From fcfcd4cdb1b19fe00f6769f33e6704a7f8700d40 Mon Sep 17 00:00:00 2001
From: Giuseppe Scrivano <gscrivan@redhat.com>
Date: Tue, 14 Jun 2022 10:49:14 +0200
Subject: container: do not create .containerenv with -v SRC:/run
if /run is on a volume do not create the file /run/.containerenv as it
would leak outside of the container.
Closes: https://github.com/containers/podman/issues/14577
Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
---
libpod/container_internal_linux.go | 13 ++++++++++++-
1 file changed, 12 insertions(+), 1 deletion(-)
(limited to 'libpod')
diff --git a/libpod/container_internal_linux.go b/libpod/container_internal_linux.go
index 41c0ac595..eafe3d75e 100644
--- a/libpod/container_internal_linux.go
+++ b/libpod/container_internal_linux.go
@@ -2249,8 +2249,19 @@ func (c *Container) makeBindMounts() error {
}
}
+ _, hasRunContainerenv := c.state.BindMounts["/run/.containerenv"]
+ if !hasRunContainerenv {
+ // check in the spec mounts
+ for _, m := range c.config.Spec.Mounts {
+ if m.Destination == "/run/.containerenv" || m.Destination == "/run" {
+ hasRunContainerenv = true
+ break
+ }
+ }
+ }
+
// Make .containerenv if it does not exist
- if _, ok := c.state.BindMounts["/run/.containerenv"]; !ok {
+ if !hasRunContainerenv {
containerenv := c.runtime.graphRootMountedFlag(c.config.Spec.Mounts)
isRootless := 0
if rootless.IsRootless() {
--
cgit v1.2.3-54-g00ecf