summaryrefslogtreecommitdiff
path: root/pkg
diff options
context:
space:
mode:
Diffstat (limited to 'pkg')
-rw-r--r--pkg/spec/spec.go16
1 files changed, 13 insertions, 3 deletions
diff --git a/pkg/spec/spec.go b/pkg/spec/spec.go
index dec3a05ef..7323b2d2b 100644
--- a/pkg/spec/spec.go
+++ b/pkg/spec/spec.go
@@ -25,7 +25,13 @@ func CreateConfigToOCISpec(config *CreateConfig) (*spec.Spec, error) { //nolint
}
g.HostSpecific = true
addCgroup := true
- if config.Privileged {
+ canMountSys := true
+
+ if !config.UsernsMode.IsHost() && config.NetMode.IsHost() {
+ canMountSys = false
+ }
+
+ if config.Privileged && canMountSys {
cgroupPerm = "rw"
g.RemoveMount("/sys")
sysMnt := spec.Mount{
@@ -35,14 +41,18 @@ func CreateConfigToOCISpec(config *CreateConfig) (*spec.Spec, error) { //nolint
Options: []string{"nosuid", "noexec", "nodev", "rw"},
}
g.AddMount(sysMnt)
- } else if !config.UsernsMode.IsHost() && config.NetMode.IsHost() {
+ } else if !canMountSys {
addCgroup = false
g.RemoveMount("/sys")
+ r := "ro"
+ if config.Privileged {
+ r = "rw"
+ }
sysMnt := spec.Mount{
Destination: "/sys",
Type: "bind",
Source: "/sys",
- Options: []string{"nosuid", "noexec", "nodev", "ro", "rbind"},
+ Options: []string{"nosuid", "noexec", "nodev", r, "rbind"},
}
g.AddMount(sysMnt)
}