The following commands are moved from `contrib/cmd` to `tests/cmd`:
- fs-idmap
- pidfd-kill
- recvtty
- remap-rootfs
- sd-helper
- seccompagent
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
Previously, all of our userns tests worked around the remapping issue by
creating the paths that runc would attempt to create (like /proc).
However, this isn't really accurate to how real userns containers are
created, so it's much better to actually remap the rootfs.
Signed-off-by: Aleksa Sarai <cyphar@cyphar.com>
The container manager like containerd-shim can't use cgroup.kill feature or
freeze all the processes in cgroup to terminate the exec init process.
It's unsafe to call kill(2) since the pid can be recycled. It's good to
provide the pidfd of init process through the pidfd-socket. It's similar to
the console-socket. With the pidfd, the container manager like containerd-shim
can send the signal to target process safely.
And for the standard init process, we can have polling support to get
exit event instead of blocking on wait4.
Signed-off-by: Wei Fu <fuweid89@gmail.com>
This really isn't ideal but it can be used to avoid the largest issues
with the memfd-based runc binary protection. There are several caveats
with using this tool, see the help page for the new binary for details.
Signed-off-by: Aleksa Sarai <cyphar@cyphar.com>
Implement sample seccomp agent. It's also used in integration tests in
the following commit.
Instructions how to use it in contrib/cmd/seccompagent/README.md
Signed-off-by: Alban Crequy <alban@kinvolk.io>
Signed-off-by: Rodrigo Campos <rodrigo@kinvolk.io>
Co-authored-by: Rodrigo Campos <rodrigo@kinvolk.io>
Add a test case for an issue fixed by the previous commit.
Unfortunately, this is somewhat complicated as there's no easy way to
create a transient unit, so a binary, sd-helper, had to be added. On top
of that, an ability to create a parent/pod cgroup is added to
helpers.bash, which might be useful for future integration tests.
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
This uses the standard go vendor location instead of old Godeps
location.
Also remove usage of symlink GOPATH. Since our README mentions that you
should build it inside GOPATH, i think its a reasonable to assume that
you dont need to create a tmp GOPATH.
Signed-off-by: Daniel Dao <dqminh89@gmail.com>
This is a proof-of-concept for the --console-socket API. It just acts as
a dumb input-output copy process (nowhere near as good as the internal
runC one since it doesn't handle console resizes or signals). It also
provides a test-friendly mode that will be used in the bats integration
tests.
This patch is part of the console rewrite patchset.
Signed-off-by: Aleksa Sarai <asarai@suse.de>
So we can make all types of release binary with combination
of following flags:
seccomp
selinux
apparmor
static
All binary files are put in release/ dir, like:
[root@zlosvm1 runc]# ls -l release
total 53556
-rwxr-xr-x 1 root root 9517965 Aug 24 16:59 runc
-rwxr-xr-x 1 root root 9673533 Aug 24 17:00 runc.seccomp
-rwxr-xr-x 1 root root 9705839 Aug 24 17:00 runc.seccomp.selinux
-rwxr-xr-x 1 root root 9546175 Aug 24 16:59 runc.selinux
-rwxr-xr-x 1 root root 8205015 Aug 24 16:59 runc.selinux.static
-rwxr-xr-x 1 root root 8181789 Aug 24 16:59 runc.static
...
Closes#899
Signed-off-by: Zhao Lei <zhaolei@cn.fujitsu.com>
Currently we need to clone github.com/opencontainers/runc to
GOPATH so we can make it, it's not friendly for developers.
We can resolve it by vendoring itself as a symlink in GOPATH.
Signed-off-by: Qiang Huang <h.huangqiang@huawei.com>
This add `make binary` to perform direct install libcontainer binaries inside
dockercore/libcontainer container instead of having to install dependencies and
run `make direct-install` on the host.
The `nsinit` binary will be placed into `bundles/nsinit`, and we ignore the
bundles directory from git.
Signed-off-by: Daniel, Dao Quang Minh <dqminh89@gmail.com>
Akihiro Suda