fix(libcontainer) no_pivot args is not used #2923

xujihui1985 · 2024-09-21T10:12:45Z

fix the problem that no_pivot args is not used when create container when we prepare rootfs with chroot, we should move_mount the rootfs before chroot, otherwise we will not able to use the new rootfs when exec into the container

xujihui1985 · 2024-09-22T07:14:58Z

@udzura This PR addresses the issue where the no_pivot argument is not recognized. This argument is crucial in environments where the pivot_root syscall is not permitted, such as when running containers within containers.

udzura · 2024-09-22T09:53:12Z

I understand what this PR aim to do 👍 But I have no privilege to merge this. I guess you've mistaken me for someone!

xujihui1985 · 2024-09-22T11:49:29Z

I understand what this PR aim to do 👍 But I have no privilege to merge this. I guess you've mistaken me for someone!

@udzura sorry for bother you, could you help to involve someone that is able to have a look at this PR? Really appreciate.

utam0k · 2024-09-23T11:58:23Z

I'll check this PR. Thanks for your first contribution!

utam0k · 2024-09-23T12:02:36Z

@xujihui1985 May I ask you to add an integration test for this PR?
https://containers.github.io/youki/developer/e2e/rust_oci_test.html

xujihui1985 · 2024-09-23T12:04:42Z

@xujihui1985 May I ask you to add an integration test for this PR?

https://containers.github.io/youki/developer/e2e/rust_oci_test.html

sure, I'd like to learn how to add integrate test

utam0k · 2024-09-23T12:21:40Z

sure, I'd like to learn how to add integrate test

I can help you if you need ;)

YJDoc2 · 2024-09-23T13:08:48Z

Hey @xujihui1985 Thanks for your contribution! May I ask you to also take a look at #2597 , which also deals with no_pivot and the create and run commands. Can you check if you need to pick up any changes from there to here? Thanks.

xujihui1985 · 2024-09-23T13:21:37Z

Hey @xujihui1985 Thanks for your contribution! May I ask you to also take a look at #2597 , which also deals with no_pivot and the create and run commands. Can you check if you need to pick up any changes from there to here? Thanks.

Hi @YJDoc2 I just noticed a similar pull request that addresses this issue and is almost identical to my approach. However, the only problem is that the chroot implementation is incorrect. I can build upon his PR, fix the chroot issue, and include credit for his work.

Signed-off-by: Vanient <[email protected]>

Move the rootfs to the root of the host filesystem before chrooting, this is equivalent to pivot_root, if don't move mount first, we will not see the new rootfs when exec into the container Signed-off-by: xujihui1985 <[email protected]>

xujihui1985 · 2024-09-27T01:10:34Z

@YJDoc2 I have pick the change from commit #2597, I will continue work on integration test

…havior Move the mount operation to occur before calling chroot to better simulate the effect of pivot_root. Add a check to confirm if the current process is running inside an isolated mount namespace, ensuring proper mount handling. Signed-off-by: xujihui1985 <[email protected]>

Signed-off-by: xujihui1985 <[email protected]>

Feat/implement intergration test

xujihui1985 · 2024-10-08T16:23:07Z

@udzura, @YJDoc2 Hi, I have implemented the integration test in commit c82496b. For now, I copied and reused some utility functions, like test_inside_container -> test_inside_container_with_no_pivot, since create_container currently doesn't allow setting the necessary arguments. and change this function will cause lots of change in current testcase. This was done to verify if the test works as expected. Once the test is reviewed and approved, I'll refactor the functions accordingly.

utam0k · 2024-10-09T01:53:40Z

tests/contest/contest/src/tests/no_pivot/mod.rs

That's what I expected. But I want @YJDoc2 to review it, too.

sure, let me know if any improvements are possible

I'll take a look at this soon. Thanks!

YJDoc2

Hey, the overall implementation looks good, I have a couple of nitpick comments, please take a look at them.

As for the tests, I feel that the added test is ok, but we need to refactor the test_inside... function to avoid duplication. I'll think on a way for more "ergonomic" imple, but if you can think of something, go ahead.

I'm also thinking we should have this functionality in test_outside.. so we can also test for container create,run,delete with no_pivot. WDYT? Would that be useful?

crates/libcontainer/src/process/container_init_process.rs

tests/contest/runtimetest/src/tests.rs

Gekko0114 · 2024-10-14T05:11:59Z

/cc @Gekko0114

Signed-off-by: xujihui1985 <[email protected]>

xujihui1985 · 2024-10-14T13:48:53Z

Hey, the overall implementation looks good, I have a couple of nitpick comments, please take a look at them.

As for the tests, I feel that the added test is ok, but we need to refactor the test_inside... function to avoid duplication. I'll think on a way for more "ergonomic" imple, but if you can think of something, go ahead.

I'm also thinking we should have this functionality in test_outside.. so we can also test for container create,run,delete with no_pivot. WDYT? Would that be useful?

@YJDoc2 I believe the test_outside_container with the no-pivot option doesn't behave any differently from the test with the option enabled. It's unclear what to assert when testing outside the container with the no-pivot option because, outside of a container mount namespace, chroot and pivot_root have no noticeable effect. Any idea?

Signed-off-by: xujihui1985 <[email protected]>

xujihui1985 · 2024-10-17T06:20:50Z

@YJDoc2 Do you think it would be better to refactor the test_inside... function in a separate PR? It will involve a lot of changes as the change of the signature

xujihui1985 · 2024-10-21T03:58:51Z

@YJDoc2 Do you think it would be better to refactor the test_inside... function in a separate PR? It will involve a lot of changes as the change of the signature

@YJDoc2 Hi, would you like to proceed the PR or wait until the function been refactored?

YJDoc2 · 2024-10-22T04:25:52Z

I believe the test_outside_container with the no-pivot option doesn't behave any differently from the test with the option enabled. It's unclear what to assert when testing outside the container with the no-pivot option because, outside of a container mount namespace, chroot and pivot_root have no noticeable effect.

I mentioned test_outside_container as that is another test fn we use, but I hadn't thought this in detail. My main intention here was that to verify via e2e that basic commands such as start, delete, run etc work properly with the no_pivot, so whatever does the trick, works.

@YJDoc2 Hi, would you like to proceed the PR or wait until the function been refactored?

I think the refactoring should be done in separate PR as that will be a big change, I'll do a final review, hopefully today, and if all's ok then merge, after which you can start with that refactoring.

xujihui1985 · 2024-10-28T10:55:52Z

I believe the test_outside_container with the no-pivot option doesn't behave any differently from the test with the option enabled. It's unclear what to assert when testing outside the container with the no-pivot option because, outside of a container mount namespace, chroot and pivot_root have no noticeable effect.

I mentioned test_outside_container as that is another test fn we use, but I hadn't thought this in detail. My main intention here was that to verify via e2e that basic commands such as start, delete, run etc work properly with the no_pivot, so whatever does the trick, works.

@YJDoc2 Hi, would you like to proceed the PR or wait until the function been refactored?

I think the refactoring should be done in separate PR as that will be a big change, I'll do a final review, hopefully today, and if all's ok then merge, after which you can start with that refactoring.

@YJDoc2 Hi, hope everything goes well with you, if there is anything I can improve for this PR, please let me know as

YJDoc2

Hey, I have a couple of nits, but nothing that blocks the merge. I'm approving this PR, and you can address the nits in the PR you'll make to refactor the test function. I'm not merging this right away, in case you want to reply something, but if no reply, I'll merge it by tomorrow.

YJDoc2 · 2024-10-28T18:35:06Z

crates/libcontainer/src/process/container_init_process.rs

-        if namespaces.get(LinuxNamespaceType::Mount)?.is_some() {
-            // change the root of filesystem of the process to the rootfs
-            syscall.pivot_rootfs(rootfs_path).map_err(|err| {
-                tracing::error!(?err, ?rootfs_path, "failed to pivot root");
-                InitProcessError::SyscallOther(err)
-            })?;


nit: we should move the comment above this to the function where we are doing this

YJDoc2 · 2024-10-28T18:35:59Z

tests/contest/contest/src/utils/test_utils.rs

-    let res = Command::new(get_runtime_path())
-        // set stdio so that we can get o/p of runtimetest
-        // in test_inside_container function
+fn create_container_command<P: AsRef<Path>>(id: &str, dir: P, with_pivot_root: bool) -> Command {


nit: I feel a better name for argument would be no_pivot or pivot_root . with_pivot_root feels like a path for pivoting a root to. wdyt?

YJDoc2 · 2024-10-28T18:38:20Z

@YJDoc2 Hi, hope everything goes well with you, if there is anything I can improve for this PR, please let me know as

Hey, sorry, I was busy with work and some other stuff and couldn't get to any of this. This is good to merge, and I have approved this. I will wait till tom if you have any replies to my comments, otherwise I'll merge this as-is, and you can address the nits in your next PR.

xujihui1985 · 2024-10-29T02:12:03Z

@YJDoc2 Hi, hope everything goes well with you, if there is anything I can improve for this PR, please let me know as

Hey, sorry, I was busy with work and some other stuff and couldn't get to any of this. This is good to merge, and I have approved this. I will wait till tom if you have any replies to my comments, otherwise I'll merge this as-is, and you can address the nits in your next PR.

thanks for your reply. I will continue working on the refactoring. Cheers

YJDoc2 · 2024-10-29T04:23:33Z

I will continue working on the refactoring.

Thank you! Please address the nitpicks in your next PR.

xujihui1985 force-pushed the fix/implement_no_pivot branch from 972e813 to fb2a3d9 Compare September 21, 2024 10:15

utam0k added the kind/bug label Sep 23, 2024

Vanient and others added 2 commits September 27, 2024 09:04

Support setting no_pivot_root for create and run command

818cec8

Signed-off-by: Vanient <[email protected]>

fix: mount move before choot

65d6b54

Move the rootfs to the root of the host filesystem before chrooting, this is equivalent to pivot_root, if don't move mount first, we will not see the new rootfs when exec into the container Signed-off-by: xujihui1985 <[email protected]>

xujihui1985 force-pushed the fix/implement_no_pivot branch from fb2a3d9 to 65d6b54 Compare September 27, 2024 01:09

xujihui1985 added 3 commits October 8, 2024 20:54

implement intergration test for no-pivot

0f0caa5

Signed-off-by: xujihui1985 <[email protected]>

Merge pull request #2 from xujihui1985/feat/implement-intergration-test

c82496b

Feat/implement intergration test

utam0k reviewed Oct 9, 2024

View reviewed changes

YJDoc2 reviewed Oct 14, 2024

View reviewed changes

crates/libcontainer/src/process/container_init_process.rs Show resolved Hide resolved

crates/libcontainer/src/process/container_init_process.rs Show resolved Hide resolved

tests/contest/runtimetest/src/tests.rs Outdated Show resolved Hide resolved

YJDoc2 mentioned this pull request Oct 14, 2024

create mount_rootfs method #2953

Merged

fix: add comments to no-pivot related code

6aa2ce5

Signed-off-by: xujihui1985 <[email protected]>

xujihui1985 force-pushed the fix/implement_no_pivot branch from 612be88 to 6aa2ce5 Compare October 14, 2024 13:34

fix(lint): fix format

60f5e23

Signed-off-by: xujihui1985 <[email protected]>

YJDoc2 approved these changes Oct 28, 2024

View reviewed changes

YJDoc2 merged commit d071596 into youki-dev:main Oct 29, 2024
27 checks passed

github-actions bot mentioned this pull request Oct 29, 2024

Release for v0.4.2 #2906

Open

xujihui1985 mentioned this pull request Nov 3, 2024

refactor(test): refine function create_container #2973

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(libcontainer) no_pivot args is not used #2923

fix(libcontainer) no_pivot args is not used #2923

xujihui1985 commented Sep 21, 2024

xujihui1985 commented Sep 22, 2024

udzura commented Sep 22, 2024

xujihui1985 commented Sep 22, 2024

utam0k commented Sep 23, 2024

utam0k commented Sep 23, 2024

xujihui1985 commented Sep 23, 2024

utam0k commented Sep 23, 2024

YJDoc2 commented Sep 23, 2024

xujihui1985 commented Sep 23, 2024

xujihui1985 commented Sep 27, 2024

xujihui1985 commented Oct 8, 2024 •

edited

Loading

utam0k Oct 9, 2024 •

edited

Loading

xujihui1985 Oct 9, 2024

YJDoc2 Oct 10, 2024

YJDoc2 left a comment

Gekko0114 commented Oct 14, 2024

xujihui1985 commented Oct 14, 2024

xujihui1985 commented Oct 17, 2024

xujihui1985 commented Oct 21, 2024

YJDoc2 commented Oct 22, 2024

xujihui1985 commented Oct 28, 2024 •

edited

Loading

YJDoc2 left a comment

YJDoc2 Oct 28, 2024

YJDoc2 Oct 28, 2024

YJDoc2 commented Oct 28, 2024

xujihui1985 commented Oct 29, 2024

YJDoc2 commented Oct 29, 2024

fix(libcontainer) no_pivot args is not used #2923

fix(libcontainer) no_pivot args is not used #2923

Conversation

xujihui1985 commented Sep 21, 2024

xujihui1985 commented Sep 22, 2024

udzura commented Sep 22, 2024

xujihui1985 commented Sep 22, 2024

utam0k commented Sep 23, 2024

utam0k commented Sep 23, 2024

xujihui1985 commented Sep 23, 2024

utam0k commented Sep 23, 2024

YJDoc2 commented Sep 23, 2024

xujihui1985 commented Sep 23, 2024

xujihui1985 commented Sep 27, 2024

xujihui1985 commented Oct 8, 2024 • edited Loading

utam0k Oct 9, 2024 • edited Loading

Choose a reason for hiding this comment

xujihui1985 Oct 9, 2024

Choose a reason for hiding this comment

YJDoc2 Oct 10, 2024

Choose a reason for hiding this comment

YJDoc2 left a comment

Choose a reason for hiding this comment

Gekko0114 commented Oct 14, 2024

xujihui1985 commented Oct 14, 2024

xujihui1985 commented Oct 17, 2024

xujihui1985 commented Oct 21, 2024

YJDoc2 commented Oct 22, 2024

xujihui1985 commented Oct 28, 2024 • edited Loading

YJDoc2 left a comment

Choose a reason for hiding this comment

YJDoc2 Oct 28, 2024

Choose a reason for hiding this comment

YJDoc2 Oct 28, 2024

Choose a reason for hiding this comment

YJDoc2 commented Oct 28, 2024

xujihui1985 commented Oct 29, 2024

YJDoc2 commented Oct 29, 2024

xujihui1985 commented Oct 8, 2024 •

edited

Loading

utam0k Oct 9, 2024 •

edited

Loading

xujihui1985 commented Oct 28, 2024 •

edited

Loading