diff options
Diffstat (limited to 'internal/app/seal_linux.go')
| -rw-r--r-- | internal/app/seal_linux.go | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/internal/app/seal_linux.go b/internal/app/seal_linux.go index cc92db29..b25b5c4f 100644 --- a/internal/app/seal_linux.go +++ b/internal/app/seal_linux.go @@ -478,6 +478,9 @@ func (seal *outcome) finalise(ctx context.Context, sys sys.State, config *hst.Co seal.container.Tmpfs(dest, 1<<13, 0755) } + // mount root read-only as the final setup Op + seal.container.Remount("/", syscall.MS_RDONLY) + // append ExtraPerms last for _, p := range config.ExtraPerms { if p == nil { |