mirror of
https://github.com/podman-container-tools/podman.git
synced 2026-08-16 05:39:34 +00:00
d222a392cd
The problem right now is that --ns contianer: syntax causes use to add the namespace path to the spec which means the runtime will try to call setns on that. This works fine for private namespaces but when the host namspace is used by the container a rootless user is not allowed to join that namespace so the setns call will return with permission denied. The fix is to effectively switch the container to the `host` mode instead of `container:` when the mention container used the host ns. I tried to fix this deep into the libpod call when we assign these namespaces but the problem is that this does not work correctly because these namespace require much more setup. Mainly different kind of mount points to work correctly. We already have similar work-arounds in place for pods because they also need this. For some reason this does not work with the user namespace, I don't know why and I don't think it is really needed so I left this out just to get at least the rest working. The original issue only reported this for the network namespace. Fixes #18027 Signed-off-by: Paul Holzinger <pholzing@redhat.com> |
||
|---|---|---|
| .. | ||
| kube | ||
| config_linux.go | ||
| config_linux_cgo.go | ||
| config_linux_nocgo.go | ||
| config_linux_test.go | ||
| container.go | ||
| container_create.go | ||
| namespaces.go | ||
| namespaces_freebsd.go | ||
| namespaces_linux.go | ||
| namespaces_unsupported.go | ||
| oci.go | ||
| oci_freebsd.go | ||
| oci_linux.go | ||
| oci_unsupported.go | ||
| pause_image.go | ||
| pod_create.go | ||
| pod_create_test.go | ||
| ports.go | ||
| ports_bench_test.go | ||
| ports_test.go | ||
| rlimit_int64.go | ||
| rlimit_uint64.go | ||
| security_freebsd.go | ||
| security_linux.go | ||
| security_unsupported.go | ||
| storage.go | ||
| validate.go | ||