diff options
| author | Ophestra <cat@gensokyo.uk> | 2025-09-14 01:35:17 +0900 |
|---|---|---|
| committer | Ophestra <cat@gensokyo.uk> | 2025-09-14 01:49:42 +0900 |
| commit | ca247b80378b7248ed4d1eda8a97e2a1d659ec7b (patch) | |
| tree | 837a6f37f6a1e7d3aa36c10e96786e9f1854b5c2 /internal/app/container.go | |
| parent | 3f25c3f0af5631dcf46584ec122f7466fb8cfe37 (diff) | |
internal/app: mount /dev/shm early
This avoids covering /dev/shm mounts from hst.
Signed-off-by: Ophestra <cat@gensokyo.uk>
Diffstat (limited to 'internal/app/container.go')
| -rw-r--r-- | internal/app/container.go | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/internal/app/container.go b/internal/app/container.go index 68ba55eb..26bda265 100644 --- a/internal/app/container.go +++ b/internal/app/container.go @@ -98,6 +98,8 @@ func newContainer(s *hst.ContainerConfig, os sys.State, prefix string, uid, gid } else { params.Bind(container.AbsFHSDev, container.AbsFHSDev, container.BindWritable|container.BindDevice) } + // /dev is mounted readonly later on, this prevents /dev/shm from going readonly with it + params.Tmpfs(container.AbsFHSDev.Append("shm"), 0, 01777) /* retrieve paths and hide them if they're made available in the sandbox; @@ -230,9 +232,7 @@ func newContainer(s *hst.ContainerConfig, os sys.State, prefix string, uid, gid // no more ContainerConfig paths beyond this point if !s.Device { - params. - Remount(container.AbsFHSDev, syscall.MS_RDONLY). - Tmpfs(container.AbsFHSDev.Append("shm"), 0, 01777) + params.Remount(container.AbsFHSDev, syscall.MS_RDONLY) } return params, maps.Clone(s.Env), nil |