vbatts/pkg
1
0
Fork 0
Code Pull requests Releases Activity

Don't restrict lxc because of apparmor

Browse source 
We don't have the flexibility to do extra things with lxc because it is
a black box and most fo the magic happens before we get a chance to
interact with it in dockerinit.
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
This commit is contained in:
Michael Crosby 2014-05-02 11:14:24 -07:00
parent 473686ec89
commit 65fb57349d
2 changed files with 3 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

2
libcontainer/nsinit/init.go
View file

@ -79,7 +79,7 @@ func Init(container *libcontainer.Container, uncleanRootfs, consolePath string,
return fmt.Errorf("set process label %s", err)
}
if container.Context["restrictions"] != "" {
if err := restrict.Restrict(); err != nil {
if err := restrict.Restrict("proc", "sys"); err != nil {
return err
}
}