container: add unshare cgroup before exec

#13
This commit is contained in:
criyle 2025-02-20 23:09:50 -05:00
parent f0dd44f466
commit f9deb2dc1a

View File

@ -66,6 +66,9 @@ type Builder struct {
// ContainerUID & ContainerGID set the container uid / gid mapping // ContainerUID & ContainerGID set the container uid / gid mapping
ContainerUID int ContainerUID int
ContainerGID int ContainerGID int
// UnshareCgroupBeforeExec calls unshare cgroup before execution
UnshareCgroupBeforeExec bool
} }
// SymbolicLink defines symlinks to be created after mount // SymbolicLink defines symlinks to be created after mount
@ -186,7 +189,7 @@ func (b *Builder) Build() (Environment, error) {
Cred: b.CredGenerator != nil, Cred: b.CredGenerator != nil,
ContainerUID: b.ContainerUID, ContainerUID: b.ContainerUID,
ContainerGID: b.ContainerGID, ContainerGID: b.ContainerGID,
UnshareCgroup: b.CloneFlags&unix.CLONE_NEWCGROUP == unix.CLONE_NEWCGROUP, UnshareCgroup: b.UnshareCgroupBeforeExec,
}); err != nil { }); err != nil {
c.Destroy() c.Destroy()
return nil, err return nil, err