From 74619689ae087869f2e1550124fc553c135f2cb7 Mon Sep 17 00:00:00 2001 From: lfbzhm Date: Wed, 19 Feb 2025 15:37:19 +0000 Subject: [PATCH 1/2] test: exec into a container with private time ns Signed-off-by: lifubang --- tests/integration/timens.bats | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/tests/integration/timens.bats b/tests/integration/timens.bats index fb33e2b27..10f3fc057 100644 --- a/tests/integration/timens.bats +++ b/tests/integration/timens.bats @@ -54,6 +54,26 @@ function teardown() { grep -E '^boottime\s+1337\s+3141519$' <<<"$output" } +# https://github.com/opencontainers/runc/issues/4635 +@test "runc exec [simple timens]" { + requires timens + + update_config '.process.args = ["sleep", "inf"]' + update_config '.linux.namespaces += [{"type": "time"}] + | .linux.timeOffsets = { + "monotonic": { "secs": 7881, "nanosecs": 2718281 }, + "boottime": { "secs": 1337, "nanosecs": 3141519 } + }' + + runc run -d --console-socket "$CONSOLE_SOCKET" test_busybox + [ "$status" -eq 0 ] + + runc exec test_busybox cat /proc/self/timens_offsets + [ "$status" -eq 0 ] + grep -E '^monotonic\s+7881\s+2718281$' <<<"$output" + grep -E '^boottime\s+1337\s+3141519$' <<<"$output" +} + @test "runc run [simple timens + userns]" { requires root requires timens From ad09197e41ecf754ed89cdfc6557948561c3523f Mon Sep 17 00:00:00 2001 From: lifubang Date: Sat, 22 Feb 2025 16:40:18 +0000 Subject: [PATCH 2/2] libct: don't send config to nsexec when joining an existing timens We should configure the process's timens offset only when we need to create new time namespace, we shouldn't do it if we are joining an existing time namespace. (#4635) Signed-off-by: lifubang --- libcontainer/container_linux.go | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/libcontainer/container_linux.go b/libcontainer/container_linux.go index 54a0eaafe..e913fef0b 100644 --- a/libcontainer/container_linux.go +++ b/libcontainer/container_linux.go @@ -1146,8 +1146,9 @@ func (c *Container) bootstrapData(cloneFlags uintptr, nsMaps map[configs.Namespa Value: c.config.RootlessEUID, }) - // write boottime and monotonic time ns offsets. - if c.config.TimeOffsets != nil { + // write boottime and monotonic time ns offsets only when we are not joining an existing time ns + _, joinExistingTime := nsMaps[configs.NEWTIME] + if !joinExistingTime && c.config.TimeOffsets != nil { var offsetSpec bytes.Buffer for clock, offset := range c.config.TimeOffsets { fmt.Fprintf(&offsetSpec, "%s %d %d\n", clock, offset.Secs, offset.Nanosecs)