From ca247b80378b7248ed4d1eda8a97e2a1d659ec7b Mon Sep 17 00:00:00 2001 From: Ophestra Date: Sun, 14 Sep 2025 01:35:17 +0900 Subject: internal/app: mount /dev/shm early This avoids covering /dev/shm mounts from hst. Signed-off-by: Ophestra --- internal/app/container.go | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'internal/app/container.go') diff --git a/internal/app/container.go b/internal/app/container.go index 68ba55eb..26bda265 100644 --- a/internal/app/container.go +++ b/internal/app/container.go @@ -98,6 +98,8 @@ func newContainer(s *hst.ContainerConfig, os sys.State, prefix string, uid, gid } else { params.Bind(container.AbsFHSDev, container.AbsFHSDev, container.BindWritable|container.BindDevice) } + // /dev is mounted readonly later on, this prevents /dev/shm from going readonly with it + params.Tmpfs(container.AbsFHSDev.Append("shm"), 0, 01777) /* retrieve paths and hide them if they're made available in the sandbox; @@ -230,9 +232,7 @@ func newContainer(s *hst.ContainerConfig, os sys.State, prefix string, uid, gid // no more ContainerConfig paths beyond this point if !s.Device { - params. - Remount(container.AbsFHSDev, syscall.MS_RDONLY). - Tmpfs(container.AbsFHSDev.Append("shm"), 0, 01777) + params.Remount(container.AbsFHSDev, syscall.MS_RDONLY) } return params, maps.Clone(s.Env), nil -- cgit v1.3.1