nvidia-container-toolkit/cmd/nvidia-cdi-hook/update-ldcache
Evan Lezar ec29b602c3
Run update-ldcache in isolated namespaces
This change uses the reexec package to run the update of the
ldcache in a container in a process with isolated namespaces.
Since the hook is invoked as a createContainer hook, these
namespaces are cloned from the container's namespaces.

In the reexec handler, we further isolate the proc filesystem,
mount the host ldconfig to a tmpfs, and pivot into the containers
root.

Signed-off-by: Evan Lezar <elezar@nvidia.com>
2025-05-15 12:45:49 +02:00
..
container-root.go [no-relnote] Move root to separate file 2025-02-27 13:48:29 +02:00
ldconfig_linux.go Run update-ldcache in isolated namespaces 2025-05-15 12:45:49 +02:00
ldconfig_other.go Run update-ldcache in isolated namespaces 2025-05-15 12:45:49 +02:00
safe-exec_linux.go Run update-ldcache in isolated namespaces 2025-05-15 12:45:49 +02:00
safe-exec_other.go Run update-ldcache in isolated namespaces 2025-05-15 12:45:49 +02:00
update-ldcache.go Run update-ldcache in isolated namespaces 2025-05-15 12:45:49 +02:00