From 248f98ef5ebacb9250fa9aefed671aa896ad5cdf Mon Sep 17 00:00:00 2001 From: Akihiro Suda Date: Thu, 1 Apr 2021 14:58:11 +0900 Subject: [PATCH] rootless: bind mount: fix "operation not permitted" The following was failing previously, because `getUnprivilegedMountFlags()` was not called: ```console $ sudo mount -t tmpfs -o noexec none /tmp/foo $ $ docker --context=rootless run -it --rm -v /tmp/foo:/mnt:ro alpine docker: Error response from daemon: OCI runtime create failed: container_linux.go:367: starting container process caused: process_linux.go:520: container init caused: rootfs_linux.go:60: mounting "/tmp/foo" to rootfs at "/home/suda/.local/share/docker/overlay2/b8e7ea02f6ef51247f7f10c7fb26edbfb308d2af8a2c77915260408ed3b0a8ec/merged/mnt" caused: operation not permitted: unknown. ``` Signed-off-by: Akihiro Suda --- daemon/oci_linux.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/daemon/oci_linux.go b/daemon/oci_linux.go index 3ef7c9060f..948690fe9a 100644 --- a/daemon/oci_linux.go +++ b/daemon/oci_linux.go @@ -648,7 +648,7 @@ func WithMounts(daemon *Daemon, c *container.Container) coci.SpecOpts { // "mount" when we bind-mount. The reason for this is that at the point // when runc sets up the root filesystem, it is already inside a user // namespace, and thus cannot change any flags that are locked. - if daemon.configStore.RemappedRoot != "" { + if daemon.configStore.RemappedRoot != "" || sys.RunningInUserNS() { unprivOpts, err := getUnprivilegedMountFlags(m.Source) if err != nil { return err