Merge pull request #2361 from masters-of-cats/no-new-keyring

Implement WithNoNewKeyring

task_opts_linux.go

@@ -18,7 +18,9 @@ package containerd
 
 import (
 	"context"
+	"errors"
 
+	"github.com/containerd/containerd/linux/runctypes"
 	"github.com/opencontainers/runtime-spec/specs-go"
 )
 
@@ -29,3 +31,18 @@ func WithResources(resources *specs.LinuxResources) UpdateTaskOpts {
 		return nil
 	}
 }
+
+// WithNoNewKeyring causes tasks not to be created with a new keyring for secret storage.
+// There is an upper limit on the number of keyrings in a linux system
+func WithNoNewKeyring(ctx context.Context, c *Client, ti *TaskInfo) error {
+	if ti.Options == nil {
+		ti.Options = &runctypes.CreateOptions{}
+	}
+	opts, ok := ti.Options.(*runctypes.CreateOptions)
+	if !ok {
+		return errors.New("could not cast TaskInfo Options to CreateOptions")
+	}
+
+	opts.NoNewKeyring = true
+	return nil
+}

task_opts_linux_test.go

@@ -0,0 +1,61 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package containerd
+
+import (
+	"context"
+	"testing"
+
+	"github.com/containerd/containerd/linux/runctypes"
+)
+
+func TestWithNoNewKeyringAddsNoNewKeyringToOptions(t *testing.T) {
+	var taskInfo TaskInfo
+	var ctx context.Context
+	var client Client
+
+	err := WithNoNewKeyring(ctx, &client, &taskInfo)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	opts := taskInfo.Options.(*runctypes.CreateOptions)
+
+	if !opts.NoNewKeyring {
+		t.Fatal("NoNewKeyring set on WithNoNewKeyring")
+	}
+
+}
+
+func TestWithNoNewKeyringDoesNotOverwriteOtherOptions(t *testing.T) {
+	var taskInfo TaskInfo
+	var ctx context.Context
+	var client Client
+
+	taskInfo.Options = &runctypes.CreateOptions{NoPivotRoot: true}
+
+	err := WithNoNewKeyring(ctx, &client, &taskInfo)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	opts := taskInfo.Options.(*runctypes.CreateOptions)
+
+	if !opts.NoPivotRoot {
+		t.Fatal("WithNoNewKeyring overwrote other options")
+	}
+}