diff options
| author | Ophestra <cat@gensokyo.uk> | 2025-08-03 19:18:53 +0900 |
|---|---|---|
| committer | Ophestra <cat@gensokyo.uk> | 2025-08-03 19:18:53 +0900 |
| commit | 38245559dca0833dc078b982d59490eee53e168c (patch) | |
| tree | ffe415b5db8fd21b3a75600428f167eeef018591 /internal/app/container_linux.go | |
| parent | 7b416d47dcb830aab5daa432cf79af5f8bbacaef (diff) | |
container/ops: mount dev readonly
There is usually no good reason to write to /dev. This however doesn't work in internal/app because FilesystemConfig supplied by ContainerConfig might add entries to /dev, so internal/app follows DevWritable with Remount instead.
Signed-off-by: Ophestra <cat@gensokyo.uk>
Diffstat (limited to 'internal/app/container_linux.go')
| -rw-r--r-- | internal/app/container_linux.go | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/internal/app/container_linux.go b/internal/app/container_linux.go index 35483018..a0c81d7a 100644 --- a/internal/app/container_linux.go +++ b/internal/app/container_linux.go @@ -85,7 +85,7 @@ func newContainer(s *hst.ContainerConfig, os sys.State, prefix string, uid, gid Tmpfs(hst.Tmp, 1<<12, 0755) if !s.Device { - params.Dev("/dev", true) + params.DevWritable("/dev", true) } else { params.Bind("/dev", "/dev", container.BindWritable|container.BindDevice) } @@ -239,6 +239,11 @@ func newContainer(s *hst.ContainerConfig, os sys.State, prefix string, uid, gid params.Etc(etcPath, prefix) } + // no more ContainerConfig paths beyond this point + if !s.Device { + params.Remount("/dev", syscall.MS_RDONLY) + } + return params, maps.Clone(s.Env), nil } |