Allow update-ldcache hook to work when pivot-root is not supported#1174
Merged
elezar merged 1 commit intoNVIDIA:mainfrom Nov 20, 2025
Merged
Allow update-ldcache hook to work when pivot-root is not supported#1174elezar merged 1 commit intoNVIDIA:mainfrom
elezar merged 1 commit intoNVIDIA:mainfrom
Conversation
Pull Request Test Coverage Report for Build 16070359030Details
💛 - Coveralls |
ArangoGutierrez
requested changes
Jul 2, 2025
Collaborator
ArangoGutierrez
left a comment
There was a problem hiding this comment.
LGTM - Just 2 NIT's
internal/ldconfig/ldconfig_linux.go
Outdated
Comment on lines
+104
to
+105
| // msMoveRoot is used | ||
| // filesystem, and everything else is cleaned up. |
Collaborator
There was a problem hiding this comment.
Nit: Can we enhance this comment?
There was a problem hiding this comment.
Pull Request Overview
This PR implements a fallback mechanism for the update-ldcache hook to work in environments where pivot_root is not supported (e.g., kata-containers with --no-pivot option). The changes detect when pivot_root is unavailable and use an alternative move mount operation similar to runc's implementation.
Key changes:
- Added pivot_root support detection by checking if the root filesystem is mounted as "rootfs"
- Implemented msMoveRoot as an alternative to pivot_root using move mount operations
- Refactored the ldconfig API to use flag-based argument parsing instead of positional parameters
Reviewed Changes
Copilot reviewed 5 out of 104 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| internal/ldconfig/ldconfig.go | Refactored constructor to use flag parsing, added pivot_root detection logic |
| internal/ldconfig/ldconfig_linux.go | Added msMoveRoot implementation, improved mountProc security |
| internal/ldconfig/ldconfig_other.go | Added stub msMoveRoot function for non-Linux platforms |
| cmd/nvidia-cdi-hook/update-ldcache/update-ldcache.go | Updated to use new ldconfig constructor API |
| cmd/nvidia-cdi-hook/create-soname-symlinks/soname-symlinks.go | Updated to use new ldconfig constructor API |
Member
Author
|
Note that the following is related: moby/moby#50755 (comment) |
ArangoGutierrez
approved these changes
Nov 4, 2025
1d9ea64 to
5c54537
Compare
zvonkok
approved these changes
Nov 20, 2025
zvonkok
left a comment
There was a problem hiding this comment.
LGTM, tested on latest Kata release.
5c54537 to
1b7f2ee
Compare
This change updates the update-ldcache logic to use an alternative to pivot-root when this is not supported. This includes cases where the root filesystem is in a ramfs (e.g. when running from the kata-agent). Signed-off-by: Evan Lezar <elezar@nvidia.com>
1b7f2ee to
241743c
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The changes made to run the update-ldcache hook in an isolated namespace were implemented using a pivot_root. This is, however, not supported in all use cases -- most notably in kata-containers where runc is typically invoked with the --no-pivot option.
This change attempts to detect when pivot_root is not supported and use the same move mount operation as implemented by runc in this case.