e0f8c04dad
CRI container runtimes mount devices (set via kubernetes device plugins) to containers by taking the host user/group IDs (uid/gid) to the corresponding container device. This triggers a problem when trying to run those containers with non-zero (root uid/gid = 0) uid/gid set via runAsUser/runAsGroup: the container process has no permission to use the device even when its gid is permissive to non-root users because the container user does not belong to that group. It is possible to workaround the problem by manually adding the device gid(s) to supplementalGroups. However, this is also problematic because the device gid(s) may have different values depending on the workers' distro/version in the cluster. This patch suggests to take RunAsUser/RunAsGroup set via SecurityContext as the device UID/GID, respectively. The feature must be enabled by setting device_ownership_from_security_context runtime config value to true (valid on Linux only). Signed-off-by: Mikko Ylinen <mikko.ylinen@intel.com>
60 lines
1.8 KiB
Go
60 lines
1.8 KiB
Go
//go:build !linux && !windows
|
|
// +build !linux,!windows
|
|
|
|
/*
|
|
Copyright The containerd Authors.
|
|
|
|
Licensed under the Apache License, Version 2.0 (the "License");
|
|
you may not use this file except in compliance with the License.
|
|
You may obtain a copy of the License at
|
|
|
|
http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
Unless required by applicable law or agreed to in writing, software
|
|
distributed under the License is distributed on an "AS IS" BASIS,
|
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
See the License for the specific language governing permissions and
|
|
limitations under the License.
|
|
*/
|
|
|
|
package oci
|
|
|
|
import (
|
|
"context"
|
|
|
|
"github.com/containerd/containerd/containers"
|
|
)
|
|
|
|
// WithHostDevices adds all the hosts device nodes to the container's spec
|
|
func WithHostDevices(_ context.Context, _ Client, _ *containers.Container, s *Spec) error {
|
|
setLinux(s)
|
|
|
|
devs, err := HostDevices()
|
|
if err != nil {
|
|
return err
|
|
}
|
|
s.Linux.Devices = append(s.Linux.Devices, devs...)
|
|
return nil
|
|
}
|
|
|
|
// WithDevices recursively adds devices from the passed in path.
|
|
// If devicePath is a dir it traverses the dir to add all devices in that dir.
|
|
// If devicePath is not a dir, it attempts to add the single device.
|
|
func WithDevices(devicePath, containerPath, permissions string) SpecOpts {
|
|
return func(_ context.Context, _ Client, _ *containers.Container, s *Spec) error {
|
|
devs, err := getDevices(devicePath, containerPath)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
s.Linux.Devices = append(s.Linux.Devices, devs...)
|
|
return nil
|
|
}
|
|
}
|
|
|
|
// WithCPUCFS sets the container's Completely fair scheduling (CFS) quota and period
|
|
func WithCPUCFS(quota int64, period uint64) SpecOpts {
|
|
return func(ctx context.Context, _ Client, c *containers.Container, s *Spec) error {
|
|
return nil
|
|
}
|
|
}
|