From 20862c9746e9f0c4ec37e9d9e914f02a82acfb60 Mon Sep 17 00:00:00 2001 From: Giuseppe Scrivano Date: Tue, 12 Jun 2018 18:47:27 +0200 Subject: rootless: do not configure additional groups Additional groups are not allowed in an userNS. Signed-off-by: Giuseppe Scrivano Closes: #936 Approved by: rhatdan --- libpod/container_internal.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'libpod') diff --git a/libpod/container_internal.go b/libpod/container_internal.go index 3d94fa871..9d5335780 100644 --- a/libpod/container_internal.go +++ b/libpod/container_internal.go @@ -1286,7 +1286,7 @@ func (c *Container) generateSpec(ctx context.Context) (*spec.Spec, error) { } // Look up and add groups the user belongs to, if a group wasn't directly specified - if !strings.Contains(c.config.User, ":") { + if !rootless.IsRootless() && !strings.Contains(c.config.User, ":") { groups, err := chrootuser.GetAdditionalGroupsForUser(c.state.Mountpoint, uint64(g.Spec().Process.User.UID)) if err != nil && errors.Cause(err) != chrootuser.ErrNoSuchUser { return nil, err -- cgit v1.2.3-54-g00ecf