Kir Kolyshkin 65c21f346f libct/cfg/validate: disallow / as rootfs ...

Using host's / as the container rootfs does not work: with a private
mount namespace, pivot_root (or MS_MOVE in case of no-pivot) fails,
and without it, container mounts (such as proc, dev etc.) are mounted
on top of the host ones, effectively breaking the host.

Disallow it.

Add an integration test.

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>

2026-10-17 10:30:39 -07:00

..

doc.go

libcontainer/configs/validate: add doc.go

2025-08-29 12:36:04 +03:00

intelrdt_test.go

libct/configs/validate: simplify intelrtd tests

2026-05-15 17:14:15 -07:00

intelrdt.go

libct/configs/validate: simplify intelrtd tests

2026-05-15 17:14:15 -07:00

rootless_test.go

Modernize code for Go 1.24

2025-08-27 19:11:02 -07:00

rootless.go

Modernize code for Go 1.24

2025-08-27 19:11:02 -07:00

validator_test.go

validate: refuse readonly tmpfs and /dev without mount namespace

2026-09-29 16:48:12 -07:00

validator.go

libct/cfg/validate: disallow / as rootfs

2026-10-17 10:30:39 -07:00