Skip to content

Commit fd2e3cd

Browse files
crosbymichaelcrosbymichael
committed
Remove mount namespace from shim
Signed-off-by: Michael Crosby <[email protected]>
1 parent 07d4154 commit fd2e3cd

7 files changed

Lines changed: 19 additions & 27 deletions

File tree

‎cmd/containerd-stress/main.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -211,8 +211,8 @@ func (w *worker) runContainer(ctx context.Context, id string) error {
211211
// fix up cgroups path for a default config
212212
w.spec.Linux.CgroupsPath = filepath.Join("/", "stress", id)
213213
c, err := w.client.NewContainer(ctx, id,
214-
containerd.WithSpec(w.spec),
215214
containerd.WithNewSnapshot(id, w.image),
215+
containerd.WithSpec(w.spec, oci.WithUsername("games")),
216216
)
217217
if err != nil {
218218
return err

‎linux/bundle.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -75,10 +75,10 @@ type bundle struct {
7575
type ShimOpt func(*bundle, string, *runctypes.RuncOptions) (shim.Config, client.Opt)
7676

7777
// ShimRemote is a ShimOpt for connecting and starting a remote shim
78-
func ShimRemote(shimBinary, daemonAddress, cgroup string, nonewns, debug bool, exitHandler func()) ShimOpt {
78+
func ShimRemote(shimBinary, daemonAddress, cgroup string, debug bool, exitHandler func()) ShimOpt {
7979
return func(b *bundle, ns string, ropts *runctypes.RuncOptions) (shim.Config, client.Opt) {
8080
return b.shimConfig(ns, ropts),
81-
client.WithStart(shimBinary, b.shimAddress(ns), daemonAddress, cgroup, nonewns, debug, exitHandler)
81+
client.WithStart(shimBinary, b.shimAddress(ns), daemonAddress, cgroup, debug, exitHandler)
8282
}
8383
}
8484

‎linux/runtime.go‎

Lines changed: 1 addition & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -78,17 +78,6 @@ type Config struct {
7878
NoShim bool `toml:"no_shim"`
7979
// Debug enable debug on the shim
8080
ShimDebug bool `toml:"shim_debug"`
81-
// ShimNoMountNS prevents the runtime from putting shims into their own mount namespace.
82-
//
83-
// Putting the shim in its own mount namespace ensure that any mounts made
84-
// by it in order to get the task rootfs ready will be undone regardless
85-
// on how the shim dies.
86-
//
87-
// NOTE: This should only be used in kernel older than 3.18 to avoid shims
88-
// from causing a DoS in their parent namespace due to having a copy of
89-
// mounts previously there which would prevent unlink, rename and remove
90-
// operations on those mountpoints.
91-
ShimNoMountNS bool `toml:"shim_no_newns"`
9281
}
9382

9483
// New returns a configured runtime
@@ -226,8 +215,7 @@ func (r *Runtime) Create(ctx context.Context, id string, opts runtime.CreateOpts
226215
}).Warn("failed to clen up after killed shim")
227216
}
228217
}
229-
shimopt = ShimRemote(r.config.Shim, r.address, cgroup,
230-
r.config.ShimNoMountNS, r.config.ShimDebug, exitHandler)
218+
shimopt = ShimRemote(r.config.Shim, r.address, cgroup, r.config.ShimDebug, exitHandler)
231219
}
232220

233221
s, err := bundle.NewShimClient(ctx, namespace, shimopt, ropts)

‎linux/shim/client/client.go‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@ var empty = &ptypes.Empty{}
3434
type Opt func(context.Context, shim.Config) (shimapi.ShimService, io.Closer, error)
3535

3636
// WithStart executes a new shim process
37-
func WithStart(binary, address, daemonAddress, cgroup string, nonewns, debug bool, exitHandler func()) Opt {
37+
func WithStart(binary, address, daemonAddress, cgroup string, debug bool, exitHandler func()) Opt {
3838
return func(ctx context.Context, config shim.Config) (_ shimapi.ShimService, _ io.Closer, err error) {
3939
socket, err := newSocket(address)
4040
if err != nil {
@@ -47,7 +47,7 @@ func WithStart(binary, address, daemonAddress, cgroup string, nonewns, debug boo
4747
}
4848
defer f.Close()
4949

50-
cmd := newCommand(binary, daemonAddress, nonewns, debug, config, f)
50+
cmd := newCommand(binary, daemonAddress, debug, config, f)
5151
ec, err := reaper.Default.Start(cmd)
5252
if err != nil {
5353
return nil, nil, errors.Wrapf(err, "failed to start shim")
@@ -87,7 +87,7 @@ func WithStart(binary, address, daemonAddress, cgroup string, nonewns, debug boo
8787
}
8888
}
8989

90-
func newCommand(binary, daemonAddress string, nonewns, debug bool, config shim.Config, socket *os.File) *exec.Cmd {
90+
func newCommand(binary, daemonAddress string, debug bool, config shim.Config, socket *os.File) *exec.Cmd {
9191
selfExe, err := os.Executable()
9292
if err != nil {
9393
panic(err)
@@ -117,7 +117,7 @@ func newCommand(binary, daemonAddress string, nonewns, debug bool, config shim.C
117117
// make sure the shim can be re-parented to system init
118118
// and is cloned in a new mount namespace because the overlay/filesystems
119119
// will be mounted by the shim
120-
cmd.SysProcAttr = getSysProcAttr(nonewns)
120+
cmd.SysProcAttr = getSysProcAttr()
121121
cmd.ExtraFiles = append(cmd.ExtraFiles, socket)
122122
if debug {
123123
cmd.Stdout = os.Stdout

‎linux/shim/client/client_linux.go‎

Lines changed: 2 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -10,14 +10,10 @@ import (
1010
"github.com/pkg/errors"
1111
)
1212

13-
func getSysProcAttr(nonewns bool) *syscall.SysProcAttr {
14-
attr := syscall.SysProcAttr{
13+
func getSysProcAttr() *syscall.SysProcAttr {
14+
return &syscall.SysProcAttr{
1515
Setpgid: true,
1616
}
17-
if !nonewns {
18-
attr.Cloneflags = syscall.CLONE_NEWNS
19-
}
20-
return &attr
2117
}
2218

2319
func setCgroup(cgroupPath string, cmd *exec.Cmd) error {

‎linux/shim/client/client_unix.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ import (
77
"syscall"
88
)
99

10-
func getSysProcAttr(nonewns bool) *syscall.SysProcAttr {
10+
func getSysProcAttr() *syscall.SysProcAttr {
1111
return &syscall.SysProcAttr{
1212
Setpgid: true,
1313
}

‎oci/spec_opts_windows.go‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -60,3 +60,11 @@ func WithTTY(width, height int) SpecOpts {
6060
return nil
6161
}
6262
}
63+
64+
// WithUsername sets the username on the process
65+
func WithUsername(username string) SpecOpts {
66+
return func(ctx context.Context, client Client, c *containers.Container, s *specs.Spec) error {
67+
s.Process.User.Username = username
68+
return nil
69+
}
70+
}

0 commit comments

Comments
 (0)