container: skip landlock on hostnet

This overlaps with net namespace, so can be skipped without degrading security.

Signed-off-by: Ophestra <cat@gensokyo.uk>

1 files changed, 2 insertions, 2 deletions

diff --git a/container/container.go b/container/container.go
index 30b77c8d..480452cd 100644
--- a/container/container.go
+++ b/container/container.go
@@ -324,9 +324,9 @@ func (p *Container) Start() error {
 				}
 
 				if abi, err := LandlockGetABI(); err != nil {
-					if p.HostAbstract {
+					if p.HostAbstract || !p.HostNet {
 						// landlock can be skipped here as it restricts access
-						// to resources already covered by namespaces (pid)
+						// to resources already covered by namespaces (pid, net)
 						goto landlockOut
 					}
 					return &StartError{Step: "get landlock ABI", Err: err}