Manage ns: manage pid #3910
Closed
Manage ns: manage pid #3910
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Member
Author
|
/test e2e_rhel |
b9b84ce to
bd0ae27
Compare
Member
Author
|
mount is getting EPERM'd in unit tests :( |
bd0ae27 to
47a7e29
Compare
47a7e29 to
da5e654
Compare
ec2dde8 to
a291448
Compare
a291448 to
1b01a85
Compare
85574c9 to
324a47b
Compare
Member
Author
|
/retest |
Member
Author
saschagrunert
approved these changes
Aug 21, 2020
Member
saschagrunert
left a comment
There was a problem hiding this comment.
Just found some nits, otherwise LGTM 👏
| } | ||
| for _, namespaceToJoin := range namespacesToJoin { | ||
| path, err := configNsPath(&m, namespaceToJoin.rspecNS) | ||
| if err == nil { |
Member
There was a problem hiding this comment.
What to do if the error is not nil? Log it or return?
Member
Author
There was a problem hiding this comment.
we ignore. If it errors, the namespaces were not managed
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: haircommander, saschagrunert The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
Contributor
|
Other than @saschagrunert 's comments, LGTM |
Member
Author
|
/retest |
mrunalp
reviewed
Aug 25, 2020
mrunalp
reviewed
Aug 25, 2020
5b48d84 to
af76399
Compare
Member
Author
|
/retest |
1 similar comment
Member
Author
|
/retest |
Member
Author
/retest |
af76399 to
bf5e5bf
Compare
Member
Author
|
/retest |
2 similar comments
Member
Author
|
/retest |
Member
Author
|
/retest |
bf5e5bf to
d79d94e
Compare
Member
Author
dang |
4e35af9 to
c07341a
Compare
Member
Author
|
/retest |
pid namespaces were special cased as a namespace that was not managed, because they function differently For the other namespaces, we can pass a new namespace to the runtime when that namespace is private to the pod However, it would be a bother creating a new pid namespace (conmon would have to unshare the namespace, then do the bind mount) Instead, mount the pid namespace *after* the sandbox is created. This way, the infra container's runtime config doesn't list the namespace (more on that below) but subsequent containers created can join the namespace, instead of the proc entry. This further protects us from pid wrap A consequence of not adding the file to the config is the restore case is a bit odd. The other namespaces can join the namespace listed in the restored config.json, but the pid namespace is not saved in its config json. Work around this by saving the pidns location to the infra container's runDir this PR also adds unit tests, and refactors a couple of things to make tests pass Signed-off-by: Peter Hunt <[email protected]>
c07341a to
57b7856
Compare
Member
Author
|
/retest |
Contributor
|
@haircommander: The following test failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here. |
|
@haircommander: PR needs rebase. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
|
A friendly reminder that this PR had no activity for 30 days. |
|
@haircommander: The following tests failed, say
DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here. |
Contributor
|
@haircommander: The following tests failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here. |
Member
Author
|
I think we're not going to do this now. Hopefully eventually we can drop the infra container entirely |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
6 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What type of PR is this?
/kind bug
What this PR does / why we need it:
pid namespaces were special cased as a namespace that was not managed, because they function differently
For the other namespaces, we can pass a new namespace to the runtime when that namespace is private to the pod
However, it would be a bother creating a new pid namespace (conmon would have to unshare the namespace, then do the bind mount)
Instead, mount the pid namespace after the sandbox is created. This way, the infra container's runtime config doesn't list the namespace (more on that below)
but subsequent containers created can join the namespace, instead of the proc entry. This further protects us from pid wrap
A consequence of not adding the file to the config is the restore case is a bit odd. The other namespaces can join the namespace listed in the restored config.json,
but the pid namespace is not saved in its config json.
Work around this by saving the pidns location to the infra container's runDir
this PR also adds unit tests, and refactors a couple of things to make tests pass
Which issue(s) this PR fixes:
Special notes for your reviewer:
build on top of #3868
Does this PR introduce a user-facing change?