github/kata-containers
1
0
Fork 1
mirror of https://github.com/kata-containers/kata-containers.git synced 2025-04-29 20:24:31 +00:00
Code Issues Projects Releases Wiki Activity

rootfs: apparmor=unconfined is needed for non Red Hat host OSes

Browse Source 
This is not needed for Fedora, RHEL, and CentOS, but it is required when
using any other host OS.  Having --security-opt apparmor=unconfined used
unconditionally is a no go as it'd break podman.

The reason this was only added when building for SUSE (as target distro)
was because debian and ubuntu condition would fall-through the switch to
the suse case (which makes me think that the fall-through was not
accidental).

Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com>
This commit is contained in:
Fabiano Fidêncio 2021-01-08 21:24:24 +01:00
parent bbeebcdbba
commit 8879f9a09b
1 changed files with 17 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
tools/osbuilder/rootfs-builder/rootfs.sh
View File

@ -196,10 +196,23 @@ docker_extra_args()
args+=" -v ${gentoo_local_portage_dir}:/usr/portage/packages"
args+=" --volumes-from ${gentoo_portage_container}"
;;
suse)
# When AppArmor is enabled, mounting inside a container is blocked with docker-default profile.
# See https://github.com/moby/moby/issues/16429
args+=" --security-opt apparmor=unconfined"
debian | ubuntu | suse)
source /etc/os-release
case "$ID" in
fedora | centos | rhel)
# Depending on the podman version, we'll face issues when passing
# `--security-opt apparmor=unconfined` on a system where not apparmor is not installed.
# Because of this, let's just avoid adding this option when the host OS comes from Red Hat.
# A explict check for podman, at least for now, can be avoided.
;;
*)
# When AppArmor is enabled, mounting inside a container is blocked with docker-default profile.
# See https://github.com/moby/moby/issues/16429
args+=" --security-opt apparmor=unconfined"
;;
esac
;;
*)
;;