From 664cab4653225b94e848e87e85afa676bbc9963b Mon Sep 17 00:00:00 2001 From: Phil Estes Date: Fri, 8 Jan 2016 09:03:17 -0500 Subject: [PATCH] Properly report conflicting namespace options when using userns This prevents strange errors and clarifies which namespace options are incompatible with user namespaces (at this time). Docker-DCO-1.1-Signed-off-by: Phil Estes (github: estesp) Upstream-commit: d5743a3a5c0864686a300b1fe5f58b89a36bb2f6 Component: engine --- components/engine/daemon/daemon_unix.go | 19 +++++++++++++++++-- 1 file changed, 17 insertions(+), 2 deletions(-) diff --git a/components/engine/daemon/daemon_unix.go b/components/engine/daemon/daemon_unix.go index be673bcf08..21ac089923 100644 --- a/components/engine/daemon/daemon_unix.go +++ b/components/engine/daemon/daemon_unix.go @@ -380,8 +380,23 @@ func verifyPlatformContainerSettings(daemon *Daemon, hostConfig *containertypes. warnings = append(warnings, "IPv4 forwarding is disabled. Networking will not work.") logrus.Warnf("IPv4 forwarding is disabled. Networking will not work") } - if hostConfig.Privileged && daemon.configStore.RemappedRoot != "" { - return warnings, fmt.Errorf("Privileged mode is incompatible with user namespace mappings") + // check for various conflicting options with user namespaces + if daemon.configStore.RemappedRoot != "" { + if hostConfig.Privileged { + return warnings, fmt.Errorf("Privileged mode is incompatible with user namespaces.") + } + if hostConfig.NetworkMode.IsHost() || hostConfig.NetworkMode.IsContainer() { + return warnings, fmt.Errorf("Cannot share the host or a container's network namespace when user namespaces are enabled.") + } + if hostConfig.PidMode.IsHost() { + return warnings, fmt.Errorf("Cannot share the host PID namespace when user namespaces are enabled.") + } + if hostConfig.IpcMode.IsContainer() { + return warnings, fmt.Errorf("Cannot share a container's IPC namespace when user namespaces are enabled.") + } + if hostConfig.ReadonlyRootfs { + return warnings, fmt.Errorf("Cannot use the --read-only option when user namespaces are enabled.") + } } return warnings, nil }