container: raise CAP_DAC_OVERRIDE

This is required for upperdir and workdir checks in overlayfs. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-08-08 00:43:19 +09:00
parent b353c3deea
commit f1a53d6116
2 changed files with 4 additions and 3 deletions
--- a/container/container.go
+++ b/container/container.go
@@ -146,7 +146,7 @@ func (p *Container) Start() error {
 			CLONE_NEWIPC | CLONE_NEWUTS | CLONE_NEWCGROUP,

 		// remain privileged for setup
-		AmbientCaps: []uintptr{CAP_SYS_ADMIN, CAP_SETPCAP},
+		AmbientCaps: []uintptr{CAP_SYS_ADMIN, CAP_SETPCAP, CAP_DAC_OVERRIDE},

 		UseCgroupFD: p.Cgroup != nil,
 	}