diff options
Diffstat (limited to 'internal/app')
| -rw-r--r-- | internal/app/container_linux.go | 10 | ||||
| -rw-r--r-- | internal/app/seal_linux.go | 8 |
2 files changed, 11 insertions, 7 deletions
diff --git a/internal/app/container_linux.go b/internal/app/container_linux.go index 33c0c72a..30477fee 100644 --- a/internal/app/container_linux.go +++ b/internal/app/container_linux.go @@ -40,9 +40,13 @@ func newContainer(s *hst.ContainerConfig, os sys.State, prefix string, uid, gid ForwardCancel: s.WaitDelay >= 0, } + as := &hst.ApplyState{ + AutoEtcPrefix: prefix, + } { ops := make(container.Ops, 0, preallocateOpsCount+len(s.Filesystem)+len(s.Link)) params.Ops = &ops + as.Ops = &ops } if s.Multiarch { @@ -81,10 +85,10 @@ func newContainer(s *hst.ContainerConfig, os sys.State, prefix string, uid, gid // if the first element targets /, it is inserted early and excluded from path hiding rootfs := filesystem[0].FilesystemConfig filesystem = filesystem[1:] - rootfs.Apply(params.Ops) + rootfs.Apply(as) // autoroot requires special handling during path hiding - if b, ok := rootfs.(*hst.FSBind); ok && b.Valid() && b.AutoRoot { + if b, ok := rootfs.(*hst.FSBind); ok && b.IsAutoRoot() { autoroot = b } } @@ -143,7 +147,7 @@ func newContainer(s *hst.ContainerConfig, os sys.State, prefix string, uid, gid if !c.Valid() { return nil, nil, fmt.Errorf("invalid filesystem at index %d", i) } - c.Apply(params.Ops) + c.Apply(as) // fs counter hidePathSourceCount += len(c.Host()) diff --git a/internal/app/seal_linux.go b/internal/app/seal_linux.go index fb6f39b6..4e77e79e 100644 --- a/internal/app/seal_linux.go +++ b/internal/app/seal_linux.go @@ -246,10 +246,10 @@ func (seal *outcome) finalise(ctx context.Context, sys sys.State, config *hst.Co Filesystem: []hst.FilesystemConfigJSON{ {&hst.FSBind{ - Target: container.AbsFHSRoot, - Source: container.AbsFHSRoot, - Write: true, - AutoRoot: true, + Target: container.AbsFHSRoot, + Source: container.AbsFHSRoot, + Write: true, + Special: true, }}, }, } |