Add flag to allow oci.WithAllDevicesAllowed on PrivilegedWithoutHostDevices by dtnyn · Pull Request #5686 · containerd/containerd

dtnyn · 2021-07-05T03:37:07Z

This commit adds a flag that enable all devices whitelisting when privileged_without_host_devices is already enabled.

Signed-off-by: Dat Nguyen [email protected]

k8s-ci-robot · 2021-07-05T03:37:15Z

Hi @dtnyn. Thanks for your PR.

I'm waiting for a containerd member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

theopenlab-ci · 2021-07-05T03:38:24Z

Build succeeded.

containerd-build-arm64 : NODE_FAILURE in 0s (non-voting)
containerd-test-arm64 : NODE_FAILURE in 0s (non-voting)
containerd-integration-test-arm64 : NODE_FAILURE in 0s (non-voting)

theopenlab-ci · 2021-07-06T06:11:48Z

Build succeeded.

containerd-build-arm64 : NODE_FAILURE in 0s (non-voting)
containerd-test-arm64 : NODE_FAILURE in 0s (non-voting)
containerd-integration-test-arm64 : NODE_FAILURE in 0s (non-voting)

dtnyn · 2021-07-09T03:29:44Z

/cc @mikebrow

Since you had contexts on the discussion regarding this changes when this issue was raised in the old cri repo #6643, could you please have a look?

kzys · 2021-07-22T21:02:16Z

/ok-to-test

theopenlab-ci · 2021-09-13T01:37:14Z

Build succeeded.

containerd-build-arm64 : FAILURE in 3m 40s (non-voting)
containerd-test-arm64 : FAILURE in 3m 48s (non-voting)
containerd-integration-test-arm64 : FAILURE in 6m 57s (non-voting)

theopenlab-ci · 2021-09-13T04:31:20Z

Build succeeded.

containerd-build-arm64 : SUCCESS in 5m 47s (non-voting)
containerd-test-arm64 : SUCCESS in 5m 25s (non-voting)
containerd-integration-test-arm64 : FAILURE in 29m 50s (non-voting)

dtnyn · 2021-09-13T04:58:00Z

/retest

dtnyn · 2021-09-13T05:21:35Z

/retest doesn't re-run failed github actions it seems

k8s-ci-robot · 2021-09-13T05:21:50Z

@dtnyn: The /retest command does not accept any targets.
The following commands are available to trigger required jobs:

/test pull-containerd-build
/test pull-containerd-node-e2e

Use /test all to run all jobs.

Details

In response to this:

/retest doesn't re-run failed github actions it seems

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

dtnyn · 2021-09-13T05:32:43Z

/test all

theopenlab-ci · 2021-09-15T00:14:47Z

Build succeeded.

containerd-build-arm64 : SUCCESS in 4m 22s (non-voting)
containerd-test-arm64 : SUCCESS in 5m 40s (non-voting)
containerd-integration-test-arm64 : SUCCESS in 23m 51s (non-voting)

theopenlab-ci · 2021-09-15T01:06:54Z

Build succeeded.

containerd-build-arm64 : SUCCESS in 5m 00s (non-voting)
containerd-test-arm64 : SUCCESS in 5m 27s (non-voting)
containerd-integration-test-arm64 : FAILURE in 23m 30s (non-voting)

theopenlab-ci · 2021-09-15T03:16:37Z

Build succeeded.

containerd-build-arm64 : SUCCESS in 4m 16s (non-voting)
containerd-test-arm64 : SUCCESS in 5m 24s (non-voting)
containerd-integration-test-arm64 : FAILURE in 23m 45s (non-voting)

theopenlab-ci · 2021-09-16T00:22:14Z

Build succeeded.

containerd-build-arm64 : SUCCESS in 4m 47s (non-voting)
containerd-test-arm64 : SUCCESS in 5m 27s (non-voting)
containerd-integration-test-arm64 : SUCCESS in 23m 35s (non-voting)

This commit adds a flag that enable all devices whitelisting when privileged_without_host_devices is already enabled. Fixes containerd#5679 Signed-off-by: Dat Nguyen <[email protected]>

theopenlab-ci · 2021-11-03T23:50:22Z

Build succeeded.

containerd-build-arm64 : SUCCESS in 4m 47s (non-voting)
containerd-test-arm64 : SUCCESS in 5m 58s (non-voting)
containerd-integration-test-arm64 : FAILURE in 24m 00s (non-voting)

dtnyn · 2021-11-04T00:07:47Z

/test pull-containerd-node-e2e

mikebrow

LGTM
still a tricky topic.. might add a diagram later on..

estesp · 2022-03-23T15:26:22Z

This PR is effectively approved but never merged; is there any new thoughts/concerns on this method @mikebrow or @AkihiroSuda? If not, we should merge.

Bevisy · 2022-06-20T06:34:52Z

Sorry to disturb, do we need to backport the pr to release/1.6 or release/1.5? @dtnyn @kzys @AkihiroSuda

AkihiroSuda · 2022-06-20T14:32:09Z

Usually we only backport bug fixes, not new features

Bevisy · 2022-06-21T08:39:08Z

Usually we only backport bug fixes, not new features

Got it, thanks a lot.

k8s-ci-robot added the needs-ok-to-test label Jul 5, 2021

AkihiroSuda mentioned this pull request Jul 6, 2021

add oci.WithAllDevicesAllowed regardless of ociRuntime.PrivilegedWithoutHostDevices containerd/cri#1567

Closed

AkihiroSuda reviewed Jul 6, 2021

View reviewed changes

Comment thread docs/cri/config.md Outdated

dtnyn force-pushed the issue-5679 branch from 35d82a3 to 734a08e Compare July 6, 2021 06:10

k8s-ci-robot added ok-to-test and removed needs-ok-to-test labels Jul 22, 2021

dtnyn force-pushed the issue-5679 branch from 734a08e to ab7e5c3 Compare September 13, 2021 01:28

dtnyn force-pushed the issue-5679 branch from ab7e5c3 to c86cc6c Compare September 13, 2021 03:59

dtnyn force-pushed the issue-5679 branch from c86cc6c to a69f084 Compare September 14, 2021 23:49

dtnyn force-pushed the issue-5679 branch from a69f084 to 1f82626 Compare September 15, 2021 00:41

dtnyn force-pushed the issue-5679 branch from 1f82626 to 3ae1ea1 Compare September 15, 2021 02:51

kzys reviewed Sep 15, 2021

View reviewed changes

Comment thread pkg/cri/server/container_create_linux_test.go Outdated

dtnyn force-pushed the issue-5679 branch from 3ae1ea1 to 1a4bfe8 Compare September 15, 2021 23:57

kzys approved these changes Sep 16, 2021

View reviewed changes

dtnyn requested a review from mikebrow October 29, 2021 00:10

dtnyn requested a review from AkihiroSuda October 29, 2021 00:11

dtnyn force-pushed the issue-5679 branch from d7f1f69 to e5c0e90 Compare November 3, 2021 23:20

add oci.WithAllDevicesAllowed flag for privileged_without_host_devices

afe39be

This commit adds a flag that enable all devices whitelisting when privileged_without_host_devices is already enabled. Fixes containerd#5679 Signed-off-by: Dat Nguyen <[email protected]>

dtnyn force-pushed the issue-5679 branch from e5c0e90 to afe39be Compare November 3, 2021 23:24

mikebrow approved these changes Nov 4, 2021

View reviewed changes

qiutongs approved these changes Nov 4, 2021

View reviewed changes

kzys merged commit f140400 into containerd:main Apr 25, 2022

justxuewei mentioned this pull request Dec 12, 2024

Unable to run privileged containers within docker:dind kata-containers/kata-containers#10298

Closed

Conversation

dtnyn commented Jul 5, 2021

Uh oh!

k8s-ci-robot commented Jul 5, 2021

Uh oh!

theopenlab-ci Bot commented Jul 5, 2021

Uh oh!

Uh oh!

theopenlab-ci Bot commented Jul 6, 2021

Uh oh!

dtnyn commented Jul 9, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

kzys commented Jul 22, 2021

Uh oh!

theopenlab-ci Bot commented Sep 13, 2021

Uh oh!

theopenlab-ci Bot commented Sep 13, 2021

Uh oh!

dtnyn commented Sep 13, 2021

Uh oh!

dtnyn commented Sep 13, 2021

Uh oh!

k8s-ci-robot commented Sep 13, 2021

Uh oh!

dtnyn commented Sep 13, 2021

Uh oh!

theopenlab-ci Bot commented Sep 15, 2021

Uh oh!

theopenlab-ci Bot commented Sep 15, 2021

Uh oh!

theopenlab-ci Bot commented Sep 15, 2021

Uh oh!

Uh oh!

theopenlab-ci Bot commented Sep 16, 2021

Uh oh!

theopenlab-ci Bot commented Nov 3, 2021

Uh oh!

dtnyn commented Nov 4, 2021

Uh oh!

mikebrow left a comment

Choose a reason for hiding this comment

Uh oh!

estesp commented Mar 23, 2022

Uh oh!

Bevisy commented Jun 20, 2022

Uh oh!

AkihiroSuda commented Jun 20, 2022

Uh oh!

Bevisy commented Jun 21, 2022

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

9 participants

dtnyn commented Jul 9, 2021 •

edited

Loading