Commit Graph

7 Commits

Author SHA1 Message Date
Akihiro Suda
9ffb34ac49 Merge pull request #9054 from macOScontainers/canonicalize-filter-mount-path
Fix usages of `mountinfo.PrefixFilter`
2023-09-27 05:10:27 +09:00
Derek McGowan
508aa3a1ef Move to use github.com/containerd/log
Add github.com/containerd/log to go.mod

Signed-off-by: Derek McGowan <derek@mcg.dev>
2023-09-22 07:53:23 -07:00
Marat Radchenko
d94a789d15 Fix usages of mountinfo.PrefixFilter
It says: The prefix path **must be absolute, have all symlinks resolved, and cleaned**. But those requirements are violated in lots of places.

What happens when it is given a non-canonicalized path is that `mountinfo.GetMounts` will not find mounts.

The trivial case is:
```
$ mkdir a && ln -s a b && mkdir b/c b/d && mount --bind b/c b/d && cat /proc/mounts | grep -- '[ab]/d'
/dev/sdd3 /home/user/a/d ext4 rw,noatime,discard 0 0
```
We asked to bind-mount b/c to b/d, but ended up with mount in a/d.
So, mount table always contains canonicalized mount points, and it is an error to look for non-canonicalized paths in it.

Signed-off-by: Marat Radchenko <marat@slonopotamus.org>
2023-09-10 15:14:26 +03:00
Rodrigo Campos
36a96d7f32 cri/sbserver: Remap snapshots for sbserver too
This is a port of 31a6449734 ("Add capability for snapshotters to
declare support for UID remapping") to sbserver.

This patch remaps the rootfs in the platform-specific if user namespaces
are in use, so the pod can read/write to the rootfs.

Signed-off-by: Rodrigo Campos <rodrigoca@microsoft.com>
2023-07-11 15:15:22 +02:00
Rodrigo Campos
73c75e2c73 cri/sbserver: Copy userns helpers to podsandbox
Currently there is a big c&p of the helpers between these two folders
and a TODO in the platform agnostic file to organize them in the future,
when some other things settle.

So, let's just copy them for now.

Signed-off-by: Rodrigo Campos <rodrigoca@microsoft.com>
2023-07-11 15:14:12 +02:00
Maksym Pavlenko
3d028308ef Cleanup CRI files
Signed-off-by: Maksym Pavlenko <pavlenko.maksym@gmail.com>
2022-07-29 16:08:07 -07:00
Maksym Pavlenko
c085fac1e5 Move sandbox start behind controller
Signed-off-by: Maksym Pavlenko <pavlenko.maksym@gmail.com>
2022-07-29 16:08:07 -07:00