github/containerd
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases 2 Wiki Activity

Merge pull request #6478 from fuweid/enhance-no-sync-during-create

Browse Source 
oci: use readonly mount to read user/group info
This commit is contained in:
Derek McGowan 2022-01-31 10:35:51 -08:00 committed by GitHub
commit c2cb589221
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 26 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
oci/spec_opts.go
View File

@ -602,6 +602,8 @@ func WithUser(userstr string) SpecOpts {
if err != nil {
return err
}
mounts = tryReadonlyMounts(mounts)
return mount.WithTempMount(ctx, mounts, f)
default:
return fmt.Errorf("invalid USER value %s", userstr)
@ -655,6 +657,8 @@ func WithUserID(uid uint32) SpecOpts {
if err != nil {
return err
}
mounts = tryReadonlyMounts(mounts)
return mount.WithTempMount(ctx, mounts, func(root string) error {
user, err := UserFromPath(root, func(u user.User) bool {
return u.Uid == int(uid)
@ -706,6 +710,8 @@ func WithUsername(username string) SpecOpts {
if err != nil {
return err
}
mounts = tryReadonlyMounts(mounts)
return mount.WithTempMount(ctx, mounts, func(root string) error {
user, err := UserFromPath(root, func(u user.User) bool {
return u.Name == username
@ -790,6 +796,8 @@ func WithAdditionalGIDs(userstr string) SpecOpts {
if err != nil {
return err
}
mounts = tryReadonlyMounts(mounts)
return mount.WithTempMount(ctx, mounts, setAdditionalGids)
}
}
@ -1278,3 +1286,21 @@ func WithDevShmSize(kb int64) SpecOpts {
return ErrNoShmMount
}
}
// tryReadonlyMounts is used by the options which are trying to get user/group
// information from container's rootfs. Since the option does read operation
// only, this helper will append ReadOnly mount option to prevent linux kernel
// from syncing whole filesystem in umount syscall.
//
// TODO(fuweid):
//
// Currently, it only works for overlayfs. I think we can apply it to other
// kinds of filesystem. Maybe we can return `ro` option by `snapshotter.Mount`
// API, when the caller passes that experimental annotation
// `containerd.io/snapshot/readonly.mount` something like that.
func tryReadonlyMounts(mounts []mount.Mount) []mount.Mount {
if len(mounts) == 1 && mounts[0].Type == "overlay" {
mounts[0].Options = append(mounts[0].Options, "ro")
}
return mounts
}