Use path based unix socket for shims by crosbymichael · Pull Request #4343 · containerd/containerd

crosbymichael · 2020-06-24T19:29:08Z

This allows filesystem based ACLs for configuring access to the socket of a
shim.

Signed-off-by: Michael Crosby michael@thepasture.io

theopenlab-ci · 2020-06-24T19:31:25Z

Build succeeded.

containerd-build-arm64 : FAILURE in 1m 32s (non-voting)

Zyqsempai

LGTM

theopenlab-ci · 2020-06-24T19:39:09Z

Build succeeded.

containerd-build-arm64 : FAILURE in 2m 11s (non-voting)

runtime/v2/shim/shim_unix.go

AkihiroSuda · 2020-06-25T01:50:10Z

runtime/v2/shim/util_unix.go

This breaks running multiple daemons

Let's put runtime dir string into the hash

ok, let me see if I can get that data easily.

Also could you:

add a code comment to explain that /run/containerd/s is hard coded for the sake of avoiding hitting the SUN_PATH length limit

add MkdirAll("/run/containerd/s")

Let's put runtime dir string into the hash

We can also consider putting the daemon UUID into the hash, not sure which one is better.

runtime/v2/shim/util_unix.go

The new shim socket path convention hardcodes `/run/containerd`: containerd/containerd#4343 `dockerd-rootless.sh` is updated to hide the rootful `/run/containerd` from the mount namespace of the rootless dockerd. Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>

theopenlab-ci · 2020-06-26T18:49:57Z

Build succeeded.

containerd-build-arm64 : FAILURE in 1m 34s (non-voting)

theopenlab-ci · 2020-06-26T19:12:38Z

Build succeeded.

containerd-build-arm64 : FAILURE in 2m 07s (non-voting)

crosbymichael · 2020-06-26T20:52:04Z

Ok, it looks like we have 1-2 test to fix. The handling and timeouts of using file based unix sockets seem to be different than an abstract socket. I'm guessing this has to be something about if there is someone listening on the other end or not.

If anyone else has time to look into this go for it, I'll try to debug Monday.

AkihiroSuda · 2020-07-08T05:19:25Z

How can we help moving this forward?

runtime/v2/runc/v2/service.go

theopenlab-ci · 2020-07-10T17:31:44Z

Build succeeded.

containerd-build-arm64 : FAILURE in 1m 34s (non-voting)

theopenlab-ci · 2020-07-10T17:48:51Z

Build succeeded.

containerd-build-arm64 : FAILURE in 1m 33s (non-voting)

theopenlab-ci · 2020-07-10T18:05:45Z

Build succeeded.

containerd-build-arm64 : FAILURE in 1m 34s (non-voting)

theopenlab-ci · 2020-07-10T18:52:11Z

Build succeeded.

containerd-build-arm64 : FAILURE in 1m 32s (non-voting)

theopenlab-ci · 2020-07-16T15:57:39Z

Build succeeded.

containerd-build-arm64 : FAILURE in 2m 11s (non-voting)

theopenlab-ci · 2020-07-16T18:49:43Z

Build succeeded.

containerd-build-arm64 : FAILURE in 2m 25s (non-voting)

theopenlab-ci · 2020-07-16T19:12:47Z

Build succeeded.

containerd-build-arm64 : FAILURE in 2m 07s (non-voting)

theopenlab-ci · 2020-07-16T19:28:23Z

Build succeeded.

containerd-build-arm64 : FAILURE in 2m 22s (non-voting)

This allows filesystem based ACLs for configuring access to the socket of a shim. Signed-off-by: Michael Crosby <michael@thepasture.io>

runtime/v2/shim/util.go

theopenlab-ci · 2020-07-21T15:42:03Z

Build succeeded.

containerd-build-arm64 : FAILURE in 2m 11s (non-voting)

theopenlab-ci · 2020-07-22T17:08:03Z

Build succeeded.

containerd-build-arm64 : FAILURE in 2m 17s (non-voting)

AkihiroSuda · 2020-08-06T06:24:16Z

Moved to v1.5 milestone. We can consider backporting to v1.4 after the PR gets stabilized.

The new shim socket path convention hardcodes `/run/containerd`: containerd/containerd#4343 `dockerd-rootless.sh` is updated to hide the rootful `/run/containerd` from the mount namespace of the rootless dockerd. Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp> Upstream-commit: 794aa20983c9384726721e1c5d3a552ef7f8f4cf Component: engine

The new shim socket path convention hardcodes `/run/containerd`: containerd/containerd#4343 `dockerd-rootless.sh` is updated to hide the rootful `/run/containerd` from the mount namespace of the rootless dockerd. Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp> (cherry picked from commit 794aa20) Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>

The new shim socket path convention hardcodes `/run/containerd`: containerd/containerd#4343 `dockerd-rootless.sh` is updated to hide the rootful `/run/containerd` from the mount namespace of the rootless dockerd. Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp> (cherry picked from commit 794aa20983c9384726721e1c5d3a552ef7f8f4cf) Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp> Upstream-commit: c7253a0e1ac88bd8eb0db409570a685a5f6258f3 Component: engine

crosbymichael force-pushed the shim-socket-path branch from 91a9d95 to af42ed3 Compare June 24, 2020 19:36

Zyqsempai approved these changes Jun 24, 2020

View reviewed changes

dmcgowan reviewed Jun 24, 2020

View reviewed changes

runtime/v2/shim/shim_unix.go Outdated Show resolved Hide resolved

AkihiroSuda requested changes Jun 25, 2020

View reviewed changes

runtime/v2/shim/util_unix.go Outdated Show resolved Hide resolved

fuweid reviewed Jun 25, 2020

View reviewed changes

runtime/v2/shim/util_unix.go Outdated Show resolved Hide resolved

dmcgowan added this to the 1.4 milestone Jun 25, 2020

AkihiroSuda mentioned this pull request Jun 26, 2020

dockerd-rootless.sh: support new containerd shim socket path convention moby/moby#41156

Merged

crosbymichael force-pushed the shim-socket-path branch from af42ed3 to 578337f Compare June 26, 2020 18:47

crosbymichael force-pushed the shim-socket-path branch from 578337f to 1839f67 Compare June 26, 2020 19:09

fuweid reviewed Jul 8, 2020

View reviewed changes

runtime/v2/runc/v2/service.go Outdated Show resolved Hide resolved

runtime/v2/runc/v2/service.go Outdated Show resolved Hide resolved

crosbymichael force-pushed the shim-socket-path branch from 1839f67 to ab432f6 Compare July 10, 2020 17:28

crosbymichael force-pushed the shim-socket-path branch from ab432f6 to d286d0c Compare July 10, 2020 17:45

crosbymichael force-pushed the shim-socket-path branch from 6c38d36 to 1a7f61d Compare July 10, 2020 18:48

crosbymichael force-pushed the shim-socket-path branch from 1a7f61d to 1b4a94c Compare July 16, 2020 15:53

crosbymichael force-pushed the shim-socket-path branch from 1b4a94c to 5fff748 Compare July 16, 2020 18:44

crosbymichael force-pushed the shim-socket-path branch from 5fff748 to e35a351 Compare July 16, 2020 19:07

crosbymichael force-pushed the shim-socket-path branch from e35a351 to d7dab44 Compare July 16, 2020 19:23

Use path based unix socket for shims

7ec135c

This allows filesystem based ACLs for configuring access to the socket of a shim. Signed-off-by: Michael Crosby <michael@thepasture.io>

cbandy reviewed Jul 21, 2020

View reviewed changes

runtime/v2/shim/util.go Outdated Show resolved Hide resolved

crosbymichael force-pushed the shim-socket-path branch from d7dab44 to 68cd97e Compare July 21, 2020 15:37

crosbymichael force-pushed the shim-socket-path branch from 68cd97e to 7ec135c Compare July 22, 2020 17:03

AkihiroSuda modified the milestones: 1.4, 1.5 Aug 6, 2020

crosbymichael closed this Oct 2, 2020

AkihiroSuda mentioned this pull request Oct 16, 2020

[19.03 backport] dockerd-rootless.sh: support new containerd shim socket path convention moby/moby#41557

Merged

Conversation

crosbymichael commented Jun 24, 2020

Uh oh!

theopenlab-ci bot commented Jun 24, 2020

Uh oh!

Zyqsempai left a comment

Choose a reason for hiding this comment

Uh oh!

theopenlab-ci bot commented Jun 24, 2020

Uh oh!

Uh oh!

AkihiroSuda Jun 25, 2020

Choose a reason for hiding this comment

Uh oh!

AkihiroSuda Jun 25, 2020

Choose a reason for hiding this comment

Uh oh!

crosbymichael Jun 25, 2020

Choose a reason for hiding this comment

Uh oh!

AkihiroSuda Jun 26, 2020

Choose a reason for hiding this comment

Uh oh!

AkihiroSuda Sep 10, 2020

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

theopenlab-ci bot commented Jun 26, 2020

Uh oh!

theopenlab-ci bot commented Jun 26, 2020

Uh oh!

crosbymichael commented Jun 26, 2020

Uh oh!

AkihiroSuda commented Jul 8, 2020

Uh oh!

Uh oh!

Uh oh!

theopenlab-ci bot commented Jul 10, 2020

Uh oh!

theopenlab-ci bot commented Jul 10, 2020

Uh oh!

theopenlab-ci bot commented Jul 10, 2020

Uh oh!

theopenlab-ci bot commented Jul 10, 2020

Uh oh!

theopenlab-ci bot commented Jul 16, 2020

Uh oh!

theopenlab-ci bot commented Jul 16, 2020

Uh oh!

theopenlab-ci bot commented Jul 16, 2020

Uh oh!

theopenlab-ci bot commented Jul 16, 2020

Uh oh!

Uh oh!

theopenlab-ci bot commented Jul 21, 2020

Uh oh!

theopenlab-ci bot commented Jul 22, 2020

Uh oh!

AkihiroSuda commented Aug 6, 2020

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants