fix: check user/group in container start #1716
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Codecov Report
@@ Coverage Diff @@
## master #1716 +/- ##
==========================================
+ Coverage 41.62% 41.78% +0.15%
==========================================
Files 278 278
Lines 18225 18244 +19
==========================================
+ Hits 7586 7623 +37
+ Misses 9709 9695 -14
+ Partials 930 926 -4
|
HusterWan
reviewed
Jul 12, 2018
|
|
||
| // GetSpecificBasePath accepts a given path, look for whether the path is exist | ||
| // within container, if has, returns container base path like BaseFS, if not, return empty string | ||
| func (c *Container) GetSpecificBasePath(path string) string { |
Contributor
There was a problem hiding this comment.
feel weird ! can we judge whether the baseFS is mounted?
Contributor
Author
There was a problem hiding this comment.
The function is used to get specified file from container, BaseFs is not created when container start, so we can only try image path.
Contributor
There was a problem hiding this comment.
i still have another question: can we ensure passwd file exists in UpperDir?
Or can we mount the mergedDir when we found it not mounted, then we can ensure the passwd file exists in MergedDir.
it's just my advice, you can think about it again, thanks a lot @Ace-Tang
Contributor
Author
There was a problem hiding this comment.
when we run a container, merged dir is not created yet until pouch pass create options to containerd, then containerd created it and mount. Add this function cause we can only find file in image when container in start process.
Contributor
Author
There was a problem hiding this comment.
I also think this pr can fix if merged dir is un-mounted by error.
HusterWan
reviewed
Jul 13, 2018
daemon/mgr/container_types.go
Outdated
| "github.com/alibaba/pouch/cri/stream/remotecommand" | ||
| "github.com/alibaba/pouch/pkg/meta" | ||
| "github.com/alibaba/pouch/pkg/utils" | ||
| "github.com/containerd/containerd/mount" |
Contributor
There was a problem hiding this comment.
please put this line to third-party package
HusterWan
reviewed
Jul 13, 2018
| return c.BaseFS | ||
| } | ||
|
|
||
| // then try lower and upper directory, since overlay filesystem support only. |
Contributor
There was a problem hiding this comment.
a good solution to fix mergeDir not mounted 👋
Contributor
Author
|
@HusterWan ,Updated. Beside, I have test a occasion that umount container rootfs to see if exec will successful. |
user parameter passed by pouch run --user is not validate in container start process, since we just try to find file in BaseFS, but BaseFS is created in containerd, so we pass the validate. Fix this by find file in image container use. Add function Get which has GetUser and GetAdditionalGids function as a interface in pkg/user package. Signed-off-by: Ace-Tang <[email protected]>
Contributor
|
lgtm |
pouchrobot
added
the
LGTM
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
user parameter passed by pouch run --user is not validate in container
start process, since we just try to find file in BaseFS, but BaseFS is
created in containerd, so we pass the validate. Fix this by find file in
image container use.
Add function Get which has GetUser and GetAdditionalGids function as a
interface in pkg/user package.
Signed-off-by: Ace-Tang [email protected]
Ⅰ. Describe what this PR did
Ⅱ. Does this pull request fix one issue?
Ⅲ. Describe how you did it
Ⅳ. Describe how to verify it
Ⅴ. Special notes for reviews