From 905795ece624675abe2ec2622b0bbafdb9d7f44c Mon Sep 17 00:00:00 2001 From: Alexander Larsson Date: Wed, 7 May 2014 15:08:52 +0200 Subject: [PATCH] Always mount a /run tmpfs in the container All modern distros set up /run to be a tmpfs, see for instance: https://wiki.debian.org/ReleaseGoals/RunDirectory Its a very useful place to store pid-files, sockets and other things that only live at runtime and that should not be stored in the image. This is also useful when running systemd inside a container, as it will try to mount /run if not already mounted, which will fail for non-privileged container. Docker-DCO-1.1-Signed-off-by: Alexander Larsson (github: alexlarsson) --- daemon/execdriver/lxc/lxc_template.go | 1 + graph/graph.go | 1 + pkg/libcontainer/mount/init.go | 1 + 3 files changed, 3 insertions(+) diff --git a/daemon/execdriver/lxc/lxc_template.go b/daemon/execdriver/lxc/lxc_template.go index 7fdc5ce92b..d40b316768 100644 --- a/daemon/execdriver/lxc/lxc_template.go +++ b/daemon/execdriver/lxc/lxc_template.go @@ -90,6 +90,7 @@ lxc.pivotdir = lxc_putold # We cannot mount them directly read-only, because that would prevent loading AppArmor profiles. lxc.mount.entry = proc {{escapeFstabSpaces $ROOTFS}}/proc proc nosuid,nodev,noexec 0 0 lxc.mount.entry = sysfs {{escapeFstabSpaces $ROOTFS}}/sys sysfs nosuid,nodev,noexec 0 0 +lxc.mount.entry = tmpfs {{escapeFstabSpaces $ROOTFS}}/run tmpfs nosuid,nodev,noexec 0 0 {{if .Tty}} lxc.mount.entry = {{.Console}} {{escapeFstabSpaces $ROOTFS}}/dev/console none bind,rw 0 0 diff --git a/graph/graph.go b/graph/graph.go index b889139121..5de9cbe7a1 100644 --- a/graph/graph.go +++ b/graph/graph.go @@ -254,6 +254,7 @@ func SetupInitLayer(initLayer string) error { "/dev/pts": "dir", "/dev/shm": "dir", "/proc": "dir", + "/run": "dir", "/sys": "dir", "/.dockerinit": "file", "/.dockerenv": "file", diff --git a/pkg/libcontainer/mount/init.go b/pkg/libcontainer/mount/init.go index 4d11cc819a..12f833a966 100644 --- a/pkg/libcontainer/mount/init.go +++ b/pkg/libcontainer/mount/init.go @@ -156,6 +156,7 @@ func newSystemMounts(rootfs, mountLabel string, mounts libcontainer.Mounts) []mo {source: "sysfs", path: filepath.Join(rootfs, "sys"), device: "sysfs", flags: defaultMountFlags}, {source: "shm", path: filepath.Join(rootfs, "dev", "shm"), device: "tmpfs", flags: defaultMountFlags, data: label.FormatMountLabel("mode=1777,size=65536k", mountLabel)}, {source: "devpts", path: filepath.Join(rootfs, "dev", "pts"), device: "devpts", flags: syscall.MS_NOSUID | syscall.MS_NOEXEC, data: label.FormatMountLabel("newinstance,ptmxmode=0666,mode=620,gid=5", mountLabel)}, + {source: "tmpfs", path: filepath.Join(rootfs, "run"), device: "tmpfs", flags: defaultMountFlags}, } if len(mounts.OfType("devtmpfs")) == 1 {