diff options
Diffstat (limited to 'internal/app/seal_linux.go')
| -rw-r--r-- | internal/app/seal_linux.go | 11 |
1 files changed, 6 insertions, 5 deletions
diff --git a/internal/app/seal_linux.go b/internal/app/seal_linux.go index d020697e..cc92db29 100644 --- a/internal/app/seal_linux.go +++ b/internal/app/seal_linux.go @@ -246,11 +246,6 @@ func (seal *outcome) finalise(ctx context.Context, sys sys.State, config *hst.Co RootFlags: container.BindWritable, } - // hide nscd from sandbox if present - nscd := "/var/run/nscd" - if _, err := sys.Stat(nscd); !errors.Is(err, fs.ErrNotExist) { - conf.Cover = append(conf.Cover, nscd) - } // bind GPU stuff if config.Enablements&(system.EX11|system.EWayland) != 0 { conf.Filesystem = append(conf.Filesystem, &hst.FilesystemConfig{Src: "/dev/dri", Device: true}) @@ -258,6 +253,12 @@ func (seal *outcome) finalise(ctx context.Context, sys sys.State, config *hst.Co // opportunistically bind kvm conf.Filesystem = append(conf.Filesystem, &hst.FilesystemConfig{Src: "/dev/kvm", Device: true}) + // hide nscd from container if present + const nscd = "/var/run/nscd" + if _, err := sys.Stat(nscd); !errors.Is(err, fs.ErrNotExist) { + conf.Filesystem = append(conf.Filesystem, &hst.FilesystemConfig{Dst: nscd, Src: hst.SourceTmpfs}) + } + config.Container = conf } |