replicate old flags and Mount behavior
which includes:
setting /sys to sysfs type and mount
move handling of privileged out of hostnetwork case (we should always mount /sys rw if we have priv, even if we have a HostNetwork)
@@ -615,9 +615,9 @@ func (s *Server) createSandboxContainer(ctx context.Context, containerID, contai
specgen.RemoveMount("/sys/fs/cgroup")
sysMnt := rspec.Mount{
Destination: "/sys",
- Type: "bind",
- Source: "/sys",
- Options: []string{"nosuid", "noexec", "nodev", "ro", "rbind"},
+ Type: "sysfs",
+ Source: "sysfs",
+ Options: []string{"nosuid", "noexec", "nodev", "ro"},
}
specgen.AddMount(sysMnt)
}
@@ -632,6 +632,7 @@ func (s *Server) createSandboxContainer(ctx context.Context, containerID, contai
if err := specgen.AddOrReplaceLinuxNamespace(string(rspec.NetworkNamespace), netNsPath); err != nil {
return nil, err
}
+ }
if privileged {
specgen.RemoveMount("/sys")
@@ -639,9 +640,9 @@ func (s *Server) createSandboxContainer(ctx context.Context, containerID, contai
sysMnt := rspec.Mount{
Destination: "/sys",
- Type: "bind",
- Source: "/sys",
- Options: []string{"nosuid", "noexec", "nodev", "rw", "rbind"},
+ Type: "sysfs",
+ Source: "sysfs",
+ Options: []string{"nosuid", "noexec", "nodev", "rw"},
}
specgen.AddMount(sysMnt)
@@ -653,7 +654,6 @@ func (s *Server) createSandboxContainer(ctx context.Context, containerID, contai
}
specgen.AddMount(cgroupMnt)
}
- }
for idx, ip := range sb.IPs() {
specgen.AddAnnotation(fmt.Sprintf("%s.%d", annotations.IP, idx), ip)
