summaryrefslogtreecommitdiff
path: root/cmd
diff options
context:
space:
mode:
authorGiuseppe Scrivano <gscrivan@redhat.com>2018-04-20 18:59:19 +0200
committerAtomic Bot <atomic-devel@projectatomic.io>2018-05-04 17:15:55 +0000
commit73078fabcfd2420c47e41843da71dd993f9a0a3e (patch)
tree1c98d8ae433c5f148c7af5184777d2348b5b2540 /cmd
parentb51d7379987581da82902027fe91cdf298047bc0 (diff)
downloadpodman-73078fabcfd2420c47e41843da71dd993f9a0a3e.tar.gz
podman-73078fabcfd2420c47e41843da71dd993f9a0a3e.tar.bz2
podman-73078fabcfd2420c47e41843da71dd993f9a0a3e.zip
networking, userNS: configure the network namespace after create
so that the OCI runtime creates the network namespace from the correct userNS. Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com> Signed-off-by: Daniel J Walsh <dwalsh@redhat.com> Closes: #690 Approved by: mheon
Diffstat (limited to 'cmd')
-rw-r--r--cmd/podman/spec.go31
1 files changed, 23 insertions, 8 deletions
diff --git a/cmd/podman/spec.go b/cmd/podman/spec.go
index 15dab6c4d..747d76359 100644
--- a/cmd/podman/spec.go
+++ b/cmd/podman/spec.go
@@ -167,6 +167,7 @@ func createConfigToOCISpec(config *createConfig) (*spec.Spec, error) {
cgroupPerm := "ro"
g := generate.New()
g.HostSpecific = true
+ addCgroup := true
if config.Privileged {
cgroupPerm = "rw"
g.RemoveMount("/sys")
@@ -177,14 +178,27 @@ func createConfigToOCISpec(config *createConfig) (*spec.Spec, error) {
Options: []string{"nosuid", "noexec", "nodev", "rw"},
}
g.AddMount(sysMnt)
+ } else if !config.UsernsMode.IsHost() && config.NetMode.IsHost() {
+ addCgroup = false
+ g.RemoveMount("/sys")
+ sysMnt := spec.Mount{
+ Destination: "/sys",
+ Type: "bind",
+ Source: "/sys",
+ Options: []string{"nosuid", "noexec", "nodev", "ro", "rbind"},
+ }
+ g.AddMount(sysMnt)
}
- cgroupMnt := spec.Mount{
- Destination: "/sys/fs/cgroup",
- Type: "cgroup",
- Source: "cgroup",
- Options: []string{"nosuid", "noexec", "nodev", "relatime", cgroupPerm},
+
+ if addCgroup {
+ cgroupMnt := spec.Mount{
+ Destination: "/sys/fs/cgroup",
+ Type: "cgroup",
+ Source: "cgroup",
+ Options: []string{"nosuid", "noexec", "nodev", "relatime", cgroupPerm},
+ }
+ g.AddMount(cgroupMnt)
}
- g.AddMount(cgroupMnt)
g.SetProcessCwd(config.WorkDir)
g.SetProcessArgs(config.Command)
g.SetProcessTerminal(config.Tty)
@@ -697,8 +711,9 @@ func (c *createConfig) GetContainerCreateOptions() ([]libpod.CtrCreateOption, er
}
options = append(options, libpod.WithNetNSFrom(connectedCtr))
} else if !c.NetMode.IsHost() && !c.NetMode.IsNone() {
- options = append(options, libpod.WithNetNS([]ocicni.PortMapping{}))
- options = append(options, libpod.WithNetNS(portBindings))
+ postConfigureNetNS := (len(c.IDMappings.UIDMap) > 0 || len(c.IDMappings.GIDMap) > 0) && !c.UsernsMode.IsHost()
+ options = append(options, libpod.WithNetNS([]ocicni.PortMapping{}, postConfigureNetNS))
+ options = append(options, libpod.WithNetNS(portBindings, postConfigureNetNS))
}
if c.PidMode.IsContainer() {