This repository was archived by the owner on Oct 13, 2023. It is now read-only.
[18.03] backport daemon/setMounts(): do not make /dev/shm ro#459
Merged
andrewhsu merged 2 commits intodocker-archive:18.03from Mar 14, 2018
Merged
[18.03] backport daemon/setMounts(): do not make /dev/shm ro#459andrewhsu merged 2 commits intodocker-archive:18.03from
andrewhsu merged 2 commits intodocker-archive:18.03from
Conversation
It has been pointed out that if --read-only flag is given, /dev/shm also becomes read-only in case of --ipc private. This happens because in this case the mount comes from OCI spec (since commit 7120976), and is a regression caused by that commit. The meaning of --read-only flag is to only have a "main" container filesystem read-only, not the auxiliary stuff (that includes /dev/shm, other mounts and volumes, --tmpfs, /proc, /dev and so on). So, let's make sure /dev/shm that comes from OCI spec is not made read-only. Fixes: 7120976 ("Implement none, private, and shareable ipc modes") Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com> (cherry picked from commit cad7405) Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The test case checks that in case of IpcMode: private and ReadonlyRootfs: true (as in "docker run --ipc private --read-only") the resulting /dev/shm mount is NOT made read-only. Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com> (cherry picked from commit 33dd562) Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Member
Author
|
ping @kolyshkin @justincormack PTAL |
Contributor
|
LGTM |
silvin-lubecki
pushed a commit
to silvin-lubecki/docker-ce
that referenced
this pull request
Jan 31, 2020
…pc-ro [18.03] backport daemon/setMounts(): do not make /dev/shm ro
docker-jenkins
pushed a commit
that referenced
this pull request
Apr 28, 2020
[master] Add rhel for s390x Upstream-commit: f969b64 Component: packaging
akrasnov-drv
pushed a commit
to drivenets/docker-ce
that referenced
this pull request
Apr 23, 2023
…390x [master] Add rhel for s390x
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Backport of moby/moby#36526 for 18.03 (fixes moby/moby#36503)
no conflicts