github/containerd
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases 2 Wiki Activity
12,181 Commits 3 Branches 2 Tags 112 MiB
master
Commit Graph

14 Commits

Author SHA1 Message Date
Akihiro Suda
3eda46af12
oci: fix additional GIDs 
Test suite:
```yaml

---
apiVersion: v1
kind: Pod
metadata:
  name: test-no-option
  annotations:
    description: "Equivalent of `docker run` (no option)"
spec:
  restartPolicy: Never
  containers:
    - name: main
      image: ghcr.io/containerd/busybox:1.28
      args: ['sh', '-euxc',
             '[ "$(id)" = "uid=0(root) gid=0(root) groups=0(root),10(wheel)" ]']
---
apiVersion: v1
kind: Pod
metadata:
  name: test-group-add-1-group-add-1234
  annotations:
    description: "Equivalent of `docker run --group-add 1 --group-add 1234`"
spec:
  restartPolicy: Never
  containers:
    - name: main
      image: ghcr.io/containerd/busybox:1.28
      args: ['sh', '-euxc',
             '[ "$(id)" = "uid=0(root) gid=0(root) groups=0(root),1(daemon),10(wheel),1234" ]']
  securityContext:
    supplementalGroups: [1, 1234]
---
apiVersion: v1
kind: Pod
metadata:
  name: test-user-1234
  annotations:
    description: "Equivalent of `docker run --user 1234`"
spec:
  restartPolicy: Never
  containers:
    - name: main
      image: ghcr.io/containerd/busybox:1.28
      args: ['sh', '-euxc',
             '[ "$(id)" = "uid=1234 gid=0(root) groups=0(root)" ]']
  securityContext:
    runAsUser: 1234
---
apiVersion: v1
kind: Pod
metadata:
  name: test-user-1234-1234
  annotations:
    description: "Equivalent of `docker run --user 1234:1234`"
spec:
  restartPolicy: Never
  containers:
    - name: main
      image: ghcr.io/containerd/busybox:1.28
      args: ['sh', '-euxc',
             '[ "$(id)" = "uid=1234 gid=1234 groups=1234" ]']
  securityContext:
    runAsUser: 1234
    runAsGroup: 1234
---
apiVersion: v1
kind: Pod
metadata:
  name: test-user-1234-group-add-1234
  annotations:
    description: "Equivalent of `docker run --user 1234 --group-add 1234`"
spec:
  restartPolicy: Never
  containers:
    - name: main
      image: ghcr.io/containerd/busybox:1.28
      args: ['sh', '-euxc',
             '[ "$(id)" = "uid=1234 gid=0(root) groups=0(root),1234" ]']
  securityContext:
    runAsUser: 1234
    supplementalGroups: [1234]
```

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
 2023-02-10 15:53:00 +09:00
Akihiro Suda
ef2560d166
oci: fix loop iterator aliasing 
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
 2023-02-10 15:53:00 +09:00
Gavin Inglis
81bbd9daca add option to resolve symlinks to linux device 
This change modifies WithLinuxDevice to take an option `followSymlink`
and be unexported as `withLinuxDevice`. An option
`WithLinuxDeviceFollowSymlinks` will call this unexported option to
follow a symlink, which will resolve a symlink before calling
`DeviceFromPath`. `WithLinuxDevice` has been changed to call
`withLinuxDevice` without following symlinks.

Signed-off-by: Gavin Inglis <giinglis@amazon.com>
 2022-11-03 20:23:25 +00:00
Sebastiaan van Stijn
29c7fc9520
clean-up "nolint" comments, remove unused ones 
- fix "nolint" comments to be in the correct format (`//nolint:<linters>[,<linter>`
  no leading space, required colon (`:`) and linters.
- remove "nolint" comments for errcheck, which is disabled in our config.
- remove "nolint" comments that were no longer needed (nolintlint).
- where known, add a comment describing why a "nolint" was applied.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2022-10-12 14:40:59 +02:00
Ye Sijun
2dbff1dbca
oci: skip checking gid for WithAppendAdditionalGroups 
Signed-off-by: Ye Sijun <junnplus@gmail.com>
 2022-08-06 00:57:19 +08:00
Ye Sijun
1ab42be15d
refactor: reduce duplicate code 
Signed-off-by: Ye Sijun <junnplus@gmail.com>
 2022-06-25 18:55:03 +08:00
Fu Wei
a860e6680e
Merge pull request #7072 from junnplus/test-specopts 2022-06-22 15:12:00 +08:00
Ye Sijun
72b87ad004
add WithAdditionalGIDs test 
Signed-off-by: Ye Sijun <junnplus@gmail.com>
 2022-06-21 23:58:19 +08:00
Ye Sijun
5bf705255d
add WithAppendAdditionalGroups helper 
Signed-off-by: Ye Sijun <junnplus@gmail.com>
 2022-06-21 23:21:04 +08:00
Andrew G. Morgan
6906b57c72
Fix the Inheritable capability defaults. 
The Linux kernel never sets the Inheritable capability flag to
anything other than empty. Non-empty values are always exclusively
set by userspace code.

[The kernel stopped defaulting this set of capability values to the
 full set in 2000 after a privilege escalation with Capabilities
 affecting Sendmail and others.]

Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
 2022-02-01 13:55:46 -08:00
Eng Zer Jun
50da673592
refactor: move from io/ioutil to io and os package 
The io/ioutil package has been deprecated as of Go 1.16, see
https://golang.org/doc/go1.16#ioutil. This commit replaces the existing
io/ioutil functions with their new definitions in io and os packages.

Signed-off-by: Eng Zer Jun <engzerjun@gmail.com>
 2021-09-21 09:50:38 +08:00
Alexandre Peixoto Ferreira
838afd2116 Adding testing of two devices 
Signed-off-by: Alexandre Peixoto Ferreira <alexandref75@gmail.com>
 2021-08-30 11:28:43 -05:00
Brian Goff
7776e5ef2a Support adding devices by dir 
This enables cases where devices exist in a subdirectory of /dev,
particularly where those device names are not portable across machines,
which makes it problematic to specify from a runtime such as cri.

Added this to `ctr` as well so I could test that the code at least
works.

Signed-off-by: Brian Goff <cpuguy83@gmail.com>
 2021-03-15 16:42:23 +00:00
Akihiro Suda
51f985cb1f
oci: move cap UT to _linux_test.go 
No substantial code change

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
 2021-02-10 17:42:18 +09:00