diff options
| author | Ophestra <cat@gensokyo.uk> | 2025-08-03 19:18:53 +0900 |
|---|---|---|
| committer | Ophestra <cat@gensokyo.uk> | 2025-08-03 19:18:53 +0900 |
| commit | 38245559dca0833dc078b982d59490eee53e168c (patch) | |
| tree | ffe415b5db8fd21b3a75600428f167eeef018591 /container/container_test.go | |
| parent | 7b416d47dcb830aab5daa432cf79af5f8bbacaef (diff) | |
container/ops: mount dev readonly
There is usually no good reason to write to /dev. This however doesn't work in internal/app because FilesystemConfig supplied by ContainerConfig might add entries to /dev, so internal/app follows DevWritable with Remount instead.
Signed-off-by: Ophestra <cat@gensokyo.uk>
Diffstat (limited to 'container/container_test.go')
| -rw-r--r-- | container/container_test.go | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/container/container_test.go b/container/container_test.go index 861a4dbd..2db2c08e 100644 --- a/container/container_test.go +++ b/container/container_test.go @@ -74,7 +74,7 @@ var containerTestCases = []struct { new(container.Ops). Dev("/dev", true), []*vfs.MountInfoEntry{ - ent("/", "/dev", "rw,nosuid,nodev,relatime", "tmpfs", "devtmpfs", ignore), + ent("/", "/dev", "ro,nosuid,nodev,relatime", "tmpfs", "devtmpfs", ignore), ent("/null", "/dev/null", "rw,nosuid", "devtmpfs", "devtmpfs", ignore), ent("/zero", "/dev/zero", "rw,nosuid", "devtmpfs", "devtmpfs", ignore), ent("/full", "/dev/full", "rw,nosuid", "devtmpfs", "devtmpfs", ignore), @@ -90,7 +90,7 @@ var containerTestCases = []struct { new(container.Ops). Dev("/dev", false), []*vfs.MountInfoEntry{ - ent("/", "/dev", "rw,nosuid,nodev,relatime", "tmpfs", "devtmpfs", ignore), + ent("/", "/dev", "ro,nosuid,nodev,relatime", "tmpfs", "devtmpfs", ignore), ent("/null", "/dev/null", "rw,nosuid", "devtmpfs", "devtmpfs", ignore), ent("/zero", "/dev/zero", "rw,nosuid", "devtmpfs", "devtmpfs", ignore), ent("/full", "/dev/full", "rw,nosuid", "devtmpfs", "devtmpfs", ignore), |