Move WillRunSystemd call after iterating the mounts
@@ -546,14 +546,6 @@ func (s *Server) createSandboxContainer(ctx context.Context, ctr ctrfactory.Cont
return nil, err
}
- if ctr.WillRunSystemd() {
- processLabel, err = selinux.InitLabel(processLabel)
- if err != nil {
- return nil, err
- }
- setupSystemd(specgen.Mounts(), *specgen)
- }
-
// When running on cgroupv2, automatically add a cgroup namespace for not privileged containers.
if !ctr.Privileged() && node.CgroupIsV2() {
if err := specgen.AddOrReplaceLinuxNamespace(string(rspec.CgroupNamespace), ""); err != nil {
@@ -741,6 +733,14 @@ func (s *Server) createSandboxContainer(ctx context.Context, ctr ctrfactory.Cont
ctr.SpecAddMount(rspecMount)
}
+ if ctr.WillRunSystemd() {
+ processLabel, err = selinux.InitLabel(processLabel)
+ if err != nil {
+ return nil, err
+ }
+ setupSystemd(specgen.Mounts(), *specgen)
+ }
+
if s.ContainerServer.Hooks != nil {
newAnnotations := map[string]string{}
for key, value := range containerConfig.Annotations {
@@ -1084,7 +1084,7 @@ func setupSystemd(mounts []rspec.Mount, g generate.Generator) {
// If the /sys/fs/cgroup is bind mounted from the host,
// then systemd-mode cgroup should be disabled
// https://bugzilla.redhat.com/show_bug.cgi?id=2064741
- if NoCgroupMount(g.Mounts()) {
+ if !hasCgroupMount(g.Mounts()) {
systemdMnt := rspec.Mount{
Destination: cgroupSysFsSystemdPath,
Type: "bind",
@@ -1098,13 +1098,13 @@ func setupSystemd(mounts []rspec.Mount, g generate.Generator) {
g.AddProcessEnv("container", "crio")
}
-func NoCgroupMount(mounts []rspec.Mount) bool {
+func hasCgroupMount(mounts []rspec.Mount) bool {
for _, m := range mounts {
if (m.Destination == cgroupSysFsPath || m.Destination == "/sys/fs" || m.Destination == "/sys") && isBindMount(m.Options) {
- return false
+ return true
}
}
- return true
+ return false
}
func isBindMount(mountOptions []string) bool {
