Introduce requirements.privileged

doc/api-extensions.md

@@ -2271,3 +2271,7 @@ no effect on existing devices.
 This API extension indicates that the `/1.0/operations/{id}/wait` endpoint exists on the server. This indicates to the client
 that the endpoint can be used to wait for an operation to complete rather than waiting for an operation event via the
 `/1.0/events` endpoint.
+
+## `image_restriction_privileged`
+
+This extension adds a new image restriction, `requirements.privileged` which when `false` indicates that an image cannot be run in a privileged container.

doc/image-handling.md

@@ -56,5 +56,6 @@ The following requirements are supported:
 
 Key                                         | Type      | Default      | Description
 :--                                         | :---      | :------      | :----------
-`requirements.secureboot`                   | string    | -            | If set to `false`, indicates that the image cannot boot under secure boot.
 `requirements.cgroup`                       | string    | -            | If set to `v1`, indicates that the image requires the host to run cgroup v1.
+`requirements.privileged`                   | bool      | -            | If set to `false`, indicates that the image cannot work as a privileged container.
+`requirements.secureboot`                   | bool      | -            | If set to `false`, indicates that the image cannot boot under secure boot.

internal/server/instance/drivers/driver_lxc.go

@@ -1916,6 +1916,11 @@ func (d *lxc) startCommon() (string, []func() error, error) {
 		return "", nil, fmt.Errorf("The image used by this instance requires a CGroupV1 host system")
 	}
 
+	// Ensure privileged is turned off for images that cannot work privileged
+	if util.IsFalse(d.localConfig["image.requirements.privileged"]) && util.IsTrue(d.expandedConfig["security.privileged"]) {
+		return "", nil, fmt.Errorf("The image used by this instance is incompatible with privileged containers. Please unset security.privileged on the instance")
+	}
+
 	// Load any required kernel modules
 	kernelModules := d.expandedConfig["linux.kernel_modules"]
 	if kernelModules != "" {

internal/version/api.go

@@ -381,6 +381,7 @@ var APIExtensions = []string{
 	"instances_nic_limits_priority",
 	"disk_initial_volume_configuration",
 	"operation_wait",
+	"image_restriction_privileged",
 }
 
 // APIExtensionsCount returns the number of available API extensions.