kotovalexarian-likes-github/moby--moby
1
0
Fork 0
mirror of https://github.com/moby/moby.git synced 2022-11-09 12:21:53 -05:00
Code Releases Activity

Merge pull request from rgulewich/cgroupns-test-req

Browse source 
Fix running in privileged mode against a daemon with --default-cgroupns-mode=host
This commit is contained in:
Akihiro Suda 2019-08-25 10:46:46 +09:00 • committed by GitHub
commit cd1356d9ea
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 9 additions and 5 deletions
daemon
daemon_unix.go
integration/container
run_cgroupns_linux_test.go

12
daemon/daemon_unix.go
View file

@ -361,11 +361,15 @@ func (daemon *Daemon) adaptContainerSettings(hostConfig *containertypes.HostConf
// Set default cgroup namespace mode, if unset for container
if hostConfig.CgroupnsMode.IsEmpty() {
m := config.DefaultCgroupNamespaceMode
if daemon.configStore != nil {
m = daemon.configStore.CgroupNamespaceMode
if hostConfig.Privileged {
hostConfig.CgroupnsMode = containertypes.CgroupnsMode("host")
} else {
m := config.DefaultCgroupNamespaceMode
if daemon.configStore != nil {
m = daemon.configStore.CgroupNamespaceMode
}
hostConfig.CgroupnsMode = containertypes.CgroupnsMode(m)
}
hostConfig.CgroupnsMode = containertypes.CgroupnsMode(m)
}
adaptSharedNamespaceContainer(daemon, hostConfig)

2
integration/container/run_cgroupns_linux_test.go
View file

@ -68,7 +68,7 @@ func TestCgroupNamespacesRun(t *testing.T) {
func TestCgroupNamespacesRunPrivileged(t *testing.T) {
skip.If(t, testEnv.DaemonInfo.OSType != "linux")
skip.If(t, testEnv.IsRemoteDaemon())
skip.If(t, requirement.CgroupNamespacesEnabled())
skip.If(t, !requirement.CgroupNamespacesEnabled())
// When the daemon defaults to private cgroup namespaces, privileged containers
// launched should not be inside their own cgroup namespaces