summaryrefslogtreecommitdiff
path: root/libpod
diff options
context:
space:
mode:
authorGiuseppe Scrivano <gscrivan@redhat.com>2018-08-29 11:41:13 +0200
committerAtomic Bot <atomic-devel@projectatomic.io>2018-09-04 14:36:57 +0000
commit4d129742143a93290288555eaf7cc894e0d808f6 (patch)
treeb63577aecac7802571dd10c4fff005d72b29ecc9 /libpod
parent14c0f9d63c1f9ab6b4f09a827a061dfeb7f4eb79 (diff)
downloadpodman-4d129742143a93290288555eaf7cc894e0d808f6.tar.gz
podman-4d129742143a93290288555eaf7cc894e0d808f6.tar.bz2
podman-4d129742143a93290288555eaf7cc894e0d808f6.zip
rootless: create compatible pod infra container
Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com> Closes: #1372 Approved by: mheon
Diffstat (limited to 'libpod')
-rw-r--r--libpod/runtime_pod_infra_linux.go16
1 files changed, 15 insertions, 1 deletions
diff --git a/libpod/runtime_pod_infra_linux.go b/libpod/runtime_pod_infra_linux.go
index 39bd8d07a..fea79e994 100644
--- a/libpod/runtime_pod_infra_linux.go
+++ b/libpod/runtime_pod_infra_linux.go
@@ -8,6 +8,7 @@ import (
"github.com/containers/libpod/libpod/image"
"github.com/containers/libpod/pkg/rootless"
"github.com/cri-o/ocicni/pkg/ocicni"
+ spec "github.com/opencontainers/runtime-spec/specs-go"
"github.com/opencontainers/runtime-tools/generate"
)
@@ -25,9 +26,22 @@ func (r *Runtime) makeInfraContainer(ctx context.Context, p *Pod, imgName, imgID
return nil, err
}
+ isRootless := rootless.IsRootless()
+
g.SetRootReadonly(true)
g.SetProcessArgs([]string{r.config.InfraCommand})
+ if isRootless {
+ g.RemoveMount("/dev/pts")
+ devPts := spec.Mount{
+ Destination: "/dev/pts",
+ Type: "devpts",
+ Source: "devpts",
+ Options: []string{"private", "nosuid", "noexec", "newinstance", "ptmxmode=0666", "mode=0620"},
+ }
+ g.AddMount(devPts)
+ }
+
containerName := p.ID()[:IDTruncLength] + "-infra"
var options []CtrCreateOption
options = append(options, r.WithPod(p))
@@ -38,7 +52,7 @@ func (r *Runtime) makeInfraContainer(ctx context.Context, p *Pod, imgName, imgID
// Since user namespace sharing is not implemented, we only need to check if it's rootless
portMappings := make([]ocicni.PortMapping, 0)
networks := make([]string, 0)
- options = append(options, WithNetNS(portMappings, rootless.IsRootless(), networks))
+ options = append(options, WithNetNS(portMappings, isRootless, networks))
return r.newContainer(ctx, g.Config, options...)
}