summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorOpenShift Merge Robot <openshift-merge-robot@users.noreply.github.com>2019-08-01 11:35:20 +0200
committerGitHub <noreply@github.com>2019-08-01 11:35:20 +0200
commit5056964d09c5de31e10bb226acdb9cb24dce84e9 (patch)
tree50d3b24fb426dbf3b52f1113b1f0d4dfa263086f
parent3215ea694da7ee965aad046b3c64b6bfa1a82b68 (diff)
parent223fe64dc0a592fd44e0c9fde9f9e0ca087d566f (diff)
downloadpodman-5056964d09c5de31e10bb226acdb9cb24dce84e9.tar.gz
podman-5056964d09c5de31e10bb226acdb9cb24dce84e9.tar.bz2
podman-5056964d09c5de31e10bb226acdb9cb24dce84e9.zip
Merge pull request #3677 from giuseppe/systemd-cgroupsv2
systemd, cgroupsv2: not bind mount /sys/fs/cgroup/systemd
-rw-r--r--libpod/container_internal_linux.go50
1 files changed, 34 insertions, 16 deletions
diff --git a/libpod/container_internal_linux.go b/libpod/container_internal_linux.go
index 72b0d3a74..6dbd53fbf 100644
--- a/libpod/container_internal_linux.go
+++ b/libpod/container_internal_linux.go
@@ -466,30 +466,48 @@ func (c *Container) setupSystemd(mounts []spec.Mount, g generate.Generator) erro
g.AddMount(tmpfsMnt)
}
- // rootless containers have no write access to /sys/fs/cgroup, so don't
- // add any mount into the container.
- if !rootless.IsRootless() {
- cgroupPath, err := c.CGroupPath()
- if err != nil {
- return err
- }
- sourcePath := filepath.Join("/sys/fs/cgroup/systemd", cgroupPath)
+ unified, err := cgroups.IsCgroup2UnifiedMode()
+ if err != nil {
+ return err
+ }
+
+ g.RemoveMount("/sys/fs/cgroup")
+ if unified {
+ sourcePath := filepath.Join("/sys/fs/cgroup")
systemdMnt := spec.Mount{
- Destination: "/sys/fs/cgroup/systemd",
+ Destination: "/sys/fs/cgroup",
Type: "bind",
Source: sourcePath,
- Options: []string{"bind", "private"},
+ Options: []string{"bind", "private", "rw"},
}
g.AddMount(systemdMnt)
} else {
- systemdMnt := spec.Mount{
- Destination: "/sys/fs/cgroup/systemd",
- Type: "bind",
- Source: "/sys/fs/cgroup/systemd",
- Options: []string{"bind", "nodev", "noexec", "nosuid"},
+ // rootless containers have no write access to /sys/fs/cgroup, so don't
+ // add any mount into the container.
+ if !rootless.IsRootless() {
+ cgroupPath, err := c.CGroupPath()
+ if err != nil {
+ return err
+ }
+ sourcePath := filepath.Join("/sys/fs/cgroup", cgroupPath)
+
+ systemdMnt := spec.Mount{
+ Destination: "/sys/fs/cgroup",
+ Type: "bind",
+ Source: sourcePath,
+ Options: []string{"bind", "private"},
+ }
+ g.AddMount(systemdMnt)
+ } else {
+ systemdMnt := spec.Mount{
+ Destination: "/sys/fs/cgroup",
+ Type: "bind",
+ Source: "/sys/fs/cgroup",
+ Options: []string{"bind", "nodev", "noexec", "nosuid"},
+ }
+ g.AddMount(systemdMnt)
}
- g.AddMount(systemdMnt)
}
return nil