cdi: add device uid/gid injection example

Author: everzakov

pkg/cdi/container-edits.go

@@ -82,14 +82,24 @@ func (e *ContainerEdits) Apply(spec *oci.Spec) error {
 		specgen.AddMultipleProcessEnv(e.Env)
 	}
 
+	var (
+		uids []oci.LinuxIDMapping
+		gids []oci.LinuxIDMapping
+	)
+
+	if specHasUserNamespace(spec) {
+		uids = cloneIDMappings(spec.Linux.UIDMappings)
+		gids = cloneIDMappings(spec.Linux.GIDMappings)
+	}
+
 	for _, d := range e.DeviceNodes {
 		dn := DeviceNode{d}
 
 		err := dn.fillMissingInfo()
 		if err != nil {
 			return err
 		}
-		dev := dn.toOCI()
+		dev := dn.toOCI(uids, gids)
 		if dev.UID == nil && spec.Process != nil {
 			if uid := spec.Process.User.UID; uid > 0 {
 				dev.UID = &uid
@@ -114,15 +124,6 @@ func (e *ContainerEdits) Apply(spec *oci.Spec) error {
 	}
 
 	if len(e.Mounts) > 0 {
-		var (
-			uids []oci.LinuxIDMapping
-			gids []oci.LinuxIDMapping
-		)
-
-		if specHasUserNamespace(spec) {
-			uids = cloneIDMappings(spec.Linux.UIDMappings)
-			gids = cloneIDMappings(spec.Linux.GIDMappings)
-		}
 		for _, m := range e.Mounts {
 			specgen.RemoveMount(m.ContainerPath)
 			specgen.AddMount((&Mount{m}).toOCI(withMountIDMappings(uids, gids)))

pkg/cdi/oci.go

@@ -17,6 +17,7 @@ limitations under the License.
 package cdi
 
 import (
+	oci "github.com/opencontainers/runtime-spec/specs-go"
 	spec "github.com/opencontainers/runtime-spec/specs-go"
 )
 
@@ -60,8 +61,8 @@ func (m *Mount) toOCI(options ...ociMountOption) spec.Mount {
 }
 
 // toOCI returns the opencontainers runtime Spec LinuxDevice for this DeviceNode.
-func (d *DeviceNode) toOCI() spec.LinuxDevice {
-	return spec.LinuxDevice{
+func (d *DeviceNode) toOCI(UIDMappings, GIDMappings []oci.LinuxIDMapping) spec.LinuxDevice {
+	dev := spec.LinuxDevice{
 		Path:     d.Path,
 		Type:     d.Type,
 		Major:    d.Major,
@@ -70,6 +71,20 @@ func (d *DeviceNode) toOCI() spec.LinuxDevice {
 		UID:      d.UID,
 		GID:      d.GID,
 	}
+	for _, mapping := range UIDMappings {
+		if dev.UID != nil && *dev.UID >= mapping.ContainerID && *dev.UID < mapping.ContainerID+mapping.Size {
+			delta := *dev.UID - mapping.ContainerID
+			*dev.UID = mapping.HostID + delta
+		}
+	}
+
+	for _, mapping := range GIDMappings {
+		if dev.GID != nil && *dev.GID >= mapping.ContainerID && *dev.GID < mapping.ContainerID+mapping.Size {
+			delta := *dev.GID - mapping.ContainerID
+			*dev.GID = mapping.HostID + delta
+		}
+	}
+	return dev
 }
 
 // toOCI returns the opencontainers runtime Spec LinuxIntelRdt for this IntelRdt config.