oci: do not set resources in rootless mode
Closes:
Approved by: mheon
@@ -82,6 +82,9 @@ func CreateConfigToOCISpec(config *CreateConfig) (*spec.Spec, error) { //nolint
}
g.AddProcessEnv("container", "podman")
+ canAddResources := os.Getuid() == 0
+
+ if canAddResources {
// RESOURCES - MEMORY
if config.Resources.Memory != 0 {
g.SetLinuxResourcesMemoryLimit(config.Resources.Memory)
@@ -148,6 +151,8 @@ func CreateConfigToOCISpec(config *CreateConfig) (*spec.Spec, error) { //nolint
}
}
}
+ }
+
for _, uidmap := range config.IDMappings.UIDMap {
g.AddLinuxUIDMapping(uint32(uidmap.HostID), uint32(uidmap.ContainerID), uint32(uidmap.Size))
@@ -160,12 +165,15 @@ func CreateConfigToOCISpec(config *CreateConfig) (*spec.Spec, error) { //nolint
g.SetProcessApparmorProfile(config.ApparmorProfile)
g.SetProcessSelinuxLabel(config.ProcessLabel)
g.SetLinuxMountLabel(config.MountLabel)
+
+ if canAddResources {
blockAccessToKernelFilesystems(config, &g)
// RESOURCES - PIDS
if config.Resources.PidsLimit != 0 {
g.SetLinuxResourcesPidsLimit(config.Resources.PidsLimit)
}
+ }
for _, i := range config.Tmpfs {
// Default options if nothing passed
@@ -268,6 +276,7 @@ func CreateConfigToOCISpec(config *CreateConfig) (*spec.Spec, error) { //nolint
}
}
+ if canAddResources {
// BLOCK IO
blkio, err := config.CreateBlockIO()
if err != nil {
@@ -276,6 +285,7 @@ func CreateConfigToOCISpec(config *CreateConfig) (*spec.Spec, error) { //nolint
if blkio != nil {
configSpec.Linux.Resources.BlockIO = blkio
}
+ }
/*
//Annotations
@@ -300,6 +310,11 @@ func CreateConfigToOCISpec(config *CreateConfig) (*spec.Spec, error) { //nolint
},
}
*/
+
+ // If we cannot add resources be sure everything is cleared out
+ if !canAddResources {
+ configSpec.Linux.Resources = &spec.LinuxResources{}
+ }
return configSpec, nil
}
