Skip to content

Commit 5dc0b68

Browse files
xibzxibz
committed
f)firecracker-runc-config.jsonixup! Add support for netns
Signed-off-by: xibz <[email protected]>
1 parent d4931e5 commit 5dc0b68

File tree

4 files changed

+46
-52
lines changed

4 files changed

+46
-52
lines changed

‎go.mod‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ require (
1818
github.com/docker/go-events v0.0.0-20170721190031-9461782956ad // indirect
1919
github.com/docker/go-metrics v0.0.0-20181218153428-b84716841b82 // indirect
2020
github.com/docker/go-units v0.3.3
21-
github.com/firecracker-microvm/firecracker-go-sdk v0.19.1-0.20191108195453-43d336c3dcbf
21+
github.com/firecracker-microvm/firecracker-go-sdk v0.19.1-0.20191114205152-9e2ff62839b2
2222
github.com/go-ole/go-ole v1.2.4 // indirect
2323
github.com/godbus/dbus v0.0.0-20181025153459-66d97aec3384 // indirect
2424
github.com/gofrs/uuid v3.2.0+incompatible

‎go.sum‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -59,8 +59,8 @@ github.com/docker/go-metrics v0.0.0-20181218153428-b84716841b82 h1:X0fj836zx99zF
5959
github.com/docker/go-metrics v0.0.0-20181218153428-b84716841b82/go.mod h1:/u0gXw0Gay3ceNrsHubL3BtdOL2fHf93USgMTe0W5dI=
6060
github.com/docker/go-units v0.3.3 h1:Xk8S3Xj5sLGlG5g67hJmYMmUgXv5N4PhkjJHHqrwnTk=
6161
github.com/docker/go-units v0.3.3/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk=
62-
github.com/firecracker-microvm/firecracker-go-sdk v0.19.1-0.20191108195453-43d336c3dcbf h1:HlqW7e7IwSIHBHJg4gBN6Kz9afSnEmB3+9e4/iTbBTw=
63-
github.com/firecracker-microvm/firecracker-go-sdk v0.19.1-0.20191108195453-43d336c3dcbf/go.mod h1:kW0gxvPpPvMukUxxTO9DrpSlScrtrTDGY3VgjAj/Qwc=
62+
github.com/firecracker-microvm/firecracker-go-sdk v0.19.1-0.20191114205152-9e2ff62839b2 h1:Ab52E0UlBOmMIAK/igRycsxSAJVDBDMYq+Wr/n7z2E0=
63+
github.com/firecracker-microvm/firecracker-go-sdk v0.19.1-0.20191114205152-9e2ff62839b2/go.mod h1:kW0gxvPpPvMukUxxTO9DrpSlScrtrTDGY3VgjAj/Qwc=
6464
github.com/globalsign/mgo v0.0.0-20180905125535-1ca0a4f7cbcb h1:D4uzjWwKYQ5XnAvUbuvHW93esHg7F8N/OYeBBcJoTr0=
6565
github.com/globalsign/mgo v0.0.0-20180905125535-1ca0a4f7cbcb/go.mod h1:xkRDCp4j0OGD1HRkm4kmhM+pmpv3AKq5SU7GMg4oO/Q=
6666
github.com/go-ole/go-ole v1.2.4 h1:nNBDSCOigTSiarFpYE9J/KtEA1IOW4CNeqT9TQDqCxI=

‎runtime/cni_integ_test.go‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,7 @@ import (
2828
"github.com/containerd/containerd/namespaces"
2929
"github.com/containerd/containerd/oci"
3030
"github.com/containerd/containerd/pkg/ttrpcutil"
31+
"github.com/firecracker-microvm/firecracker-go-sdk/cni/cmd/tc-redirect-tap/args"
3132
"github.com/shirou/gopsutil/cpu"
3233
"github.com/stretchr/testify/assert"
3334
"github.com/stretchr/testify/require"
@@ -95,8 +96,23 @@ func TestCNISupport_Isolated(t *testing.T) {
9596
CNIConfig: &proto.CNIConfiguration{
9697
NetworkName: cniNetworkName,
9798
InterfaceName: "veth0",
99+
Args: []*proto.CNIConfiguration_CNIArg{
100+
{
101+
Key: "IgnoreUnknown",
102+
Value: "true",
103+
},
104+
{
105+
Key: args.TCRedirectTapUID,
106+
Value: fmt.Sprintf("%d", jailerUID),
107+
},
108+
{
109+
Key: args.TCRedirectTapGID,
110+
Value: fmt.Sprintf("%d", jailerGID),
111+
},
112+
},
98113
},
99114
}},
115+
JailerConfig: &proto.JailerConfig{},
100116
})
101117
require.NoError(t, err, "failed to create vm")
102118

‎runtime/runc_jailer.go‎

Lines changed: 27 additions & 49 deletions
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,6 @@ import (
2323
"os/exec"
2424
"path/filepath"
2525
"strings"
26-
"sync"
2726
"syscall"
2827

2928
"github.com/firecracker-microvm/firecracker-go-sdk"
@@ -51,13 +50,11 @@ type runcJailer struct {
5150
runcBinaryPath string
5251
uid uint32
5352
gid uint32
54-
once sync.Once
53+
configSpec specs.Spec
5554
}
5655

5756
const firecrackerFileName = "firecracker"
5857

59-
var configSpec *specs.Spec
60-
6158
func newRuncJailer(ctx context.Context, logger *logrus.Entry, ociBundlePath, runcBinPath string, uid, gid uint32) (*runcJailer, error) {
6259
l := logger.WithField("ociBundlePath", ociBundlePath).
6360
WithField("runcBinaryPath", runcBinPath)
@@ -71,6 +68,19 @@ func newRuncJailer(ctx context.Context, logger *logrus.Entry, ociBundlePath, run
7168
gid: gid,
7269
}
7370

71+
spec := specs.Spec{}
72+
var configBytes []byte
73+
configBytes, err := ioutil.ReadFile(runcConfigPath)
74+
if err != nil {
75+
return nil, errors.Wrapf(err, "failed to read %s", runcConfigPath)
76+
}
77+
78+
if err = json.Unmarshal(configBytes, &spec); err != nil {
79+
return nil, errors.Wrapf(err, "failed to unmarshal %s", runcConfigPath)
80+
}
81+
82+
j.configSpec = spec
83+
7484
rootPath := j.RootPath()
7585

7686
const mode = os.FileMode(0700)
@@ -109,7 +119,7 @@ func (j *runcJailer) BuildJailedMachine(cfg *Config, machineConfig *firecracker.
109119
client := firecracker.NewClient(machineConfig.SocketPath, j.logger, machineConfig.Debug)
110120

111121
if machineConfig.NetNS == "" {
112-
if netns := getNetNS(configSpec); netns != "" {
122+
if netns := getNetNS(j.configSpec); netns != "" {
113123
machineConfig.NetNS = netns
114124
}
115125
}
@@ -370,47 +380,19 @@ func (j *runcJailer) jailerCommand(containerName string, isDebug bool) *exec.Cmd
370380

371381
// overwriteConfig will set the proper default values if a field had not been set.
372382
func (j *runcJailer) overwriteConfig(cfg *Config, machineConfig *firecracker.Config, socketPath, configPath string) error {
373-
var err error
374-
j.once.Do(func() {
375-
// here we attempt to cache the runc config. If the config has already been
376-
// cached, we will return immediately
377-
if configSpec != nil {
378-
return
379-
}
380-
381-
spec := specs.Spec{}
382-
var configBytes []byte
383-
configBytes, err = ioutil.ReadFile(configPath)
384-
if err != nil {
385-
return
386-
}
387-
388-
if err = json.Unmarshal(configBytes, &spec); err != nil {
389-
return
390-
}
391-
392-
configSpec = &spec
393-
394-
if spec.Process.User.UID != 0 ||
395-
spec.Process.User.GID != 0 {
396-
err = fmt.Errorf(
397-
"using UID %d and GID %d, these values must not be set",
398-
spec.Process.User.UID,
399-
spec.Process.User.GID,
400-
)
401-
return
402-
}
403-
404-
spec = j.setDefaultConfigValues(cfg, socketPath, spec)
405-
spec.Root.Path = rootfsFolder
406-
spec.Root.Readonly = false
407-
})
408-
409-
if err != nil {
410-
return err
383+
spec := j.configSpec
384+
if spec.Process.User.UID != 0 ||
385+
spec.Process.User.GID != 0 {
386+
return fmt.Errorf(
387+
"using UID %d and GID %d, these values must not be set",
388+
spec.Process.User.UID,
389+
spec.Process.User.GID,
390+
)
411391
}
412392

413-
spec := *configSpec
393+
spec = j.setDefaultConfigValues(cfg, socketPath, spec)
394+
spec.Root.Path = rootfsFolder
395+
spec.Root.Readonly = false
414396
spec.Process.User.UID = j.uid
415397
spec.Process.User.GID = j.gid
416398

@@ -491,11 +473,7 @@ func mkdirAllWithPermissions(path string, mode os.FileMode, uid, gid uint32) err
491473
return nil
492474
}
493475

494-
func getNetNS(spec *specs.Spec) string {
495-
if spec == nil {
496-
return ""
497-
}
498-
476+
func getNetNS(spec specs.Spec) string {
499477
for _, ns := range spec.Linux.Namespaces {
500478
if ns.Type == networkNamespaceRuncName {
501479
return ns.Path

0 commit comments

Comments
 (0)