shim: Handle apparmor_restrict_unprivileged_userns#134
shim: Handle apparmor_restrict_unprivileged_userns#134dmcgowan merged 4 commits intocontainerd:mainfrom
apparmor_restrict_unprivileged_userns#134Conversation
There was a problem hiding this comment.
Pull request overview
Adds an integration test that verifies the shim’s TTRPC socket is actually reachable after start returns, aiming to reproduce/guard against CI flakes where the returned socket path is not connectable yet.
Changes:
- Refactors shim startup logic into a
startShimhelper returning parsed bootstrap params. - Adds
TestShimConnectthat polls for socket readiness, dials the Unix socket, and pings the TTRPC server viainternal/ttrpcutil.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
vvoland
changed the title
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 2 out of 2 changed files in this pull request and generated 4 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
vvoland
force-pushed
the
test-shimconn
branch
3 times, most recently
from
3275cbc to
d1a3840
Compare
vvoland
changed the title
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 6 out of 6 changed files in this pull request and generated 6 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 6 out of 6 changed files in this pull request and generated 3 comments.
Comments suppressed due to low confidence (1)
internal/shim/manager/mount_linux.go:62
- This PR’s description says the CLONE_NEWUSER|CLONE_NEWNS logic in
cloneMntNsis being commented out/disabled, but this implementation still unconditionally enablesCLONE_NEWUSER|CLONE_NEWNS(and now errors if AppArmor restricts it). Please reconcile the PR description with the actual behavior, or adjust the implementation if the intent really is to disable userns cloning temporarily.
func cloneMntNs(cmd *exec.Cmd) error {
if restricted, err := apparmorRestrictsUserns(); err != nil {
return fmt.Errorf("checking apparmor userns restriction: %w", err)
} else if restricted {
return fmt.Errorf("kernel.apparmor_restrict_unprivileged_userns=1 prevents creating user namespaces; either disable this sysctl or configure an AppArmor profile that allows userns creation for the containerd process")
}
uid := os.Getuid()
gid := os.Getgid()
cmd.SysProcAttr.Cloneflags |= syscall.CLONE_NEWUSER | syscall.CLONE_NEWNS
cmd.SysProcAttr.UidMappings = []syscall.SysProcIDMap{
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Ubuntu 24+ enables kernel.apparmor_restrict_unprivileged_userns=1 by default, which cripples the user namespaces. Set it to 0 before running integration tests. Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
vvoland
changed the title
vvoland
changed the title
apparmor_restrict_unprivileged_userns
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 6 out of 6 changed files in this pull request and generated 3 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Check the kernel.apparmor_restrict_unprivileged_userns sysctl before attempting to create user namespaces. When set to 1, AppArmor cripples unprivileged user namespaces, causing the shim to fail when accessing the parent socket. Return an actionable error message instead. Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
…m start Add a test that exercises the full shim connection lifecycle: start the shim binary, parse the returned socket address, then dial and ping the TTRPC server. This reproduces the "failed to create TTRPC connection: dial unix …: connect: no such file or directory" error seen in docker-next CI when the shim socket is unreachable after Start returns. Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Build and run cmd/repro to verify that user namespaces are not restricted before running integration tests. This catches environment issues (e.g. apparmor_restrict_unprivileged_userns still enabled) Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
apparmor_restrict_unprivileged_usernsapparmor_restrict_unprivileged_userns=1and return human readable error