From ba75587132d379932362bf86a73811608f810f33 Mon Sep 17 00:00:00 2001 From: Ophestra Date: Wed, 21 Jan 2026 04:49:25 +0900 Subject: internal/pkg: allow user namespace creation No good reason to filter this in the execArtifact container, and the extended filter breaks certain programs. Signed-off-by: Ophestra --- internal/pkg/exec.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'internal/pkg/exec.go') diff --git a/internal/pkg/exec.go b/internal/pkg/exec.go index a4ade28b..f8913174 100644 --- a/internal/pkg/exec.go +++ b/internal/pkg/exec.go @@ -290,7 +290,7 @@ func (a *execArtifact) cure(f *FContext, hostNet bool) (err error) { z := container.New(ctx, f.GetMessage()) z.WaitDelay = execWaitDelay - z.SeccompPresets |= std.PresetStrict + z.SeccompPresets |= std.PresetStrict & ^std.PresetDenyNS z.ParentPerm = 0700 z.HostNet = hostNet z.Hostname = "cure" -- cgit v1.3.1