[release/1.6 backport] [CRI] fix additionalGids: it should fallback to imageConfig.User when securityContext.RunAsUser,RunAsUsername are empty #8823

thaJeztah · 2023-07-14T11:16:57Z

(partial) backport of:

⚠️ conflict due to sbserver not being in this branch, so ignore those files

Also removed 50740a1 from the backport, as it requires go1.18 (and we still verify on go1.17)

What is the issue

I found a bug in setting runtime.Spec.Process.User.additionalGids in CRI server/sbserver.

If LinuxContainerSecurityContext.{RunAsUser,RunAsUsername} are empty, contained should fallback to the container image's Config.User for resolving the primary user and use it to inspect /etc/group in the container image for resolving additionalGids. But containerd always fallback to 0.

Fortunately, in the use of Kubernetes+containerd, the bug does NOT happen because kubelet always fills out LinuxContainerSecurityContext.RunAsUser from the image status (code) when image's Config.User is not empty. So ontainer_create_linux.go#L369-L370 can grab the correct user from the SecurityContext.

However, because the cri-api spec does not assume the behavior, which fills out LinuxContainerSecurityContext.RunAsUser from the image's Config.User, I think the code should be fixed.

CRI-O seems to handle this correctly. See here.

Reproduction

Version

root@primary:~# crictl version
Version:  0.1.0
RuntimeName:  containerd
RuntimeVersion:  1.6.16
RuntimeApiVersion:  v1

Image and Container Spec

The image everpeace/test:containerd-image-config is used.

# the image has alice(uid=1000)
root@primary:~# docker run -it --rm everpeace/test:containerd-image-config cat /etc/passwd | grep alice
alice:x:1000:1000::/home/alice:/bin/sh

# In the image
# - root belongs to an additional-group-for-root
# - alice belongs to an additiona-group-for-alice
root@primary:~# docker run -it --rm everpeace/test:containerd-image-config cat /etc/group | grep -e root -e alice
root:x:0:
Alice:x:1000:
additional-group-for-alice:x:10000:alice
additional-group-for-root:x:20000:root

# image specifies "config.user: 1000" (alice)
root@primary:~# crictl inspecti everpeace/test:containerd-image-config
...
  "info": {
    "chainID": "sha256:140469df148ed27972d663207bf92e11d6d11b046647532811ab0f7a297c0cb0",
    "imageSpec": {
      "config": {
        "User": "1000",
...

root@primary:~# cat pod-config.json
{
    "metadata": {
        "name": "test-sandbox",
        "namespace": "default",
        "attempt": 1,
        "uid": "hdishd83djaidwnduwk28bcsx"
    },
    "log_directory": "/tmp/tmp.AqRbZ4eV2s",
    "linux": {
    }
}

root@primary:~# cat container-config.json
{
    "metadata": {
        "name": "test"
    },
    "image": {
        "image": "everpeace/test:containerd-image-config"
    },
    "command": [
        "id"
    ],
    "log_path": "test.0.log",
    "linux": {}
}

The output

# Run the container
root@primary:~# crictl runp pod-config.json 
3323c5e01e65ae0a4663b6e7391eb1e81a6fccb9a6cda07b639e792798cdb11e
root@primary:~# crictl create 3323c5e01e65ae0a4663b6e7391eb1e81a6fccb9a6cda07b639e792798cdb11e container-config.json pod-config.json 
6fa373a9292d86f3cdc43e63feeb298c622a0f092ba3204ac04a541a9ca56cc4
root@primary:~# crictl start 6fa373a9292d86f3cdc43e63feeb298c622a0f092ba3204ac04a541a9ca56cc4
6fa373a9292d86f3cdc43e63feeb298c622a0f092ba3204ac04a541a9ca56cc4

# 'additional-group-for-alice' expects to be attached because imageConfig.User=1000(alice).
# However, 'additional-group-gor-root' is attached instead.
root@primary:~# crictl logs 6fa373a9292d86f3cdc43e63feeb298c622a0f092ba3204ac04a541a9ca56cc4
uid=1000(alice) gid=1000(alice) groups=1000(alice),20000(additional-group-for-root)

Notes for reviewers

The current containerd's CRI implementation doesn't follow the conversion spec config.User to spec.Process.User. The containerd's CRI impl

doesn't support to specify group in config.User in the image, and
ALWAYS attach groups from the image(/etc/group) when setting RunAsGroup in SecurityContext

The issue will be handled in kubernetes/enhancements#3619 separately to avoid breaking changes to the users.

It should fallback to imageConfig.User when no securityContext.RunAsUser/RunAsUsername Signed-off-by: Shingo Omura <[email protected]> (cherry picked from commit 727b254) Signed-off-by: Sebastiaan van Stijn <[email protected]>

thaJeztah · 2023-07-14T11:36:59Z

Doh! This would need go1.17 to be removed from the builds;

Error: pkg/cri/server/container_create_linux.go:350:19: undefined: strings.Cut
note: module requires Go 1.18
make: *** [Makefile:202: build] Error 2
Error: Process completed with exit code 2.

Signed-off-by: Shingo Omura <[email protected]> (cherry picked from commit 05bb52b) Signed-off-by: Sebastiaan van Stijn <[email protected]>

…arallel mode Signed-off-by: Shingo Omura <[email protected]> (cherry picked from commit dc2fc98) Signed-off-by: Sebastiaan van Stijn <[email protected]>

thaJeztah · 2023-07-14T11:38:58Z

removed cherry-pick of 50740a1

containerd 1.6.22 Welcome to the v1.6.22 release of containerd! The twenty-second patch release for containerd 1.6 contains various fixes and updates. * **RunC: Update runc binary to v1.1.8** ([containerd#8842](containerd#8842)) * **CRI: Fix additionalGids: it should fallback to imageConfig.User when securityContext.RunAsUser,RunAsUsername are empty** ([containerd#8823](containerd#8823)) * **CRI: Write generated CNI config atomically** ([containerd#8826](containerd#8826)) * **Fix concurrent writes for `UpdateContainerStats`** ([containerd#8819](containerd#8819)) * **Make checkContainerTimestamps less strict on Windows** ([containerd#8827](containerd#8827)) * **Port-Forward: Correctly handle known errors** ([containerd#8805](containerd#8805)) * **Resolve docker.NewResolver race condition** ([containerd#8800](containerd#8800)) * **SecComp: Always allow `name_to_handle_at`** ([containerd#8754](containerd#8754)) * **Adding support to run hcsshim from local clone** ([containerd#8713](containerd#8713)) * **Pinned image support** ([containerd#8720](containerd#8720)) * **Runtime/V2/RunC: Handle early exits w/o big locks** ([containerd#8695](containerd#8695)) * **CRITool: Move up to CRI-TOOLS v1.27.0** ([containerd#7997](containerd#7997)) * **Fix cpu architecture detection issue on emulated ARM platform** ([containerd#8533](containerd#8533)) * **Task: Don't `close()` io before `cancel()`** ([containerd#8659](containerd#8659)) * **Fix panic when remote differ returns empty result** ([containerd#8640](containerd#8640)) * **Plugins: Notify readiness when registered plugins are ready** ([containerd#8583](containerd#8583)) * **Unwrap io errors in server connection receive error handling** ([ttrpc#143](containerd/ttrpc#143)) See the changelog for complete list of changes Please try out the release binaries and report any issues at https://github.com/containerd/containerd/issues. * Akihiro Suda * Phil Estes * Sebastiaan van Stijn * Derek McGowan * Wei Fu * Kazuyoshi Kato * Austin Vazquez * Samuel Karp * dependabot[bot] * Jin Dong * Maksym Pavlenko * Mike Brown * Shingo Omura * Akhil Mohan * Bjorn Neergaard * Laura Brehm * Tony Fang * Aditi Sharma * Andrey Epifanov * Benjamin Wang * Brian Goff * Cory Snider * Daniel Canter * Daniel Lenar * Henry Wang * Luca Comellini * Madhav Jivrajani * Mahamed Ali * Mohit Sharma * Oliver Radwell * Priyanka Saggu * Qasim Sarfraz * Takumasa Sakao * wangxiang * zounengren <details><summary>95 commits</summary> * [release/1.6] Prepare release notes for v1.6.22 ([containerd#8863](containerd#8863)) * [`0770a4601`](containerd@0770a46) [release/1.6] Add release notes for v1.6.22 * [release/1.6] migrate to community owned bucket for node e2e tests ([containerd#8876](containerd#8876)) * [`512a672af`](containerd@512a672) migrate to community owned bucket * [release/1.6] cri: memory.memsw.limit_in_bytes: no such file or directory ([containerd#8870](containerd#8870)) * [`b585ff155`](containerd@b585ff1) cri: memory.memsw.limit_in_bytes: no such file or directory * [release/1.6] Update go-restful to v3.10.1 ([containerd#8412](containerd#8412)) * [`a322077bf`](containerd@a322077) go.mod: github.com/emicklei/go-restful/v3 v3.10.1 * [release/1.6 backport] update runc binary to v1.1.8 ([containerd#8842](containerd#8842)) * [`b3ac068eb`](containerd@b3ac068) update runc binary to v1.1.8 * [release/1.6 backport] ci: remove libseccomp-dev installation for nightly ([containerd#8773](containerd#8773)) * [`6e2bcb6dd`](containerd@6e2bcb6) ci: remove libseccomp-dev installation for nightly * [release/1.6 backport] [CRI] fix additionalGids: it should fallback to imageConfig.User when securityContext.RunAsUser,RunAsUsername are empty ([containerd#8823](containerd#8823)) * [`cd06f23af`](containerd@cd06f23) capture desc variable in range variable just in case that it run in parallel mode * [`30f5c6a1f`](containerd@30f5c6a) Use t.TempDir instead of os.MkdirTemp * [`59d8363ef`](containerd@59d8363) fix userstr for dditionalGids on Linux * [release/1.6 backport] cri: write generated CNI config atomically ([containerd#8826](containerd#8826)) * [`d75bf78c2`](containerd@d75bf78) ctr: update WritePidFile to use atomicfile * [`5f70b23c1`](containerd@5f70b23) shim: WritePidFile & WriteAddress use atomicfile * [`505d444b0`](containerd@505d444) cri: write generated CNI config atomically on Unix * [`b2d2d3829`](containerd@b2d2d38) atomicfile: new package for atomic file writes * [release/1.6 backport] Fix concurrent writes for UpdateContainerStats ([containerd#8819](containerd#8819)) * [`9f650143f`](containerd@9f65014) Fix concurrent writes for UpdateContainerStats * [release/1.6 backport] Make checkContainerTimestamps less strict on Windows ([containerd#8827](containerd#8827)) * [`568ce91ca`](containerd@568ce91) Make checkContainerTimestamps less strict on Windows * [release/1.6 backport] dependency: bump go.etcd.io/bbolt to v1.3.7 ([containerd#8817](containerd#8817)) * [`d2f47192a`](containerd@d2f4719) dependency: bump go.etcd.io/bbolt to v1.3.7 * [`fb56dc245`](containerd@fb56dc2) [release/1.6] vendor: github.com/stretchr/testify v1.8.1 * [release/1.6 backport] Move logrus setup code to log package ([containerd#8832](containerd#8832)) * [`7fbd5dc89`](containerd@7fbd5dc) Move logrus setup code to log package * [release/1.6 backport] release: Add "cri-containerd.DEPRECATED.txt" in the deprecated cri-containerd-* bundles ([containerd#8820](containerd#8820)) * [`59a143670`](containerd@59a1436) release: Add "cri-containerd.DEPRECATED.txt" in the deprecated cri-containerd-* bundles * [release/1.6 backport] Use version 2 configuration format in docs ([containerd#8821](containerd#8821)) * [`5b51b79e2`](containerd@5b51b79) [release/1.6] fix remaining "v1 config" plugin IDs * [`b7cf26d8d`](containerd@b7cf26d) docs: Fix sample config.toml syntax * [`fcdaf0966`](containerd@fcdaf09) docs: migrate config v1 to v2 * [`728d5c5f0`](containerd@728d5c5) Use version 2 config and mention containerd config command * [release/1.6] update go to go1.19.11 ([containerd#8816](containerd#8816)) * [`81aa14718`](containerd@81aa147) [release/1.6] update go to go1.19.11 * [release/1.6] update go to go1.19.10 ([containerd#8715](containerd#8715)) * [`17cd86629`](containerd@17cd866) [release/1.6] update go to go1.19.10 * [release/1.6 backport] bugfix(port-forward): Correctly handle known errors ([containerd#8805](containerd#8805)) * [`fdb65f214`](containerd@fdb65f2) bugfix(port-forward): Correctly handle known errors * [release/1.6] Resolve docker.NewResolver race condition ([containerd#8800](containerd#8800)) * [`b5784af66`](containerd@b5784af) Change http.Header copy to builtin Clone * [`31c466f82`](containerd@31c466f) Resolve docker.NewResolver race condition * [release/1.6 backport] vendor: github.com/containerd/zfs v1.1.0 ([containerd#8781](containerd#8781)) * [`be6406ca6`](containerd@be6406c) vendor: github.com/containerd/zfs v1.1.0 * [`9f1260074`](containerd@9f12600) [release/1.6] vendor gotest.tools/v3 v3.5.0 * [`526e9e0ce`](containerd@526e9e0) Bump grpc to v1.50.1 * [`0e7d2d121`](containerd@0e7d2d1) go.mod: github.com/sirupsen/logrus v1.9.0 * [`5b153c621`](containerd@5b153c6) go.mod: github.com/moby/sys/mountinfo v0.6.2 * [`9dee60960`](containerd@9dee609) go.mod: github.com/moby/sys/mountinfo v0.6.0 * [release/1.6 backport] seccomp: always allow name_to_handle_at ([containerd#8754](containerd#8754)) * [`07ea7b9e7`](containerd@07ea7b9) seccomp: always allow name_to_handle_at * [release/1.6 backport] Update ginkgo to match cri-tools' version ([containerd#8759](containerd#8759)) * [`1dae51fed`](containerd@1dae51f) Update ginkgo to match cri-tools' version * [release/1.6 backport] integration/client: add timeout to `TestShimOOMScore` ([containerd#8749](containerd#8749)) * [`bd76ab978`](containerd@bd76ab9) integration/client: add timeout to `TestShimOOMScore` * [release/1.6 backport] Adding support to run hcsshim from local clone ([containerd#8713](containerd#8713)) * [`8e14eccb2`](containerd@8e14ecc) Adding support to run hcsshim from local clone * [1.6] Add Fields type alias to log package ([containerd#8739](containerd#8739)) * [`9f2cdd589`](containerd@9f2cdd5) Add Fields type alias to log package * [release/1.6] Pinned image support ([containerd#8720](containerd#8720)) * [`f4713aad0`](containerd@f4713aa) Pinned image support * [release/1.6 backport] runtime/v2/runc: handle early exits w/o big locks ([containerd#8695](containerd#8695)) * [`dbeec47b4`](containerd@dbeec47) runtime/v2/runc: handle early exits w/o big locks * [release/1.6 backport] move up to CRI-TOOLS v1.27.0 ([containerd#7997](containerd#7997)) * [`a8e01e40a`](containerd@a8e01e4) move to CRI-TOOLS v1.27.0 * [`755f80698`](containerd@755f806) move up to CRI-TOOLS v1.26.0 * [`b29cc035f`](containerd@b29cc03) bump critools into ca1571e6edd116b2c95f52e3dfa0b4779b74223a * [`9138999f5`](containerd@9138999) Upgrade critools from 1.24.1 to 1.25.0 * [release/1.6] cherry-pick: No more nondistributable layers in MS registry ([containerd#8691](containerd#8691)) * [`712ff8eb3`](containerd@712ff8e) No more nondistributable layers in MS registry * [release/1.6] Fix cpu architecture detection issue on emulated ARM platform ([containerd#8533](containerd#8533)) * [`2b16e4bfa`](containerd@2b16e4b) Add unit test to function GetCPUVariantFromArch * [`106e36ec3`](containerd@106e36e) Use uname machine field to get CPU variant if fails at /proc/cpuinfo * [release/1.6] Update lint timeout ([containerd#8679](containerd#8679)) * [`287fdfea6`](containerd@287fdfe) Update linter timeout to match main branch * [release/1.6 backport] task: don't `close()` io before `cancel()` ([containerd#8659](containerd#8659)) * [`b27f7daa5`](containerd@b27f7da) task: don't `close()` io before `cancel()` * [release/1.6] update test box to fedora 37 ([containerd#8660](containerd#8660)) * [`8b4c69248`](containerd@8b4c692) update test box to fedora 37 * [release/1.6] Revert "Downgrade MinGW to version 10.2.0" ([containerd#8668](containerd#8668)) * [`81d6085af`](containerd@81d6085) Revert "Downgrade MinGW to version 10.2.0" * [release/1.6 backport] Fix panic when remote differ returns empty result ([containerd#8640](containerd#8640)) * [`f98122378`](containerd@f981223) Fix panic when remote differ returns empty result * [1.6] Bump x/net to 0.8 ([containerd#8642](containerd#8642)) * [`aa53f272d`](containerd@aa53f27) Bump x/net to 0.8 * [release/1.6 backport] remotes/docker: ResolverOptions: fix deprecation comments ([containerd#8620](containerd#8620)) * [`56ff20839`](containerd@56ff208) remotes/docker: ResolverOptions: fix deprecation comments * [release/1.6] notify readiness when registered plugins are ready ([containerd#8583](containerd#8583)) * [`bccaf68b7`](containerd@bccaf68) notify readiness when registered plugins are ready * [release/1.6] Update ttrpc to 1.1.2 ([containerd#8528](containerd#8528)) * [`1cdbbe76b`](containerd@1cdbbe7) Update ttrpc to 1.1.2 </details> <details><summary>2 commits</summary> * [release/1.1] Unwrap io errors in server connection receive error handling ([containerd#143](containerd/ttrpc#143)) * [`d5f7eed`](containerd/ttrpc@d5f7eed) Unwrap io errors in server connection receive error handling </details> <details><summary>49 commits</summary> * gofumpt and update status badges ([containerd#75](containerd/zfs#75)) * [`5e3457b`](containerd/zfs@5e3457b) TestZFSUsage: use t.TempDir() * [`6e9c675`](containerd/zfs@6e9c675) README: update badges * [`ff17a79`](containerd/zfs@ff17a79) gofmt code * go.mod: github.com/mistifyio/go-zfs/v3 v3.0.1 ([containerd#73](containerd/zfs#73)) * [`d3485b9`](containerd/zfs@d3485b9) go.mod: github.com/mistifyio/go-zfs/v3 v3.0.1 * gha: fix golangci-lint, and upgrade to v1.52.2 ([containerd#74](containerd/zfs#74)) * [`23c831a`](containerd/zfs@23c831a) remove pre-go1.17 build-tags, and fix missing build-tags in plugin * [`e5acd95`](containerd/zfs@e5acd95) gha: fix golangci-lint, upgrade to v1.52.2 * Bump github.com/containerd/containerd from 1.6.12 to 1.6.18 ([containerd#72](containerd/zfs#72)) * [`00b96c2`](containerd/zfs@00b96c2) Bump github.com/containerd/containerd from 1.6.12 to 1.6.18 * Bump github.com/containerd/containerd from 1.6.9 to 1.6.12 ([containerd#69](containerd/zfs#69)) * [`a099def`](containerd/zfs@a099def) Bump github.com/containerd/containerd from 1.6.9 to 1.6.12 * Add CodeQL analysis workflow ([containerd#67](containerd/zfs#67)) * [`fee1db7`](containerd/zfs@fee1db7) Add CodeQL analysis workflow * Update GitHub actions CI workflow ([containerd#66](containerd/zfs#66)) * [`b8b7ab2`](containerd/zfs@b8b7ab2) Update GitHub actions CI workflow * Upgrade compiler to Go 1.19 and update dependencies ([containerd#68](containerd/zfs#68)) * [`3e729b3`](containerd/zfs@3e729b3) Update dependencies * [`3c003f8`](containerd/zfs@3c003f8) Upgrade compiler to Go 1.19 * Remove references to io/ioutil package ([containerd#65](containerd/zfs#65)) * [`d700762`](containerd/zfs@d700762) Remove references to io/ioutil package * Update go.mod and move to supported Go version ([containerd#62](containerd/zfs#62)) * [`f52906e`](containerd/zfs@f52906e) Update Go version to supported version * [`79ca2cb`](containerd/zfs@79ca2cb) Update containerd depedency to latest * go.mod: github.com/mistifyio/go-zfs v3.0.0 ([containerd#59](containerd/zfs#59)) * [`2e3db29`](containerd/zfs@2e3db29) go.mod: github.com/mistifyio/go-zfs v3.0.0 * go.mod: github.com/mistifyio/go-zfs/v3 v3.0.0-20220217145925-d014733a5309 ([containerd#58](containerd/zfs#58)) * [`d904e63`](containerd/zfs@d904e63) go.mod: github.com/mistifyio/go-zfs/v3 v3.0.0-20220217145925-d014733a5309 * Update vendoring to containerd 1.6.x ([containerd#57](containerd/zfs#57)) * [`e021180`](containerd/zfs@e021180) Update vendoring to containerd 1.6.x * Bump github.com/containerd/containerd from 1.5.8 to 1.5.9 ([containerd#55](containerd/zfs#55)) * [`fc0c9a9`](containerd/zfs@fc0c9a9) Bump github.com/containerd/containerd from 1.5.8 to 1.5.9 * Bump github.com/containerd/containerd from 1.5.5 to 1.5.8 ([containerd#54](containerd/zfs#54)) * [`5d2f28c`](containerd/zfs@5d2f28c) Bump github.com/containerd/containerd from 1.5.5 to 1.5.8 * follow-up-containerd#52: fix the order of cause in fmt.Errorf ([containerd#53](containerd/zfs#53)) * [`b3f193d`](containerd/zfs@b3f193d) follow-up-containerd#52: fix the order of cause in fmt.Errorf * replace pkg/errors ([containerd#52](containerd/zfs#52)) * [`d5b0a2f`](containerd/zfs@d5b0a2f) replace pkg/errors * Bump github.com/containerd/containerd from 1.5.2 to 1.5.4 ([containerd#51](containerd/zfs#51)) * [`fd6afa5`](containerd/zfs@fd6afa5) Bump github.com/containerd/containerd from 1.5.2 to 1.5.4 * Bump containerd to 1.5.2 ([containerd#50](containerd/zfs#50)) * [`aef875e`](containerd/zfs@aef875e) bump containerd to 1.5.2 * Rename branches from master to main ([containerd#49](containerd/zfs#49)) * [`35c6af7`](containerd/zfs@35c6af7) Rename branches from master to main * sync up with containerd 1.5 GA ([containerd#47](containerd/zfs#47)) * [`3d5efef`](containerd/zfs@3d5efef) vendor sync up with containerd 1.5 ga * README.md: fix CI badge ([containerd#46](containerd/zfs#46)) * [`0977d81`](containerd/zfs@0977d81) README.md: fix CI badge </details> * **github.com/containerd/ttrpc** v1.1.1 -> v1.1.2 * **github.com/containerd/zfs** v1.0.0 -> v1.1.0 * **github.com/emicklei/go-restful/v3** v3.7.3 -> v3.10.1 * **github.com/google/go-cmp** v0.5.6 -> v0.5.9 * **github.com/google/uuid** v1.2.0 -> v1.3.0 * **github.com/mistifyio/go-zfs/v3** v3.0.1 **_new_** * **github.com/moby/sys/mountinfo** v0.5.0 -> v0.6.2 * **github.com/sirupsen/logrus** v1.8.1 -> v1.9.0 * **github.com/stretchr/testify** v1.7.0 -> v1.8.1 * **go.etcd.io/bbolt** v1.3.6 -> v1.3.7 * **golang.org/x/net** a158d28d115b -> v0.8.0 * **golang.org/x/sys** 8c9f86f7a55f -> v0.6.0 * **golang.org/x/term** 03fcf44c2211 -> v0.6.0 * **golang.org/x/text** v0.3.7 -> v0.8.0 * **google.golang.org/grpc** v1.47.0 -> v1.50.1 * **google.golang.org/protobuf** v1.28.0 -> v1.28.1 * **gotest.tools/v3** v3.0.3 -> v3.5.0 Previous release can be found at [v1.6.21](https://github.com/containerd/containerd/releases/tag/v1.6.21)

fix userstr for dditionalGids on Linux

59d8363

It should fallback to imageConfig.User when no securityContext.RunAsUser/RunAsUsername Signed-off-by: Shingo Omura <[email protected]> (cherry picked from commit 727b254) Signed-off-by: Sebastiaan van Stijn <[email protected]>

thaJeztah added kind/bug area/cri Container Runtime Interface (CRI) labels Jul 14, 2023

everpeace added 2 commits July 14, 2023 13:38

Use t.TempDir instead of os.MkdirTemp

30f5c6a

Signed-off-by: Shingo Omura <[email protected]> (cherry picked from commit 05bb52b) Signed-off-by: Sebastiaan van Stijn <[email protected]>

capture desc variable in range variable just in case that it run in p…

cd06f23

…arallel mode Signed-off-by: Shingo Omura <[email protected]> (cherry picked from commit dc2fc98) Signed-off-by: Sebastiaan van Stijn <[email protected]>

thaJeztah force-pushed the 1.6_backport_fix-additiona-gids-to-read-image-user branch from 2bb1b27 to cd06f23 Compare July 14, 2023 11:38

estesp approved these changes Jul 14, 2023

View reviewed changes

laurazard approved these changes Jul 17, 2023

View reviewed changes

estesp merged commit 276299c into containerd:release/1.6 Jul 17, 2023

thaJeztah deleted the 1.6_backport_fix-additiona-gids-to-read-image-user branch July 17, 2023 15:51

thaJeztah mentioned this pull request Jul 25, 2023

[release/1.6] Prepare release notes for v1.6.22 #8863

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[release/1.6 backport] [CRI] fix additionalGids: it should fallback to imageConfig.User when securityContext.RunAsUser,RunAsUsername are empty #8823

[release/1.6 backport] [CRI] fix additionalGids: it should fallback to imageConfig.User when securityContext.RunAsUser,RunAsUsername are empty #8823

thaJeztah commented Jul 14, 2023 •

edited

Loading

Uh oh!

thaJeztah commented Jul 14, 2023

Uh oh!

thaJeztah commented Jul 14, 2023

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

[release/1.6 backport] [CRI] fix additionalGids: it should fallback to imageConfig.User when securityContext.RunAsUser,RunAsUsername are empty #8823

[release/1.6 backport] [CRI] fix additionalGids: it should fallback to imageConfig.User when securityContext.RunAsUser,RunAsUsername are empty #8823

Conversation

thaJeztah commented Jul 14, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What is the issue

Reproduction

Version

Image and Container Spec

The output

Notes for reviewers

Uh oh!

thaJeztah commented Jul 14, 2023

Uh oh!

thaJeztah commented Jul 14, 2023

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

thaJeztah commented Jul 14, 2023 •

edited

Loading