diff options
| author | Fabricio Voznika <fvoznika@google.com> | 2018-10-18 12:41:07 -0700 |
|---|---|---|
| committer | Shentubot <shentubot@google.com> | 2018-10-18 12:42:24 -0700 |
| commit | f3ffa4db525ea1a1d36307ea9593ed7b5e014ca7 (patch) | |
| tree | e490c99350392544e21abb8953fe3c656a676221 /runsc/boot/config.go | |
| parent | 2a697791d1a473c76973f135f3af9240a32ad668 (diff) | |
Resolve mount paths while setting up root fs mount
It's hard to resolve symlinks inside the sandbox because rootfs and mounts
may be read-only, forcing us to create mount points inside lower layer of an
overlay, **before** the volumes are mounted.
Since the destination must already be resolved outside the sandbox when creating
mounts, take this opportunity to rewrite the spec with paths resolved.
"runsc boot" will use the "resolved" spec to load mounts. In addition, symlink
traversals were disabled while mounting containers inside the sandbox.
It haven't been able to write a good test for it. So I'm relying on manual tests
for now.
PiperOrigin-RevId: 217749904
Change-Id: I7ac434d5befd230db1488446cda03300cc0751a9
Diffstat (limited to 'runsc/boot/config.go')
| -rw-r--r-- | runsc/boot/config.go | 3 |
1 files changed, 0 insertions, 3 deletions
diff --git a/runsc/boot/config.go b/runsc/boot/config.go index 41af084b9..51d20d06d 100644 --- a/runsc/boot/config.go +++ b/runsc/boot/config.go @@ -192,9 +192,6 @@ type Config struct { // disabled. Pardon the double negation, but default to enabled is important. DisableSeccomp bool - // SpecFile is the file containing the OCI spec. - SpecFile string - // WatchdogAction sets what action the watchdog takes when triggered. WatchdogAction watchdog.Action |