From 07b3aac9020f1f5e3f7af0cb691cfb6e2189c089 Mon Sep 17 00:00:00 2001 From: Tonis Tiigi Date: Mon, 10 Jun 2019 16:28:01 -0700 Subject: [PATCH] builder-next: userns remap support Signed-off-by: Tonis Tiigi --- builder/builder-next/adapters/snapshot/snapshot.go | 14 +++++++++----- builder/builder-next/builder.go | 2 ++ builder/builder-next/controller.go | 11 ++++++----- builder/builder-next/executor_unix.go | 4 +++- builder/builder-next/executor_windows.go | 3 ++- cmd/dockerd/daemon.go | 1 + 6 files changed, 23 insertions(+), 12 deletions(-) diff --git a/builder/builder-next/adapters/snapshot/snapshot.go b/builder/builder-next/adapters/snapshot/snapshot.go index 93af8f3426..3a722e5923 100644 --- a/builder/builder-next/adapters/snapshot/snapshot.go +++ b/builder/builder-next/adapters/snapshot/snapshot.go @@ -26,9 +26,10 @@ var keySize = []byte("size") // Opt defines options for creating the snapshotter type Opt struct { - GraphDriver graphdriver.Driver - LayerStore layer.Store - Root string + GraphDriver graphdriver.Driver + LayerStore layer.Store + Root string + IdentityMapping *idtools.IdentityMapping } type graphIDRegistrar interface { @@ -79,7 +80,7 @@ func (s *snapshotter) Name() string { } func (s *snapshotter) IdentityMapping() *idtools.IdentityMapping { - return nil + return s.opt.IdentityMapping } func (s *snapshotter) Prepare(ctx context.Context, key, parent string, opts ...snapshots.Opt) error { @@ -253,6 +254,7 @@ func (s *snapshotter) Mounts(ctx context.Context, key string) (snapshot.Mountabl id := identity.NewID() var rwlayer layer.RWLayer return &mountable{ + idmap: s.opt.IdentityMapping, acquire: func() ([]mount.Mount, error) { rwlayer, err = s.opt.LayerStore.CreateRWLayer(id, l.ChainID(), nil) if err != nil { @@ -278,6 +280,7 @@ func (s *snapshotter) Mounts(ctx context.Context, key string) (snapshot.Mountabl id, _ := s.getGraphDriverID(key) return &mountable{ + idmap: s.opt.IdentityMapping, acquire: func() ([]mount.Mount, error) { rootfs, err := s.opt.GraphDriver.Get(id, "") if err != nil { @@ -440,6 +443,7 @@ type mountable struct { acquire func() ([]mount.Mount, error) release func() error refCount int + idmap *idtools.IdentityMapping } func (m *mountable) Mount() ([]mount.Mount, error) { @@ -480,5 +484,5 @@ func (m *mountable) Release() error { } func (m *mountable) IdentityMapping() *idtools.IdentityMapping { - return nil + return m.idmap } diff --git a/builder/builder-next/builder.go b/builder/builder-next/builder.go index b8a8faa8b2..1d8840d4c6 100644 --- a/builder/builder-next/builder.go +++ b/builder/builder-next/builder.go @@ -17,6 +17,7 @@ import ( "github.com/docker/docker/builder" "github.com/docker/docker/daemon/config" "github.com/docker/docker/daemon/images" + "github.com/docker/docker/pkg/idtools" "github.com/docker/docker/pkg/streamformatter" "github.com/docker/docker/pkg/system" "github.com/docker/libnetwork" @@ -73,6 +74,7 @@ type Opt struct { ResolverOpt resolver.ResolveOptionsFunc BuilderConfig config.BuilderConfig Rootless bool + IdentityMapping *idtools.IdentityMapping } // Builder can build using BuildKit backend diff --git a/builder/builder-next/controller.go b/builder/builder-next/controller.go index 37b6c24440..dfc482e17b 100644 --- a/builder/builder-next/controller.go +++ b/builder/builder-next/controller.go @@ -38,7 +38,7 @@ import ( ) func newController(rt http.RoundTripper, opt Opt) (*control.Controller, error) { - if err := os.MkdirAll(opt.Root, 0700); err != nil { + if err := os.MkdirAll(opt.Root, 0711); err != nil { return nil, err } @@ -55,9 +55,10 @@ func newController(rt http.RoundTripper, opt Opt) (*control.Controller, error) { } sbase, err := snapshot.NewSnapshotter(snapshot.Opt{ - GraphDriver: driver, - LayerStore: dist.LayerStore, - Root: root, + GraphDriver: driver, + LayerStore: dist.LayerStore, + Root: root, + IdentityMapping: opt.IdentityMapping, }) if err != nil { return nil, err @@ -112,7 +113,7 @@ func newController(rt http.RoundTripper, opt Opt) (*control.Controller, error) { return nil, err } - exec, err := newExecutor(root, opt.DefaultCgroupParent, opt.NetworkController, opt.Rootless) + exec, err := newExecutor(root, opt.DefaultCgroupParent, opt.NetworkController, opt.Rootless, opt.IdentityMapping) if err != nil { return nil, err } diff --git a/builder/builder-next/executor_unix.go b/builder/builder-next/executor_unix.go index 620ffb401d..7cbc2569eb 100644 --- a/builder/builder-next/executor_unix.go +++ b/builder/builder-next/executor_unix.go @@ -8,6 +8,7 @@ import ( "strconv" "sync" + "github.com/docker/docker/pkg/idtools" "github.com/docker/libnetwork" "github.com/moby/buildkit/executor" "github.com/moby/buildkit/executor/runcexecutor" @@ -20,7 +21,7 @@ import ( const networkName = "bridge" -func newExecutor(root, cgroupParent string, net libnetwork.NetworkController, rootless bool) (executor.Executor, error) { +func newExecutor(root, cgroupParent string, net libnetwork.NetworkController, rootless bool, idmap *idtools.IdentityMapping) (executor.Executor, error) { networkProviders := map[pb.NetMode]network.Provider{ pb.NetMode_UNSET: &bridgeProvider{NetworkController: net, Root: filepath.Join(root, "net")}, pb.NetMode_HOST: network.NewHostProvider(), @@ -32,6 +33,7 @@ func newExecutor(root, cgroupParent string, net libnetwork.NetworkController, ro DefaultCgroupParent: cgroupParent, Rootless: rootless, NoPivot: os.Getenv("DOCKER_RAMDISK") != "", + IdentityMapping: idmap, }, networkProviders) } diff --git a/builder/builder-next/executor_windows.go b/builder/builder-next/executor_windows.go index e2cc907160..b870abe6ce 100644 --- a/builder/builder-next/executor_windows.go +++ b/builder/builder-next/executor_windows.go @@ -5,12 +5,13 @@ import ( "errors" "io" + "github.com/docker/docker/pkg/idtools" "github.com/docker/libnetwork" "github.com/moby/buildkit/cache" "github.com/moby/buildkit/executor" ) -func newExecutor(_, _ string, _ libnetwork.NetworkController, _ bool) (executor.Executor, error) { +func newExecutor(_, _ string, _ libnetwork.NetworkController, _ bool, _ *idtools.IdentityMapping) (executor.Executor, error) { return &winExecutor{}, nil } diff --git a/cmd/dockerd/daemon.go b/cmd/dockerd/daemon.go index 658421033d..4a2962409a 100644 --- a/cmd/dockerd/daemon.go +++ b/cmd/dockerd/daemon.go @@ -318,6 +318,7 @@ func newRouterOptions(config *config.Config, d *daemon.Daemon) (routerOptions, e ResolverOpt: d.NewResolveOptionsFunc(), BuilderConfig: config.Builder, Rootless: d.Rootless(), + IdentityMapping: d.IdentityMapping(), }) if err != nil { return opts, err