fix docker cp -a failing to access / in container (run getent with a noop stdin)#45720
fix docker cp -a failing to access / in container (run getent with a noop stdin)#45720thaJeztah merged 1 commit intomoby:masterfrom
docker cp -a failing to access / in container (run getent with a noop stdin)#45720Conversation
|
Seems like a strange thing: $ getent passwd 1000 < /dev/null
cpuguy83:x:1000:1000:Ubuntu:/home/cpuguy83:/bin/bashAlso doing the same in go works just fine as well. |
|
I'm not convinced this is right at all either -- if |
|
@neersighted I totally agree with you, this is at most a temporary workaround. Maybe this deserve a but I haven't found any bug reported to the golang team related to such an issue, and have no idea how to investigate further. |
|
During copy the container filesystem is mounted and the archive code gets a view of that filesystem, I tried adding a simple if err := mount.Mount("/dev", dest, "tmpfs", "rbind"); err != nil {
return err
}But then the copy fails with |
|
It appears this isn't a regression then, but a subtle breaking change where the Go runtime depends on the |
|
according to #45720 (comment) this is actually a reasonable fix, but need to add some comment to explain the reason for this. I'll update my PR on Monday |
Signed-off-by: Nicolas De Loof <nicolas.deloof@gmail.com>
| } | ||
| out, err := exec.Command(getentCmd, database, key).CombinedOutput() | ||
| command := exec.Command(getentCmd, database, key) | ||
| // we run getent within container filesystem, but without /dev so /dev/null is not available for exec to mock stdin |
There was a problem hiding this comment.
'close' might be more accurate than 'mock'; but this is fine.
| // empty content | ||
| dstDir, _ := makeEmptyArchive(t) | ||
| err := apiclient.CopyToContainer(ctx, cid, dstDir, bytes.NewReader([]byte("")), types.CopyToContainerOptions{}) |
There was a problem hiding this comment.
Not a blocker; we probably could've used subtests for these
| // empty content | ||
| dstDir, _ := makeEmptyArchive(t) | ||
| err := apiclient.CopyToContainer(ctx, cid, dstDir, bytes.NewReader([]byte("")), types.CopyToContainerOptions{}) | ||
| assert.NilError(t, err) |
There was a problem hiding this comment.
Not a blocker; using assert.Check() allows the test to continue (assert.NilError() does a t.Fatal(), which in this case means we won't test the other cases if an earlier one fails)
| assert.NilError(t, err) | |
| assert.Check(t, err) |
docker cp -a failing to access / in containerdocker cp -a failing to access / in container (run getent with a noop stdin)
fixes #45719 (actually, just a workaround)
- What I did
configure command to run
getentto use a noop readCloser as stdin to prevent ENOENT failure to open/dev/null- How I did it
- How to verify it
test case included
- Description for the changelog
- A picture of a cute animal (not mandatory but encouraged)
