
runc, as mandated by the runtime-spec, ignores unknown fields in the config.json. This is unfortunate for cases where we _must_ enable that feature or fail. For example, if we want to start a container with user namespaces and volumes, using the uidMappings/gidMappings field is needed so the UID/GIDs in the volume don't end up with garbage. However, if we don't fail when runc will ignore these fields (because they are unknown to runc), we will just start a container without using the mappings and the UID/GIDs the container will persist to volumes the hostUID/GID, that can change if the container is re-scheduled by Kubernetes. This will end up in volumes having "garbage" and unmapped UIDs that the container can no longer change. So, let's avoid this entirely by just checking that runc supports idmap mounts if the container we are about to create needs them. Please note that the "runc features" subcommand is only run when we are using idmap mounts. If idmap mounts are not used, the subcommand is not run and therefore this should not affect containers that don't use idmap mounts in any way. Signed-off-by: Rodrigo Campos <rodrigoca@microsoft.com>
211 lines
4.6 KiB
Go
211 lines
4.6 KiB
Go
//go:build !windows
|
|
|
|
/*
|
|
Copyright The containerd Authors.
|
|
|
|
Licensed under the Apache License, Version 2.0 (the "License");
|
|
you may not use this file except in compliance with the License.
|
|
You may obtain a copy of the License at
|
|
|
|
http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
Unless required by applicable law or agreed to in writing, software
|
|
distributed under the License is distributed on an "AS IS" BASIS,
|
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
See the License for the specific language governing permissions and
|
|
limitations under the License.
|
|
*/
|
|
|
|
package process
|
|
|
|
import (
|
|
"context"
|
|
"encoding/json"
|
|
"errors"
|
|
"fmt"
|
|
"io"
|
|
"os"
|
|
"path/filepath"
|
|
"strings"
|
|
"sync"
|
|
"time"
|
|
|
|
"github.com/containerd/containerd/errdefs"
|
|
runc "github.com/containerd/go-runc"
|
|
specs "github.com/opencontainers/runtime-spec/specs-go"
|
|
"golang.org/x/sys/unix"
|
|
)
|
|
|
|
const (
|
|
// RuncRoot is the path to the root runc state directory
|
|
RuncRoot = "/run/containerd/runc"
|
|
// InitPidFile name of the file that contains the init pid
|
|
InitPidFile = "init.pid"
|
|
// configFile is the name of the runc config file
|
|
configFile = "config.json"
|
|
)
|
|
|
|
// safePid is a thread safe wrapper for pid.
|
|
type safePid struct {
|
|
sync.Mutex
|
|
pid int
|
|
}
|
|
|
|
func (s *safePid) get() int {
|
|
s.Lock()
|
|
defer s.Unlock()
|
|
return s.pid
|
|
}
|
|
|
|
// TODO(mlaventure): move to runc package?
|
|
func getLastRuntimeError(r *runc.Runc) (string, error) {
|
|
if r.Log == "" {
|
|
return "", nil
|
|
}
|
|
|
|
f, err := os.OpenFile(r.Log, os.O_RDONLY, 0400)
|
|
if err != nil {
|
|
return "", err
|
|
}
|
|
defer f.Close()
|
|
|
|
var (
|
|
errMsg string
|
|
log struct {
|
|
Level string
|
|
Msg string
|
|
Time time.Time
|
|
}
|
|
)
|
|
|
|
dec := json.NewDecoder(f)
|
|
for err = nil; err == nil; {
|
|
if err = dec.Decode(&log); err != nil && err != io.EOF {
|
|
return "", err
|
|
}
|
|
if log.Level == "error" {
|
|
errMsg = strings.TrimSpace(log.Msg)
|
|
}
|
|
}
|
|
|
|
return errMsg, nil
|
|
}
|
|
|
|
// criuError returns only the first line of the error message from criu
|
|
// it tries to add an invalid dump log location when returning the message
|
|
func criuError(err error) string {
|
|
parts := strings.Split(err.Error(), "\n")
|
|
return parts[0]
|
|
}
|
|
|
|
func copyFile(to, from string) error {
|
|
ff, err := os.Open(from)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
defer ff.Close()
|
|
tt, err := os.Create(to)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
defer tt.Close()
|
|
|
|
p := bufPool.Get().(*[]byte)
|
|
defer bufPool.Put(p)
|
|
_, err = io.CopyBuffer(tt, ff, *p)
|
|
return err
|
|
}
|
|
|
|
func checkKillError(err error) error {
|
|
if err == nil {
|
|
return nil
|
|
}
|
|
if strings.Contains(err.Error(), "os: process already finished") ||
|
|
strings.Contains(err.Error(), "container not running") ||
|
|
strings.Contains(strings.ToLower(err.Error()), "no such process") ||
|
|
err == unix.ESRCH {
|
|
return fmt.Errorf("process already finished: %w", errdefs.ErrNotFound)
|
|
} else if strings.Contains(err.Error(), "does not exist") {
|
|
return fmt.Errorf("no such container: %w", errdefs.ErrNotFound)
|
|
}
|
|
return fmt.Errorf("unknown error after kill: %w", err)
|
|
}
|
|
|
|
func newPidFile(bundle string) *pidFile {
|
|
return &pidFile{
|
|
path: filepath.Join(bundle, InitPidFile),
|
|
}
|
|
}
|
|
|
|
func newExecPidFile(bundle, id string) *pidFile {
|
|
return &pidFile{
|
|
path: filepath.Join(bundle, fmt.Sprintf("%s.pid", id)),
|
|
}
|
|
}
|
|
|
|
type pidFile struct {
|
|
path string
|
|
}
|
|
|
|
func (p *pidFile) Path() string {
|
|
return p.path
|
|
}
|
|
|
|
func (p *pidFile) Read() (int, error) {
|
|
return runc.ReadPidFile(p.path)
|
|
}
|
|
|
|
// waitTimeout handles waiting on a waitgroup with a specified timeout.
|
|
// this is commonly used for waiting on IO to finish after a process has exited
|
|
func waitTimeout(ctx context.Context, wg *sync.WaitGroup, timeout time.Duration) error {
|
|
ctx, cancel := context.WithTimeout(ctx, timeout)
|
|
defer cancel()
|
|
done := make(chan struct{})
|
|
go func() {
|
|
wg.Wait()
|
|
close(done)
|
|
}()
|
|
select {
|
|
case <-done:
|
|
return nil
|
|
case <-ctx.Done():
|
|
return ctx.Err()
|
|
}
|
|
}
|
|
|
|
func stateName(v interface{}) string {
|
|
switch v.(type) {
|
|
case *runningState, *execRunningState:
|
|
return "running"
|
|
case *createdState, *execCreatedState, *createdCheckpointState:
|
|
return "created"
|
|
case *pausedState:
|
|
return "paused"
|
|
case *deletedState:
|
|
return "deleted"
|
|
case *stoppedState:
|
|
return "stopped"
|
|
}
|
|
panic(fmt.Errorf("invalid state %v", v))
|
|
}
|
|
|
|
func readConfig(path string) (spec *specs.Spec, err error) {
|
|
cfg := filepath.Join(path, configFile)
|
|
f, err := os.Open(cfg)
|
|
if err != nil {
|
|
if os.IsNotExist(err) {
|
|
return nil, fmt.Errorf("JSON specification file %s not found", cfg)
|
|
}
|
|
return nil, err
|
|
}
|
|
defer f.Close()
|
|
|
|
if err = json.NewDecoder(f).Decode(&spec); err != nil {
|
|
return nil, fmt.Errorf("failed to parse config: %w", err)
|
|
}
|
|
if spec == nil {
|
|
return nil, errors.New("config cannot be null")
|
|
}
|
|
return spec, nil
|
|
}
|