Dockerfile

@@ -1,6 +1,6 @@
-FROM registry.fedoraproject.org/fedora:28
+FROM registry.fedoraproject.org/fedora:rawhide
 
-ENV VERSION=0 RELEASE=15 ARCH=x86_64
+ENV VERSION=0 RELEASE=4 ARCH=x86_64
 LABEL com.redhat.component="cri-o" \
       name="$FGC/cri-o" \
       version="$VERSION" \
@@ -13,13 +13,15 @@ LABEL com.redhat.component="cri-o" \
 
 COPY README.md /
 
-RUN dnf install --setopt=tsflags=nodocs -y iptables cri-o socat iproute runc  && \
+RUN dnf install --setopt=tsflags=nodocs -y iptables cri-o iproute runc && \
     rpm -V iptables cri-o iproute runc && \
     dnf clean all && \
     mkdir -p /exports/hostfs/etc/crio /exports/hostfs/opt/cni/bin/ /exports/hostfs/var/lib/containers/storage/ && \
     cp /etc/crio/* /exports/hostfs/etc/crio && \
     if test -e /usr/libexec/cni; then cp -Lr /usr/libexec/cni/* /exports/hostfs/opt/cni/bin/; fi
 
+RUN sed -i '/storage_option =/s/.*/&\n"overlay.override_kernel_check=1",/' /exports/hostfs/etc/crio/crio.conf
+
 COPY manifest.json tmpfiles.template config.json.template service.template /exports/
 
 COPY set_mounts.sh /

config.json.template

@@ -258,17 +258,6 @@
             "source": "/tmp",
             "type": "bind"
         },
-        {
-            "destination": "/var/tmp",
-            "options": [
-                "private",
-                "bind",
-                "rw",
-                "mode=755"
-            ],
-            "source": "/var/tmp",
-            "type": "bind"
-        },
         {
             "destination": "/etc",
             "options": [
@@ -302,6 +291,28 @@
             "source": "/root",
             "type": "bind"
         },
+        {
+            "destination": "/home",
+            "options": [
+                "rbind",
+                "rprivate",
+                "rw",
+                "mode=755"
+            ],
+            "source": "/home",
+            "type": "bind"
+        },
+        {
+            "destination": "/mnt",
+            "options": [
+                "rbind",
+                "rw",
+                "rprivate",
+                "mode=755"
+            ],
+            "source": "/mnt",
+            "type": "bind"
+        },
 	{
 	    "type": "bind",
 	    "source": "${RUN_DIRECTORY}",
@@ -379,7 +390,7 @@
             "options": [
                 "rbind",
                 "rprivate",
-                "rw",
+                "ro",
                 "mode=755"
             ],
             "source": "${OPT_CNI}",
@@ -396,16 +407,6 @@
             "source": "/dev",
             "type": "bind"
         },
-        {
-            "destination": "/host",
-            "options": [
-                "rbind",
-                "rshared",
-                "rw"
-            ],
-            "source": "/",
-            "type": "bind"
-        },
         {
             "destination": "/sys",
             "options": [
@@ -427,6 +428,5 @@
             "source": "/proc",
             "type": "proc"
         }
-        $ADDTL_MOUNTS
     ]
 }

manifest.json

@@ -5,7 +5,6 @@
         "OPT_CNI" : "/opt/cni",
         "VAR_LIB_CONTAINERS_STORAGE" : "/var/lib/containers/storage",
         "VAR_LIB_ORIGIN" : "/var/lib/origin",
-        "VAR_LIB_KUBE" : "/var/lib/kubelet",
-        "ADDTL_MOUNTS" : ""
+        "VAR_LIB_KUBE" : "/var/lib/kubelet"
     }
 }

run.sh

@@ -8,4 +8,4 @@ printf %s $LABEL > /proc/self/attr/exec
 test -e /etc/sysconfig/crio-storage && source /etc/sysconfig/crio-storage
 test -e /etc/sysconfig/crio-network && source /etc/sysconfig/crio-network
 
-exec /usr/bin/crio --bind-mount-prefix=/host --log-level=$LOG_LEVEL
+exec /usr/bin/crio --log-level=$LOG_LEVEL