vbatts/cri-o
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

server: container_create: make the spec hostspecific

Browse source 
node-e2e tests were failing in RHEL because, if running a privileged
container, we get all capability in the spec. The spec generator wasn't
filtering caps based on actual host caps, it was just adding _everything_.
This patch makes spec generator host specific.

Signed-off-by: Antonio Murdaca <runcom@redhat.com>
This commit is contained in:
Antonio Murdaca 2017-05-30 17:04:21 +02:00
parent 90e3e7a632
commit 089cb88f17
No known key found for this signature in database
GPG key ID: B2BEAD150DE936B9
1 changed files with 2 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
server/container_create.go
View file

@ -330,6 +330,7 @@ func (s *Server) createSandboxContainer(ctx context.Context, containerID string,
// creates a spec Generator with the default spec. // creates a spec Generator with the default spec.
specgen := generate.New() specgen := generate.New()
specgen.HostSpecific = true
if err := addOciBindMounts(sb, containerConfig, &specgen); err != nil { if err := addOciBindMounts(sb, containerConfig, &specgen); err != nil {
return nil, err return nil, err
@ -456,7 +457,7 @@ func (s *Server) createSandboxContainer(ctx context.Context, containerID string,
if dropCaps != nil { if dropCaps != nil {
for _, cap := range dropCaps { for _, cap := range dropCaps {
if err := specgen.DropProcessCapability(toCAPPrefixed(cap)); err != nil { if err := specgen.DropProcessCapability(toCAPPrefixed(cap)); err != nil {
return nil, err logrus.Debugf("failed to drop cap %s: %v", toCAPPrefixed(cap), err)
} }
} }
} }