diff options
| author | Fabricio Voznika <fvoznika@google.com> | 2018-08-27 11:09:06 -0700 |
|---|---|---|
| committer | Shentubot <shentubot@google.com> | 2018-08-27 11:10:14 -0700 |
| commit | db81c0b02f2f947ae837a3e16471a148a66436eb (patch) | |
| tree | d91ef12da80b0a76ef1c69db290665e31cc59860 /runsc/sandbox/network.go | |
| parent | 2524111fc63343fd7372f5ea0266130adea778a5 (diff) | |
Put fsgofer inside chroot
Now each container gets its own dedicated gofer that is chroot'd to the
rootfs path. This is done to add an extra layer of security in case the
gofer gets compromised.
PiperOrigin-RevId: 210396476
Change-Id: Iba21360a59dfe90875d61000db103f8609157ca0
Diffstat (limited to 'runsc/sandbox/network.go')
| -rw-r--r-- | runsc/sandbox/network.go | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/runsc/sandbox/network.go b/runsc/sandbox/network.go index d0ce6228b..8694ba755 100644 --- a/runsc/sandbox/network.go +++ b/runsc/sandbox/network.go @@ -29,6 +29,7 @@ import ( "gvisor.googlesource.com/gvisor/pkg/log" "gvisor.googlesource.com/gvisor/pkg/urpc" "gvisor.googlesource.com/gvisor/runsc/boot" + "gvisor.googlesource.com/gvisor/runsc/specutils" ) const ( @@ -132,7 +133,7 @@ func createDefaultLoopbackInterface(conn *urpc.Client) error { func joinNetNS(nsPath string) (func(), error) { runtime.LockOSThread() - restoreNS, err := applyNS(specs.LinuxNamespace{ + restoreNS, err := specutils.ApplyNS(specs.LinuxNamespace{ Type: specs.NetworkNamespace, Path: nsPath, }) |