Browse code

contrib/init: unshare mount namespace for inits

* openrc
* sysvinit-debian
* upstart

Signed-off-by: Vincent Batts <vbatts@redhat.com>

Vincent Batts authored on 2015/04/23 21:21:39
Showing 3 changed files
... ...
@@ -7,6 +7,7 @@ DOCKER_LOGFILE=${DOCKER_LOGFILE:-/var/log/${SVCNAME}.log}
7 7
 DOCKER_PIDFILE=${DOCKER_PIDFILE:-/run/${SVCNAME}.pid}
8 8
 DOCKER_BINARY=${DOCKER_BINARY:-/usr/bin/docker}
9 9
 DOCKER_OPTS=${DOCKER_OPTS:-}
10
+UNSHARE_BINARY=${UNSHARE_BINARY:-/usr/bin/unshare}
10 11
 
11 12
 start() {
12 13
 	checkpath -f -m 0644 -o root:docker "$DOCKER_LOGFILE"
... ...
@@ -16,11 +17,12 @@ start() {
16 16
 
17 17
 	ebegin "Starting docker daemon"
18 18
 	start-stop-daemon --start --background \
19
-		--exec "$DOCKER_BINARY" \
19
+		--exec "$UNSHARE_BINARY" \
20 20
 		--pidfile "$DOCKER_PIDFILE" \
21 21
 		--stdout "$DOCKER_LOGFILE" \
22 22
 		--stderr "$DOCKER_LOGFILE" \
23
-		-- -d -p "$DOCKER_PIDFILE" \
23
+		-- --mount \
24
+		-- "$DOCKER_BINARY" -d -p "$DOCKER_PIDFILE" \
24 25
 		$DOCKER_OPTS
25 26
 	eend $?
26 27
 }
... ...
@@ -30,6 +30,7 @@ DOCKER_SSD_PIDFILE=/var/run/$BASE-ssd.pid
30 30
 DOCKER_LOGFILE=/var/log/$BASE.log
31 31
 DOCKER_OPTS=
32 32
 DOCKER_DESC="Docker"
33
+UNSHARE=${UNSHARE:-/usr/bin/unshare}
33 34
 
34 35
 # Get lsb functions
35 36
 . /lib/lsb/init-functions
... ...
@@ -99,11 +100,11 @@ case "$1" in
99 99
 		log_begin_msg "Starting $DOCKER_DESC: $BASE"
100 100
 		start-stop-daemon --start --background \
101 101
 			--no-close \
102
-			--exec "$DOCKER" \
102
+			--exec "$UNSHARE" \
103 103
 			--pidfile "$DOCKER_SSD_PIDFILE" \
104 104
 			--make-pidfile \
105
-			-- \
106
-				-d -p "$DOCKER_PIDFILE" \
105
+			-- --mount \
106
+			-- "$DOCKER" -d -p "$DOCKER_PIDFILE" \
107 107
 				$DOCKER_OPTS \
108 108
 					>> "$DOCKER_LOGFILE" 2>&1
109 109
 		log_end_msg $?
... ...
@@ -37,7 +37,7 @@ script
37 37
 	if [ -f /etc/default/$UPSTART_JOB ]; then
38 38
 		. /etc/default/$UPSTART_JOB
39 39
 	fi
40
-	exec "$DOCKER" -d $DOCKER_OPTS
40
+	exec unshare -m -- "$DOCKER" -d $DOCKER_OPTS
41 41
 end script
42 42
 
43 43
 # Don't emit "started" event until docker.sock is ready.