summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorMatthew Heon <matthew.heon@gmail.com>2018-09-13 15:00:58 -0400
committerAtomic Bot <atomic-devel@projectatomic.io>2018-09-13 21:35:44 +0000
commite2137cd009376af0f66855221bd2605bd3297104 (patch)
treed34f45bd306d65c6cfec122a17797fd711564375
parentf0a3a4329ecaaadd60331641712d5e9b35e1120f (diff)
downloadpodman-e2137cd009376af0f66855221bd2605bd3297104.tar.gz
podman-e2137cd009376af0f66855221bd2605bd3297104.tar.bz2
podman-e2137cd009376af0f66855221bd2605bd3297104.zip
Swap default mount propagation from private to rprivate
This matches Docker behavior more closely and should resolve an issue we were seeing with /sys mounts Signed-off-by: Matthew Heon <matthew.heon@gmail.com> Closes: #1465 Approved by: rhatdan
-rw-r--r--pkg/secrets/secrets.go4
-rw-r--r--pkg/spec/createconfig.go6
-rw-r--r--pkg/spec/spec.go12
-rw-r--r--pkg/spec/spec_test.go2
4 files changed, 12 insertions, 12 deletions
diff --git a/pkg/secrets/secrets.go b/pkg/secrets/secrets.go
index be5642eba..7208f53b7 100644
--- a/pkg/secrets/secrets.go
+++ b/pkg/secrets/secrets.go
@@ -243,7 +243,7 @@ func addSecretsFromMountsFile(filePath, mountLabel, containerWorkingDir, mountPr
Source: filepath.Join(mountPrefix, ctrDir),
Destination: ctrDir,
Type: "bind",
- Options: []string{"bind", "private"},
+ Options: []string{"bind", "rprivate"},
}
mounts = append(mounts, m)
@@ -278,7 +278,7 @@ func addFIPSModeSecret(mounts *[]rspec.Mount, containerWorkingDir string) error
Source: ctrDirOnHost,
Destination: secretsDir,
Type: "bind",
- Options: []string{"bind", "private"},
+ Options: []string{"bind", "rprivate"},
}
*mounts = append(*mounts, m)
}
diff --git a/pkg/spec/createconfig.go b/pkg/spec/createconfig.go
index 3cca345b4..a441b4019 100644
--- a/pkg/spec/createconfig.go
+++ b/pkg/spec/createconfig.go
@@ -189,7 +189,7 @@ func (c *CreateConfig) GetVolumeMounts(specMounts []spec.Mount) ([]spec.Mount, e
}
}
if rootProp == "" {
- options = append(options, "private")
+ options = append(options, "rprivate")
}
m = append(m, spec.Mount{
@@ -214,7 +214,7 @@ func (c *CreateConfig) GetVolumeMounts(specMounts []spec.Mount) ([]spec.Mount, e
Destination: vol,
Type: string(TypeTmpfs),
Source: string(TypeTmpfs),
- Options: []string{"private", "rw", "noexec", "nosuid", "nodev", "tmpcopyup"},
+ Options: []string{"rprivate", "rw", "noexec", "nosuid", "nodev", "tmpcopyup"},
}
m = append(m, mount)
}
@@ -272,7 +272,7 @@ func (c *CreateConfig) GetTmpfsMounts() []spec.Mount {
var m []spec.Mount
for _, i := range c.Tmpfs {
// Default options if nothing passed
- options := []string{"private", "rw", "noexec", "nosuid", "nodev", "size=65536k"}
+ options := []string{"rprivate", "rw", "noexec", "nosuid", "nodev", "size=65536k"}
spliti := strings.Split(i, ":")
destPath := spliti[0]
if len(spliti) > 1 {
diff --git a/pkg/spec/spec.go b/pkg/spec/spec.go
index 77dbf8b42..cc3501e1e 100644
--- a/pkg/spec/spec.go
+++ b/pkg/spec/spec.go
@@ -43,7 +43,7 @@ func CreateConfigToOCISpec(config *CreateConfig) (*spec.Spec, error) { //nolint
Destination: "/sys",
Type: "sysfs",
Source: "sysfs",
- Options: []string{"private", "nosuid", "noexec", "nodev", "rw"},
+ Options: []string{"rprivate", "nosuid", "noexec", "nodev", "rw"},
}
g.AddMount(sysMnt)
} else if !canMountSys {
@@ -57,7 +57,7 @@ func CreateConfigToOCISpec(config *CreateConfig) (*spec.Spec, error) { //nolint
Destination: "/sys",
Type: "bind",
Source: "/sys",
- Options: []string{"nosuid", "noexec", "nodev", r, "rbind"},
+ Options: []string{"rprivate", "nosuid", "noexec", "nodev", r, "rbind"},
}
g.AddMount(sysMnt)
}
@@ -67,7 +67,7 @@ func CreateConfigToOCISpec(config *CreateConfig) (*spec.Spec, error) { //nolint
Destination: "/dev/pts",
Type: "devpts",
Source: "devpts",
- Options: []string{"private", "nosuid", "noexec", "newinstance", "ptmxmode=0666", "mode=0620"},
+ Options: []string{"rprivate", "nosuid", "noexec", "newinstance", "ptmxmode=0666", "mode=0620"},
}
g.AddMount(devPts)
}
@@ -97,7 +97,7 @@ func CreateConfigToOCISpec(config *CreateConfig) (*spec.Spec, error) { //nolint
Destination: "/sys/fs/cgroup",
Type: "cgroup",
Source: "cgroup",
- Options: []string{"private", "nosuid", "noexec", "nodev", "relatime", cgroupPerm},
+ Options: []string{"rprivate", "nosuid", "noexec", "nodev", "relatime", cgroupPerm},
}
g.AddMount(cgroupMnt)
}
@@ -231,7 +231,7 @@ func CreateConfigToOCISpec(config *CreateConfig) (*spec.Spec, error) { //nolint
}
for _, i := range config.Tmpfs {
// Default options if nothing passed
- options := []string{"rw", "private", "noexec", "nosuid", "nodev", "size=65536k"}
+ options := []string{"rw", "rprivate", "noexec", "nosuid", "nodev", "size=65536k"}
spliti := strings.SplitN(i, ":", 2)
if len(spliti) > 1 {
if _, _, err := mount.ParseTmpfsOptions(spliti[1]); err != nil {
@@ -385,7 +385,7 @@ func setupSystemd(config *CreateConfig, g *generate.Generator) error {
if err != nil {
return err
}
- options := []string{"rw", "private", "noexec", "nosuid", "nodev"}
+ options := []string{"rw", "rprivate", "noexec", "nosuid", "nodev"}
for _, dest := range []string{"/run", "/run/lock", "/sys/fs/cgroup/systemd"} {
if libpod.MountExists(mounts, dest) {
continue
diff --git a/pkg/spec/spec_test.go b/pkg/spec/spec_test.go
index de3605068..c037bf69e 100644
--- a/pkg/spec/spec_test.go
+++ b/pkg/spec/spec_test.go
@@ -13,7 +13,7 @@ func TestCreateConfig_GetVolumeMounts(t *testing.T) {
Destination: "/foobar",
Type: "bind",
Source: "foobar",
- Options: []string{"ro", "rbind", "private"},
+ Options: []string{"ro", "rbind", "rprivate"},
}
config := CreateConfig{
Volumes: []string{"foobar:/foobar:ro"},