3 Commits

Author	SHA1	Message	Date
Evan Lezar	ec29b602c3	Run update-ldcache in isolated namespaces ... This change uses the reexec package to run the update of the ldcache in a container in a process with isolated namespaces. Since the hook is invoked as a createContainer hook, these namespaces are cloned from the container's namespaces. In the reexec handler, we further isolate the proc filesystem, mount the host ldconfig to a tmpfs, and pivot into the containers root. Signed-off-by: Evan Lezar <elezar@nvidia.com>	2025-05-15 12:45:49 +02:00
Tariq Ibrahim	f7a415f480	bump runc go dep to v1.3.0 ... Signed-off-by: Tariq Ibrahim <tibrahim@nvidia.com>	2025-04-29 19:01:38 -07:00
Evan Lezar	52b9631333	Use libcontainer execseal to run ldconfig ... This change copies ldconfig into a memfd before executing it from the createContainer hook. Signed-off-by: Evan Lezar <elezar@nvidia.com>	2025-02-27 13:52:27 +02:00