Repository navigation
[Bug Bash] microVM: set containerd's default masked and read-only paths - #3249
Merged
Tim Hockin (thockin) merged 7 commits intoNov 1, 2026
Merged
Conversation
Huy Pham (hdp617)
changed the title
Huy Pham (hdp617)
force-pushed
the
microvm-masked-paths
branch
from
October 26, 2026 22:34
141aa70 to
f516aa1
Compare
Huy Pham (hdp617)
marked this pull request as ready for review
October 26, 2026 23:18
Benjamin Elder (BenTheElder)
added
area/microVM
area/security
Walter Fender (cheftako)
left a comment
Walter Fender (cheftako)
left a comment
Contributor
There was a problem hiding this comment.
Before this change a uid 0 container could tune guest sysctls at runtime, such as sysctl -w vm.max_map_count=..., vm.overcommit_memory or net.core.somaxconn. Entrypoints that do this and exit on failure will now crash. So if we want this change we should get it in prior to GA.
Huy Pham (hdp617)
force-pushed
the
microvm-masked-paths
branch
from
October 27, 2026 20:25
a41525b to
9d5ee4a
Compare
Contributor
Author
That's fair. I added a note to the PR description for this. |
Contributor
|
/lgtm |
16 of 23 tasks
Huy Pham (hdp617)
force-pushed
the
microvm-masked-paths
branch
from
October 31, 2026 04:08
626fdd2 to
276d6b6
Compare
Tim Hockin (thockin)
previously approved these changes
Oct 31, 2026
Tim Hockin (thockin)
left a comment
Tim Hockin (thockin)
left a comment
Collaborator
There was a problem hiding this comment.
I am approving -- Benjamin Elder (@BenTheElder) do we wait for dirs, too or merge this and consider followup. This is a subtle area.
A uid 0 container is root in the guest kernel, and with no read-only paths it could write the guest's /proc/sys. Signed-off-by: Huy Pham <[email protected]>
Any error passed before, so the test could pass when the write failed for another reason. Signed-off-by: Huy Pham <[email protected]>
Also list the read-only paths one per line, like the masked paths. Signed-off-by: Huy Pham <[email protected]>
The gVisor write now has to fail with permission denied, so an error like ENOENT no longer passes. On microVM, /proc/interrupts has to read as empty, which shows the /dev/null mask is in force. Signed-off-by: Huy Pham <[email protected]>
Signed-off-by: Huy Pham <[email protected]>
Signed-off-by: Huy Pham <[email protected]>
Huy Pham (hdp617)
force-pushed
the
microvm-masked-paths
branch
from
November 1, 2026 00:33
276d6b6 to
8e16eda
Compare
Contributor
Author
Thanks for looking into this. I think we should just do dirs now; I've adjusted the PR. |
Benjamin Elder (BenTheElder)
previously approved these changes
Nov 1, 2026
Benjamin Elder (BenTheElder)
left a comment
Benjamin Elder (BenTheElder)
left a comment
Collaborator
There was a problem hiding this comment.
Non-blocking follow-ups. Thanks!
Collaborator
Pass goarch into guestMaskedDirPaths so both arches are unit tested, and say ShapeMicroVM applies a subset of containerd's masked paths. Signed-off-by: Huy Pham <[email protected]>
Tim Hockin (thockin)
approved these changes
Nov 1, 2026
1 of 2 tasks
Dmitry Berkovich (dberkov)
pushed a commit
that referenced
this pull request
Nov 2, 2026
…hs (#3249) <!-- The PR title becomes the release note. Write it for users. --> > Why is this needed? (Or link the issue. Open one first for features, API, install or CI changes.) On microVM, an actor’s container runs as uid 0 in the guest kernel. Before this PR, the worker sent kata-agent empty masked and read-only path lists. That left the guest’s `/proc/sys` writable: the kernel lets uid 0 write sysctls without any capability. The kata-agent skips masked paths that are directories. Of the five directories, only `/proc/acpi` and `/sys/firmware` exist in the kata 4.3.1 guest kernel. We mount read-only tmpfs similar to [runc](https://github.com/opencontainers/runc/blob/4ca628d1d4c974f92d24daccb901aa078aad748e/libcontainer/rootfs_linux.go#L1250-L1258). **Breaking change**: a uid 0 entrypoint can no longer write guest sysctls, such as `sysctl -w vm.max_map_count=...`. This already fails on gVisor. Goldens and checkpoints taken before this change keep a writable `/proc/sys` until they are re-taken. Part of #3226. <!-- e.g. "AI-assisted, I reviewed and tested it." No AI co-author trailers. --> AI use: AI-assisted, I reviewed and tested it. <!-- Breaking change? Describe what users must do on upgrade and ask for the `breaking-change` label. --> - [x] Tests pass - [ ] Docs updated --------- Signed-off-by: Huy Pham <[email protected]> (cherry picked from commit 4488a66) Signed-off-by: Eitan Yarmush <[email protected]>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
On microVM, an actor’s container runs as uid 0 in the guest kernel. Before this PR, the worker sent kata-agent empty masked and read-only path lists. That left the guest’s
/proc/syswritable: the kernel lets uid 0 write sysctls without any capability.The kata-agent skips masked paths that are directories. Of the five directories, only
/proc/acpiand/sys/firmwareexist in the kata 4.3.1 guest kernel. We mount read-only tmpfs similar to runc.Breaking change: a uid 0 entrypoint can no longer write guest sysctls, such as
sysctl -w vm.max_map_count=.... This already fails on gVisor. Goldens and checkpoints taken before this change keep a writable/proc/sysuntil they are re-taken.Part of #3226.
AI use: AI-assisted, I reviewed and tested it.