summaryrefslogtreecommitdiff
path: root/libpod
diff options
context:
space:
mode:
authorOpenShift Merge Robot <openshift-merge-robot@users.noreply.github.com>2019-02-11 17:22:25 +0100
committerGitHub <noreply@github.com>2019-02-11 17:22:25 +0100
commit112a5ab20cd6a07bcfcccadd0c0b851927a16f05 (patch)
treeea57fba0de037c4c9f3e284221a9215b38cc3deb /libpod
parent8440b0734cac68ddd13c0c9c7bd5d07394da38fd (diff)
parent440dd8c2ed5127d657e06e10b48b9ee8d423a799 (diff)
downloadpodman-112a5ab20cd6a07bcfcccadd0c0b851927a16f05.tar.gz
podman-112a5ab20cd6a07bcfcccadd0c0b851927a16f05.tar.bz2
podman-112a5ab20cd6a07bcfcccadd0c0b851927a16f05.zip
Merge pull request #2310 from baude/issue2304
lock and sync container before checking mountpoint
Diffstat (limited to 'libpod')
-rw-r--r--libpod/kube.go10
1 files changed, 8 insertions, 2 deletions
diff --git a/libpod/kube.go b/libpod/kube.go
index f34805e39..16cebf99b 100644
--- a/libpod/kube.go
+++ b/libpod/kube.go
@@ -401,7 +401,7 @@ func capAddDrop(caps *specs.LinuxCapabilities) (*v1.Capabilities, error) {
func generateKubeSecurityContext(c *Container) (*v1.SecurityContext, error) {
priv := c.Privileged()
ro := c.IsReadOnly()
- allowPrivEscalation := !c.Spec().Process.NoNewPrivileges
+ allowPrivEscalation := !c.config.Spec.Process.NoNewPrivileges
newCaps, err := capAddDrop(c.config.Spec.Process.Capabilities)
if err != nil {
@@ -421,7 +421,13 @@ func generateKubeSecurityContext(c *Container) (*v1.SecurityContext, error) {
}
if c.User() != "" {
- // It is *possible* that
+ if !c.batched {
+ c.lock.Lock()
+ defer c.lock.Unlock()
+ }
+ if err := c.syncContainer(); err != nil {
+ return nil, errors.Wrapf(err, "unable to sync container during YAML generation")
+ }
logrus.Debugf("Looking in container for user: %s", c.User())
u, err := lookup.GetUser(c.state.Mountpoint, c.User())
if err != nil {