[systemd-devel] Docker vs PrivateTmp

[Lars Kellogg-Stedman]

On Sun, Jan 18, 2015 at 11:38:12PM -0500, Lars Kellogg-Stedman wrote:
> I think we actually want MountFlags=slave, which will permit mounts
> from the global namespace to propagate into the service namespace
> without permitting propagation in the other direction.  It seems like
> this would the Least Surprising behavior.

...which would be the default if docker.service were itself using
PrivateTmp=true, because from systemd.exec:

    Note that the file system namespace related options (PrivateTmp=,
    PrivateDevices=, ProtectSystem=, ProtectHome=, ReadOnlyDirectories=,
    InaccessibleDirectories= and ReadWriteDirectories=) require that mount
    and unmount propagation from the unit's file system namespace is
    disabled, and hence downgrade shared to slave.

So either explicitly setting MountFlags=slave, or setting
PrivateTmp=true if that doesn't cause any issues of which I am not
aware.

-- 
Lars Kellogg-Stedman <lars at redhat.com> | larsks @ {freenode,twitter,github}
Cloud Engineering / OpenStack          | http://blog.oddbit.com/

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 819 bytes
Desc: not available
URL: <http://lists.freedesktop.org/archives/systemd-devel/attachments/20150119/e004abe5/attachment.sig>