Remove hard links in runc jailer #508
Conversation
RoyceDavison
force-pushed
the
saved-bind-mount
branch
from
d0dbf13 to
bb60e69
Compare
RoyceDavison
changed the title
RoyceDavison
force-pushed
the
saved-bind-mount
branch
4 times, most recently
from
3cefc56 to
07661f6
Compare
RoyceDavison
force-pushed
the
saved-bind-mount
branch
2 times, most recently
from
4a49b48 to
16bd9b3
Compare
| } | ||
|
|
||
| j.logger.Info("Successfully ran jailer handler") | ||
| j.started = true |
There was a problem hiding this comment.
Why do you want to move j.started = true from here to the handler above? I'd like to keep this line here, since we may reorder the handlers in future.
There was a problem hiding this comment.
j.started = true in the BuildJailedRootHandler will block BuildBindMountFifoHandler, since RootHandler is always the first handler. Once RootHandler sets up j.started=true which means the runcJailer is started, no bind mount is allowed as this line of code is shown. BuildBindMountFifoHandler is triggered after firecracker.CreateLogFilesHandlerName.
There was a problem hiding this comment.
Hmm, how does that work? bindMountFileToJail is modifying runc's configuration. It has to be executed before starting runc.
There was a problem hiding this comment.
If j.started=true is placed inside BuildBindMountFifoHandler, it will work. I thought the runc started after all the defaultHandlers. So I just moved the line inside BuildBindMountFifoHandler. hmm..I am not quite sure when the runc is started now. Will look into it.
RoyceDavison
force-pushed
the
saved-bind-mount
branch
2 times, most recently
from
015e73b to
9eebaea
Compare
firecracker-containerd uses hard links in runc jailer. However making a hard link doesn't work if its destination and its source are in different partitions. Signed-off-by: Royce Zhao <qiqinzha@amazon.com>
RoyceDavison
force-pushed
the
saved-bind-mount
branch
from
9eebaea to
ba1122a
Compare
2 participants
To remove hard links for FIFOs(LogFifo and MetricsFifo) in runc jailer, as described in #456
Signed-off-by: Royce Zhao qiqinzha@amazon.com
Issue #, if available:
Description of changes:
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.