Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Adds rootless containers support #318

Merged
merged 4 commits into from
Oct 27, 2019
Merged

Adds rootless containers support #318

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
963ff16
Bumps libcontainer version
ncordon Oct 23, 2019
814dc32
run containers in rootless mode
Mar 3, 2018
924c14e
Updates rootless params and adds new Init: true requirement
ncordon Oct 23, 2019
65dc491
Updates documentation and kills containers with SIGKILL
ncordon Oct 24, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions daemon/driver.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -74,6 +74,7 @@ func NewDriverInstance(r *runtime.Runtime, lang string, i runtime.DriverImage, o
Env: o.Env,
Stdout: os.Stdout,
Stderr: os.Stderr,
Init: true,
}

tmp := filepath.Join(r.Root, fmt.Sprintf(TmpPathPattern, id))
Expand Down
8 changes: 5 additions & 3 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,7 @@ require (
github.com/beorn7/perks v1.0.0 // indirect
github.com/briandowns/spinner v0.0.0-20170614154858-48dbb65d7bd5
github.com/cenkalti/backoff v2.1.1+incompatible
github.com/checkpoint-restore/go-criu v0.0.0-20190109184317-bdb7599cd87b // indirect
github.com/containerd/console v0.0.0-20180220200639-2748ece16665 // indirect
github.com/containers/image v0.0.0-20170921085858-33dad2514b7d
github.com/containers/storage v0.0.0-20180220103138-477e551dd493 // indirect
Expand All @@ -34,9 +35,9 @@ require (
github.com/oklog/ulid v1.3.1
github.com/olekukonko/tablewriter v0.0.0-20170925234030-a7a4c189eb47
github.com/opencontainers/image-spec v1.0.1
github.com/opencontainers/runc v1.0.0-rc5
github.com/opencontainers/runc v1.0.0-rc9
github.com/opencontainers/runtime-spec v0.0.0-20170712232009-96de01bbb42c // indirect
github.com/opencontainers/selinux v0.0.0-20170621221121-4a2974bf1ee9 // indirect
github.com/opencontainers/selinux v1.3.0 // indirect
github.com/opentracing/opentracing-go v1.1.0
github.com/ostreedev/ostree-go v0.0.0-20170727130318-80ab7dbb8986 // indirect
github.com/pkg/errors v0.8.1
Expand All @@ -48,9 +49,10 @@ require (
github.com/src-d/enry/v2 v2.0.0
github.com/stretchr/objx v0.2.0 // indirect
github.com/stretchr/testify v1.3.0
github.com/syndtr/gocapability v0.0.0-20170704070218-db04d3cc01c8 // indirect
github.com/syndtr/gocapability v0.0.0-20180916011248-d98352740cb2 // indirect
github.com/uber/jaeger-client-go v2.16.0+incompatible
github.com/uber/jaeger-lib v2.0.0+incompatible // indirect
github.com/urfave/cli v1.22.1 // indirect
github.com/vishvananda/netlink v0.0.0-20170710030406-8c5a115d793b // indirect
github.com/vishvananda/netns v0.0.0-20170707011535-86bef332bfc3 // indirect
golang.org/x/net v0.0.0-20190628185345-da137c7871d7
Expand Down
18 changes: 18 additions & 0 deletions go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,6 +32,8 @@ github.com/briandowns/spinner v0.0.0-20170614154858-48dbb65d7bd5 h1:osZyZB7J4kE1
github.com/briandowns/spinner v0.0.0-20170614154858-48dbb65d7bd5/go.mod h1:hw/JEQBIE+c/BLI4aKM8UU8v+ZqrD3h7HC27kKt8JQU=
github.com/cenkalti/backoff v2.1.1+incompatible h1:tKJnvO2kl0zmb/jA5UKAt4VoEVw1qxKWjE/Bpp46npY=
github.com/cenkalti/backoff v2.1.1+incompatible/go.mod h1:90ReRw6GdpyfrHakVjL/QHaoyV4aDUVVkXQJJJ3NXXM=
github.com/checkpoint-restore/go-criu v0.0.0-20190109184317-bdb7599cd87b h1:T4nWG1TXIxeor8mAu5bFguPJgSIGhZqv/f0z55KCrJM=
github.com/checkpoint-restore/go-criu v0.0.0-20190109184317-bdb7599cd87b/go.mod h1:TrMrLQfeENAPYPRsJuq3jsqdlRh3lvi6trTZJG8+tho=
github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
github.com/codahale/hdrhistogram v0.0.0-20161010025455-3a0bb77429bd h1:qMd81Ts1T2OTKmB4acZcyKaMtRnY5Y44NuXGX2GFJ1w=
github.com/codahale/hdrhistogram v0.0.0-20161010025455-3a0bb77429bd/go.mod h1:sE/e/2PUdi/liOCUjSTXgM1o87ZssimdTWN964YiIeI=
Expand All @@ -47,6 +49,8 @@ github.com/coreos/go-systemd v0.0.0-20170609144627-24036eb3df68 h1:Z80xKolFQLHEJ
github.com/coreos/go-systemd v0.0.0-20170609144627-24036eb3df68/go.mod h1:F5haX7vjVVG0kc13fIWeqUViNPyEJxv/OmvnBo0Yme4=
github.com/coreos/pkg v0.0.0-20170420172956-8dbaa491b063 h1:xjjDTql0P7yB/ZNeKvozGwVM0mmX+tPndHwCssWMH+g=
github.com/coreos/pkg v0.0.0-20170420172956-8dbaa491b063/go.mod h1:E3G3o1h8I7cfcXa63jLwjI0eiQQMgzzUDFVpN/nH/eA=
github.com/cpuguy83/go-md2man/v2 v2.0.0-20190314233015-f79a8a8ca69d h1:U+s90UTSYgptZMwQh2aRr3LuazLJIa+Pg3Kc1ylSYVY=
github.com/cpuguy83/go-md2man/v2 v2.0.0-20190314233015-f79a8a8ca69d/go.mod h1:maD7wRr/U5Z6m/iR4s+kqSMx2CaBsrgA7czyZG/E6dU=
github.com/cyphar/filepath-securejoin v0.2.1 h1:5DPkzz/0MwUpvR4fxASKzgApeq2OMFY5FfYtrX28Coo=
github.com/cyphar/filepath-securejoin v0.2.1/go.mod h1:FpkQEhXnPnOthhzymB7CGsFk2G9VLXONKD9G7QGMM+4=
github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
Expand Down Expand Up @@ -160,10 +164,16 @@ github.com/opencontainers/image-spec v1.0.1 h1:JMemWkRwHx4Zj+fVxWoMCFm/8sYGGrUVo
github.com/opencontainers/image-spec v1.0.1/go.mod h1:BtxoFyWECRxE4U/7sNtV5W15zMzWCbyJoFRP3s7yZA0=
github.com/opencontainers/runc v1.0.0-rc5 h1:rYjdzMDXVly2Av0RLs3nf/iVkaWh2UrDhuTdTT2KggQ=
github.com/opencontainers/runc v1.0.0-rc5/go.mod h1:qT5XzbpPznkRYVz/mWwUaVBUv2rmF59PVA73FjuZG0U=
github.com/opencontainers/runc v1.0.0-rc6 h1:7AoN22rYxxkmsJS48wFaziH/n0OvrZVqL/TglgHKbKQ=
github.com/opencontainers/runc v1.0.0-rc6/go.mod h1:qT5XzbpPznkRYVz/mWwUaVBUv2rmF59PVA73FjuZG0U=
github.com/opencontainers/runc v1.0.0-rc9 h1:/k06BMULKF5hidyoZymkoDCzdJzltZpz/UU4LguQVtc=
github.com/opencontainers/runc v1.0.0-rc9/go.mod h1:qT5XzbpPznkRYVz/mWwUaVBUv2rmF59PVA73FjuZG0U=
github.com/opencontainers/runtime-spec v0.0.0-20170712232009-96de01bbb42c h1:2nC8isMK+o8MEaxkQx5hGoRd1vIbPn4BodOzawUaaZA=
github.com/opencontainers/runtime-spec v0.0.0-20170712232009-96de01bbb42c/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
github.com/opencontainers/selinux v0.0.0-20170621221121-4a2974bf1ee9 h1:vVmQZ2IaaEe1MiuvZQbcydTbnlTG0OnZO5/4j7VZv0A=
github.com/opencontainers/selinux v0.0.0-20170621221121-4a2974bf1ee9/go.mod h1:+BLncwf63G4dgOzykXAxcmnFlUaOlkDdmw/CqsW6pjs=
github.com/opencontainers/selinux v1.3.0 h1:xsI95WzPZu5exzA6JzkLSfdr/DilzOhCJOqGe5TgR0g=
github.com/opencontainers/selinux v1.3.0/go.mod h1:+BLncwf63G4dgOzykXAxcmnFlUaOlkDdmw/CqsW6pjs=
github.com/opentracing/opentracing-go v1.0.2 h1:3jA2P6O1F9UOrWVpwrIo17pu01KWvNWg4X946/Y5Zwg=
github.com/opentracing/opentracing-go v1.0.2/go.mod h1:UkNAQd3GIcIGf0SeVgPpRdFStlNbqXla1AfSYxPUl2o=
github.com/opentracing/opentracing-go v1.1.0 h1:pWlfV3Bxv7k65HYwkikxat0+s3pV4bsqf19k25Ur8rU=
Expand Down Expand Up @@ -192,8 +202,12 @@ github.com/prometheus/procfs v0.0.0-20190425082905-87a4384529e0 h1:c8R11WC8m7KNM
github.com/prometheus/procfs v0.0.0-20190425082905-87a4384529e0/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsTZCD3I8kEA=
github.com/rogpeppe/go-internal v1.3.0 h1:RR9dF3JtopPvtkroDZuVD7qquD0bnHlKSqaQhgwt8yk=
github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
github.com/russross/blackfriday/v2 v2.0.1 h1:lPqVAte+HuHNfhJ/0LC98ESWRz8afy9tM/0RK8m9o+Q=
github.com/russross/blackfriday/v2 v2.0.1/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
github.com/seccomp/libseccomp-golang v0.0.0-20170625204121-f6ec81daf48e h1:9O+ppf4lSP+JT6Ym0zIPyy/Ql1lEcU6PAs861rvrzIM=
github.com/seccomp/libseccomp-golang v0.0.0-20170625204121-f6ec81daf48e/go.mod h1:GbW5+tmTXfcxTToHLXlScSlAvWlF4P2Ca7zGrPiEpWo=
github.com/shurcooL/sanitized_anchor_name v1.0.0 h1:PdmoCO6wvbs+7yrJyMORt4/BmY5IYyJwS/kOiWx8mHo=
github.com/shurcooL/sanitized_anchor_name v1.0.0/go.mod h1:1NzhyTcUVG4SuEtjjoZeVRXNmyL/1OwPU0+IJeTBvfc=
github.com/sirupsen/logrus v1.0.5/go.mod h1:pMByvHTf9Beacp5x1UXfOR9xyW/9antXMhjMPG0dEzc=
github.com/sirupsen/logrus v1.2.0 h1:juTguoYk5qI21pwyTXY3B3Y5cOTH3ZUyZCg1v/mihuo=
github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo=
Expand All @@ -216,6 +230,8 @@ github.com/stretchr/testify v1.3.0 h1:TivCn/peBQ7UY8ooIcPgZFpTNSz0Q2U6UrFlUfqbe0
github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
github.com/syndtr/gocapability v0.0.0-20170704070218-db04d3cc01c8 h1:zLV6q4e8Jv9EHjNg/iHfzwDkCve6Ua5jCygptrtXHvI=
github.com/syndtr/gocapability v0.0.0-20170704070218-db04d3cc01c8/go.mod h1:hkRG7XYTFWNJGYcbNJQlaLq0fg1yr4J4t/NcTQtrfww=
github.com/syndtr/gocapability v0.0.0-20180916011248-d98352740cb2 h1:b6uOv7YOFK0TYG7HtkIgExQo+2RdLuwRft63jn2HWj8=
github.com/syndtr/gocapability v0.0.0-20180916011248-d98352740cb2/go.mod h1:hkRG7XYTFWNJGYcbNJQlaLq0fg1yr4J4t/NcTQtrfww=
github.com/toqueteos/trie v1.0.0 h1:8i6pXxNUXNRAqP246iibb7w/pSFquNTQ+uNfriG7vlk=
github.com/toqueteos/trie v1.0.0/go.mod h1:Ywk48QhEqhU1+DwhMkJ2x7eeGxDHiGkAdc9+0DYcbsM=
github.com/uber-go/atomic v1.3.2 h1:Azu9lPBWRNKzYXSIwRfgRuDuS0YKsK4NFhiQv98gkxo=
Expand All @@ -230,6 +246,8 @@ github.com/uber/jaeger-lib v1.5.0 h1:OHbgr8l656Ub3Fw5k9SWnBfIEwvoHQ+W2y+Aa9D1Uyo
github.com/uber/jaeger-lib v1.5.0/go.mod h1:ComeNDZlWwrWnDv8aPp0Ba6+uUTzImX/AauajbLI56U=
github.com/uber/jaeger-lib v2.0.0+incompatible h1:iMSCV0rmXEogjNWPh2D0xk9YVKvrtGoHJNe9ebLu/pw=
github.com/uber/jaeger-lib v2.0.0+incompatible/go.mod h1:ComeNDZlWwrWnDv8aPp0Ba6+uUTzImX/AauajbLI56U=
github.com/urfave/cli v1.22.1 h1:+mkCCcOFKPnCmVYVcURKps1Xe+3zP90gSYGNfRkjoIY=
github.com/urfave/cli v1.22.1/go.mod h1:Gos4lmkARVdJ6EkW0WaNv/tZAAMe9V7XWyB60NtXRu0=
github.com/vishvananda/netlink v0.0.0-20170710030406-8c5a115d793b h1:V/rhZov2dVBDmfHI+k2DwFxHlvF8UXWbXST0AaaMl4Q=
github.com/vishvananda/netlink v0.0.0-20170710030406-8c5a115d793b/go.mod h1:+SR5DhBJrl6ZM7CoCKvpw5BKroDKQ+PJqOg65H/2ktk=
github.com/vishvananda/netns v0.0.0-20170707011535-86bef332bfc3 h1:NcYCJC+LbOrfvuf/uHeM/kxh6vOmiuInC4GAWRdc+P0=
Expand Down
9 changes: 8 additions & 1 deletion runtime/container_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,6 +53,7 @@ func (s *ContainerSuite) TestContainer_Run() {
p := &Process{
Args: []string{"/bin/ls"},
Stdout: os.Stdout,
Init: true,
}

c, err := s.Runtime.Container("run", s.Image, p, nil)
Expand All @@ -67,6 +68,7 @@ func (s *ContainerSuite) TestContainer_StartStopStart() {
p := &Process{
Args: []string{"/bin/sleep", "5m"},
Stdout: os.Stdout,
Init: true,
}

c, err := s.Runtime.Container("1", s.Image, p, nil)
Expand All @@ -82,6 +84,7 @@ func (s *ContainerSuite) TestContainer_StartStopStart() {
p = &Process{
Args: []string{"/bin/sleep", "5m"},
Stdout: os.Stdout,
Init: true,
}

c, err = s.Runtime.Container("2", s.Image, p, nil)
Expand All @@ -103,6 +106,7 @@ func (s *ContainerSuite) TestContainer_StartWait() {
p := &Process{
Args: []string{"/bin/ls"},
Stdout: out,
Init: true,
}

c, err := s.Runtime.Container("wait", s.Image, p, nil)
Expand All @@ -114,7 +118,7 @@ func (s *ContainerSuite) TestContainer_StartWait() {
err = c.Wait()
require.NoError(err)

require.Equal("bin\ndev\netc\nhome\nopt\nproc\nroot\nsys\ntmp\nusr\nvar\n", out.String())
require.Equal("bin\ndev\netc\nhome\nopt\nproc\nroot\ntmp\nusr\nvar\n", out.String())
}

func (s *ContainerSuite) TestContainer_StartWaitExit1() {
Expand All @@ -125,6 +129,7 @@ func (s *ContainerSuite) TestContainer_StartWaitExit1() {
p := &Process{
Args: []string{"/bin/false"},
Stdout: out,
Init: true,
}

c, err := s.Runtime.Container("wait-exit", s.Image, p, nil)
Expand All @@ -147,6 +152,7 @@ func (s *ContainerSuite) TestContainer_StartFailure() {
p := &Process{
Args: []string{"/bin/non-existent"},
Stdout: out,
Init: true,
}

c, err := s.Runtime.Container("start-failure", s.Image, p, nil)
Expand All @@ -164,6 +170,7 @@ func (s *ContainerSuite) TestContainer_Env() {
p := &Process{
Args: []string{"/bin/env"},
Stdout: out,
Init: true,
}

c, err := s.Runtime.Container("env", s.Image, p, nil)
Expand Down
19 changes: 11 additions & 8 deletions runtime/runtime.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,7 +48,7 @@ func (r *Runtime) Init() error {
var err error
r.f, err = libcontainer.New(
filepath.Join(r.Root, containersPath),
libcontainer.Cgroupfs,
libcontainer.RootlessCgroupfs,
)

return err
Expand Down Expand Up @@ -105,12 +105,21 @@ func ContainerConfigFactory(containerID string) *configs.Config {
defaultMountFlags := syscall.MS_NOEXEC | syscall.MS_NOSUID | syscall.MS_NODEV

return &configs.Config{
RootlessEUID: true,
RootlessCgroups: true,
Namespaces: configs.Namespaces([]configs.Namespace{
{Type: configs.NEWNS},
{Type: configs.NEWUTS},
{Type: configs.NEWIPC},
{Type: configs.NEWPID},
{Type: configs.NEWUSER},
}),
UidMappings: []configs.IDMap{
{ContainerID: 0, HostID: os.Getuid(), Size: 1},
},
GidMappings: []configs.IDMap{
{ContainerID: 0, HostID: os.Getgid(), Size: 1},
},
Cgroups: &configs.Cgroup{
Name: containerID,
Parent: "system",
Expand Down Expand Up @@ -148,20 +157,14 @@ func ContainerConfigFactory(containerID string) *configs.Config {
Destination: "/dev/pts",
Device: "devpts",
Flags: syscall.MS_NOSUID | syscall.MS_NOEXEC,
Data: "newinstance,ptmxmode=0666,mode=0620,gid=5",
Data: "newinstance,ptmxmode=0666,mode=0620",
},
{
Source: "mqueue",
Destination: "/dev/mqueue",
Device: "mqueue",
Flags: defaultMountFlags,
},
{
Source: "sysfs",
Destination: "/sys",
Device: "sysfs",
Flags: defaultMountFlags | syscall.MS_RDONLY,
},
{
Source: "/etc/localtime",
Destination: "/etc/localtime",
Expand Down