linux: drop check for /proc as invalid dest #1832
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
@giuseppe Looks like you missed some function calls in tests. |
giuseppe
force-pushed
the
runc-drop-invalid-proc-destination-with-chroot
branch
from
3da0739 to
da6be08
Compare
|
tests fixed! |
|
@opencontainers/runc-maintainers PTAL |
|
@dqminh would you mind to take a quick look at this patch as well? :-) |
giuseppe
force-pushed
the
runc-drop-invalid-proc-destination-with-chroot
branch
from
da6be08 to
de879c7
Compare
giuseppe
changed the title
giuseppe
force-pushed
the
runc-drop-invalid-proc-destination-with-chroot
branch
2 times, most recently
from
89bba2e to
638fdda
Compare
giuseppe
force-pushed
the
runc-drop-invalid-proc-destination-with-chroot
branch
from
638fdda to
cc44090
Compare
giuseppe
added a commit
to giuseppe/libpod
that referenced
this pull request
Aug 27, 2018
Unfortunately this is not enough to get it working as runc doesn't allow to bind mount /proc. Depends on: opencontainers/runc#1832 Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
rh-atomic-bot
pushed a commit
to containers/podman
that referenced
this pull request
Aug 27, 2018
Unfortunately this is not enough to get it working as runc doesn't allow to bind mount /proc. Depends on: opencontainers/runc#1832 Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com> Closes: #1349 Approved by: rhatdan
|
@cyphar @crosbymichael @dqminh PTAL |
libcontainer/rootfs_linux.go
Outdated
| @@ -53,7 +53,7 @@ func prepareRootfs(pipe io.ReadWriter, iConfig *initConfig) (err error) { | |||
| } | |||
| } | |||
|
|
|||
| if err := mountToRootfs(m, config.Rootfs, config.MountLabel); err != nil { | |||
| if err := mountToRootfs(m, config.Rootfs, config.MountLabel, config.Namespaces.Contains(configs.NEWNS)); err != nil { | |||
There was a problem hiding this comment.
Why are you using NEWNS here when the description of the PR talks about NEWPID?
There was a problem hiding this comment.
sorry that was a leftover of a cleanup. The patch was originally written to address only the "chroot" case but I've changed it to address also another problem: /proc could not be bind mounted from the host. This is useful for rootless containers when the PID namespace is shared with the host (and the container cannot mount a new /proc).
I've pushed a new version which is much simpler now.
giuseppe
force-pushed
the
runc-drop-invalid-proc-destination-with-chroot
branch
from
cc44090 to
fe0d9b1
Compare
it is now allowed to bind mount /proc. This is useful for rootless containers when the PID namespace is shared with the host. Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
giuseppe
force-pushed
the
runc-drop-invalid-proc-destination-with-chroot
branch
from
fe0d9b1 to
636b664
Compare
|
LGTM |
1 similar comment
|
LGTM |
# for free
to join this conversation on GitHub.
Already have an account?
# to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
it is now allowed to bind mount /proc when the PID namespace is shared
with the host.
Signed-off-by: Giuseppe Scrivano gscrivan@redhat.com