only enable cgroup namespaces if supported by the kernel
package spec
-import "github.com/opencontainers/runtime-spec/specs-go"
+import (
+ "os"
+
+ "github.com/opencontainers/runtime-spec/specs-go"
+)
var (
PrivilegedContainerNamespaces = []specs.LinuxNamespace{
@@ -13,10 +17,13 @@ var (
UnprivilegedContainerNamespaces = append(PrivilegedContainerNamespaces,
specs.LinuxNamespace{Type: specs.UserNamespace},
- specs.LinuxNamespace{Type: specs.CgroupNamespace},
)
)
+func init() {
+ cgroupNamespacesEnabled()
+}
+
func OciNamespaces(privileged bool) []specs.LinuxNamespace {
if !privileged {
return UnprivilegedContainerNamespaces
@@ -24,3 +31,12 @@ func OciNamespaces(privileged bool) []specs.LinuxNamespace {
return PrivilegedContainerNamespaces
}
+
+func cgroupNamespacesEnabled() {
+ if _, err := os.Stat("/proc/self/ns/cgroup"); os.IsNotExist(err) {
+ return
+ }
+
+ UnprivilegedContainerNamespaces = append(UnprivilegedContainerNamespaces,
+ specs.LinuxNamespace{Type: specs.CgroupNamespace})
+}
