chown cgroup only when new cgroupns also specified

opencontainers · Sep 23, 2021 · 183dd28 · 183dd28
1 parent e1d1e87
commit 183dd28
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/config-linux.md b/config-linux.md
@@ -206,6 +206,11 @@ Runtimes SHOULD NOT change the ownership of container cgroups when
 cgroups v1 is in use.  Cgroup delegation is not secure in cgroups
 v1.
 
+A runtime SHOULD NOT change the ownership of a container cgroup
+unless it will also create a new cgroup namespace for the container.
+Typically this occurs when the `linux.namespaces` array contains an
+object with `type` equal to `"cgroup"` and `path` unset.
+
 Runtimes SHOULD change the cgroup ownership if and only if the
 cgroup filesystem is to be mounted read/write; that is, when the
 configuration's `mounts` array contains an object where: