diff options
Diffstat (limited to 'container/container.go')
| -rw-r--r-- | container/container.go | 15 |
1 files changed, 15 insertions, 0 deletions
diff --git a/container/container.go b/container/container.go index 4208a449..85e6596f 100644 --- a/container/container.go +++ b/container/container.go @@ -91,6 +91,9 @@ type ( // Time to wait for processes lingering after the initial process terminates. AdoptWaitDelay time.Duration + // Map uid/gid 0 in the init process. Requires [FstypeProc] attached to + // [fhs.Proc] in the container filesystem. + InitAsRoot bool // Mapped Uid in user namespace. Uid int // Mapped Gid in user namespace. @@ -286,6 +289,18 @@ func (p *Container) Start() error { if !p.HostNet { p.cmd.SysProcAttr.Cloneflags |= CLONE_NEWNET } + if p.InitAsRoot { + p.cmd.SysProcAttr.AmbientCaps = append(p.cmd.SysProcAttr.AmbientCaps, + // mappings during init as root + CAP_SETFCAP, + ) + + if !p.SeccompDisable && + len(p.SeccompRules) == 0 && + p.SeccompPresets&std.PresetDenyNS != 0 { + return errors.New("container: as root requires late namespace creation") + } + } // place setup pipe before user supplied extra files, this is later restored by init if r, w, err := os.Pipe(); err != nil { |