mirror/runc
1
0
Fork 0
mirror of https://github.com/opencontainers/runc.git synced 2026-07-11 06:03:57 +08:00
Code Issues Packages Projects Releases Wiki Activity
3,867 Commits 7 Branches 82 Tags
f08cdaeec98a2a28aaa2ea14d630fb0b618ee216
Commit Graph

3867 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Erik Sipsma f08cdaeec9 Skip searching /dev/.udev for device nodes. 
Closes: #2093

Signed-off-by: Erik Sipsma <sipsma@amazon.com>
 2019-07-31 19:41:33 +00:00
Mrunal Patel 80d35c7ce4 Merge pull request #2082 from AkihiroSuda/blkio-kernel50 
integration: remove blkio.weight (unavailable in kernel 5.0)
 2019-07-29 12:54:32 -07:00
Mrunal Patel dd8b9b1414 Merge pull request #2081 from AkihiroSuda/criu312 
Bump CRIU to 3.12
 2019-07-29 12:50:41 -07:00
Qiang Huang 9ae790178e Merge pull request #2080 from zhlhahaha/pr_id 
Update busybox source and fix runc exec bug
 2019-07-27 09:26:32 +08:00
Akihiro Suda 351bfb4baf integration: remove blkio.weight (unavailable in kernel 5.0) 
weight, leafWeight, and weightDevice are removed in kernel 5.0

https://github.com/torvalds/linux/commit/f382fb0bcef4c37dc049e9f6963e3baf204d815c
https://github.com/opencontainers/runtime-spec/issues/1015

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
 2019-07-08 18:08:50 +09:00
Akihiro Suda 7e67862542 Bump CRIU to 3.12 
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
 2019-07-08 17:22:57 +09:00
Howard Zhang 68cc1a772a Update busybox source and fix runc exec bug 
Currently, the id verification in integration test failed on arm
platform due to the inconsistent /etc/group in the busybox images
for arm and x86. To be specific, the nogroup id in x86 is 99 while
that in arm is 65534.

99 is old id for nogroup, and no longer be used in recent system,
so sync the busybox image for arm and x86 to the image in busybox
github. Also change the id verification rule in integration test.

Signed-off-by: Howard Zhang <howard.zhang@arm.com>
 2019-07-07 19:36:23 -07:00
Michael Crosby 6cccc1760d Merge pull request #2075 from KentaTada/fix-bash-completion 
Update bash completion for v1.0.0 release
 2019-06-26 12:58:14 -04:00
Kenta Tada 371d13c995 Update bash completion for v1.0.0 release 
Signed-off-by: Kenta Tada <Kenta.Tada@sony.com>
 2019-06-25 11:17:31 +09:00
Mrunal Patel f4982d86f7 Merge pull request #2074 from odinuge/dep/libseccomp-golang 
Update dependency libseccomp-golang
 2019-06-21 13:37:24 -07:00
Odin Ugedal 652297c7c7 Update dependency libseccomp-golang 
Diff here: https://github.com/seccomp/libseccomp-golang/compare/1b506fc7c24e...v0.9.1

Fixes https://nvd.nist.gov/vuln/detail/CVE-2017-18367

Signed-off-by: Odin Ugedal <odin@ugedal.com>
 2019-06-20 22:35:57 +02:00
Michael Crosby 6cc5158888 Merge pull request #2071 from judu/patch-1 
Allow to define `COMMIT` by env
 2019-06-11 08:12:36 -04:00
Julien Durillon 6770c8695a Allow to define COMMIT by env 
Some package managers download the archive instead of cloning the git repo.
When they do that, the call to git fails.

This commit allows package managers to provide the COMMIT value via environment.

Signed-off-by: Julien Durillon <julien.durillon@clever-cloud.com>
 2019-06-11 13:41:20 +02:00
Mrunal Patel b4a0b1d737 Merge pull request #2065 from odinuge/master 
Fix cgroup hugetlb size prefix for kB
 2019-06-06 12:38:57 -07:00
Aleksa Sarai a77c3195e9 merge branch 'pr-2067' 
libcontainer: change seccomp test for clone syscall

LGTMs: @crosbymichael @cyphar
Closes #2067
 2019-06-05 11:12:22 +10:00
Kenta Tada b54fd85bbf libcontainer: change seccomp test for clone syscall 
This commit changes the value of seccomp test for clone syscall.
Also hardcoded values should be changed because it is unclear to
understand what flags are tested.

Related issues:

* https://github.com/containerd/containerd/pull/3314
* https://github.com/moby/moby/pull/39308
* https://github.com/opencontainers/runtime-tools/pull/694

Signed-off-by: Kenta Tada <Kenta.Tada@sony.com>
 2019-06-04 18:52:00 +09:00
Odin Ugedal 6f77e35daf Export list of HugePageSizeUnits 
This will allow others to import it instead of copying it.

Signed-off-by: Odin Ugedal <odin@ugedal.com>
 2019-05-30 20:17:30 +02:00
Odin Ugedal c6445b1c1c Add tests for GetHugePageSize 
Add tests to avoid regressions

Signed-off-by: Odin Ugedal <odin@ugedal.com>
 2019-05-30 17:27:32 +02:00
Odin Ugedal 273e7b74a7 Fix cgroup hugetlb size prefix for kB 
The hugetlb cgroup control files (introduced here in 2012:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=abb8206cb0773)
use "KB" and not "kB"
(https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/mm/hugetlb_cgroup.c?h=v5.0#n349).

The behavior in the kernel has not changed since the introduction, and
the current code using "kB" will therefore fail on devices with small
amounts of ram (see
https://github.com/kubernetes/kubernetes/issues/77169) running a kernel
with config flag CONFIG_HUGETLBFS=y

As seen from the code in "mem_fmt" inside hugetlb_cgroup.c, only "KB",
"MB" and "GB" are used, so the others may be removed as well.

Here is a real world example of the files inside the
"/sys/kernel/mm/hugepages/" directory:
- "hugepages-64kB"
- "hugepages-2048kB"
- "hugepages-32768kB"
- "hugepages-1048576kB"

And the corresponding cgroup files:
- "hugetlb.64KB._____"
- "hugetlb.2MB._____"
- "hugetlb.32MB._____"
- "hugetlb.1GB._____"

Signed-off-by: Odin Ugedal <odin@ugedal.com>
 2019-05-29 21:52:43 +02:00
Mrunal Patel 5ef781c2e7 Merge pull request #2061 from KentaTada/add-cgroup-namespace-test 
libcontainer: fix TestGetContainerState to check configs.NEWCGROUP
 2019-05-22 16:09:38 -07:00
Qiang Huang c8337777b6 Merge pull request #2042 from xiaochenshen/rdt-add-missing-destroy 
libcontainer: intelrdt: add missing destroy handler in defer func
 2019-05-21 09:48:00 +08:00
Kenta Tada 65032b55b1 libcontainer: fix TestGetContainerState to check configs.NEWCGROUP 
This test needs to handle the case of configs.NEWCGROUP
as Namespace's type.

Signed-off-by: Kenta Tada <Kenta.Tada@sony.com>
 2019-05-21 09:10:38 +09:00
Mrunal Patel b9b6cc6e47 Merge pull request #2057 from giuseppe/no-reopen-stderr 
main: not reopen /dev/stderr
 2019-05-14 17:39:28 -07:00
Giuseppe Scrivano 8383c724a4 main: not reopen /dev/stderr 
commit a146081828 introduced a change to
write to /dev/stderr by default.  Do not reopen the file in this case,
but use directly the fd 2.

Closes: https://github.com/opencontainers/runc/issues/2056
Closes: https://github.com/kubernetes/kubernetes/issues/77615
Closes: https://github.com/cri-o/cri-o/issues/2368

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
 2019-05-14 21:56:41 +02:00
Mrunal Patel eb4aeed24f Merge pull request #2038 from imxyb/defer-destroy 
`r.destroy` can defer exec in `runner.run` method.
 2019-05-07 15:48:14 -07:00
Mrunal Patel 2484581dd7 Merge pull request #2035 from cyphar/bindmount-types 
specconv: always set "type: bind" in case of MS_BIND
 2019-05-07 15:47:58 -07:00
Mrunal Patel a0ecf749ee Merge pull request #2047 from filbranden/systemd7 
Move systemd.Manager initialization into a function in that module
 2019-05-07 15:08:41 -07:00
Michael Crosby 70bc4cd847 Merge pull request #2034 from masters-of-cats/pr-child-logging 
Support for logging from children processes
 2019-05-07 10:35:48 -04:00
Filipe Brandenburger 46351eb3d1 Move systemd.Manager initialization into a function in that module 
This will permit us to extend the internals of systemd.Manager to include
further information about the system, such as whether cgroupv1, cgroupv2 or
both are in effect.

Furthermore, it allows a future refactor of moving more of UseSystemd() code
into the factory initialization function.

Signed-off-by: Filipe Brandenburger <filbranden@gmail.com>
 2019-05-01 13:22:19 -07:00
Mrunal Patel dae70e8efe Merge pull request #2045 from cyphar/release-rc8 
VERSION: release 1.0.0-rc8
 2019-04-25 16:48:16 -07:00
Aleksa Sarai 62bd2593b3 VERSION: back to development 
Signed-off-by: Aleksa Sarai <asarai@suse.de>
 2019-04-25 07:48:36 +10:00
Aleksa Sarai 425e105d5a VERSION: release 1.0.0-rc8 
Signed-off-by: Aleksa Sarai <asarai@suse.de>
v1.0.0-rc8 		2019-04-25 07:48:25 +10:00
Mrunal Patel c1b8c57aba Merge pull request #2043 from rhatdan/selinux 
Vendor in latest selinux code for keycreate errors
 2019-04-24 08:39:10 -07:00
Daniel J Walsh 8362cd02c0 Vendor in latest selinux code for keycreate errors 
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
 2019-04-24 08:41:56 -04:00
Georgi Sabev a146081828 Write logs to stderr by default 
Minor refactoring to use the filePair struct for both init sock and log pipe

Co-authored-by: Julia Nedialkova <julianedialkova@hotmail.com>
Signed-off-by: Georgi Sabev <georgethebeatle@gmail.com>
 2019-04-24 15:18:14 +03:00
Georgi Sabev 68b4ff5b37 Simplify bail logic & minor nsexec improvements 
Co-authored-by: Julia Nedialkova <julianedialkova@hotmail.com>
Signed-off-by: Georgi Sabev <georgethebeatle@gmail.com>
 2019-04-24 15:16:11 +03:00
Xiaochen Shen 17b37ea3fa libcontainer: intelrdt: add missing destroy handler in defer func 
In the exception handling of initProcess.start(), we need to add the
missing IntelRdtManager.Destroy() handler in defer func.

Signed-off-by: Xiaochen Shen <xiaochen.shen@intel.com>
 2019-04-24 16:41:51 +08:00
Georgi Sabev 475aef10f7 Remove redundant log function 
Bump logrus so that we can use logrus.StandardLogger().Logf instead

Co-authored-by: Julia Nedialkova <julianedialkova@hotmail.com>
Signed-off-by: Georgi Sabev <georgethebeatle@gmail.com>
 2019-04-22 17:54:55 +03:00
Georgi Sabev ba3cabf932 Improve nsexec logging 
* Simplify logging function
* Logs contain __FUNCTION__:__LINE__
* Bail uses write_log

Co-authored-by: Julia Nedialkova <julianedialkova@hotmail.com>
Co-authored-by: Danail Branekov <danailster@gmail.com>
Signed-off-by: Georgi Sabev <georgethebeatle@gmail.com>
 2019-04-22 17:53:52 +03:00
Xiao YongBiao da5a2dd456 r.destroy can defer exec in runner.run method. 
Signed-off-by: Xiao YongBiao <xyb4638@gmail.com>
 2019-04-10 23:25:03 +08:00
Aleksa Sarai 8296826da5 specconv: always set "type: bind" in case of MS_BIND 
We discovered in umoci that setting a dummy type of "none" would result
in file-based bind-mounts no longer working properly, which is caused by
a restriction for when specconv will change the device type to "bind" to
work around rootfs_linux.go's ... issues.

However, bind-mounts don't have a type (and Linux will ignore any type
specifier you give it) because the type is copied from the source of the
bind-mount. So we should always overwrite it to avoid user confusion.

Signed-off-by: Aleksa Sarai <asarai@suse.de>
 2019-04-08 15:08:08 +10:00
Danail Branekov c486e3c406 Address comments in PR 1861 
Refactor configuring logging into a reusable component
so that it can be nicely used in both main() and init process init()

Co-authored-by: Georgi Sabev <georgethebeatle@gmail.com>
Co-authored-by: Giuseppe Capizzi <gcapizzi@pivotal.io>
Co-authored-by: Claudia Beresford <cberesford@pivotal.io>
Signed-off-by: Danail Branekov <danailster@gmail.com>
 2019-04-04 14:57:28 +03:00
Marco Vedovati feebfac358 Remove pipe close before exec. 
Pipe close before exec is not necessary as os.Pipe() is calling pipe2
with O_CLOEXEC option.

Signed-off-by: Marco Vedovati <mvedovati@suse.com>
 2019-04-04 14:53:30 +03:00
Marco Vedovati 9a599f62fb Support for logging from children processes 
Add support for children processes logging (including nsexec).
A pipe is used to send logs from children to parent in JSON.
The JSON format used is the same used by logrus JSON formatted,
i.e. children process can use standard logrus APIs.

Signed-off-by: Marco Vedovati <mvedovati@suse.com>
 2019-04-04 14:53:23 +03:00
Michael Crosby 029124da7a Merge pull request #2031 from lifubang/selinux 
Add selinux validate in runc exec
 2019-04-03 16:09:19 -04:00
lifubang 3e6688f5c9 add selinux label for runc exec 
Signed-off-by: lifubang <lifubang@acmcoder.com>
 2019-04-03 12:09:06 +08:00
Mrunal Patel 6a3f4749b8 Merge pull request #2032 from rhatdan/selinux 
Fix SELinux failures on disabled SELinux Machines
 2019-04-02 13:39:48 -07:00
Daniel J Walsh dcf994b4f8 Fix SELinux failures on disabled SELinux Machines 
On some machines when setting the SELinux key labels to "", we are seeing
failures that cause runc to fail.  Even if SELinux is disabled.

This check will ignore callers calling SELinux Set*Label functions with ""
when SELinux is disabled.

Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
 2019-04-02 10:27:27 -04:00
Aleksa Sarai da2021132b merge branch 'pr-2026' 
VERSION: back to development
  VERSION: release v1.0.0-rc7

Votes: +5 -0 /0
LGTMs: [unanimous]
 2019-03-29 02:19:24 +11:00
Aleksa Sarai 6b5ee713f3 VERSION: back to development 
Signed-off-by: Aleksa Sarai <asarai@suse.de>
 2019-03-28 22:46:35 +11:00