From 7b416d47dcb830aab5daa432cf79af5f8bbacaef Mon Sep 17 00:00:00 2001 From: Ophestra Date: Sun, 3 Aug 2025 18:34:55 +0900 Subject: container/ops: merge mqueue and dev Ops There is no reason to mount mqueue anywhere else, and these Ops usually follow each other. This change merges them. This helps decrease IPC overhead and also enables mounting dev readonly. Signed-off-by: Ophestra --- container/container_test.go | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-) (limited to 'container/container_test.go') diff --git a/container/container_test.go b/container/container_test.go index 91fa49bb..861a4dbd 100644 --- a/container/container_test.go +++ b/container/container_test.go @@ -72,8 +72,7 @@ var containerTestCases = []struct { {"dev", true, true /* go test output is not a tty */, false, false, new(container.Ops). - Dev("/dev"). - Mqueue("/dev/mqueue"), + Dev("/dev", true), []*vfs.MountInfoEntry{ ent("/", "/dev", "rw,nosuid,nodev,relatime", "tmpfs", "devtmpfs", ignore), ent("/null", "/dev/null", "rw,nosuid", "devtmpfs", "devtmpfs", ignore), @@ -86,6 +85,21 @@ var containerTestCases = []struct { ent("/", "/dev/mqueue", "rw,nosuid,nodev,noexec,relatime", "mqueue", "mqueue", "rw"), }, 1971, 100, nil, 0, seccomp.PresetStrict}, + + {"dev no mqueue", true, true /* go test output is not a tty */, false, false, + new(container.Ops). + Dev("/dev", false), + []*vfs.MountInfoEntry{ + ent("/", "/dev", "rw,nosuid,nodev,relatime", "tmpfs", "devtmpfs", ignore), + ent("/null", "/dev/null", "rw,nosuid", "devtmpfs", "devtmpfs", ignore), + ent("/zero", "/dev/zero", "rw,nosuid", "devtmpfs", "devtmpfs", ignore), + ent("/full", "/dev/full", "rw,nosuid", "devtmpfs", "devtmpfs", ignore), + ent("/random", "/dev/random", "rw,nosuid", "devtmpfs", "devtmpfs", ignore), + ent("/urandom", "/dev/urandom", "rw,nosuid", "devtmpfs", "devtmpfs", ignore), + ent("/tty", "/dev/tty", "rw,nosuid", "devtmpfs", "devtmpfs", ignore), + ent("/", "/dev/pts", "rw,nosuid,noexec,relatime", "devpts", "devpts", "rw,mode=620,ptmxmode=666"), + }, + 1971, 100, nil, 0, seccomp.PresetStrict}, } func TestContainer(t *testing.T) { -- cgit v1.3.1