Add rprivate parameters to kubelet mounts. Fixed
Such as Docker 1.13, bind mounts propagation doesn't default to `rprivate` which cause problems when kubelet unmount cgroup.
@@ -215,13 +215,13 @@ func (c *Cluster) BuildKubeletProcess(host *hosts.Host) v3.Process {
"/opt/cni:/opt/cni:ro,z",
"/var/lib/cni:/var/lib/cni:z",
"/etc/resolv.conf:/etc/resolv.conf",
- "/sys:/sys",
+ "/sys:/sys:rprivate",
host.DockerInfo.DockerRootDir + ":" + host.DockerInfo.DockerRootDir + ":rw,z",
"/var/lib/kubelet:/var/lib/kubelet:shared,z",
- "/var/run:/var/run:rw",
- "/run:/run",
+ "/var/run:/var/run:rw,rprivate",
+ "/run:/run:rprivate",
"/etc/ceph:/etc/ceph",
- "/dev:/host/dev",
+ "/dev:/host/dev,rprivate",
"/var/log/containers:/var/log/containers:z",
"/var/log/pods:/var/log/pods:z",
}
