From d06158e9d9ab4a706ca72a4940e7acb5fc25697d Mon Sep 17 00:00:00 2001 From: Guillaume Abrioux Date: Thu, 21 Nov 2019 16:28:42 +0100 Subject: [PATCH] nfs: do not run privileged nfs container At the moment, we bindmount the dbus socket from the host, this requires to run the container with --privileged. Since we now run a dedicated dbus daemon inside the same container, we can stop running privileged nfs-ganesha containers Related ceph-container PR : ceph/ceph-container#1517 Closes: https://bugzilla.redhat.com/show_bug.cgi?id=1725254 Signed-off-by: Guillaume Abrioux --- roles/ceph-nfs/templates/ceph-nfs.service.j2 | 4 ---- 1 file changed, 4 deletions(-) diff --git a/roles/ceph-nfs/templates/ceph-nfs.service.j2 b/roles/ceph-nfs/templates/ceph-nfs.service.j2 index 459689ef8..3f64ce058 100644 --- a/roles/ceph-nfs/templates/ceph-nfs.service.j2 +++ b/roles/ceph-nfs/templates/ceph-nfs.service.j2 @@ -18,10 +18,6 @@ ExecStart=/usr/bin/{{ container_binary }} run --rm --net=host \ -v /etc/ganesha:/etc/ganesha:z \ -v /var/run/ceph:/var/run/ceph:z \ -v /var/log/ceph:/var/log/ceph:z \ - {% if ceph_nfs_dynamic_exports %} - --privileged \ - -v /var/run/dbus/system_bus_socket:/var/run/dbus/system_bus_socket \ - {% endif -%} -v /etc/localtime:/etc/localtime:ro \ -e CLUSTER={{ cluster }} \ -e CEPH_DAEMON=NFS \