From f4af9ad5fc25b0b263e064e9b5307bbffeac2b0d Mon Sep 17 00:00:00 2001 From: lfbzhm Date: Wed, 19 Feb 2025 15:37:19 +0000 Subject: [PATCH 1/2] test: exec into a container with private time ns Signed-off-by: lifubang (cherry picked from commit 74619689ae087869f2e1550124fc553c135f2cb7) Signed-off-by: Kir Kolyshkin --- tests/integration/timens.bats | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/tests/integration/timens.bats b/tests/integration/timens.bats index fb33e2b27..10f3fc057 100644 --- a/tests/integration/timens.bats +++ b/tests/integration/timens.bats @@ -54,6 +54,26 @@ function teardown() { grep -E '^boottime\s+1337\s+3141519$' <<<"$output" } +# https://github.com/opencontainers/runc/issues/4635 +@test "runc exec [simple timens]" { + requires timens + + update_config '.process.args = ["sleep", "inf"]' + update_config '.linux.namespaces += [{"type": "time"}] + | .linux.timeOffsets = { + "monotonic": { "secs": 7881, "nanosecs": 2718281 }, + "boottime": { "secs": 1337, "nanosecs": 3141519 } + }' + + runc run -d --console-socket "$CONSOLE_SOCKET" test_busybox + [ "$status" -eq 0 ] + + runc exec test_busybox cat /proc/self/timens_offsets + [ "$status" -eq 0 ] + grep -E '^monotonic\s+7881\s+2718281$' <<<"$output" + grep -E '^boottime\s+1337\s+3141519$' <<<"$output" +} + @test "runc run [simple timens + userns]" { requires root requires timens From c5312bc308180864d4c82d6ded183184d3875ecf Mon Sep 17 00:00:00 2001 From: lifubang Date: Sat, 22 Feb 2025 16:40:18 +0000 Subject: [PATCH 2/2] libct: don't send config to nsexec when joining an existing timens We should configure the process's timens offset only when we need to create new time namespace, we shouldn't do it if we are joining an existing time namespace. (#4635) Signed-off-by: lifubang (cherry picked from commit ad09197e41ecf754ed89cdfc6557948561c3523f) Signed-off-by: Kir Kolyshkin --- libcontainer/container_linux.go | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/libcontainer/container_linux.go b/libcontainer/container_linux.go index c02116177..97b0c4005 100644 --- a/libcontainer/container_linux.go +++ b/libcontainer/container_linux.go @@ -1114,8 +1114,9 @@ func (c *Container) bootstrapData(cloneFlags uintptr, nsMaps map[configs.Namespa Value: c.config.RootlessEUID, }) - // write boottime and monotonic time ns offsets. - if c.config.TimeOffsets != nil { + // write boottime and monotonic time ns offsets only when we are not joining an existing time ns + _, joinExistingTime := nsMaps[configs.NEWTIME] + if !joinExistingTime && c.config.TimeOffsets != nil { var offsetSpec bytes.Buffer for clock, offset := range c.config.TimeOffsets { fmt.Fprintf(&offsetSpec, "%s %d %d\n", clock, offset.Secs, offset.Nanosecs)