From 42f28d2aa165580381cf2226d066729562e9bfc4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?St=C3=A9phane=20Graber?= Date: Thu, 19 Oct 2023 23:32:51 -0400 Subject: [PATCH] internal/server/instance/lxc: Add support for image.requirements.privileged MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Stéphane Graber --- internal/server/instance/drivers/driver_lxc.go | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/internal/server/instance/drivers/driver_lxc.go b/internal/server/instance/drivers/driver_lxc.go index 0972efcc0dc..3caffa402dd 100644 --- a/internal/server/instance/drivers/driver_lxc.go +++ b/internal/server/instance/drivers/driver_lxc.go @@ -1916,6 +1916,11 @@ func (d *lxc) startCommon() (string, []func() error, error) { return "", nil, fmt.Errorf("The image used by this instance requires a CGroupV1 host system") } + // Ensure privileged is turned off for images that cannot work privileged + if util.IsFalse(d.localConfig["image.requirements.privileged"]) && util.IsTrue(d.expandedConfig["security.privileged"]) { + return "", nil, fmt.Errorf("The image used by this instance is incompatible with privileged containers. Please unset security.privileged on the instance") + } + // Load any required kernel modules kernelModules := d.expandedConfig["linux.kernel_modules"] if kernelModules != "" {