From b101a8d3664f054157a9e3f08a6bf8db0144041c Mon Sep 17 00:00:00 2001 From: Giuseppe Scrivano Date: Sun, 1 Sep 2019 00:30:55 +0200 Subject: spec: do not set devices cgroup when rootless eBPF requires to be root in the init namespace. Signed-off-by: Giuseppe Scrivano --- pkg/spec/config_linux.go | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) (limited to 'pkg') diff --git a/pkg/spec/config_linux.go b/pkg/spec/config_linux.go index dea9b393c..9636d7a11 100644 --- a/pkg/spec/config_linux.go +++ b/pkg/spec/config_linux.go @@ -173,15 +173,16 @@ func (c *CreateConfig) addPrivilegedDevices(g *generate.Generator) error { newMounts = append(newMounts, devMnt) } g.Config.Mounts = append(newMounts, g.Config.Mounts...) + g.Config.Linux.Resources.Devices = nil } else { for _, d := range hostDevices { g.AddDevice(Device(d)) } + // Add resources device - need to clear the existing one first. + g.Config.Linux.Resources.Devices = nil + g.AddLinuxResourcesDevice(true, "", nil, nil, "rwm") } - // Add resources device - need to clear the existing one first. - g.Config.Linux.Resources.Devices = nil - g.AddLinuxResourcesDevice(true, "", nil, nil, "rwm") return nil } -- cgit v1.2.3-54-g00ecf