X Tutup
Skip to content

Commit b48f27d

Browse files
tghartlandtghartland
committed
Support PID NamespaceMode_TARGET
This commit adds support for the PID namespace mode TARGET when generating a container spec. The container that is created will be sharing its PID namespace with the target container that was specified by ID in the namespace options. Signed-off-by: Thomas Hartland <thomas.george.hartland@cern.ch>
1 parent 7b7a230 commit b48f27d

File tree

4 files changed

+56
-6
lines changed

4 files changed

+56
-6
lines changed

‎pkg/cri/opts/spec_linux.go‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -593,16 +593,16 @@ func WithSupplementalGroups(groups []int64) oci.SpecOpts {
593593
}
594594

595595
// WithPodNamespaces sets the pod namespaces for the container
596-
func WithPodNamespaces(config *runtime.LinuxContainerSecurityContext, pid uint32) oci.SpecOpts {
596+
func WithPodNamespaces(config *runtime.LinuxContainerSecurityContext, sandboxPid uint32, targetPid uint32) oci.SpecOpts {
597597
namespaces := config.GetNamespaceOptions()
598598

599599
opts := []oci.SpecOpts{
600-
oci.WithLinuxNamespace(runtimespec.LinuxNamespace{Type: runtimespec.NetworkNamespace, Path: GetNetworkNamespace(pid)}),
601-
oci.WithLinuxNamespace(runtimespec.LinuxNamespace{Type: runtimespec.IPCNamespace, Path: GetIPCNamespace(pid)}),
602-
oci.WithLinuxNamespace(runtimespec.LinuxNamespace{Type: runtimespec.UTSNamespace, Path: GetUTSNamespace(pid)}),
600+
oci.WithLinuxNamespace(runtimespec.LinuxNamespace{Type: runtimespec.NetworkNamespace, Path: GetNetworkNamespace(sandboxPid)}),
601+
oci.WithLinuxNamespace(runtimespec.LinuxNamespace{Type: runtimespec.IPCNamespace, Path: GetIPCNamespace(sandboxPid)}),
602+
oci.WithLinuxNamespace(runtimespec.LinuxNamespace{Type: runtimespec.UTSNamespace, Path: GetUTSNamespace(sandboxPid)}),
603603
}
604604
if namespaces.GetPid() != runtime.NamespaceMode_CONTAINER {
605-
opts = append(opts, oci.WithLinuxNamespace(runtimespec.LinuxNamespace{Type: runtimespec.PIDNamespace, Path: GetPIDNamespace(pid)}))
605+
opts = append(opts, oci.WithLinuxNamespace(runtimespec.LinuxNamespace{Type: runtimespec.PIDNamespace, Path: GetPIDNamespace(targetPid)}))
606606
}
607607
return oci.Compose(opts...)
608608
}

‎pkg/cri/server/container_create_linux.go‎

Lines changed: 16 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -270,9 +270,24 @@ func (c *criService) containerSpec(
270270
specOpts = append(specOpts, customopts.WithAnnotation(pKey, pValue))
271271
}
272272

273+
// Default target PID namespace is the sandbox PID.
274+
targetPid := sandboxPid
275+
// If the container targets another container's PID namespace,
276+
// set targetPid to the PID of that container.
277+
nsOpts := securityContext.GetNamespaceOptions()
278+
if nsOpts.GetPid() == runtime.NamespaceMode_TARGET {
279+
targetContainer, err := c.validateTargetContainer(sandboxID, nsOpts.TargetId)
280+
if err != nil {
281+
return nil, errors.Wrapf(err, "invalid target container")
282+
}
283+
284+
status := targetContainer.Status.Get()
285+
targetPid = status.Pid
286+
}
287+
273288
specOpts = append(specOpts,
274289
customopts.WithOOMScoreAdj(config, c.config.RestrictOOMScoreAdj),
275-
customopts.WithPodNamespaces(securityContext, sandboxPid),
290+
customopts.WithPodNamespaces(securityContext, sandboxPid, targetPid),
276291
customopts.WithSupplementalGroups(supplementalGroups),
277292
customopts.WithAnnotation(annotations.ContainerType, annotations.ContainerTypeContainer),
278293
customopts.WithAnnotation(annotations.SandboxID, sandboxID),

‎pkg/cri/server/container_start.go‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -84,6 +84,17 @@ func (c *criService) StartContainer(ctx context.Context, r *runtime.StartContain
8484
return nil, errors.Errorf("sandbox container %q is not running", sandboxID)
8585
}
8686

87+
// Recheck target container validity in Linux namespace options.
88+
if linux := config.GetLinux(); linux != nil {
89+
nsOpts := linux.GetSecurityContext().GetNamespaceOptions()
90+
if nsOpts.GetPid() == runtime.NamespaceMode_TARGET {
91+
_, err := c.validateTargetContainer(sandboxID, nsOpts.TargetId)
92+
if err != nil {
93+
return nil, errors.Wrap(err, "invalid target container")
94+
}
95+
}
96+
}
97+
8798
ioCreation := func(id string) (_ containerdio.IO, err error) {
8899
stdoutWC, stderrWC, err := c.createContainerLoggers(meta.LogPath, config.GetTty())
89100
if err != nil {

‎pkg/cri/server/helpers.go‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -242,6 +242,30 @@ func (c *criService) ensureImageExists(ctx context.Context, ref string, config *
242242
return &newImage, nil
243243
}
244244

245+
// validateTargetContainer checks that a container is a valid
246+
// target for a container using PID NamespaceMode_TARGET.
247+
// The target container must be in the same sandbox and must be running.
248+
// Returns the target container for convenience.
249+
func (c *criService) validateTargetContainer(sandboxID, targetContainerID string) (containerstore.Container, error) {
250+
targetContainer, err := c.containerStore.Get(targetContainerID)
251+
if err != nil {
252+
return containerstore.Container{}, errors.Wrapf(err, "container %q does not exist", targetContainerID)
253+
}
254+
255+
targetSandboxID := targetContainer.Metadata.SandboxID
256+
if targetSandboxID != sandboxID {
257+
return containerstore.Container{},
258+
errors.Errorf("container %q (sandbox %s) does not belong to sandbox %s", targetContainerID, targetSandboxID, sandboxID)
259+
}
260+
261+
status := targetContainer.Status.Get()
262+
if state := status.State(); state != runtime.ContainerState_CONTAINER_RUNNING {
263+
return containerstore.Container{}, errors.Errorf("container %q is not running - in state %s", targetContainerID, state)
264+
}
265+
266+
return targetContainer, nil
267+
}
268+
245269
// isInCRIMounts checks whether a destination is in CRI mount list.
246270
func isInCRIMounts(dst string, mounts []*runtime.Mount) bool {
247271
for _, m := range mounts {

0 commit comments

Comments
 (0)
X Tutup