fix panic when Linux is nil for rootless case
congfig.Sysctl setting is duplicated.
when contianer is rootless and Linux is nil, runc will panic.
@@ -236,7 +236,6 @@ func CreateLibcontainerConfig(opts *CreateOpts) (*configs.Config, error) {
if spec.Process.SelinuxLabel != "" {
config.ProcessLabel = spec.Process.SelinuxLabel
}
- config.Sysctl = spec.Linux.Sysctl
if spec.Process != nil && spec.Process.OOMScoreAdj != nil {
config.OomScoreAdj = *spec.Process.OOMScoreAdj
}
@@ -321,10 +320,8 @@ func createCgroupConfig(opts *CreateOpts) (*configs.Cgroup, error) {
// the user didn't specify.
if !opts.Rootless {
c.Resources.AllowedDevices = allowedDevices
- if spec.Linux == nil {
- return c, nil
- }
}
+ if spec.Linux != nil {
r := spec.Linux.Resources
if r == nil {
return c, nil
@@ -360,10 +357,6 @@ func createCgroupConfig(opts *CreateOpts) (*configs.Cgroup, error) {
}
c.Resources.Devices = append(c.Resources.Devices, dd)
}
- if !opts.Rootless {
- // append the default allowed devices to the end of the list
- c.Resources.Devices = append(c.Resources.Devices, allowedDevices...)
- }
if r.Memory != nil {
if r.Memory.Limit != nil {
c.Resources.Memory = *r.Memory.Limit
@@ -479,6 +472,11 @@ func createCgroupConfig(opts *CreateOpts) (*configs.Cgroup, error) {
})
}
}
+ }
+ if !opts.Rootless {
+ // append the default allowed devices to the end of the list
+ c.Resources.Devices = append(c.Resources.Devices, allowedDevices...)
+ }
return c, nil
}
