Merge pull request #43557 from neersighted/overlay2-report-metacopy

[v2] overlay2: test for and report metacopy status

daemon/graphdriver/overlay2/check.go

@@ -10,7 +10,9 @@ import (
 	"path/filepath"
 	"syscall"
 
+	"github.com/containerd/containerd/mount"
 	"github.com/containerd/containerd/pkg/userns"
+	"github.com/docker/docker/daemon/graphdriver/overlayutils"
 	"github.com/docker/docker/pkg/system"
 	"github.com/pkg/errors"
 	"golang.org/x/sys/unix"
@@ -107,3 +109,89 @@ func doesSupportNativeDiff(d string) error {
 
 	return nil
 }
+
+// Forked from https://github.com/containers/storage/blob/05c69f1b2a5871d170c07dc8d2eec69c681e143b/drivers/overlay/check.go
+//
+// usingMetacopy checks if overlayfs's metacopy feature is active. When active,
+// overlayfs will only copy up metadata (as opposed to the whole file) when a
+// metadata-only operation is performed. Affected inodes will be marked with
+// the "(trusted|user).overlay.metacopy" xattr.
+//
+// The CONFIG_OVERLAY_FS_METACOPY option, the overlay.metacopy parameter, or
+// the metacopy mount option can all enable metacopy mode. For more details on
+// this feature, see filesystems/overlayfs.txt in the kernel documentation
+// tree.
+//
+// Note that the mount option should never be relevant should never come up the
+// daemon has control over all of its own mounts and presently does not request
+// metacopy. Nonetheless, a user or kernel distributor may enable metacopy, so
+// we should report in the daemon whether or not we detect its use.
+func usingMetacopy(d string) (bool, error) {
+	userxattr := false
+	if userns.RunningInUserNS() {
+		needed, err := overlayutils.NeedsUserXAttr(d)
+		if err != nil {
+			return false, err
+		}
+		if needed {
+			userxattr = true
+		}
+	}
+
+	td, err := os.MkdirTemp(d, "metacopy-check")
+	if err != nil {
+		return false, err
+	}
+	defer func() {
+		if err := os.RemoveAll(td); err != nil {
+			logger.WithError(err).Warnf("failed to remove check directory %v", td)
+		}
+	}()
+
+	l1, l2, work, merged := filepath.Join(td, "l1"), filepath.Join(td, "l2"), filepath.Join(td, "work"), filepath.Join(td, "merged")
+	for _, dir := range []string{l1, l2, work, merged} {
+		if err := os.Mkdir(dir, 0755); err != nil {
+			return false, err
+		}
+	}
+
+	// Create empty file in l1 with 0700 permissions for metacopy test
+	if err := os.WriteFile(filepath.Join(l1, "f"), []byte{}, 0700); err != nil {
+		return false, err
+	}
+
+	opts := []string{fmt.Sprintf("lowerdir=%s,upperdir=%s,workdir=%s", l1, l2, work)}
+	if userxattr {
+		opts = append(opts, "userxattr")
+	}
+
+	m := mount.Mount{
+		Type:    "overlay",
+		Source:  "overlay",
+		Options: opts,
+	}
+
+	if err := m.Mount(merged); err != nil {
+		return false, errors.Wrap(err, "failed to mount overlay for metacopy check")
+	}
+	defer func() {
+		if err := mount.UnmountAll(merged, 0); err != nil {
+			logger.WithError(err).Warnf("failed to unmount check directory %v", merged)
+		}
+	}()
+
+	// Make a change that only impacts the inode, in the upperdir
+	if err := os.Chmod(filepath.Join(merged, "f"), 0600); err != nil {
+		return false, errors.Wrap(err, "error changing permissions on file for metacopy check")
+	}
+
+	// ...and check if the pulled-up copy is marked as metadata-only
+	xattr, err := system.Lgetxattr(filepath.Join(l2, "f"), overlayutils.GetOverlayXattr("metacopy"))
+	if err != nil {
+		return false, errors.Wrap(err, "metacopy flag was not set on file in the upperdir")
+	}
+	usingMetacopy := xattr != nil
+
+	logger.WithField("usingMetacopy", usingMetacopy).Debug("successfully detected metacopy status")
+	return usingMetacopy, nil
+}

daemon/graphdriver/overlay2/overlay.go

@@ -99,6 +99,7 @@ type Driver struct {
 	options       overlayOptions
 	naiveDiff     graphdriver.DiffDriver
 	supportsDType bool
+	usingMetacopy bool
 	locker        *locker.Locker
 }
 
@@ -159,6 +160,11 @@ func Init(home string, options []string, idMap idtools.IdentityMapping) (graphdr
 		return nil, overlayutils.ErrDTypeNotSupported("overlay2", backingFs)
 	}
 
+	usingMetacopy, err := usingMetacopy(testdir)
+	if err != nil {
+		return nil, err
+	}
+
 	cur := idtools.CurrentIdentity()
 	dirID := idtools.Identity{
 		UID: cur.UID,
@@ -176,6 +182,7 @@ func Init(home string, options []string, idMap idtools.IdentityMapping) (graphdr
 		idMap:         idMap,
 		ctr:           graphdriver.NewRefCounter(graphdriver.NewFsChecker(graphdriver.FsMagicOverlay)),
 		supportsDType: supportsDType,
+		usingMetacopy: usingMetacopy,
 		locker:        locker.New(),
 		options:       *opts,
 	}
@@ -213,8 +220,8 @@ func Init(home string, options []string, idMap idtools.IdentityMapping) (graphdr
 		userxattr = "userxattr,"
 	}
 
-	logger.Debugf("backingFs=%s, projectQuotaSupported=%v, indexOff=%q, userxattr=%q",
-		backingFs, projectQuotaSupported, indexOff, userxattr)
+	logger.Debugf("backingFs=%s, projectQuotaSupported=%v, usingMetacopy=%v, indexOff=%q, userxattr=%q",
+		backingFs, projectQuotaSupported, usingMetacopy, indexOff, userxattr)
 
 	return d, nil
 }
@@ -266,6 +273,7 @@ func (d *Driver) Status() [][2]string {
 	return [][2]string{
 		{"Backing Filesystem", backingFs},
 		{"Supports d_type", strconv.FormatBool(d.supportsDType)},
+		{"Using metacopy", strconv.FormatBool(d.usingMetacopy)},
 		{"Native Overlay Diff", strconv.FormatBool(!useNaiveDiff(d.home))},
 		{"userxattr", strconv.FormatBool(userxattr != "")},
 	}

daemon/graphdriver/overlayutils/overlayutils.go

@@ -9,6 +9,7 @@ import (
 	"path"
 	"path/filepath"
 
+	"github.com/containerd/containerd/pkg/userns"
 	"github.com/docker/docker/daemon/graphdriver"
 	"github.com/pkg/errors"
 	"github.com/sirupsen/logrus"
@@ -77,3 +78,14 @@ func SupportsOverlay(d string, checkMultipleLowers bool) error {
 	}
 	return nil
 }
+
+// GetOverlayXattr combines the overlay module's xattr class with the named
+// xattr -- `user` when mounted inside a user namespace, and `trusted` when
+// mounted in the 'root' namespace.
+func GetOverlayXattr(name string) string {
+	class := "trusted"
+	if userns.RunningInUserNS() {
+		class = "user"
+	}
+	return fmt.Sprintf("%s.overlay.%s", class, name)
+}