containerd

0 Fork 0

mirror of https://github.com/containerd/containerd.git synced 2026-11-06 13:27:16 +00:00

Files

T

Chris Henzie 9b2d72ee03 Preserve host cgroup mount options for privileged containers

Privileged containers don't have a cgroup namespace and share the host's
cgroup namespace. Mounting cgroup2 inside these containers can
inadvertently alter the host's cgroup2 VFS superblock mount options
because they are shared.

To prevent this, update WithMounts to read the host's /sys/fs/cgroup
mount options and explicitly propagate nsdelegate and
memory_recursiveprot into the container's mount spec. This avoids
stripping them on the host when they are not in the hardcoded default
set.

Signed-off-by: Chris Henzie <chrishenzie@gmail.com>

2026-03-25 02:21:56 +00:00

cleanup

internal/cleanup: remove Background(), add tests for Do()

2025-05-07 13:06:57 +02:00

cri

Preserve host cgroup mount options for privileged containers

2026-03-25 02:21:56 +00:00

erofsutils

Update erofs to use mount transformers

2025-10-14 22:53:43 -07:00

eventq

Add support for multiple subscribers to CRI container events