3 files changed, 52 insertions, 13 deletions
diff --git a/pkg/spec/config_unsupported.go b/pkg/spec/config_unsupported.go
index c2a58696d..160414878 100644
--- a/pkg/spec/config_unsupported.go
+++ b/pkg/spec/config_unsupported.go
@@ -26,3 +26,7 @@ func (c *CreateConfig) createBlockIO() (*spec.LinuxBlockIO, error) {
 func makeThrottleArray(throttleInput []string, rateType int) ([]spec.LinuxThrottleDevice, error) {
 	return nil, errors.New("function not implemented")
 }
+
+func devicesFromPath(g *generate.Generator, devicePath string) error {
+	return errors.New("function not implemented")
+}
diff --git a/pkg/spec/createconfig.go b/pkg/spec/createconfig.go
index 25f8cd7a1..344f4afb9 100644
--- a/pkg/spec/createconfig.go
+++ b/pkg/spec/createconfig.go
@@ -2,6 +2,7 @@ package createconfig
 
 import (
 	"encoding/json"
+	"fmt"
 	"net"
 	"os"
 	"strconv"
@@ -145,6 +146,36 @@ func (c *CreateConfig) CreateBlockIO() (*spec.LinuxBlockIO, error) {
 	return c.createBlockIO()
 }
 
+// AddContainerInitBinary adds the init binary specified by path iff the
+// container will run in a private PID namespace that is not shared with the
+// host or another pre-existing container, where an init-like process is
+// already running.
+//
+// Note that AddContainerInitBinary prepends "/dev/init" "--" to the command
+// to execute the bind-mounted binary as PID 1.
+func (c *CreateConfig) AddContainerInitBinary(path string) error {
+	if path == "" {
+		return fmt.Errorf("please specify a path to the container-init binary")
+	}
+	if !c.PidMode.IsPrivate() {
+		return fmt.Errorf("cannot add init binary as PID 1 (PID namespace isn't private)")
+	}
+	if c.Systemd {
+		return fmt.Errorf("cannot use container-init binary with systemd")
+	}
+	if _, err := os.Stat(path); os.IsNotExist(err) {
+		return errors.Wrap(err, "container-init binary not found on the host")
+	}
+	c.Command = append([]string{"/dev/init", "--"}, c.Command...)
+	c.Mounts = append(c.Mounts, spec.Mount{
+		Destination: "/dev/init",
+		Type:        "bind",
+		Source:      path,
+		Options:     []string{"bind", "ro"},
+	})
+	return nil
+}
+
 func processOptions(options []string) []string {
 	var (
 		foundrw, foundro bool
@@ -310,10 +341,9 @@ func (c *CreateConfig) createExitCommand() []string {
 }
 
 // GetContainerCreateOptions takes a CreateConfig and returns a slice of CtrCreateOptions
-func (c *CreateConfig) GetContainerCreateOptions(runtime *libpod.Runtime) ([]libpod.CtrCreateOption, error) {
+func (c *CreateConfig) GetContainerCreateOptions(runtime *libpod.Runtime, pod *libpod.Pod) ([]libpod.CtrCreateOption, error) {
 	var options []libpod.CtrCreateOption
 	var portBindings []ocicni.PortMapping
-	var pod *libpod.Pod
 	var err error
 
 	if c.Interactive {
@@ -327,12 +357,14 @@ func (c *CreateConfig) GetContainerCreateOptions(runtime *libpod.Runtime) ([]lib
 		logrus.Debugf("appending name %s", c.Name)
 		options = append(options, libpod.WithName(c.Name))
 	}
-	if c.Pod != "" {
-		logrus.Debugf("adding container to pod %s", c.Pod)
-		pod, err = runtime.LookupPod(c.Pod)
-		if err != nil {
-			return nil, errors.Wrapf(err, "unable to add container to pod %s", c.Pod)
+	if c.Pod != "" || pod != nil {
+		if pod == nil {
+			pod, err = runtime.LookupPod(c.Pod)
+			if err != nil {
+				return nil, errors.Wrapf(err, "unable to add container to pod %s", c.Pod)
+			}
 		}
+		logrus.Debugf("adding container to pod %s", c.Pod)
 		options = append(options, runtime.WithPod(pod))
 	}
 	if len(c.PortBindings) > 0 {
@@ -390,11 +422,7 @@ func (c *CreateConfig) GetContainerCreateOptions(runtime *libpod.Runtime) ([]lib
 		}
 		options = append(options, libpod.WithNetNSFrom(connectedCtr))
 	} else if !c.NetMode.IsHost() && !c.NetMode.IsNone() {
-		isRootless := rootless.IsRootless()
 		postConfigureNetNS := c.NetMode.IsSlirp4netns() || (len(c.IDMappings.UIDMap) > 0 || len(c.IDMappings.GIDMap) > 0) && !c.UsernsMode.IsHost()
-		if isRootless && len(portBindings) > 0 {
-			return nil, errors.New("port bindings are not yet supported by rootless containers")
-		}
 		options = append(options, libpod.WithNetNS(portBindings, postConfigureNetNS, string(c.NetMode), networks))
 	}
 
@@ -487,7 +515,9 @@ func (c *CreateConfig) GetContainerCreateOptions(runtime *libpod.Runtime) ([]lib
 	if c.CgroupParent != "" {
 		options = append(options, libpod.WithCgroupParent(c.CgroupParent))
 	}
-	if c.Detach {
+	// For a rootless container always cleanup the storage/network as they
+	// run in a different namespace thus not reusable when we restart.
+	if c.Detach || rootless.IsRootless() {
 		options = append(options, libpod.WithExitCommand(c.createExitCommand()))
 	}
 
diff --git a/pkg/spec/spec.go b/pkg/spec/spec.go
index 3d6603364..46105af4a 100644
--- a/pkg/spec/spec.go
+++ b/pkg/spec/spec.go
@@ -6,8 +6,8 @@ import (
 	"strings"
 
 	"github.com/containers/libpod/pkg/rootless"
+	"github.com/containers/storage/pkg/mount"
 	"github.com/docker/docker/daemon/caps"
-	"github.com/docker/docker/pkg/mount"
 	"github.com/docker/go-units"
 	spec "github.com/opencontainers/runtime-spec/specs-go"
 	"github.com/opencontainers/runtime-tools/generate"
@@ -252,6 +252,7 @@ func CreateConfigToOCISpec(config *CreateConfig) (*spec.Spec, error) { //nolint
 	}
 	// SECURITY OPTS
 	g.SetProcessNoNewPrivileges(config.NoNewPrivs)
+
 	g.SetProcessApparmorProfile(config.ApparmorProfile)
 
 	blockAccessToKernelFilesystems(config, &g)
@@ -375,6 +376,10 @@ func CreateConfigToOCISpec(config *CreateConfig) (*spec.Spec, error) { //nolint
 }
 
 func blockAccessToKernelFilesystems(config *CreateConfig, g *generate.Generator) {
+	if config.PidMode.IsHost() && rootless.IsRootless() {
+		return
+	}
+
 	if !config.Privileged {
 		for _, mp := range []string{
 			"/proc/acpi",