Skip to content

Commit 8d3c678

Browse files
xibzxibz
committed
fixup! Add support for netns
Signed-off-by: xibz <[email protected]>
1 parent 9a9c431 commit 8d3c678

File tree

4 files changed

+49
-51
lines changed

4 files changed

+49
-51
lines changed

‎go.mod‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ require (
1818
github.com/docker/go-events v0.0.0-20170721190031-9461782956ad // indirect
1919
github.com/docker/go-metrics v0.0.0-20181218153428-b84716841b82 // indirect
2020
github.com/docker/go-units v0.3.3
21-
github.com/firecracker-microvm/firecracker-go-sdk v0.19.1-0.20191108195453-43d336c3dcbf
21+
github.com/firecracker-microvm/firecracker-go-sdk v0.19.1-0.20191114205152-9e2ff62839b2
2222
github.com/go-ole/go-ole v1.2.4 // indirect
2323
github.com/godbus/dbus v0.0.0-20181025153459-66d97aec3384 // indirect
2424
github.com/gofrs/uuid v3.2.0+incompatible

‎go.sum‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -59,8 +59,8 @@ github.com/docker/go-metrics v0.0.0-20181218153428-b84716841b82 h1:X0fj836zx99zF
5959
github.com/docker/go-metrics v0.0.0-20181218153428-b84716841b82/go.mod h1:/u0gXw0Gay3ceNrsHubL3BtdOL2fHf93USgMTe0W5dI=
6060
github.com/docker/go-units v0.3.3 h1:Xk8S3Xj5sLGlG5g67hJmYMmUgXv5N4PhkjJHHqrwnTk=
6161
github.com/docker/go-units v0.3.3/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk=
62-
github.com/firecracker-microvm/firecracker-go-sdk v0.19.1-0.20191108195453-43d336c3dcbf h1:HlqW7e7IwSIHBHJg4gBN6Kz9afSnEmB3+9e4/iTbBTw=
63-
github.com/firecracker-microvm/firecracker-go-sdk v0.19.1-0.20191108195453-43d336c3dcbf/go.mod h1:kW0gxvPpPvMukUxxTO9DrpSlScrtrTDGY3VgjAj/Qwc=
62+
github.com/firecracker-microvm/firecracker-go-sdk v0.19.1-0.20191114205152-9e2ff62839b2 h1:Ab52E0UlBOmMIAK/igRycsxSAJVDBDMYq+Wr/n7z2E0=
63+
github.com/firecracker-microvm/firecracker-go-sdk v0.19.1-0.20191114205152-9e2ff62839b2/go.mod h1:kW0gxvPpPvMukUxxTO9DrpSlScrtrTDGY3VgjAj/Qwc=
6464
github.com/globalsign/mgo v0.0.0-20180905125535-1ca0a4f7cbcb h1:D4uzjWwKYQ5XnAvUbuvHW93esHg7F8N/OYeBBcJoTr0=
6565
github.com/globalsign/mgo v0.0.0-20180905125535-1ca0a4f7cbcb/go.mod h1:xkRDCp4j0OGD1HRkm4kmhM+pmpv3AKq5SU7GMg4oO/Q=
6666
github.com/go-ole/go-ole v1.2.4 h1:nNBDSCOigTSiarFpYE9J/KtEA1IOW4CNeqT9TQDqCxI=

‎runtime/cni_integ_test.go‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,7 @@ import (
2828
"github.com/containerd/containerd/namespaces"
2929
"github.com/containerd/containerd/oci"
3030
"github.com/containerd/containerd/pkg/ttrpcutil"
31+
"github.com/firecracker-microvm/firecracker-go-sdk/cni/cmd/tc-redirect-tap/args"
3132
"github.com/shirou/gopsutil/cpu"
3233
"github.com/stretchr/testify/assert"
3334
"github.com/stretchr/testify/require"
@@ -95,8 +96,23 @@ func TestCNISupport_Isolated(t *testing.T) {
9596
CNIConfig: &proto.CNIConfiguration{
9697
NetworkName: cniNetworkName,
9798
InterfaceName: "veth0",
99+
Args: []*proto.CNIConfiguration_CNIArg{
100+
{
101+
Key: "IgnoreUnknown",
102+
Value: "true",
103+
},
104+
{
105+
Key: args.TCRedirectTapUID,
106+
Value: fmt.Sprintf("%d", jailerUID),
107+
},
108+
{
109+
Key: args.TCRedirectTapGID,
110+
Value: fmt.Sprintf("%d", jailerGID),
111+
},
112+
},
98113
},
99114
}},
115+
JailerConfig: &proto.JailerConfig{},
100116
})
101117
require.NoError(t, err, "failed to create vm")
102118

‎runtime/runc_jailer.go‎

Lines changed: 30 additions & 48 deletions
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,6 @@ import (
2323
"os/exec"
2424
"path/filepath"
2525
"strings"
26-
"sync"
2726
"syscall"
2827

2928
"github.com/firecracker-microvm/firecracker-go-sdk"
@@ -51,13 +50,12 @@ type runcJailer struct {
5150
runcBinaryPath string
5251
uid uint32
5352
gid uint32
54-
once sync.Once
53+
54+
configSpec specs.Spec
5555
}
5656

5757
const firecrackerFileName = "firecracker"
5858

59-
var configSpec *specs.Spec
60-
6159
func newRuncJailer(ctx context.Context, logger *logrus.Entry, ociBundlePath, runcBinPath string, uid, gid uint32) (*runcJailer, error) {
6260
l := logger.WithField("ociBundlePath", ociBundlePath).
6361
WithField("runcBinaryPath", runcBinPath)
@@ -71,6 +69,19 @@ func newRuncJailer(ctx context.Context, logger *logrus.Entry, ociBundlePath, run
7169
gid: gid,
7270
}
7371

72+
spec := specs.Spec{}
73+
var configBytes []byte
74+
configBytes, err := ioutil.ReadFile(runcConfigPath)
75+
if err != nil {
76+
return nil, errors.Wrapf(err, "failed to read firecracker-runc-config.json")
77+
}
78+
79+
if err = json.Unmarshal(configBytes, &spec); err != nil {
80+
return nil, errors.Wrapf(err, "failed to unmarshal firecracker-runc-config.json")
81+
}
82+
83+
j.configSpec = spec
84+
7485
rootPath := j.RootPath()
7586

7687
const mode = os.FileMode(0700)
@@ -109,7 +120,7 @@ func (j *runcJailer) BuildJailedMachine(cfg *Config, machineConfig *firecracker.
109120
client := firecracker.NewClient(machineConfig.SocketPath, j.logger, machineConfig.Debug)
110121

111122
if machineConfig.NetNS == "" {
112-
if netns := getNetNS(configSpec); netns != "" {
123+
if netns := getNetNS(j.configSpec); netns != "" {
113124
machineConfig.NetNS = netns
114125
}
115126
}
@@ -371,46 +382,21 @@ func (j *runcJailer) jailerCommand(containerName string, isDebug bool) *exec.Cmd
371382
// overwriteConfig will set the proper default values if a field had not been set.
372383
func (j *runcJailer) overwriteConfig(cfg *Config, machineConfig *firecracker.Config, socketPath, configPath string) error {
373384
var err error
374-
j.once.Do(func() {
375-
// here we attempt to cache the runc config. If the config has already been
376-
// cached, we will return immediately
377-
if configSpec != nil {
378-
return
379-
}
380-
381-
spec := specs.Spec{}
382-
var configBytes []byte
383-
configBytes, err = ioutil.ReadFile(configPath)
384-
if err != nil {
385-
return
386-
}
387-
388-
if err = json.Unmarshal(configBytes, &spec); err != nil {
389-
return
390-
}
391-
392-
configSpec = &spec
393-
394-
if spec.Process.User.UID != 0 ||
395-
spec.Process.User.GID != 0 {
396-
err = fmt.Errorf(
397-
"using UID %d and GID %d, these values must not be set",
398-
spec.Process.User.UID,
399-
spec.Process.User.GID,
400-
)
401-
return
402-
}
403-
404-
spec = j.setDefaultConfigValues(cfg, socketPath, spec)
405-
spec.Root.Path = rootfsFolder
406-
spec.Root.Readonly = false
407-
})
408-
409-
if err != nil {
410-
return err
385+
// here we attempt to cache the runc config. If the config has already been
386+
// cached, we will return immediately
387+
spec := j.configSpec
388+
if spec.Process.User.UID != 0 ||
389+
spec.Process.User.GID != 0 {
390+
return fmt.Errorf(
391+
"using UID %d and GID %d, these values must not be set",
392+
spec.Process.User.UID,
393+
spec.Process.User.GID,
394+
)
411395
}
412396

413-
spec := *configSpec
397+
spec = j.setDefaultConfigValues(cfg, socketPath, spec)
398+
spec.Root.Path = rootfsFolder
399+
spec.Root.Readonly = false
414400
spec.Process.User.UID = j.uid
415401
spec.Process.User.GID = j.gid
416402

@@ -491,11 +477,7 @@ func mkdirAllWithPermissions(path string, mode os.FileMode, uid, gid uint32) err
491477
return nil
492478
}
493479

494-
func getNetNS(spec *specs.Spec) string {
495-
if spec == nil {
496-
return ""
497-
}
498-
480+
func getNetNS(spec specs.Spec) string {
499481
for _, ns := range spec.Linux.Namespaces {
500482
if ns.Type == networkNamespaceRuncName {
501483
return ns.Path

0 commit comments

Comments
 (0)