35991- make --device works at privileged mode#40291
Conversation
Signed-off-by: wenlxie <[email protected]>
When a container is started in privileged mode, the device mappings provided by `--device` flag was ignored. Now the device mappings will be considered even in privileged mode. Signed-off-by: Akhil Mohan <[email protected]>
|
As I mentioned in the original PR, a documentation update is needed to warn that device permissions are ignored in privileged mode. Can you work on this one @akhilerm ? |
|
Sure. I will raise the PR to docker documentation. |
| } | ||
| // check if the path exists in the container. need to create a device only if the | ||
| // path does not exists. | ||
| if _, err := os.Stat(deviceMapping.PathInContainer); !os.IsNotExist(err) { |
There was a problem hiding this comment.
@kolyshkin Just now I was testing this change. This code where we do an os.Stat for a path in the container. Is it the right way to do it. Because I can see that the container creation fails, if such a path exists on the host.
Example: There is a /test directory on the host. And the mapping used is --device /dev/sdc:/test. This will fail because os.Stat checks and finds that a directory exists, but in actual case there is no such directory inside the container.
The same issue can happen in reverse also. There is a directory /test available inside the container but not on the host. When docker run is executed with --device /dev/sdc:/test, it won't show any errors. Inside the container, the device won't be available at /test. Just the original directory.
How should both these cases be handled.
cc: @thaJeztah
Signed-off-by: Akhil Mohan <[email protected]>
|
Can this PR be merged into version 19 of Moby？ |
+1 |
1 similar comment
+1 |
8 participants
Signed-off-by: Akhil Mohan [email protected]
- What I did
Fixes issue #35991. Most changes have been taken from PR #36258, since it was not being actively worked on.
Changes:
--deviceflag will not be ignored in privileged mode- How I did it
When creating the container spec for privileged containers, the device mapping is also included along with the entries from
/dev. Since the container is already privileged, the cgroup permissions will berwmfor all the devices.- How to verify it
Test Cases:
1. When the same host and container device is specified
Host
Daemon Logs
2. When two different path in
/devis specifiedHost
Container
3. When a path other than
/devis specifiedHost
Container
4. Device mapped with a different permission
Host
Daemon Logs
- Description for the changelog
The
--deviceflag indocker runwill now be honored when the container is started in privileged mode.- A picture of a cute animal (not mandatory but encouraged)
