diff options
| author | Giuseppe Scrivano <gscrivan@redhat.com> | 2019-07-08 13:11:18 +0200 |
|---|---|---|
| committer | Giuseppe Scrivano <gscrivan@redhat.com> | 2019-07-18 10:32:25 +0200 |
| commit | 0b57e77d7c1c54706611c9ca15e352425adb05e5 (patch) | |
| tree | 6ae9a85fd1f16fb410ccfbd4ea88d5c6ef79004c /test | |
| parent | 7488ed6d9a619d86333dc1880d4df034fbb371b9 (diff) | |
| download | podman-0b57e77d7c1c54706611c9ca15e352425adb05e5.tar.gz podman-0b57e77d7c1c54706611c9ca15e352425adb05e5.tar.bz2 podman-0b57e77d7c1c54706611c9ca15e352425adb05e5.zip | |
libpod: support for cgroup namespace
allow a container to run in a new cgroup namespace.
When running in a new cgroup namespace, the current cgroup appears to
be the root, so that there is no way for the container to access
cgroups outside of its own subtree.
By default it uses --cgroup=host to keep the previous behavior.
To create a new namespace, --cgroup=private must be provided.
Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
Diffstat (limited to 'test')
| -rw-r--r-- | test/e2e/run_ns_test.go | 9 |
1 files changed, 9 insertions, 0 deletions
diff --git a/test/e2e/run_ns_test.go b/test/e2e/run_ns_test.go index 6ba0d1aba..e3e86fc66 100644 --- a/test/e2e/run_ns_test.go +++ b/test/e2e/run_ns_test.go @@ -51,6 +51,15 @@ var _ = Describe("Podman run ns", func() { Expect(session.ExitCode()).To(Not(Equal(0))) }) + It("podman run --cgroup private test", func() { + session := podmanTest.Podman([]string{"run", "--cgroupns=private", fedoraMinimal, "cat", "/proc/self/cgroup"}) + session.WaitWithDefaultTimeout() + Expect(session.ExitCode()).To(Equal(0)) + + output := session.OutputToString() + Expect(output).ToNot(ContainSubstring("slice")) + }) + It("podman run ipcns test", func() { setup := SystemExec("ls", []string{"--inode", "-d", "/dev/shm"}) Expect(setup.ExitCode()).To(Equal(0)) |