From 018d83650fd4b23d61cd7af381ea5123935005c6 Mon Sep 17 00:00:00 2001 From: Wei Fu Date: Wed, 4 Dec 2024 20:21:08 +0000 Subject: [PATCH] internal/cri: should not apply IoOwner options When kubelet enables UserNamespaceSupport feature gate, kubelet always uses non-empty UsernsOptions to setup pods. In this case, the gVisor shim is unable to parse runc.Option so that it will be unable to start container. This change is to avoid adding IoOwner options if the UsernsOptions is for node level. Since gVisor hasn't feature subcommand yet, CRI status will report that gVisor runtime doesn't support user namespace. So it's kind of workaround to avoid compatible issue. REF: #11091 Signed-off-by: Wei Fu --- internal/cri/server/container_start_linux.go | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/internal/cri/server/container_start_linux.go b/internal/cri/server/container_start_linux.go index 0f0a49cf0..6ef50a7fb 100644 --- a/internal/cri/server/container_start_linux.go +++ b/internal/cri/server/container_start_linux.go @@ -31,11 +31,19 @@ func updateContainerIOOwner(ctx context.Context, cntr containerd.Container, conf return nil, nil } - // FIXME(fuweid): Ideally, the pipe owner should be aligned with process owner. - // No matter what user namespace container uses, it should work well. However, - // it breaks the sig-node conformance case - [when querying /stats/summary should report resource usage through the stats api]. + // FIXME(fuweid): + // + // For builtin runc runtime, the pipe owner should be aligned with process + // owner. No matter what user namespace container uses, it should work + // well. + // + // However, gVisor runtime doesn't support runc.Options and no idea why + // adding options could breaks the sig-node conformance case [when querying /stats/summary should report resource usage through the stats api]. // In order to keep compatible, the change should apply to user namespace only. - if config.GetLinux().GetSecurityContext().GetNamespaceOptions().GetUsernsOptions() == nil { + // + // REF: https://github.com/containerd/containerd/issues/11091 + usernsOpts := config.GetLinux().GetSecurityContext().GetNamespaceOptions().GetUsernsOptions() + if usernsOpts == nil || usernsOpts.Mode == runtime.NamespaceMode_NODE { return nil, nil }