Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

#

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

Jump to bottom

Can't exec into a container with private time namespace #4635

Closed
lifubang opened this issue Feb 19, 2025 · 0 comments · Fixed by #4636
Closed

Can't exec into a container with private time namespace #4635

lifubang opened this issue Feb 19, 2025 · 0 comments · Fixed by #4636
Labels
kind/bug

Comments

@lifubang
Copy link
Member

Description

When we exec into a container with a private time namespace, it will get an error.

Steps to reproduce the issue

  1. Create a container with a private time namespace;
  2. Exec into this container;
  3. We will always get an error.

Describe the results you received and expected

@lifubang ➜ ~/ubuntu $ sudo ./runc.amd64 run -d test
@lifubang ➜ ~/ubuntu $ sudo ./runc.amd64 exec test true
FATA[0000] nsexec-0[10598]: failed to update /proc/10599/timens_offsets: Permission denied
FATA[0000] nsexec-1[10599]: failed to sync with parent: read(SYNC_TIMEOFFSETS_ACK): Success
ERRO[0000] exec failed: unable to start container process: error executing setns process: exit status 1

What version of runc are you using?

runc version 1.2.5
commit: v1.2.5-0-g59923ef1
spec: 1.2.0
go: go1.22.12
libseccomp: 2.5.5

Host OS information

No response

Host kernel information

No response
lifubang added a commit to lifubang/runc that referenced this issue Feb 19, 2025
@lifubang
libct/nsexec: don't update timens offset when joining a time ns
fa9f3a3 
We should configure the process's timens offset only when we need to
create new time namespace, we shouldn't do it if we are joining an
existing time namespace. (opencontainers#4635)

Signed-off-by: lfbzhm <lifubang@acmcoder.com>
@lifubang lifubang mentioned this issue Feb 19, 2025
Merged
lifubang added a commit to lifubang/runc that referenced this issue Feb 22, 2025
@lifubang
libct: don't send config to nsexec when joining an existing timens
ad09197 
We should configure the process's timens offset only when we need to
create new time namespace, we shouldn't do it if we are joining an
existing time namespace. (opencontainers#4635)

Signed-off-by: lifubang <lifubang@acmcoder.com>
# for free to join this conversation on GitHub. Already have an account? # to comment
Assignees
No one assigned
Labels
kind/bug
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

libct: don't send config to nsexec when joining an existing timens lifubang/runc
1 participant
@lifubang