From 8156f8c69473f8a7f970ca4f1b4a5f01a99d368a Mon Sep 17 00:00:00 2001 From: Giuseppe Scrivano Date: Fri, 18 Jan 2019 17:12:23 +0100 Subject: rootless: fix --pid=host without --privileged When using --pid=host don't try to cover /proc paths, as they are coming from the /proc bind mounted from the host. Signed-off-by: Giuseppe Scrivano --- pkg/spec/spec.go | 4 ++++ test/e2e/rootless_test.go | 4 ++++ 2 files changed, 8 insertions(+) diff --git a/pkg/spec/spec.go b/pkg/spec/spec.go index 9ef0223f2..46105af4a 100644 --- a/pkg/spec/spec.go +++ b/pkg/spec/spec.go @@ -376,6 +376,10 @@ func CreateConfigToOCISpec(config *CreateConfig) (*spec.Spec, error) { //nolint } func blockAccessToKernelFilesystems(config *CreateConfig, g *generate.Generator) { + if config.PidMode.IsHost() && rootless.IsRootless() { + return + } + if !config.Privileged { for _, mp := range []string{ "/proc/acpi", diff --git a/test/e2e/rootless_test.go b/test/e2e/rootless_test.go index daf8b8c32..2b84d34c9 100644 --- a/test/e2e/rootless_test.go +++ b/test/e2e/rootless_test.go @@ -276,6 +276,10 @@ var _ = Describe("Podman rootless", func() { runRootlessHelper([]string{"--net", "host"}) }) + It("podman rootless rootfs --pid host", func() { + runRootlessHelper([]string{"--pid", "host"}) + }) + It("podman rootless rootfs --privileged", func() { runRootlessHelper([]string{"--privileged"}) }) -- cgit v1.2.3-54-g00ecf