Do not set devices cgroup when updating containers to avoid eBPF prog…

…rams leak
opencontainers · Mar 28, 2021 · ce04524 · ce04524
1 parent 3505f15
commit ce04524
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/update.go b/update.go
@@ -327,6 +327,9 @@ other options are ignored.
 			config.IntelRdt.MemBwSchema = memBwSchema
 		}
 
+		// Do not set devices cgroup when updating containers to avoid eBPF programs leak
+		config.Cgroups.SkipDevices = true
+
 		return container.Set(config)
 	},
 }