From 9bc8532d56fc5c1f727919d21f464dff09316913 Mon Sep 17 00:00:00 2001 From: Ophestra Date: Tue, 26 Aug 2025 03:15:32 +0900 Subject: container/initdev: mount tmpfs on shm for ro dev Programs expect /dev/shm to be a writable tmpfs. Signed-off-by: Ophestra --- container/initdev.go | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) (limited to 'container/initdev.go') diff --git a/container/initdev.go b/container/initdev.go index b3192912..43ef5247 100644 --- a/container/initdev.go +++ b/container/initdev.go @@ -72,8 +72,9 @@ func (d *MountDevOp) apply(state *setupState, k syscallDispatcher) error { } } + devShmPath := path.Join(target, "shm") devPtsPath := path.Join(target, "pts") - for _, name := range []string{path.Join(target, "shm"), devPtsPath} { + for _, name := range []string{devShmPath, devPtsPath} { if err := k.mkdir(name, state.ParentPerm); err != nil { return wrapErrSelf(err) } @@ -117,8 +118,12 @@ func (d *MountDevOp) apply(state *setupState, k syscallDispatcher) error { if d.Write { return nil } - return wrapErrSuffix(k.remount(target, MS_RDONLY), - fmt.Sprintf("cannot remount %q:", target)) + + if err := k.remount(target, MS_RDONLY); err != nil { + return wrapErrSuffix(k.remount(target, MS_RDONLY), + fmt.Sprintf("cannot remount %q:", target)) + } + return k.mountTmpfs(SourceTmpfs, devShmPath, MS_NOSUID|MS_NODEV, 0, 01777) } func (d *MountDevOp) Is(op Op) bool { -- cgit v1.3.1