Merge pull request #1455 from 6WIND/master

fix incomplete host device for PrivilegedWithoutHostDevices
containerd · Apr 27, 2020 · 4ea4ca9 · 4ea4ca9
2 parents 197dca5 + 98f8ec4
commit 4ea4ca9
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/pkg/server/container_create_unix.go b/pkg/server/container_create_unix.go
@@ -175,6 +175,9 @@ func (c *criService) containerSpec(id string, sandboxID string, sandboxPid uint3
 		specOpts = append(specOpts, oci.WithPrivileged)
 		if !ociRuntime.PrivilegedWithoutHostDevices {
 			specOpts = append(specOpts, oci.WithHostDevices, oci.WithAllDevicesAllowed)
+		} else {
+			// add requested devices by the config as host devices are not automatically added
+			specOpts = append(specOpts, customopts.WithDevices(c.os, config), customopts.WithCapabilities(securityContext))
 		}
 	} else { // not privileged
 		specOpts = append(specOpts, customopts.WithDevices(c.os, config), customopts.WithCapabilities(securityContext))