From f1a53d611604482db975b312f4eeb6a81ea95ce5 Mon Sep 17 00:00:00 2001 From: Ophestra Date: Fri, 8 Aug 2025 00:43:19 +0900 Subject: container: raise CAP_DAC_OVERRIDE This is required for upperdir and workdir checks in overlayfs. Signed-off-by: Ophestra --- container/container.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'container/container.go') diff --git a/container/container.go b/container/container.go index 5a7858f1..a0e1c2d5 100644 --- a/container/container.go +++ b/container/container.go @@ -146,7 +146,7 @@ func (p *Container) Start() error { CLONE_NEWIPC | CLONE_NEWUTS | CLONE_NEWCGROUP, // remain privileged for setup - AmbientCaps: []uintptr{CAP_SYS_ADMIN, CAP_SETPCAP}, + AmbientCaps: []uintptr{CAP_SYS_ADMIN, CAP_SETPCAP, CAP_DAC_OVERRIDE}, UseCgroupFD: p.Cgroup != nil, } -- cgit v1.3.1