Refactor mount and selinux codes in container creation. #9667
Conversation
WalkthroughSELinux label configuration now returns errors and is propagated; host-network decision is computed earlier; mount setup split into base and container-specific functions with updated signatures; systemd mount setup renamed to Changes
Sequence Diagram(s)mermaid Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes
Possibly related PRs
Suggested labels
Suggested reviewers
Poem
Pre-merge checks and finishing touches❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✨ Finishing touches
🧪 Generate unit tests (beta)
Comment |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: bitoku The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## main #9667 +/- ##
==========================================
- Coverage 67.10% 66.83% -0.28%
==========================================
Files 208 208
Lines 28987 28863 -124
==========================================
- Hits 19452 19290 -162
- Misses 7876 7902 +26
- Partials 1659 1671 +12 🚀 New features to boost your workflow:
|
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (1)
server/container_create.go (1)
804-805: Consider removing duplicatehostNetcomputation.The
hostNetvalue is computed here at line 804 and again at line 1199 insideconfigureSELinuxLabels. SinceconfigureSELinuxLabelsuseshostNetinternally but doesn't return it, consider either:
- Having
configureSELinuxLabelsreturnhostNetas it previously did, or- Passing
hostNetas a parameter toconfigureSELinuxLabelsThis would eliminate the duplicate computation and reduce the risk of inconsistency if the logic changes.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (2)
server/container_create.go(11 hunks)server/container_create_linux.go(1 hunks)
🧰 Additional context used
📓 Path-based instructions (1)
**/*.go
📄 CodeRabbit inference engine (AGENTS.md)
**/*.go: Use interface-based design and dependency injection patterns in Go code
Propagate context.Context through function calls in Go code
Usefmt.Errorfwith%wfor error wrapping in Go code
Use logrus with structured fields for logging in Go code
Add comments explaining 'why' not 'what' in Go code
Use platform-specific file naming:*_{linux,freebsd}.gofor platform-dependent code
Files:
server/container_create_linux.goserver/container_create.go
🧬 Code graph analysis (1)
server/container_create.go (2)
internal/storage/runtime.go (1)
ContainerInfo(48-55)server/selinux.go (1)
InitLabel(21-31)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (33)
- GitHub Check: rpm-build:fedora-rawhide-aarch64:fedora-rawhide
- GitHub Check: rpm-build:centos-stream-9-aarch64:fedora-rawhide
- GitHub Check: rpm-build:fedora-43-aarch64:fedora-rawhide
- GitHub Check: rpm-build:fedora-rawhide-x86_64:fedora-rawhide
- GitHub Check: rpm-build:centos-stream-9-x86_64:fedora-rawhide
- GitHub Check: rpm-build:fedora-43-x86_64:fedora-rawhide
- GitHub Check: rpm-build:fedora-rawhide-x86_64:fedora-rawhide
- GitHub Check: rpm-build:fedora-43-x86_64:fedora-rawhide
- GitHub Check: rpm-build:centos-stream-9-aarch64:fedora-rawhide
- GitHub Check: rpm-build:centos-stream-9-x86_64:fedora-rawhide
- GitHub Check: rpm-build:fedora-43-aarch64:fedora-rawhide
- GitHub Check: rpm-build:fedora-rawhide-aarch64:fedora-rawhide
- GitHub Check: rpm-build:fedora-rawhide-x86_64:fedora-rawhide
- GitHub Check: rpm-build:fedora-43-x86_64:fedora-rawhide
- GitHub Check: rpm-build:centos-stream-9-aarch64:fedora-rawhide
- GitHub Check: rpm-build:centos-stream-9-x86_64:fedora-rawhide
- GitHub Check: rpm-build:fedora-43-aarch64:fedora-rawhide
- GitHub Check: rpm-build:fedora-rawhide-aarch64:fedora-rawhide
- GitHub Check: rpm-build:fedora-43-x86_64:fedora-rawhide
- GitHub Check: rpm-build:centos-stream-9-x86_64:fedora-rawhide
- GitHub Check: rpm-build:centos-stream-9-aarch64:fedora-rawhide
- GitHub Check: rpm-build:fedora-rawhide-x86_64:fedora-rawhide
- GitHub Check: rpm-build:fedora-43-aarch64:fedora-rawhide
- GitHub Check: rpm-build:fedora-rawhide-aarch64:fedora-rawhide
- GitHub Check: unit / arm64 / root
- GitHub Check: unit / amd64 / rootless
- GitHub Check: build static / s390x
- GitHub Check: build-freebsd
- GitHub Check: space-at-eol
- GitHub Check: build
- GitHub Check: binaries / amd64
- GitHub Check: binaries / arm64
- GitHub Check: shellcheck
🔇 Additional comments (8)
server/container_create_linux.go (1)
658-660: Clean refactor to simplify function interface.The change from accepting mounts as a parameter to deriving them from the generator via
g.Mounts()reduces coupling and makes the function self-contained. Using a pointer receiver for*generate.Generatoris correct since the function modifies the generator state.server/container_create.go (7)
680-683: Good addition of error propagation from SELinux label configuration.The change to propagate errors from
configureSELinuxLabelsfollows Go best practices. Usingfmt.Errorfwith%wfor error wrapping would be preferred if additional context is needed, but the direct return is acceptable here since the function name provides sufficient context.
824-826: LGTM!The call to
setupBaseContainerMountsis correctly structured with proper error handling.
862-865: LGTM!The refactored
setupContainerMountscall properly passes all required parameters and handles errors correctly.
973-1019: Good refactoring with proper error handling.The function now correctly returns errors using
fmt.Errorfwith%wfor error wrapping, as per the coding guidelines. The separation of mount concerns from systemd setup improves maintainability.
1121-1185: Well-structured consolidation of base mount setup.The new function cleanly groups related mount operations with consistent error handling for security labeling. The integration of
setupSystemdMountsat line 1181 correctly uses the refactored pointer-based signature.
1190-1233: Improved error handling with SELinux label initialization.The addition of error return and the conditional initialization of
processLabelviaInitLabel(lines 1213-1218) ensures proper label setup for containers running init processes. The error tuple correctly propagates failures from the underlying SELinux operation.
1210-1218: The code comment claimingcontainer_init_tlabeling is inaccurate.The comment states this should set
container_init_tto run init processes, butInitLabel()callsselinux.InitContainerLabels()which returns standard container labels (likecontainer_t), notcontainer_init_t. This type does not exist in SELinux container policies. Update the comment to accurately reflect what label type is actually applied.
d5dd57f to
0830bee
Compare
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
server/container_create.go (1)
1121-1185: Consider adding a function doc comment.The new
setupBaseContainerMountsfunction handles important mount setup logic, but lacks a doc comment explaining its purpose and responsibilities. Consider adding documentation similar toconfigureSELinuxLabels(lines 1187-1189) to improve code maintainability.Example:
+// setupBaseContainerMounts configures the base container mounts including resolv.conf, hostname, +// hosts file, and systemd-related mounts if the container will run systemd. It applies the +// appropriate mount labels and permissions based on the container's read-only status. func (s *Server) setupBaseContainerMounts(ctr container.Container, sb *sandbox.Sandbox, containerConfig *types.ContainerConfig, mountLabel string, hostNet bool, specgen *generate.Generator) error {
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (3)
server/container_create.go(11 hunks)server/container_create_freebsd.go(1 hunks)server/container_create_linux.go(1 hunks)
🚧 Files skipped from review as they are similar to previous changes (1)
- server/container_create_linux.go
🧰 Additional context used
📓 Path-based instructions (1)
**/*.go
📄 CodeRabbit inference engine (AGENTS.md)
**/*.go: Use interface-based design and dependency injection patterns in Go code
Propagate context.Context through function calls in Go code
Usefmt.Errorfwith%wfor error wrapping in Go code
Use logrus with structured fields for logging in Go code
Add comments explaining 'why' not 'what' in Go code
Use platform-specific file naming:*_{linux,freebsd}.gofor platform-dependent code
Files:
server/container_create_freebsd.goserver/container_create.go
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (31)
- GitHub Check: rpm-build:fedora-rawhide-x86_64:fedora-rawhide
- GitHub Check: rpm-build:fedora-43-x86_64:fedora-rawhide
- GitHub Check: rpm-build:centos-stream-9-aarch64:fedora-rawhide
- GitHub Check: rpm-build:centos-stream-9-x86_64:fedora-rawhide
- GitHub Check: rpm-build:fedora-43-aarch64:fedora-rawhide
- GitHub Check: rpm-build:fedora-rawhide-aarch64:fedora-rawhide
- GitHub Check: rpm-build:fedora-rawhide-aarch64:fedora-rawhide
- GitHub Check: rpm-build:fedora-43-aarch64:fedora-rawhide
- GitHub Check: rpm-build:fedora-43-x86_64:fedora-rawhide
- GitHub Check: rpm-build:centos-stream-9-x86_64:fedora-rawhide
- GitHub Check: rpm-build:fedora-rawhide-x86_64:fedora-rawhide
- GitHub Check: rpm-build:centos-stream-9-aarch64:fedora-rawhide
- GitHub Check: rpm-build:centos-stream-9-aarch64:fedora-rawhide
- GitHub Check: rpm-build:fedora-43-aarch64:fedora-rawhide
- GitHub Check: binaries / arm64
- GitHub Check: rpm-build:fedora-rawhide-aarch64:fedora-rawhide
- GitHub Check: rpm-build:centos-stream-9-x86_64:fedora-rawhide
- GitHub Check: rpm-build:fedora-rawhide-x86_64:fedora-rawhide
- GitHub Check: rpm-build:fedora-43-x86_64:fedora-rawhide
- GitHub Check: docs
- GitHub Check: lint
- GitHub Check: unit / amd64 / root
- GitHub Check: security-checks
- GitHub Check: build static / amd64
- GitHub Check: build static / arm64
- GitHub Check: build static / ppc64le
- GitHub Check: build static / s390x
- GitHub Check: unit / arm64 / root
- GitHub Check: codeql-build
- GitHub Check: unit / amd64 / rootless
- GitHub Check: build
🔇 Additional comments (4)
server/container_create_freebsd.go (1)
156-157: LGTM: Function signature updated for cross-platform consistency.The rename from
setupSystemdtosetupSystemdMountsand the signature change (removing themountsparameter, using pointer receiver for generator) aligns with the Linux variant and the broader refactoring pattern described in the PR. The empty body remains appropriate for FreeBSD.server/container_create.go (3)
680-683: LGTM: Proper error propagation from SELinux configuration.The updated
configureSELinuxLabelssignature now returns an error, which is correctly checked and propagated. This enables proper error handling for theInitLabelcall that was consolidated into this function.
973-1020: LGTM: Clean function signature and proper error handling.The refactored
setupContainerMountshas a cleaner signature (returns only error) and follows coding guidelines with proper error wrapping using%won line 996.
804-805: LGTM: Function calls updated correctly for the refactored signatures.The call sites for
setupBaseContainerMounts(line 824) andsetupContainerMounts(line 862) are properly updated with the new signatures. The local computation ofhostNet(line 804) aligns with the PR's goal to compute values locally where needed instead of passing them between functions.Also applies to: 824-826, 862-865
0830bee to
6b7ecac
Compare
…ndling Signed-off-by: Ayato Tokubi <[email protected]>
6b7ecac to
dd62d21
Compare
There was a problem hiding this comment.
Actionable comments posted: 1
📜 Review details
Configuration used: defaults
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (3)
server/container_create.go(11 hunks)server/container_create_freebsd.go(1 hunks)server/container_create_linux.go(1 hunks)
🚧 Files skipped from review as they are similar to previous changes (1)
- server/container_create_linux.go
🧰 Additional context used
📓 Path-based instructions (1)
**/*.go
📄 CodeRabbit inference engine (AGENTS.md)
**/*.go: Use interface-based design and dependency injection patterns in Go code
Propagate context.Context through function calls in Go code
Usefmt.Errorfwith%wfor error wrapping in Go code
Use logrus with structured fields for logging in Go code
Add comments explaining 'why' not 'what' in Go code
Use platform-specific file naming:*_{linux,freebsd}.gofor platform-dependent code
Files:
server/container_create.goserver/container_create_freebsd.go
🧠 Learnings (1)
📚 Learning: 2025-12-03T18:27:19.593Z
Learnt from: CR
Repo: cri-o/cri-o PR: 0
File: AGENTS.md:0-0
Timestamp: 2025-12-03T18:27:19.593Z
Learning: Applies to **/*.go : Use `fmt.Errorf` with `%w` for error wrapping in Go code
Applied to files:
server/container_create.go
🧬 Code graph analysis (1)
server/container_create.go (3)
internal/storage/runtime.go (1)
ContainerInfo(48-55)server/selinux.go (1)
InitLabel(21-31)pkg/annotations/annotations.go (1)
GetAnnotationValue(15-17)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (31)
- GitHub Check: rpm-build:fedora-43-x86_64:fedora-rawhide
- GitHub Check: rpm-build:fedora-43-aarch64:fedora-rawhide
- GitHub Check: rpm-build:fedora-rawhide-x86_64:fedora-rawhide
- GitHub Check: rpm-build:centos-stream-9-aarch64:fedora-rawhide
- GitHub Check: rpm-build:fedora-rawhide-aarch64:fedora-rawhide
- GitHub Check: rpm-build:centos-stream-9-x86_64:fedora-rawhide
- GitHub Check: rpm-build:fedora-rawhide-x86_64:fedora-rawhide
- GitHub Check: rpm-build:fedora-43-x86_64:fedora-rawhide
- GitHub Check: rpm-build:centos-stream-9-aarch64:fedora-rawhide
- GitHub Check: rpm-build:centos-stream-9-x86_64:fedora-rawhide
- GitHub Check: rpm-build:fedora-43-aarch64:fedora-rawhide
- GitHub Check: rpm-build:fedora-rawhide-aarch64:fedora-rawhide
- GitHub Check: rpm-build:fedora-43-aarch64:fedora-rawhide
- GitHub Check: binaries / arm64
- GitHub Check: rpm-build:centos-stream-9-aarch64:fedora-rawhide
- GitHub Check: rpm-build:fedora-43-x86_64:fedora-rawhide
- GitHub Check: rpm-build:fedora-rawhide-x86_64:fedora-rawhide
- GitHub Check: rpm-build:fedora-rawhide-aarch64:fedora-rawhide
- GitHub Check: rpm-build:centos-stream-9-x86_64:fedora-rawhide
- GitHub Check: lint
- GitHub Check: docs
- GitHub Check: build static / amd64
- GitHub Check: unit / arm64 / root
- GitHub Check: security-checks
- GitHub Check: unit / amd64 / root
- GitHub Check: build static / arm64
- GitHub Check: build static / s390x
- GitHub Check: unit / amd64 / rootless
- GitHub Check: build static / ppc64le
- GitHub Check: build
- GitHub Check: codeql-build
🔇 Additional comments (7)
server/container_create_freebsd.go (1)
156-158: LGTM! Clean platform-specific implementation.The signature change aligns with the Linux counterpart, and the no-op implementation with an explanatory comment is appropriate for FreeBSD where systemd is not supported.
server/container_create.go (6)
680-683: LGTM! Proper error propagation.The error handling for
configureSELinuxLabelsfollows Go best practices by checking and propagating the error immediately.
804-804: Good refactoring: hostNet computed locally.Computing
hostNetdirectly from the security context simplifies the flow and aligns with the PR's goal of removing it fromconfigureSELinuxLabelsreturn values.
973-1022: Well-structured function with proper documentation.The refactored
setupContainerMountshas a clear purpose documented in the comment, proper error wrapping usingfmt.Errorfwith%w, and focuses on OCI/volume/secret mount configuration as intended.
1123-1190: Excellent refactoring with clear separation of concerns.The new
setupBaseContainerMountsfunction consolidates base mount setup (resolv.conf, hostname, /etc/hosts) and conditionally handles privileged and systemd mounts. The documentation is clear, error handling is consistent, and the systemd mount setup correctly passesctr.Spec()tosetupSystemdMounts.
1216-1225: Good addition: SELinux init label handling.The container_init_t label initialization for systemd/init containers is properly implemented with clear documentation explaining the requirement. Error wrapping follows coding guidelines using
fmt.Errorfwith%w.Based on coding guidelines: "Use
fmt.Errorfwith%wfor error wrapping in Go code"
1195-1240: Solid refactoring with improved error handling.The refactored
configureSELinuxLabelsproperly returns errors, computeshostNetlocally (removing it from return values), and consolidates the container_init_t label initialization logic. The function signature change is consistent with all call sites.
What type of PR is this?
/kind cleanup
What this PR does / why we need it:
It decouples selinux code and mount code, and decouple some unrelated codes.
Also it removes some arguments which should be the same as
ctr.Which issue(s) this PR fixes:
Special notes for your reviewer:
Does this PR introduce a user-facing change?
Summary by CodeRabbit
✏️ Tip: You can customize this high-level summary in your review settings.