Function setPlatformOptions

pkg/cmd/container/run_linux.go:46–118

(ctx context.Context, client *containerd.Client, id, uts string, internalLabels *internalLabels, options types.ContainerCreateOptions)

}

func setPlatformOptions(ctx context.Context, client *containerd.Client, id, uts string, internalLabels *internalLabels, options types.ContainerCreateOptions) ([]oci.SpecOpts, error) {
	var opts []oci.SpecOpts
	opts = append(opts,
		oci.WithDefaultUnixDevices,
		WithoutRunMount(), // unmount default tmpfs on "/run": https://github.com/containerd/nerdctl/issues/157)
	)

	opts = append(opts,
		oci.WithMounts([]specs.Mount{
			{Type: "cgroup", Source: "cgroup", Destination: "/sys/fs/cgroup", Options: []string{"ro", "nosuid", "noexec", "nodev"}},
		}))

	cgOpts, err := generateCgroupOpts(id, options, internalLabels)
	if err != nil {
		return nil, err
	}
	opts = append(opts, cgOpts...)

	annotations := strutil.ConvertKVStringsToMap(options.Annotations)

	capOpts, err := generateCapOpts(
		strutil.DedupeStrSlice(options.CapAdd),
		strutil.DedupeStrSlice(options.CapDrop))
	if err != nil {
		return nil, err
	}
	opts = append(opts, capOpts...)
	securityOptsMaps := strutil.ConvertKVStringsToMap(strutil.DedupeStrSlice(options.SecurityOpt))
	secOpts, err := generateSecurityOpts(options.Privileged, options.GOptions.SelinuxEnabled, securityOptsMaps)
	if err != nil {
		return nil, err
	}
	opts = append(opts, secOpts...)

	b4nnOpts, err := bypass4netnsutil.GenerateBypass4netnsOpts(securityOptsMaps, annotations, id)
	if err != nil {
		return nil, err
	}
	opts = append(opts, b4nnOpts...)

	ulimitOpts, err := generateUlimitsOpts(options.Ulimit)
	if err != nil {
		return nil, err
	}

	// If without any ulimitOpts, we need to reset the default value from spec
	// which has 1024 as file limit. Make this behavior same as containerd/cri.
	if len(ulimitOpts) == 0 {
		ulimitOpts = append(ulimitOpts, withRlimits(nil))
	}

	opts = append(opts, ulimitOpts...)
	if options.Sysctl != nil {
		opts = append(opts, WithSysctls(strutil.ConvertKVStringsToMap(options.Sysctl)))
	}

	if options.RDTClass != "" {
		opts = append(opts, oci.WithRdt(options.RDTClass, "", ""))