2 files changed, 30 insertions, 12 deletions
diff --git a/runsc/config/config.go b/runsc/config/config.go
index 3d8c7a0ab..cc4650180 100644
--- a/runsc/config/config.go
+++ b/runsc/config/config.go
@@ -142,7 +142,8 @@ type Config struct {
 	// Rootless allows the sandbox to be started with a user that is not root.
 	// Defense in depth measures are weaker in rootless mode. Specifically, the
 	// sandbox and Gofer process run as root inside a user namespace with root
-	// mapped to the caller's user.
+	// mapped to the caller's user. When using rootless, the container root path
+	// should not have a symlink.
 	Rootless bool `flag:"rootless"`
 
 	// AlsoLogToStderr allows to send log messages to stderr.
@@ -175,7 +176,8 @@ type Config struct {
 	// TestOnlyAllowRunAsCurrentUserWithoutChroot should only be used in
 	// tests. It allows runsc to start the sandbox process as the current
 	// user, and without chrooting the sandbox process. This can be
-	// necessary in test environments that have limited capabilities.
+	// necessary in test environments that have limited capabilities. When
+	// disabling chroot, the container root path should not have a symlink.
 	TestOnlyAllowRunAsCurrentUserWithoutChroot bool `flag:"TESTONLY-unsafe-nonroot"`
 
 	// TestOnlyTestNameEnv should only be used in tests. It looks up for the
diff --git a/runsc/config/config_test.go b/runsc/config/config_test.go
index fb162b7eb..80ff2c0a6 100644
--- a/runsc/config/config_test.go
+++ b/runsc/config/config_test.go
@@ -41,21 +41,37 @@ func TestDefault(t *testing.T) {
 	}
 }
 
-func setDefault(name string) {
+func setDefault(name string) error {
 	fl := flag.CommandLine.Lookup(name)
-	fl.Value.Set(fl.DefValue)
+	return fl.Value.Set(fl.DefValue)
 }
 
 func TestFromFlags(t *testing.T) {
-	flag.CommandLine.Lookup("root").Value.Set("some-path")
-	flag.CommandLine.Lookup("debug").Value.Set("true")
-	flag.CommandLine.Lookup("num-network-channels").Value.Set("123")
-	flag.CommandLine.Lookup("network").Value.Set("none")
+	if err := flag.CommandLine.Lookup("root").Value.Set("some-path"); err != nil {
+		t.Errorf("Flag set: %v", err)
+	}
+	if err := flag.CommandLine.Lookup("debug").Value.Set("true"); err != nil {
+		t.Errorf("Flag set: %v", err)
+	}
+	if err := flag.CommandLine.Lookup("num-network-channels").Value.Set("123"); err != nil {
+		t.Errorf("Flag set: %v", err)
+	}
+	if err := flag.CommandLine.Lookup("network").Value.Set("none"); err != nil {
+		t.Errorf("Flag set: %v", err)
+	}
 	defer func() {
-		setDefault("root")
-		setDefault("debug")
-		setDefault("num-network-channels")
-		setDefault("network")
+		if err := setDefault("root"); err != nil {
+			t.Errorf("Flag set: %v", err)
+		}
+		if err := setDefault("debug"); err != nil {
+			t.Errorf("Flag set: %v", err)
+		}
+		if err := setDefault("num-network-channels"); err != nil {
+			t.Errorf("Flag set: %v", err)
+		}
+		if err := setDefault("network"); err != nil {
+			t.Errorf("Flag set: %v", err)
+		}
 	}()
 
 	c, err := NewFromFlags()