server: mount cgroup with rslave
even when running as privileged container, prevent cgroup mounts to be
propagated to the host as it could cause errors when running with
rshared and systemd inside of the container.
Closes:
@@ -470,13 +470,13 @@ func (s *Server) createSandboxContainer(ctx context.Context, ctr ctrIface.Contai
Destination: "/sys",
Type: "sysfs",
Source: "sysfs",
- Options: []string{"nosuid", "noexec", "nodev", "rw"},
+ Options: []string{"nosuid", "noexec", "nodev", "rw", "rslave"},
})
ctr.SpecAddMount(rspec.Mount{
Destination: "/sys/fs/cgroup",
Type: "cgroup",
Source: "cgroup",
- Options: []string{"nosuid", "noexec", "nodev", "rw", "relatime"},
+ Options: []string{"nosuid", "noexec", "nodev", "rw", "relatime", "rslave"},
})
}
