spec: bind mount /sys only for rootless containers
root can always mount a new instance.
Closes:
Approved by: rhatdan
@@ -35,7 +35,7 @@ func CreateConfigToOCISpec(config *CreateConfig) (*spec.Spec, error) { //nolint
Options: []string{"nosuid", "noexec", "nodev", "rw"},
}
g.AddMount(sysMnt)
- } else if !config.UsernsMode.IsHost() && config.NetMode.IsHost() {
+ } else if rootless.IsRootless() && !config.UsernsMode.IsHost() && config.NetMode.IsHost() {
addCgroup = false
g.RemoveMount("/sys")
sysMnt := spec.Mount{
