dilim/containerd
1
0
Fork 0
mirror of https://github.com/containerd/containerd.git synced 2026-08-09 01:21:15 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #13389 from AkihiroSuda/fix-13388

Browse Source 
overlay: disable "rebase" capability when running in UserNS
This commit is contained in:
Derek McGowan
2026-05-12 19:12:20 +00:00
committed by GitHub
parent d09d4d533f 65d75e997b
commit 0ed0ec0d41
1 changed files with 8 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
plugins/snapshots/overlay/plugin/plugin.go
View File

@@ -21,6 +21,8 @@ package overlay
import (
"errors"
"github.com/moby/sys/userns"
"github.com/containerd/containerd/v2/plugins"
"github.com/containerd/containerd/v2/plugins/snapshots/overlay"
"github.com/containerd/containerd/v2/plugins/snapshots/overlay/overlayutils"
@@ -93,7 +95,12 @@ func init() {
ic.Meta.Capabilities = append(ic.Meta.Capabilities, capaOnlyRemapIDs)
}
ic.Meta.Capabilities = append(ic.Meta.Capabilities, capaRebase)
if !userns.RunningInUserNS() {
// "rebase" capability depends on `mknod c 0 0` via OverlayConvertWhiteout,
// so it does not work when running in UserNS.
// https://github.com/containerd/containerd/issues/13388
ic.Meta.Capabilities = append(ic.Meta.Capabilities, capaRebase)
}
ic.Meta.Exports[plugins.SnapshotterRootDir] = root
return overlay.NewSnapshotter(root, oOpts...)