diff --git a/packages/containerd/containerd-cri-base-json b/packages/containerd/containerd-cri-base-json index 1f6a1993ec4..191dadc4c8c 100644 --- a/packages/containerd/containerd-cri-base-json +++ b/packages/containerd/containerd-cri-base-json @@ -102,6 +102,15 @@ oci-defaults = { version = "v1", helpers = ["oci_defaults"] } "mode=755", "size=65536k" ] + }, + { + "destination": "/usr/local/sbin/modprobe", + "source": "/usr/bin/kmod", + "options": [ + "exec", + "bind", + "ro" + ] } ], "linux": { diff --git a/packages/docker-engine/0002-oci-inject-kmod-in-all-containers.patch b/packages/docker-engine/0002-oci-inject-kmod-in-all-containers.patch new file mode 100644 index 00000000000..c75d9bb7371 --- /dev/null +++ b/packages/docker-engine/0002-oci-inject-kmod-in-all-containers.patch @@ -0,0 +1,32 @@ +From e35f5eeeaa4c7b9ec1ae0720fc7de0fc4d43e02f Mon Sep 17 00:00:00 2001 +From: Arnaldo Garcia Rincon +Date: Thu, 30 May 2024 14:38:33 +0000 +Subject: [PATCH] oci: inject kmod in all containers + +Append a new mount to the default spec created for Linux containers + +Signed-off-by: Arnaldo Garcia Rincon +Signed-off-by: Vighnesh Maheshwari +--- + oci/defaults.go | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/oci/defaults.go b/oci/defaults.go +index c3dae8b..2e90cfa 100644 +--- a/oci/defaults.go ++++ b/oci/defaults.go +@@ -100,6 +100,12 @@ func DefaultLinuxSpec() specs.Spec { + Source: "shm", + Options: []string{"nosuid", "noexec", "nodev", "mode=1777"}, + }, ++ { ++ Destination: "/usr/local/sbin/modprobe", ++ Type: "bind", ++ Source: "/usr/bin/kmod", ++ Options: []string{"exec", "bind", "ro"}, ++ }, + }, + Linux: &specs.Linux{ + MaskedPaths: []string{ +-- +2.44.0 diff --git a/packages/docker-engine/docker-engine.spec b/packages/docker-engine/docker-engine.spec index d0cf0e3f7cb..f9ad8919ca2 100644 --- a/packages/docker-engine/docker-engine.spec +++ b/packages/docker-engine/docker-engine.spec @@ -30,6 +30,7 @@ Source100: prepare-var-lib-docker.service Source1000: clarify.toml Patch0001: 0001-Change-default-capabilities-using-daemon-config.patch +Patch0002: 0002-oci-inject-kmod-in-all-containers.patch BuildRequires: git BuildRequires: %{_cross_os}glibc-devel diff --git a/sources/host-ctr/cmd/host-ctr/main.go b/sources/host-ctr/cmd/host-ctr/main.go index 7519baa4a5e..704d87a4577 100644 --- a/sources/host-ctr/cmd/host-ctr/main.go +++ b/sources/host-ctr/cmd/host-ctr/main.go @@ -896,6 +896,12 @@ func withPrivilegedMounts() oci.SpecOpts { Source: "/mnt", Type: "bind", }, + { + Options: []string{"bind", "ro", "exec"}, + Destination: "/usr/local/sbin/modprobe", + Source: "/usr/bin/kmod", + Type: "bind", + }, }) }