Merge pull request opencontainers#564 from hallyn/2016-02-16/userns.d…

…evicecg Do not set devices cgroup entries if in a user namespace
kinvolk · Feb 17, 2016 · 2c489ce · 2c489ce
2 parents d854d8f + 655f8ea
commit 2c489ce
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/libcontainer/cgroups/fs/devices.go b/libcontainer/cgroups/fs/devices.go
@@ -5,6 +5,7 @@ package fs
 import (
 	"github.com/opencontainers/runc/libcontainer/cgroups"
 	"github.com/opencontainers/runc/libcontainer/configs"
+	"github.com/opencontainers/runc/libcontainer/system"
 )
 
 type DevicesGroup struct {
@@ -25,6 +26,10 @@ func (s *DevicesGroup) Apply(d *cgroupData) error {
 }
 
 func (s *DevicesGroup) Set(path string, cgroup *configs.Cgroup) error {
+	if system.RunningInUserNS() {
+		return nil
+	}
+
 	devices := cgroup.Resources.Devices
 	if len(devices) > 0 {
 		for _, dev := range devices {