Skip to content
This repository has been archived by the owner on Feb 24, 2020. It is now read-only.

stage1/prepare-app: don't mount /sys/fs/cgroup in stage2 #2681

Merged
merged 3 commits into from May 24, 2016
Merged

stage1/prepare-app: don't mount /sys/fs/cgroup in stage2 #2681

merged 3 commits into from May 24, 2016

Commits on May 24, 2016

  1. Revert "Revert "stage1/prepare-app: avoid recursive bind-mounts on /s… 

    …ys""

This reverts commit 3256dae.
    @iaguis
    iaguis committed May 24, 2016
    Configuration menu
    Copy the full SHA
    7825ddb View commit details
    Browse the repository at this point in the history

  2. Revert "Revert "stage1/prepare-app: check for user namespace env"" 

    This reverts commit b5bf7a0.
    @iaguis
    iaguis committed May 24, 2016
    Configuration menu
    Copy the full SHA
    d18fe50 View commit details
    Browse the repository at this point in the history

  3. stage1/prepare-app: don't mount /sys/fs/cgroup in stage2 

    The previous two patches make rkt not do a recursive bind-mount on /sys
unless we use user namespaces (the kernel doesn't allow that). However,
SELinux doesn't allow mounting `/sys/fs/cgroup` manually in that case.

Since the spec doesn't say apps should have a view of /sys/fs/cgroup,
let's not mount it in stage2.
    @iaguis
    iaguis committed May 24, 2016
    Configuration menu
    Copy the full SHA
    2954a58 View commit details
    Browse the repository at this point in the history