From a6104c3bbe65dcf7db93b279aed6d60b8a02b097 Mon Sep 17 00:00:00 2001 From: Mrunal Patel Date: Tue, 19 Apr 2016 09:56:23 -0700 Subject: [PATCH] Allow mounting cgroups as read-only when user namespace is configured We use bind mount to achieve this as other file system remounts are disallowed in a user namespace. Signed-off-by: Mrunal Patel --- libcontainer/rootfs_linux.go | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/libcontainer/rootfs_linux.go b/libcontainer/rootfs_linux.go index 477a1df4b..1ca35c422 100644 --- a/libcontainer/rootfs_linux.go +++ b/libcontainer/rootfs_linux.go @@ -266,8 +266,10 @@ func mountToRootfs(m *configs.Mount, rootfs, mountLabel string) error { if m.Flags&syscall.MS_RDONLY != 0 { // remount cgroup root as readonly mcgrouproot := &configs.Mount{ + Source: m.Destination, + Device: "bind", Destination: m.Destination, - Flags: defaultMountFlags | syscall.MS_RDONLY, + Flags: defaultMountFlags | syscall.MS_RDONLY | syscall.MS_BIND, } if err := remount(mcgrouproot, rootfs); err != nil { return err