On Mon, Oct 19, 2020 at 06:43:41PM +0900, Chirantan Ekbote wrote: > On Thu, Oct 8, 2020 at 5:55 PM Stefan Hajnoczi <stefa...@redhat.com> wrote: > > > > virtiofsd cannot run in a container because CAP_SYS_ADMIN is required to > > create namespaces. > > > > In crosvm we deal with this by also creating a user namespace, which > then allows us to create the mount, net, and pid namespaces as well. > Could that also work for virtiofsd?
I think one key question here is that who does the sandboxing. Is it the contatiner runtime environment or virtiofsd itself. I think what stefan is trying to do is that container runtime has done the sandboxing so virtiofsd has not do it. Having said that, if container runtime has setup things in such a way that virtiofsd has CAP_SYS_ADMIN, is it desirable that virtiofsd does pivot_root() instead of chroot()? Thanks Vivek
