cri-o · openshift-merge-robot · Nov 19, 2021 · Nov 18, 2021
@@ -60,6 +60,7 @@ type Sandbox struct {
 	privileged         bool
 	hostNetwork        bool
 	usernsMode         string
+	containerEnvPath   string
 }
 
 // DefaultShmSize is the default shm size
@@ -248,6 +249,11 @@ func (s *Sandbox) HostnamePath() string {
 	return s.hostnamePath
 }
 
+// ContainerEnvPath retrieves the .containerenv path from a sandbox
+func (s *Sandbox) ContainerEnvPath() string {
+	return s.containerEnvPath
+}
+
 // Hostname returns the hostname of the sandbox
 func (s *Sandbox) Hostname() string {
 	return s.hostname
@@ -350,6 +356,23 @@ func (s *Sandbox) SetNetworkStopped(createFile bool) error {
 	return nil
 }
 
+// SetContainerEnvFile sets the container environment file.
+func (s *Sandbox) SetContainerEnvFile() error {
+	if s.containerEnvPath != "" {
+		return nil
+	}
+
+	infra := s.InfraContainer()
+	filePath := filepath.Join(infra.Dir(), ".containerenv")
+
+	f, err := os.Create(filePath)
+	if err == nil {
+		f.Close()
+	}
+	s.containerEnvPath = filePath
+	return nil
+}
+
 func (s *Sandbox) createFileInInfraDir(filename string) error {
 	// If the sandbox is not yet created,
 	// this function is being called when

@@ -256,6 +256,18 @@ var _ = t.Describe("Sandbox", func() {
 			// Then
 			Expect(err).NotTo(BeNil())
 		})
+
+		It("should set containerenv file", func() {
+			// Given
+			Expect(testSandbox.ContainerEnvPath()).To(BeEmpty())
+			Expect(testSandbox.SetInfraContainer(testContainer)).To(BeNil())
+
+			// When
+			Expect(testSandbox.SetContainerEnvFile()).To(BeNil())
+
+			// Then
+			Expect(testSandbox.ContainerEnvPath()).To(ContainSubstring(".containerenv"))
+		})
 	})
 	t.Describe("NeedsInfra", func() {
 		It("should not need when managing NS and NS mode NODE", func() {

@@ -591,6 +591,15 @@ func (s *Server) createSandboxContainer(ctx context.Context, ctr ctrIface.Contai
 		})
 	}
 
+	if sb.ContainerEnvPath() != "" {
+		ctr.SpecAddMount(rspec.Mount{
+			Destination: "/run/.containerenv",
+			Type:        "bind",
+			Source:      sb.ContainerEnvPath(),
+			Options:     append(options, "bind"),
+		})
+	}
+
 	if !isInCRIMounts("/etc/hosts", containerConfig.Mounts) && hostNet {
 		// Only bind mount for host netns and when CRI does not give us any hosts file
 		ctr.SpecAddMount(rspec.Mount{

@@ -863,6 +863,10 @@ func (s *Server) runPodSandbox(ctx context.Context, req *types.RunPodSandboxRequ
 		return nil, err
 	}
 
+	if err := sb.SetContainerEnvFile(); err != nil {
+		return nil, err
+	}
+
 	if err = g.SaveToFile(filepath.Join(podContainer.Dir, "config.json"), saveOptions); err != nil {
 		return nil, fmt.Errorf("failed to save template configuration for pod sandbox %s(%s): %v", sb.Name(), sbox.ID(), err)
 	}

@@ -920,3 +920,12 @@ function check_oci_annotation() {
 	pod_id=$(crictl runp "$TESTDATA"/sandbox_config.json)
 	! crictl create "$pod_id" "$TESTDIR/config" "$TESTDATA"/sandbox_config.json
 }
+
+@test "ctr has containerenv" {
+	start_crio
+	pod_id=$(crictl runp "$TESTDATA"/sandbox_config.json)
+	ctr_id=$(crictl create "$pod_id" "$TESTDATA"/container_redis.json "$TESTDATA"/sandbox_config.json)
+	crictl start "$ctr_id"
+
+	crictl exec --sync "$ctr_id" sh -c "stat /run/.containerenv"
+}