diff options
| author | Nicolas Lacasse <nlacasse@google.com> | 2018-09-24 17:21:16 -0700 |
|---|---|---|
| committer | Shentubot <shentubot@google.com> | 2018-09-24 17:22:15 -0700 |
| commit | d489336784f12e1b6f92d65f53679c1226b58668 (patch) | |
| tree | 822794fb40440b2544afe885732d984987dd9786 /runsc/main.go | |
| parent | 4094480b28e7367346840938f83db65f20e7ddaa (diff) | |
runsc: All non-root bind mounts should be shared.
This CL changes the semantics of the "--file-access" flag so that it only
affects the root filesystem. The default remains "exclusive" which is the
common use case, as neither Docker nor K8s supports sharing the root.
Keeping the root fs as "exclusive" means that the fs-intensive work done during
application startup will mostly be cacheable, and thus faster.
Non-root bind mounts will always be shared.
This CL also removes some redundant FSAccessType validations. We validate this
flag in main(), so we can assume it is valid afterwards.
PiperOrigin-RevId: 214359936
Change-Id: I7e75d7bf52dbd7fa834d0aacd4034868314f3b51
Diffstat (limited to 'runsc/main.go')
| -rw-r--r-- | runsc/main.go | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/runsc/main.go b/runsc/main.go index 44d30768f..624db5f40 100644 --- a/runsc/main.go +++ b/runsc/main.go @@ -58,7 +58,7 @@ var ( // Flags that control sandbox runtime behavior. platform = flag.String("platform", "ptrace", "specifies which platform to use: ptrace (default), kvm") network = flag.String("network", "sandbox", "specifies which network to use: sandbox (default), host, none. Using network inside the sandbox is more secure because it's isolated from the host network.") - fileAccess = flag.String("file-access", "exclusive", "specifies which filesystem to use: exclusive (default), shared. Setting 'shared' will disable caches and should be used if external modifications to the filesystem are expected.") + fileAccess = flag.String("file-access", "exclusive", "specifies which filesystem to use for the root mount: exclusive (default), shared. Volume mounts are always shared.") overlay = flag.Bool("overlay", false, "wrap filesystem mounts with writable overlay. All modifications are stored in memory inside the sandbox.") multiContainer = flag.Bool("multi-container", false, "enable *experimental* multi-container support.") watchdogAction = flag.String("watchdog-action", "log", "sets what action the watchdog takes when triggered: log (default), panic.") |