b817729eef
- Expose the host's entire / in the container at /run/host - Resolves: #1977343 Signed-off-by: Jindrich Novy <jnovy@redhat.com>
77 lines
2.5 KiB
Diff
77 lines
2.5 KiB
Diff
From d03a5fee80f2f72da6a409f7ebc3b6caf21506e3 Mon Sep 17 00:00:00 2001
|
|
From: =?UTF-8?q?Ond=C5=99ej=20M=C3=ADchal?= <harrymichal@seznam.cz>
|
|
Date: Sat, 3 Jul 2021 20:39:49 +0200
|
|
Subject: [PATCH] cmd/create: Expose the host's entire / in the container at
|
|
/run/host
|
|
|
|
Having the entire host file system hierarchy mounted inside a toolbox
|
|
container gives the containers a more complete environment that's
|
|
resilient against future changes in the layout of the file system
|
|
hierarchy and the need for giving access to new paths to support new
|
|
use-cases. Otherwise, one would have to create a new container to get
|
|
access to any path that lies outside the /boot, /etc, /run, /tmp, /usr
|
|
and /var directories.
|
|
|
|
As a nice side-effect, this also simplifies the bind mount handling
|
|
code.
|
|
|
|
https://github.com/containers/toolbox/pull/827
|
|
---
|
|
src/cmd/create.go | 29 +----------------------------
|
|
1 file changed, 1 insertion(+), 28 deletions(-)
|
|
|
|
diff --git a/src/cmd/create.go b/src/cmd/create.go
|
|
index ff533c26db98..297b336f6382 100644
|
|
--- a/src/cmd/create.go
|
|
+++ b/src/cmd/create.go
|
|
@@ -265,28 +265,6 @@ func createContainer(container, image, release string, showCommandToEnter bool)
|
|
logrus.Debugf("%s canonicalized to %s", currentUser.HomeDir, homeDirEvaled)
|
|
homeDirMountArg := homeDirEvaled + ":" + homeDirEvaled + ":rslave"
|
|
|
|
- bootMountFlags := "ro"
|
|
- isBootReadWrite, err := isPathReadWrite("/boot")
|
|
- if err != nil {
|
|
- return err
|
|
- }
|
|
- if isBootReadWrite {
|
|
- bootMountFlags = "rw"
|
|
- }
|
|
-
|
|
- bootMountArg := "/boot:/run/host/boot:" + bootMountFlags + ",rslave"
|
|
-
|
|
- usrMountFlags := "ro"
|
|
- isUsrReadWrite, err := isPathReadWrite("/usr")
|
|
- if err != nil {
|
|
- return err
|
|
- }
|
|
- if isUsrReadWrite {
|
|
- usrMountFlags = "rw"
|
|
- }
|
|
-
|
|
- usrMountArg := "/usr:/run/host/usr:" + usrMountFlags + ",rslave"
|
|
-
|
|
var avahiSocketMount []string
|
|
|
|
avahiSocket, err := getServiceSocket("Avahi", "avahi-daemon.socket")
|
|
@@ -423,16 +401,11 @@ func createContainer(container, image, release string, showCommandToEnter bool)
|
|
createArgs = append(createArgs, []string{
|
|
"--userns", usernsArg,
|
|
"--user", "root:root",
|
|
- "--volume", "/etc:/run/host/etc",
|
|
+ "--volume", "/:/run/host:rslave",
|
|
"--volume", "/dev:/dev:rslave",
|
|
- "--volume", "/run:/run/host/run:rslave",
|
|
- "--volume", "/tmp:/run/host/tmp:rslave",
|
|
- "--volume", "/var:/run/host/var:rslave",
|
|
- "--volume", bootMountArg,
|
|
"--volume", dbusSystemSocketMountArg,
|
|
"--volume", homeDirMountArg,
|
|
"--volume", toolboxPathMountArg,
|
|
- "--volume", usrMountArg,
|
|
"--volume", runtimeDirectoryMountArg,
|
|
}...)
|
|
|
|
--
|
|
2.31.1
|
|
|