Please sign in to comment.
Disable rootless mode except RootlessCgMgr when executed as the root …
…in userns This PR decomposes `libcontainer/configs.Config.Rootless bool` into `RootlessEUID bool` and `RootlessCgroups bool`, so as to make "runc-in-userns" to be more compatible with "rootful" runc. `RootlessEUID` denotes that runc is being executed as a non-root user (euid != 0) in the current user namespace. `RootlessEUID` is almost identical to the former `Rootless` except cgroups stuff. `RootlessCgroups` denotes that runc is unlikely to have the full access to cgroups. `RootlessCgroups` is set to false if runc is executed as the root (euid == 0) in the initial namespace. Otherwise `RootlessCgroups` is set to true. (Hint: if `RootlessEUID` is true, `RootlessCgroups` becomes true as well) When runc is executed as the root (euid == 0) in an user namespace (e.g. by Docker-in-LXD, Podman, Usernetes), `RootlessEUID` is set to false but `RootlessCgroups` is set to true. So, "runc-in-userns" behaves almost same as "rootful" runc except that cgroups errors are ignored. This PR does not have any impact on CLI flags and `state.json`. Note about CLI: * Now `runc --rootless=(auto|true|false)` CLI flag is only used for setting `RootlessCgroups`. * Now `runc spec --rootless` is only required when `RootlessEUID` is set to true. For runc-in-userns, `runc spec` without `--rootless` should work, when sufficient numbers of UID/GID are mapped. Note about `$XDG_RUNTIME_DIR` (e.g. `/run/user/1000`): * `$XDG_RUNTIME_DIR` is ignored if runc is being executed as the root (euid == 0) in the initial namespace, for backward compatibility. (`/run/runc` is used) * If runc is executed as the root (euid == 0) in an user namespace, `$XDG_RUNTIME_DIR` is honored if `$USER != "" && $USER != "root"`. This allows unprivileged users to allow execute runc as the root in userns, without mounting writable `/run/runc`. Note about `state.json`: * `rootless` is set to true when `RootlessEUID == true && RootlessCgroups == true`. Signed-off-by: Akihiro Suda <firstname.lastname@example.org>
- Loading branch information...
Showing with 231 additions and 198 deletions.
- +5 −6 checkpoint.go
- +8 −2 libcontainer/cgroups/fs/apply_raw.go
- +10 −3 libcontainer/configs/config.go
- +13 −40 libcontainer/configs/validate/rootless.go
- +20 −24 libcontainer/configs/validate/rootless_test.go
- +2 −2 libcontainer/configs/validate/validator.go
- +26 −25 libcontainer/container_linux.go
- +1 −1 libcontainer/factory_linux.go
- +4 −3 libcontainer/init_linux.go
- +10 −10 libcontainer/message_linux.go
- +6 −6 libcontainer/nsenter/nsexec.c
- +11 −10 libcontainer/process_linux.go
- +1 −1 libcontainer/specconv/example.go
- +15 −18 libcontainer/specconv/spec_linux.go
- +3 −2 libcontainer/specconv/spec_linux_test.go
- +3 −8 main.go
- +18 −1 pause.go
- +4 −4 ps.go
- +4 −7 restore.go
- +57 −0 rootless_linux.go
- +5 −1 spec.go
- +5 −24 utils_linux.go
Oops, something went wrong.