diff options
| author | OpenShift Merge Robot <openshift-merge-robot@users.noreply.github.com> | 2019-02-11 17:22:25 +0100 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2019-02-11 17:22:25 +0100 |
| commit | 112a5ab20cd6a07bcfcccadd0c0b851927a16f05 (patch) | |
| tree | ea57fba0de037c4c9f3e284221a9215b38cc3deb /libpod/kube.go | |
| parent | 8440b0734cac68ddd13c0c9c7bd5d07394da38fd (diff) | |
| parent | 440dd8c2ed5127d657e06e10b48b9ee8d423a799 (diff) | |
| download | podman-112a5ab20cd6a07bcfcccadd0c0b851927a16f05.tar.gz podman-112a5ab20cd6a07bcfcccadd0c0b851927a16f05.tar.bz2 podman-112a5ab20cd6a07bcfcccadd0c0b851927a16f05.zip | |
Merge pull request #2310 from baude/issue2304
lock and sync container before checking mountpoint
Diffstat (limited to 'libpod/kube.go')
| -rw-r--r-- | libpod/kube.go | 10 |
1 files changed, 8 insertions, 2 deletions
diff --git a/libpod/kube.go b/libpod/kube.go index f34805e39..16cebf99b 100644 --- a/libpod/kube.go +++ b/libpod/kube.go @@ -401,7 +401,7 @@ func capAddDrop(caps *specs.LinuxCapabilities) (*v1.Capabilities, error) { func generateKubeSecurityContext(c *Container) (*v1.SecurityContext, error) { priv := c.Privileged() ro := c.IsReadOnly() - allowPrivEscalation := !c.Spec().Process.NoNewPrivileges + allowPrivEscalation := !c.config.Spec.Process.NoNewPrivileges newCaps, err := capAddDrop(c.config.Spec.Process.Capabilities) if err != nil { @@ -421,7 +421,13 @@ func generateKubeSecurityContext(c *Container) (*v1.SecurityContext, error) { } if c.User() != "" { - // It is *possible* that + if !c.batched { + c.lock.Lock() + defer c.lock.Unlock() + } + if err := c.syncContainer(); err != nil { + return nil, errors.Wrapf(err, "unable to sync container during YAML generation") + } logrus.Debugf("Looking in container for user: %s", c.User()) u, err := lookup.GetUser(c.state.Mountpoint, c.User()) if err != nil { |