diff options
| author | Giuseppe Scrivano <gscrivan@redhat.com> | 2022-06-14 10:49:14 +0200 |
|---|---|---|
| committer | Giuseppe Scrivano <gscrivan@redhat.com> | 2022-06-14 10:49:19 +0200 |
| commit | fcfcd4cdb1b19fe00f6769f33e6704a7f8700d40 (patch) | |
| tree | cf5252f77a52bcd9662e322d69c72a33afdb84e9 /libpod | |
| parent | 576c739e5ff01c760b383a258c62ed3ca7e1c30c (diff) | |
| download | podman-fcfcd4cdb1b19fe00f6769f33e6704a7f8700d40.tar.gz podman-fcfcd4cdb1b19fe00f6769f33e6704a7f8700d40.tar.bz2 podman-fcfcd4cdb1b19fe00f6769f33e6704a7f8700d40.zip | |
container: do not create .containerenv with -v SRC:/run
if /run is on a volume do not create the file /run/.containerenv as it
would leak outside of the container.
Closes: https://github.com/containers/podman/issues/14577
Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
Diffstat (limited to 'libpod')
| -rw-r--r-- | libpod/container_internal_linux.go | 13 |
1 files changed, 12 insertions, 1 deletions
diff --git a/libpod/container_internal_linux.go b/libpod/container_internal_linux.go index 41c0ac595..eafe3d75e 100644 --- a/libpod/container_internal_linux.go +++ b/libpod/container_internal_linux.go @@ -2249,8 +2249,19 @@ func (c *Container) makeBindMounts() error { } } + _, hasRunContainerenv := c.state.BindMounts["/run/.containerenv"] + if !hasRunContainerenv { + // check in the spec mounts + for _, m := range c.config.Spec.Mounts { + if m.Destination == "/run/.containerenv" || m.Destination == "/run" { + hasRunContainerenv = true + break + } + } + } + // Make .containerenv if it does not exist - if _, ok := c.state.BindMounts["/run/.containerenv"]; !ok { + if !hasRunContainerenv { containerenv := c.runtime.graphRootMountedFlag(c.config.Spec.Mounts) isRootless := 0 if rootless.IsRootless() { |