From 9df0b5e268a8ed78d2005792e46a97103c541218 Mon Sep 17 00:00:00 2001
From: Sebastiaan van Stijn <github@gone.nl>
Date: Mon, 4 May 2020 15:53:33 +0200
Subject: [PATCH] libcontainer: RunningInUserNS() use sync.Once

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
---
 libcontainer/system/linux.go | 21 +++++++++++++++------
 1 file changed, 15 insertions(+), 6 deletions(-)

diff --git a/libcontainer/system/linux.go b/libcontainer/system/linux.go
index 36d72a53e..49471960b 100644
--- a/libcontainer/system/linux.go
+++ b/libcontainer/system/linux.go
@@ -5,6 +5,7 @@ package system
 import (
 	"os"
 	"os/exec"
+	"sync"
 	"unsafe"
 
 	"github.com/opencontainers/runc/libcontainer/user"
@@ -86,15 +87,23 @@ func Setctty() error {
 	return nil
 }
 
+var (
+	inUserNS bool
+	nsOnce   sync.Once
+)
+
 // RunningInUserNS detects whether we are currently running in a user namespace.
 // Originally copied from github.com/lxc/lxd/shared/util.go
 func RunningInUserNS() bool {
-	uidmap, err := user.CurrentProcessUIDMap()
-	if err != nil {
-		// This kernel-provided file only exists if user namespaces are supported
-		return false
-	}
-	return UIDMapInUserNS(uidmap)
+	nsOnce.Do(func() {
+		uidmap, err := user.CurrentProcessUIDMap()
+		if err != nil {
+			// This kernel-provided file only exists if user namespaces are supported
+			return
+		}
+		inUserNS = UIDMapInUserNS(uidmap)
+	})
+	return inUserNS
 }
 
 func UIDMapInUserNS(uidmap []user.IDMap) bool {