From fa72e2f693c2d08805c6114d5226bf646f4128a2 Mon Sep 17 00:00:00 2001 From: Akihiro Suda Date: Mon, 9 Mar 2020 01:49:04 +0900 Subject: [PATCH] cgroup2: do not unshare cgroup namespace for privileged Conforms to the latest KEP: https://github.com/kubernetes/enhancements/blob/0e409b47497e398b369c281074485c8de129694f/keps/sig-node/20191118-cgroups-v2.md#cgroup-namespace Signed-off-by: Akihiro Suda --- pkg/server/container_create_unix.go | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/pkg/server/container_create_unix.go b/pkg/server/container_create_unix.go index 6b5de7528..4dba453b5 100644 --- a/pkg/server/container_create_unix.go +++ b/pkg/server/container_create_unix.go @@ -225,9 +225,10 @@ func (c *criService) containerSpec(id string, sandboxID string, sandboxPid uint3 customopts.WithAnnotation(annotations.SandboxID, sandboxID), ) // cgroupns is used for hiding /sys/fs/cgroup from containers. - // For compatibility, cgroupns is not used when running in cgroup v1 mode. + // For compatibility, cgroupns is not used when running in cgroup v1 mode or in privileged. // https://github.com/containers/libpod/issues/4363 - if cgroups.Mode() == cgroups.Unified { + // https://github.com/kubernetes/enhancements/blob/0e409b47497e398b369c281074485c8de129694f/keps/sig-node/20191118-cgroups-v2.md#cgroup-namespace + if cgroups.Mode() == cgroups.Unified && !securityContext.GetPrivileged() { specOpts = append(specOpts, oci.WithLinuxNamespace( runtimespec.LinuxNamespace{ Type: runtimespec.CgroupNamespace,