kotovalexarian-likes-github/moby--moby
1
0
Fork 0
mirror of https://github.com/moby/moby.git synced 2022-11-09 12:21:53 -05:00
Code Releases Activity

rootless: bind mount: fix "operation not permitted"

Browse source 
The following was failing previously, because `getUnprivilegedMountFlags()` was not called:
```console
$ sudo mount -t tmpfs -o noexec none /tmp/foo
$ $ docker --context=rootless run -it --rm -v /tmp/foo:/mnt:ro alpine
docker: Error response from daemon: OCI runtime create failed: container_linux.go:367: starting container process caused: process_linux.go:520: container init caused: rootfs_linux.go:60: mounting "/tmp/foo" to rootfs at "/home/suda/.local/share/docker/overlay2/b8e7ea02f6ef51247f7f10c7fb26edbfb308d2af8a2c77915260408ed3b0a8ec/merged/mnt" caused: operation not permitted: unknown.
```

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
This commit is contained in:
Akihiro Suda 2021-04-01 14:58:11 +09:00
parent b96a0909f0
commit 248f98ef5e
No known key found for this signature in database
GPG key ID: 49524C6F9F638F1A
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
daemon/oci_linux.go
View file

@ -648,7 +648,7 @@ func WithMounts(daemon *Daemon, c *container.Container) coci.SpecOpts {
// "mount" when we bind-mount. The reason for this is that at the point // "mount" when we bind-mount. The reason for this is that at the point
// when runc sets up the root filesystem, it is already inside a user // when runc sets up the root filesystem, it is already inside a user
// namespace, and thus cannot change any flags that are locked. // namespace, and thus cannot change any flags that are locked.
if daemon.configStore.RemappedRoot != "" { if daemon.configStore.RemappedRoot != "" || sys.RunningInUserNS() {
unprivOpts, err := getUnprivilegedMountFlags(m.Source) unprivOpts, err := getUnprivilegedMountFlags(m.Source)
if err != nil { if err != nil {
return err return err