mirror of
https://github.com/privatevoid-net/nix-super.git
synced 2024-09-22 17:28:05 +03:00
bc1d9fd8b5
In unprivileged podman containers, /proc is not fully visible (there are other filesystems mounted on subdirectories of /proc). Therefore we can't mount a new /proc in the sandbox that matches the PID namespace of the sandbox. So this commit automatically disables sandboxing if /proc is not fully visible. |
||
|---|---|---|
| .. | ||
| derivation-goal.cc | ||
| derivation-goal.hh | ||
| drv-output-substitution-goal.cc | ||
| drv-output-substitution-goal.hh | ||
| entry-points.cc | ||
| goal.cc | ||
| goal.hh | ||
| hook-instance.cc | ||
| hook-instance.hh | ||
| local-derivation-goal.cc | ||
| local-derivation-goal.hh | ||
| personality.cc | ||
| personality.hh | ||
| sandbox-defaults.sb | ||
| sandbox-minimal.sb | ||
| sandbox-network.sb | ||
| substitution-goal.cc | ||
| substitution-goal.hh | ||
| worker.cc | ||
| worker.hh | ||