From 11d01cef448eec5b985ca2893f658c6e3d252aa7 Mon Sep 17 00:00:00 2001 From: Kir Kolyshkin Date: Wed, 7 Mar 2018 20:14:16 -0800 Subject: [PATCH] daemon/setMounts(): do not make /dev/shm ro It has been pointed out that if --read-only flag is given, /dev/shm also becomes read-only in case of --ipc private. This happens because in this case the mount comes from OCI spec (since commit 7120976d74195), and is a regression caused by that commit. The meaning of --read-only flag is to only have a "main" container filesystem read-only, not the auxiliary stuff (that includes /dev/shm, other mounts and volumes, --tmpfs, /proc, /dev and so on). So, let's make sure /dev/shm that comes from OCI spec is not made read-only. Fixes: 7120976d74195 ("Implement none, private, and shareable ipc modes") Signed-off-by: Kir Kolyshkin Upstream-commit: cad74056c09f6276b0f4a996a1511553177cd3d7 Component: engine --- components/engine/daemon/oci_linux.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/components/engine/daemon/oci_linux.go b/components/engine/daemon/oci_linux.go index 15bcb705bf..8d5eebb885 100644 --- a/components/engine/daemon/oci_linux.go +++ b/components/engine/daemon/oci_linux.go @@ -667,7 +667,7 @@ func setMounts(daemon *Daemon, s *specs.Spec, c *container.Container, mounts []c if s.Root.Readonly { for i, m := range s.Mounts { switch m.Destination { - case "/proc", "/dev/pts", "/dev/mqueue", "/dev": + case "/proc", "/dev/pts", "/dev/shm", "/dev/mqueue", "/dev": continue } if _, ok := userMounts[m.Destination]; !ok {