Add nodev to options of bind mounts from kube
Need to do this in the runtime as k8s doesn't allow
arbitrary mount options to be passed in for bind mounts.
Fixes vulnerability issue.
@@ -986,7 +986,7 @@ func addOCIBindMounts(mountLabel string, containerConfig *pb.ContainerConfig, sp
if mount.Readonly {
options = []string{"ro"}
}
- options = append(options, "rbind")
+ options = append(options, "rbind", "nodev")
// mount propagation
mountInfos, err := dockermounts.GetMounts(nil)
