vendor: libcontainer: update libcontainer#19250
Conversation
|
Moving to "merge" as the original PR already got LGTM'd |
|
I'm not sure why the tests are failing, but the fact that I haven't changed any code in Docker other than the code vendored in tells me something is broken upstream in runC. |
|
Seems there really is an issue with the new vendored runc (libcontainer specifically) with container stop/destroy? Don't have enough data yet, but clearly the tests that are failing are failing because there are containers still running affecting expected ps output, for example. One container that is all over the output (because it can be matched up to a specific test) is from here: https://github.com/docker/docker/blob/master/integration-cli/docker_cli_commit_test.go#L154-L159 |
|
Yup, and I have some of those failures locally :( |
|
@estesp Yeah, that's what I was thinking. The problem is that I can't effectively bisect on my machine (I don't get the errors). Since #19182 has the same error, it look like the bad commit occurs before opencontainers/runc@c0ad40c. I'll try pushing to this PR to do the bisecting, but I suspect it's related to the state machine stuff. |
0d48acb to
0d169cc
Compare
|
Okay, I've confirmed that @crosbymichael's commit opencontainers/runc@4415446 causes this build issue (after bisecting, using this PR as a testbed). |
0d169cc to
53fe088
Compare
Update the vendor'd version of libcontainer to include path sanitisation fixes and some other cgroup fixes. Signed-off-by: Aleksa Sarai <asarai@suse.com>
To ensure we don't regress on bad --cgroup-parent paths, add some integration tests that check that the host hasn't toppled (or suddently started to create files in the host). Signed-off-by: Aleksa Sarai <asarai@suse.com>
53fe088 to
7b3b788
Compare
1967468 to
0286e48
Compare
|
DO NOT MERGE YET, I'M TESTING WITH A BRANCH ON MY PERSONAL FORK OF RUNC Okay, so it looks it was all fixed by opencontainers/runc#470 (which seems to fix all of the failing tests). Can you all take a look at that PR and get it merged ASAP? |
DO NOT MERGE THIS, IT IS BASED ON MY PERSONAL RUNC BRANCH! Signed-off-by: Aleksa Sarai <asarai@suse.com>
04a44c5 to
d23c2e3
Compare
|
@cyphar whats up with this? |
|
@tiborvass we need opencontainers/runc#470 or fix from @crosbymichael |
|
I'm looking into the state changes and any bugs associated. we can close this for now until the bugs are fixed and we determine if we even need to bump libcontainer at this time. |
|
@crosbymichael There are security fixes to the Docker daemon (specifically, a DoS attack) in this libcontainer bump. |
Update the vendor'd version of libcontainer to include path sanitisation
fixes and some other cgroup fixes.
Signed-off-by: Aleksa Sarai asarai@suse.com
This is the same as #19024, except GitHub won't let me push to it.
/cc @icecrime @runcom