linux: fix systemd with --cgroupns=private
When --cgroupns=private is used we need to mount a new cgroup file
system so that it points to the correct namespace.
Needs:
@@ -491,13 +491,30 @@ func (c *Container) setupSystemd(mounts []spec.Mount, g generate.Generator) erro
if unified {
g.RemoveMount("/sys/fs/cgroup")
- sourcePath := filepath.Join("/sys/fs/cgroup")
- systemdMnt := spec.Mount{
+ hasCgroupNs := false
+ for _, ns := range c.config.Spec.Linux.Namespaces {
+ if ns.Type == spec.CgroupNamespace {
+ hasCgroupNs = true
+ break
+ }
+ }
+
+ var systemdMnt spec.Mount
+ if hasCgroupNs {
+ systemdMnt = spec.Mount{
+ Destination: "/sys/fs/cgroup",
+ Type: "cgroup",
+ Source: "cgroup",
+ Options: []string{"private", "rw"},
+ }
+ } else {
+ systemdMnt = spec.Mount{
Destination: "/sys/fs/cgroup",
Type: "bind",
- Source: sourcePath,
+ Source: "/sys/fs/cgroup",
Options: []string{"bind", "private", "rw"},
}
+ }
g.AddMount(systemdMnt)
} else {
systemdMnt := spec.Mount{
