wroclaw-git-backups/nix
1
0
Fork 0
mirror of https://github.com/NixOS/nix synced 2025-06-28 01:11:15 +02:00
Code Activity

Check whether we can use PID namespaces

Browse source 
In unprivileged podman containers, /proc is not fully visible (there
are other filesystems mounted on subdirectories of /proc). Therefore
we can't mount a new /proc in the sandbox that matches the PID
namespace of the sandbox. So this commit automatically disables
sandboxing if /proc is not fully visible.
This commit is contained in:
Eelco Dolstra 2023-01-27 15:25:56 +01:00
parent fb2f7f5dcc
commit bc1d9fd8b5
3 changed files with 37 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

2
src/libutil/namespaces.hh
View file

@ -6,4 +6,6 @@ bool userNamespacesSupported();
bool mountNamespacesSupported();
bool pidNamespacesSupported();
}