In user namespaces, we need to make sure we don't chown() the console to
unmapped users. This means we need to get both the UID and GID of the
root user in the container when changing the owner.
Signed-off-by: Aleksa Sarai <asarai@suse.de>
Add a waitgroup to wait for the io.Copy of stdout/err to finish before
existing runc. The problem happens more in exec because it is really
fast and the pipe has data buffered but not yet read after the process
has already exited.
Signed-off-by: Michael Crosby <crosbymichael@gmail.com>
This flag allows systems that are running runc to allocate tty's that
they own and provide to the container.
Signed-off-by: Michael Crosby <crosbymichael@gmail.com>
When we are using user namespaces we need to make sure that when we do
not have a TTY we change the ownership of the pipe()'s used for the
process to the root user within the container so that when you call
open() on any of the /proc/self/fd/*'s you do not get an EPERM.
Signed-off-by: Michael Crosby <crosbymichael@gmail.com>
When we use ```cat | runc``` or ```runc /dev/stdin < config.json```,
it will fail and output ```FATA[0000] Container start failed: inappropriate ioctl for device```.
It is hard for the users to find out the reason from the message:
the config.json enables the terminal but the user redirect the stdin
to an non-terminal file.
After this patch, the output will be
```FATA[0000] Container start failed: Failed to set the terminal from the stdin: inappropriate ioctl for device```
So the user can disable the terminal in the config.json.
See the #202
Cc: W. Trevor King <wking@tremily.us> (@wking)
Signed-off-by: Lai Jiangshan <jiangshanlai@gmail.com>
Should compile now without errors but changes needed to be added for each system so it actually works.
main_unsupported.go is a new file with all the unsupported commands
Fixes#9
Signed-off-by: Marianna <mtesselh@gmail.com>
Aleksa Sarai
Jessica Frazelle
Michael Crosby
Lai Jiangshan
Jin-Hwan Jeong
Marianna
Zefan Li