github/containerd
4
0
Fork 0
Code Issues Pull Requests Packages Projects Releases 2 Wiki Activity

Merge pull request #9218 from fuweid/followup-idmapped

Browse Source 
idmapped: use pidfd to avoid pid reuse issue
This commit is contained in:
Derek McGowan
2023-10-20 17:34:02 +00:00
committed by GitHub
parent e973109c2d 3742f7f0db
commit 788f7f248a
5 changed files with 406 additions and 99 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
snapshots/overlay/overlayutils/check.go
View File

@@ -255,13 +255,13 @@ func SupportsIDMappedMounts() (bool, error) {
uidmap := fmt.Sprintf("%d:%d:%d", uidMap.ContainerID, uidMap.HostID, uidMap.Size)
gidmap := fmt.Sprintf("%d:%d:%d", gidMap.ContainerID, gidMap.HostID, gidMap.Size)
usernsFd, childProcCleanUp, err := mount.GetUsernsFD(uidmap, gidmap)
usernsFd, err := mount.GetUsernsFD(uidmap, gidmap)
if err != nil {
return false, err
}
defer childProcCleanUp()
defer usernsFd.Close()
if err = mount.IDMapMount(lowerDir, lowerDir, usernsFd); err != nil {
if err = mount.IDMapMount(lowerDir, lowerDir, int(usernsFd.Fd())); err != nil {
return false, fmt.Errorf("failed to remap lowerdir %s: %w", lowerDir, err)
}
defer func() {