github/containerd
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases 2 Wiki Activity

ctr: add privileged-without-host-devices for run command

Browse Source 
For Kata Containers, starting a privileged container will fail
if passing all host devices to container due to the permission
issue, like the `privileged_without_host_devices` for CRI service,
add a `privileged-without-host-devices` to `ctr run` command will
disable passing all host devices to containers.

Signed-off-by: bin liu <liubin0329@gmail.com>
This commit is contained in:
bin liu 2022-08-26 15:56:01 +08:00
parent 765351ac4d
commit fdff11def3
1 changed files with 17 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
cmd/ctr/commands/run/run_unix.go
View File

@ -70,6 +70,10 @@ var platformRunFlags = []cli.Flag{
Name: "remap-labels",
Usage: "provide the user namespace ID remapping to the snapshotter via label options; requires snapshotter support",
},
cli.BoolFlag{
Name: "privileged-without-host-devices",
Usage: "don't pass all host devices to privileged container",
},
cli.Float64Flag{
Name: "cpus",
Usage: "set the CFS cpu quota",
@ -202,9 +206,20 @@ func NewContainer(ctx gocontext.Context, client *containerd.Client, context *cli
if context.Bool("tty") {
opts = append(opts, oci.WithTTY)
}
if context.Bool("privileged") {
privileged := context.Bool("privileged")
privilegedWithoutHostDevices := context.Bool("privileged-without-host-devices")
if privilegedWithoutHostDevices && !privileged {
return nil, fmt.Errorf("can't use 'privileged-without-host-devices' without 'privileged' specified")
}
if privileged {
if privilegedWithoutHostDevices {
opts = append(opts, oci.WithPrivileged)
} else {
opts = append(opts, oci.WithPrivileged, oci.WithAllDevicesAllowed, oci.WithHostDevices)
}
}
if context.Bool("net-host") {
hostname, err := os.Hostname()
if err != nil {