33
parentff3aa2b3d1b9765e0f09ed15dcf160065b54c889 (diff)
parent4f7da3274baed18c3eaf0a1329501d528e224436 (diff)
downloadpodman-08755e59b60df8e183a70cdbe90d7424a2fb91f4.tar.gz
podman-08755e59b60df8e183a70cdbe90d7424a2fb91f4.tar.bz2
podman-08755e59b60df8e183a70cdbe90d7424a2fb91f4.zip
Merge pull request #7456 from giuseppe/modprobe-fuse
spec: modprobe fuse with --device .*/fuse
-rw-r--r--docs/source/markdown/podman-create.1.md4
-rw-r--r--docs/source/markdown/podman-run.1.md4
-rw-r--r--pkg/specgen/generate/config_linux.go7
3 files changed, 15 insertions, 0 deletions
diff --git a/docs/source/markdown/podman-create.1.md b/docs/source/markdown/podman-create.1.md
index 4a8b311f0..28c340d2f 100644
--- a/docs/source/markdown/podman-create.1.md
+++ b/docs/source/markdown/podman-create.1.md
@@ -215,6 +215,10 @@ Note: if the user only has access rights via a group, accessing the device
from inside a rootless container will fail. The **crun**(1) runtime offers a
workaround for this by adding the option **--annotation run.oci.keep_original_groups=1**.
+Podman may load kernel modules required for using the specified
+device. The devices that podman will load modules when necessary are:
+/dev/fuse.
+
**--device-cgroup-rule**="type major:minor mode"
Add a rule to the cgroup allowed devices list. The rule is expected to be in the format specified in the Linux kernel documentation (Documentation/cgroup-v1/devices.txt):
diff --git a/docs/source/markdown/podman-run.1.md b/docs/source/markdown/podman-run.1.md
index 47aa8827f..a27b1b175 100644
--- a/docs/source/markdown/podman-run.1.md
+++ b/docs/source/markdown/podman-run.1.md
@@ -231,6 +231,10 @@ Note: if the user only has access rights via a group, accessing the device
from inside a rootless container will fail. The **crun**(1) runtime offers a
workaround for this by adding the option **--annotation run.oci.keep_original_groups=1**.
+Podman may load kernel modules required for using the specified
+device. The devices that podman will load modules when necessary are:
+/dev/fuse.
+
**--device-cgroup-rule**=rule
Add a rule to the cgroup allowed devices list
diff --git a/pkg/specgen/generate/config_linux.go b/pkg/specgen/generate/config_linux.go
index 1d5dcd8e7..fac02ad01 100644
--- a/pkg/specgen/generate/config_linux.go
+++ b/pkg/specgen/generate/config_linux.go
@@ -248,6 +248,13 @@ func addDevice(g *generate.Generator, device string) error {
}
g.Config.Mounts = append(g.Config.Mounts, devMnt)
return nil
+ } else if src == "/dev/fuse" {
+ // if the user is asking for fuse inside the container
+ // make sure the module is loaded.
+ f, err := unix.Open(src, unix.O_RDONLY|unix.O_NONBLOCK, 0)
+ if err == nil {
+ unix.Close(f)
+ }
}
dev.Path = dst
g.AddDevice(*dev)