github/containerd
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases 2 Wiki Activity

internal/cri: should not apply IoOwner options

Browse Source 
When kubelet enables UserNamespaceSupport feature gate, kubelet always
uses non-empty UsernsOptions to setup pods. In this case, the gVisor shim is
unable to parse runc.Option so that it will be unable to start container.

This change is to avoid adding IoOwner options if the UsernsOptions is
for node level. Since gVisor hasn't feature subcommand yet, CRI status
will report that gVisor runtime doesn't support user namespace. So it's
kind of workaround to avoid compatible issue.

REF: #11091

Signed-off-by: Wei Fu <fuweid89@gmail.com>
This commit is contained in:
Wei Fu 2024-12-04 20:21:08 +00:00 committed by k8s-infra-cherrypick-robot
parent d93ae6232a
commit 018d83650f
1 changed files with 12 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
internal/cri/server/container_start_linux.go
View File

@ -31,11 +31,19 @@ func updateContainerIOOwner(ctx context.Context, cntr containerd.Container, conf
return nil, nil return nil, nil
} }
// FIXME(fuweid): Ideally, the pipe owner should be aligned with process owner. // FIXME(fuweid):
// No matter what user namespace container uses, it should work well. However, //
// it breaks the sig-node conformance case - [when querying /stats/summary should report resource usage through the stats api]. // For builtin runc runtime, the pipe owner should be aligned with process
// owner. No matter what user namespace container uses, it should work
// well.
//
// However, gVisor runtime doesn't support runc.Options and no idea why
// adding options could breaks the sig-node conformance case [when querying /stats/summary should report resource usage through the stats api].
// In order to keep compatible, the change should apply to user namespace only. // In order to keep compatible, the change should apply to user namespace only.
if config.GetLinux().GetSecurityContext().GetNamespaceOptions().GetUsernsOptions() == nil { //
// REF: https://github.com/containerd/containerd/issues/11091
usernsOpts := config.GetLinux().GetSecurityContext().GetNamespaceOptions().GetUsernsOptions()
if usernsOpts == nil || usernsOpts.Mode == runtime.NamespaceMode_NODE {
return nil, nil return nil, nil
} }