Commit Graph

3870 Commits

Author SHA1 Message Date
Mrunal Patel 2e94378464
Merge pull request #2094 from sipsma/2093-nodotudev
Skip searching /dev/.udev for device nodes.
2019-08-05 10:41:54 -07:00
Mrunal Patel 44f9ec138d
Merge pull request #2089 from anx-astocker/master
doc: First process in container needs `Init: true`
2019-08-05 10:40:54 -07:00
Erik Sipsma f08cdaeec9 Skip searching /dev/.udev for device nodes.
Closes: #2093

Signed-off-by: Erik Sipsma <sipsma@amazon.com>
2019-07-31 19:41:33 +00:00
Andreas Stocker 808e809f8a doc: First process in container needs `Init: true`
`Init` on the `Process` struct specifies whether the process is the first process in the container. This needs to be set to `true` when running the container.

Signed-off-by: Andreas Stocker <astocker@anexia-it.com>
2019-07-29 22:24:28 +02:00
Mrunal Patel 80d35c7ce4
Merge pull request #2082 from AkihiroSuda/blkio-kernel50
integration: remove blkio.weight (unavailable in kernel 5.0)
2019-07-29 12:54:32 -07:00
Mrunal Patel dd8b9b1414
Merge pull request #2081 from AkihiroSuda/criu312
Bump CRIU to 3.12
2019-07-29 12:50:41 -07:00
Qiang Huang 9ae790178e
Merge pull request #2080 from zhlhahaha/pr_id
Update busybox source and fix runc exec bug
2019-07-27 09:26:32 +08:00
Akihiro Suda 351bfb4baf integration: remove blkio.weight (unavailable in kernel 5.0)
weight, leafWeight, and weightDevice are removed in kernel 5.0

f382fb0bce
https://github.com/opencontainers/runtime-spec/issues/1015

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
2019-07-08 18:08:50 +09:00
Akihiro Suda 7e67862542 Bump CRIU to 3.12
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
2019-07-08 17:22:57 +09:00
Howard Zhang 68cc1a772a Update busybox source and fix runc exec bug
Currently, the id verification in integration test failed on arm
platform due to the inconsistent /etc/group in the busybox images
for arm and x86. To be specific, the nogroup id in x86 is 99 while
that in arm is 65534.

99 is old id for nogroup, and no longer be used in recent system,
so sync the busybox image for arm and x86 to the image in busybox
github. Also change the id verification rule in integration test.

Signed-off-by: Howard Zhang <howard.zhang@arm.com>
2019-07-07 19:36:23 -07:00
Michael Crosby 6cccc1760d
Merge pull request #2075 from KentaTada/fix-bash-completion
Update bash completion for v1.0.0 release
2019-06-26 12:58:14 -04:00
Kenta Tada 371d13c995 Update bash completion for v1.0.0 release
Signed-off-by: Kenta Tada <Kenta.Tada@sony.com>
2019-06-25 11:17:31 +09:00
Mrunal Patel f4982d86f7
Merge pull request #2074 from odinuge/dep/libseccomp-golang
Update dependency libseccomp-golang
2019-06-21 13:37:24 -07:00
Odin Ugedal 652297c7c7
Update dependency libseccomp-golang
Diff here: https://github.com/seccomp/libseccomp-golang/compare/1b506fc7c24e...v0.9.1

Fixes https://nvd.nist.gov/vuln/detail/CVE-2017-18367

Signed-off-by: Odin Ugedal <odin@ugedal.com>
2019-06-20 22:35:57 +02:00
Michael Crosby 6cc5158888
Merge pull request #2071 from judu/patch-1
Allow to define `COMMIT` by env
2019-06-11 08:12:36 -04:00
Julien Durillon 6770c8695a Allow to define `COMMIT` by env
Some package managers download the archive instead of cloning the git repo.
When they do that, the call to git fails.

This commit allows package managers to provide the COMMIT value via environment.

Signed-off-by: Julien Durillon <julien.durillon@clever-cloud.com>
2019-06-11 13:41:20 +02:00
Mrunal Patel b4a0b1d737
Merge pull request #2065 from odinuge/master
Fix cgroup hugetlb size prefix for kB
2019-06-06 12:38:57 -07:00
Aleksa Sarai a77c3195e9
merge branch 'pr-2067'
libcontainer: change seccomp test for clone syscall

LGTMs: @crosbymichael @cyphar
Closes #2067
2019-06-05 11:12:22 +10:00
Kenta Tada b54fd85bbf libcontainer: change seccomp test for clone syscall
This commit changes the value of seccomp test for clone syscall.
Also hardcoded values should be changed because it is unclear to
understand what flags are tested.

Related issues:

* https://github.com/containerd/containerd/pull/3314
* https://github.com/moby/moby/pull/39308
* https://github.com/opencontainers/runtime-tools/pull/694

Signed-off-by: Kenta Tada <Kenta.Tada@sony.com>
2019-06-04 18:52:00 +09:00
Odin Ugedal 6f77e35daf
Export list of HugePageSizeUnits
This will allow others to import it instead of copying it.

Signed-off-by: Odin Ugedal <odin@ugedal.com>
2019-05-30 20:17:30 +02:00
Odin Ugedal c6445b1c1c
Add tests for GetHugePageSize
Add tests to avoid regressions

Signed-off-by: Odin Ugedal <odin@ugedal.com>
2019-05-30 17:27:32 +02:00
Odin Ugedal 273e7b74a7
Fix cgroup hugetlb size prefix for kB
The hugetlb cgroup control files (introduced here in 2012:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=abb8206cb0773)
use "KB" and not "kB"
(https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/mm/hugetlb_cgroup.c?h=v5.0#n349).

The behavior in the kernel has not changed since the introduction, and
the current code using "kB" will therefore fail on devices with small
amounts of ram (see
https://github.com/kubernetes/kubernetes/issues/77169) running a kernel
with config flag CONFIG_HUGETLBFS=y

As seen from the code in "mem_fmt" inside hugetlb_cgroup.c, only "KB",
"MB" and "GB" are used, so the others may be removed as well.

Here is a real world example of the files inside the
"/sys/kernel/mm/hugepages/" directory:
- "hugepages-64kB"
- "hugepages-2048kB"
- "hugepages-32768kB"
- "hugepages-1048576kB"

And the corresponding cgroup files:
- "hugetlb.64KB._____"
- "hugetlb.2MB._____"
- "hugetlb.32MB._____"
- "hugetlb.1GB._____"

Signed-off-by: Odin Ugedal <odin@ugedal.com>
2019-05-29 21:52:43 +02:00
Mrunal Patel 5ef781c2e7
Merge pull request #2061 from KentaTada/add-cgroup-namespace-test
libcontainer: fix TestGetContainerState to check configs.NEWCGROUP
2019-05-22 16:09:38 -07:00
Qiang Huang c8337777b6
Merge pull request #2042 from xiaochenshen/rdt-add-missing-destroy
libcontainer: intelrdt: add missing destroy handler in defer func
2019-05-21 09:48:00 +08:00
Kenta Tada 65032b55b1 libcontainer: fix TestGetContainerState to check configs.NEWCGROUP
This test needs to handle the case of configs.NEWCGROUP
as Namespace's type.

Signed-off-by: Kenta Tada <Kenta.Tada@sony.com>
2019-05-21 09:10:38 +09:00
Mrunal Patel b9b6cc6e47
Merge pull request #2057 from giuseppe/no-reopen-stderr
main: not reopen /dev/stderr
2019-05-14 17:39:28 -07:00
Giuseppe Scrivano 8383c724a4
main: not reopen /dev/stderr
commit a146081828 introduced a change to
write to /dev/stderr by default.  Do not reopen the file in this case,
but use directly the fd 2.

Closes: https://github.com/opencontainers/runc/issues/2056
Closes: https://github.com/kubernetes/kubernetes/issues/77615
Closes: https://github.com/cri-o/cri-o/issues/2368

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
2019-05-14 21:56:41 +02:00
Mrunal Patel eb4aeed24f
Merge pull request #2038 from imxyb/defer-destroy
`r.destroy` can defer exec in `runner.run` method.
2019-05-07 15:48:14 -07:00
Mrunal Patel 2484581dd7
Merge pull request #2035 from cyphar/bindmount-types
specconv: always set "type: bind" in case of MS_BIND
2019-05-07 15:47:58 -07:00
Mrunal Patel a0ecf749ee
Merge pull request #2047 from filbranden/systemd7
Move systemd.Manager initialization into a function in that module
2019-05-07 15:08:41 -07:00
Michael Crosby 70bc4cd847
Merge pull request #2034 from masters-of-cats/pr-child-logging
Support for logging from children processes
2019-05-07 10:35:48 -04:00
Filipe Brandenburger 46351eb3d1 Move systemd.Manager initialization into a function in that module
This will permit us to extend the internals of systemd.Manager to include
further information about the system, such as whether cgroupv1, cgroupv2 or
both are in effect.

Furthermore, it allows a future refactor of moving more of UseSystemd() code
into the factory initialization function.

Signed-off-by: Filipe Brandenburger <filbranden@gmail.com>
2019-05-01 13:22:19 -07:00
Mrunal Patel dae70e8efe
Merge pull request #2045 from cyphar/release-rc8
VERSION: release 1.0.0-rc8
2019-04-25 16:48:16 -07:00
Aleksa Sarai 62bd2593b3
VERSION: back to development
Signed-off-by: Aleksa Sarai <asarai@suse.de>
2019-04-25 07:48:36 +10:00
Aleksa Sarai 425e105d5a
VERSION: release 1.0.0-rc8
Signed-off-by: Aleksa Sarai <asarai@suse.de>
2019-04-25 07:48:25 +10:00
Mrunal Patel c1b8c57aba
Merge pull request #2043 from rhatdan/selinux
Vendor in latest selinux code for keycreate errors
2019-04-24 08:39:10 -07:00
Daniel J Walsh 8362cd02c0
Vendor in latest selinux code for keycreate errors
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
2019-04-24 08:41:56 -04:00
Georgi Sabev a146081828 Write logs to stderr by default
Minor refactoring to use the filePair struct for both init sock and log pipe

Co-authored-by: Julia Nedialkova <julianedialkova@hotmail.com>
Signed-off-by: Georgi Sabev <georgethebeatle@gmail.com>
2019-04-24 15:18:14 +03:00
Georgi Sabev 68b4ff5b37 Simplify bail logic & minor nsexec improvements
Co-authored-by: Julia Nedialkova <julianedialkova@hotmail.com>
Signed-off-by: Georgi Sabev <georgethebeatle@gmail.com>
2019-04-24 15:16:11 +03:00
Xiaochen Shen 17b37ea3fa libcontainer: intelrdt: add missing destroy handler in defer func
In the exception handling of initProcess.start(), we need to add the
missing IntelRdtManager.Destroy() handler in defer func.

Signed-off-by: Xiaochen Shen <xiaochen.shen@intel.com>
2019-04-24 16:41:51 +08:00
Georgi Sabev 475aef10f7 Remove redundant log function
Bump logrus so that we can use logrus.StandardLogger().Logf instead

Co-authored-by: Julia Nedialkova <julianedialkova@hotmail.com>
Signed-off-by: Georgi Sabev <georgethebeatle@gmail.com>
2019-04-22 17:54:55 +03:00
Georgi Sabev ba3cabf932 Improve nsexec logging
* Simplify logging function
* Logs contain __FUNCTION__:__LINE__
* Bail uses write_log

Co-authored-by: Julia Nedialkova <julianedialkova@hotmail.com>
Co-authored-by: Danail Branekov <danailster@gmail.com>
Signed-off-by: Georgi Sabev <georgethebeatle@gmail.com>
2019-04-22 17:53:52 +03:00
Xiao YongBiao da5a2dd456 `r.destroy` can defer exec in `runner.run` method.
Signed-off-by: Xiao YongBiao <xyb4638@gmail.com>
2019-04-10 23:25:03 +08:00
Aleksa Sarai 8296826da5
specconv: always set "type: bind" in case of MS_BIND
We discovered in umoci that setting a dummy type of "none" would result
in file-based bind-mounts no longer working properly, which is caused by
a restriction for when specconv will change the device type to "bind" to
work around rootfs_linux.go's ... issues.

However, bind-mounts don't have a type (and Linux will ignore any type
specifier you give it) because the type is copied from the source of the
bind-mount. So we should always overwrite it to avoid user confusion.

Signed-off-by: Aleksa Sarai <asarai@suse.de>
2019-04-08 15:08:08 +10:00
Danail Branekov c486e3c406 Address comments in PR 1861
Refactor configuring logging into a reusable component
so that it can be nicely used in both main() and init process init()

Co-authored-by: Georgi Sabev <georgethebeatle@gmail.com>
Co-authored-by: Giuseppe Capizzi <gcapizzi@pivotal.io>
Co-authored-by: Claudia Beresford <cberesford@pivotal.io>
Signed-off-by: Danail Branekov <danailster@gmail.com>
2019-04-04 14:57:28 +03:00
Marco Vedovati feebfac358 Remove pipe close before exec.
Pipe close before exec is not necessary as os.Pipe() is calling pipe2
with O_CLOEXEC option.

Signed-off-by: Marco Vedovati <mvedovati@suse.com>
2019-04-04 14:53:30 +03:00
Marco Vedovati 9a599f62fb Support for logging from children processes
Add support for children processes logging (including nsexec).
A pipe is used to send logs from children to parent in JSON.
The JSON format used is the same used by logrus JSON formatted,
i.e. children process can use standard logrus APIs.

Signed-off-by: Marco Vedovati <mvedovati@suse.com>
2019-04-04 14:53:23 +03:00
Michael Crosby 029124da7a
Merge pull request #2031 from lifubang/selinux
Add selinux validate in runc exec
2019-04-03 16:09:19 -04:00
lifubang 3e6688f5c9 add selinux label for runc exec
Signed-off-by: lifubang <lifubang@acmcoder.com>
2019-04-03 12:09:06 +08:00
Mrunal Patel 6a3f4749b8
Merge pull request #2032 from rhatdan/selinux
Fix SELinux failures on disabled SELinux Machines
2019-04-02 13:39:48 -07:00