diff options
| author | Anders F Björklund <anders.f.bjorklund@gmail.com> | 2020-12-29 18:02:21 +0100 |
|---|---|---|
| committer | Anders F Björklund <anders.f.bjorklund@gmail.com> | 2020-12-29 18:03:49 +0100 |
| commit | 25b7198441a0ea4c38b6a2b65d22ddfbe0cb4851 (patch) | |
| tree | 01a8264dd98d506427e85f5d008f6173884497ff /libpod/networking_linux.go | |
| parent | 9c9f02aad773051fa742a874844f08f2fb567d3b (diff) | |
| download | podman-25b7198441a0ea4c38b6a2b65d22ddfbe0cb4851.tar.gz podman-25b7198441a0ea4c38b6a2b65d22ddfbe0cb4851.tar.bz2 podman-25b7198441a0ea4c38b6a2b65d22ddfbe0cb4851.zip | |
The slirp4netns sandbox requires pivot_root
Disable the sandbox, when running on rootfs
Signed-off-by: Anders F Björklund <anders.f.bjorklund@gmail.com>
Diffstat (limited to 'libpod/networking_linux.go')
| -rw-r--r-- | libpod/networking_linux.go | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/libpod/networking_linux.go b/libpod/networking_linux.go index 863e82efd..be6867399 100644 --- a/libpod/networking_linux.go +++ b/libpod/networking_linux.go @@ -247,6 +247,7 @@ func (r *Runtime) setupRootlessNetNS(ctr *Container) error { func (r *Runtime) setupSlirp4netns(ctr *Container) error { path := r.config.Engine.NetworkCmdPath slirpOptions := r.config.Engine.NetworkCmdOptions + noPivotRoot := r.config.Engine.NoPivotRoot if path == "" { var err error path, err = exec.LookPath("slirp4netns") @@ -351,7 +352,7 @@ func (r *Runtime) setupSlirp4netns(ctr *Container) error { if slirpFeatures.HasMTU { cmdArgs = append(cmdArgs, "--mtu", "65520") } - if slirpFeatures.HasEnableSandbox { + if !noPivotRoot && slirpFeatures.HasEnableSandbox { cmdArgs = append(cmdArgs, "--enable-sandbox") } if slirpFeatures.HasEnableSeccomp { @@ -424,7 +425,7 @@ func (r *Runtime) setupSlirp4netns(ctr *Container) error { } // workaround for https://github.com/rootless-containers/slirp4netns/pull/153 - if slirpFeatures.HasEnableSandbox { + if !noPivotRoot && slirpFeatures.HasEnableSandbox { cmd.SysProcAttr.Cloneflags = syscall.CLONE_NEWNS cmd.SysProcAttr.Unshareflags = syscall.CLONE_NEWNS } |