libcontainer: config: validate default filesystems#1176
libcontainer: config: validate default filesystems#1176cyphar wants to merge 1 commit intoopencontainers:masterfrom cyphar:validate-default-filesystems
Conversation
According to the runtime-spec[1], some filesystems must be mounted in all containers'. So, add verification to make sure someone doesn't ask us to create a rootfs that is missing key features. [1]: https://github.com/opencontainers/runtime-spec/blob/v1.0.0-rc2/config-linux.md#default-filesystems Signed-off-by: Aleksa Sarai <asarai@suse.de>
|
Also, apparently |
| {Destination: "/sys"}, | ||
| {Destination: "/dev/shm"}, | ||
| {Destination: "/dev/pts"}, | ||
| }, |
There was a problem hiding this comment.
One more test to make it failed with invalid mount info?
There was a problem hiding this comment.
Sure. I'll do it tomorrow (have an exam tomorrow morning).
| dests[filepath.Clean(mount.Destination)] = true | ||
| } | ||
|
|
||
| // From the spec. |
There was a problem hiding this comment.
nit: i think this comment is redundant.
|
do we want to swap this validator package with https://github.com/opencontainers/runtime-tools. They are mostly the same . |
|
@dqminh We validate |
|
@cyphar yah i supposed that's fair. |
|
LGTM |
|
I don't know who added a Things like This is also weird because if we say that they are required then why even give the user the option to mess up. I would rather leave this as is and change the spec to a |
|
@philips Could you take a look at this and let me know what you think since you added the section for these required filesystems? |
|
Yes I have containers that really don't need or want these filesystems. They are required by (for example) most |
|
In which case, can you please make a PR against the runtime specification to switch things to |
|
We changed this in the spec to SHOULDs so we don't need this PR, it would have created many issues if we did validate this in the first place |
According to the runtime-spec, some filesystems must be mounted in all
containers'. So, add verification to make sure someone doesn't ask us to
create a rootfs that is missing key features.
Signed-off-by: Aleksa Sarai asarai@suse.de