diff --git a/daemon/graphdriver/overlay2/check.go b/daemon/graphdriver/overlay2/check.go index af5bc34650..d16ee3555c 100644 --- a/daemon/graphdriver/overlay2/check.go +++ b/daemon/graphdriver/overlay2/check.go @@ -10,7 +10,9 @@ import ( "path/filepath" "syscall" + "github.com/containerd/containerd/mount" "github.com/containerd/containerd/pkg/userns" + "github.com/docker/docker/daemon/graphdriver/overlayutils" "github.com/docker/docker/pkg/system" "github.com/pkg/errors" "golang.org/x/sys/unix" @@ -107,3 +109,89 @@ func doesSupportNativeDiff(d string) error { return nil } + +// Forked from https://github.com/containers/storage/blob/05c69f1b2a5871d170c07dc8d2eec69c681e143b/drivers/overlay/check.go +// +// usingMetacopy checks if overlayfs's metacopy feature is active. When active, +// overlayfs will only copy up metadata (as opposed to the whole file) when a +// metadata-only operation is performed. Affected inodes will be marked with +// the "(trusted|user).overlay.metacopy" xattr. +// +// The CONFIG_OVERLAY_FS_METACOPY option, the overlay.metacopy parameter, or +// the metacopy mount option can all enable metacopy mode. For more details on +// this feature, see filesystems/overlayfs.txt in the kernel documentation +// tree. +// +// Note that the mount option should never be relevant should never come up the +// daemon has control over all of its own mounts and presently does not request +// metacopy. Nonetheless, a user or kernel distributor may enable metacopy, so +// we should report in the daemon whether or not we detect its use. +func usingMetacopy(d string) (bool, error) { + userxattr := false + if userns.RunningInUserNS() { + needed, err := overlayutils.NeedsUserXAttr(d) + if err != nil { + return false, err + } + if needed { + userxattr = true + } + } + + td, err := os.MkdirTemp(d, "metacopy-check") + if err != nil { + return false, err + } + defer func() { + if err := os.RemoveAll(td); err != nil { + logger.WithError(err).Warnf("failed to remove check directory %v", td) + } + }() + + l1, l2, work, merged := filepath.Join(td, "l1"), filepath.Join(td, "l2"), filepath.Join(td, "work"), filepath.Join(td, "merged") + for _, dir := range []string{l1, l2, work, merged} { + if err := os.Mkdir(dir, 0755); err != nil { + return false, err + } + } + + // Create empty file in l1 with 0700 permissions for metacopy test + if err := os.WriteFile(filepath.Join(l1, "f"), []byte{}, 0700); err != nil { + return false, err + } + + opts := []string{fmt.Sprintf("lowerdir=%s,upperdir=%s,workdir=%s", l1, l2, work)} + if userxattr { + opts = append(opts, "userxattr") + } + + m := mount.Mount{ + Type: "overlay", + Source: "overlay", + Options: opts, + } + + if err := m.Mount(merged); err != nil { + return false, errors.Wrap(err, "failed to mount overlay for metacopy check") + } + defer func() { + if err := mount.UnmountAll(merged, 0); err != nil { + logger.WithError(err).Warnf("failed to unmount check directory %v", merged) + } + }() + + // Make a change that only impacts the inode, in the upperdir + if err := os.Chmod(filepath.Join(merged, "f"), 0600); err != nil { + return false, errors.Wrap(err, "error changing permissions on file for metacopy check") + } + + // ...and check if the pulled-up copy is marked as metadata-only + xattr, err := system.Lgetxattr(filepath.Join(l2, "f"), overlayutils.GetOverlayXattr("metacopy")) + if err != nil { + return false, errors.Wrap(err, "metacopy flag was not set on file in the upperdir") + } + usingMetacopy := xattr != nil + + logger.WithField("usingMetacopy", usingMetacopy).Debug("successfully detected metacopy status") + return usingMetacopy, nil +} diff --git a/daemon/graphdriver/overlay2/overlay.go b/daemon/graphdriver/overlay2/overlay.go index 3a3267467f..ef243163c8 100644 --- a/daemon/graphdriver/overlay2/overlay.go +++ b/daemon/graphdriver/overlay2/overlay.go @@ -99,6 +99,7 @@ type Driver struct { options overlayOptions naiveDiff graphdriver.DiffDriver supportsDType bool + usingMetacopy bool locker *locker.Locker } @@ -159,6 +160,11 @@ func Init(home string, options []string, idMap idtools.IdentityMapping) (graphdr return nil, overlayutils.ErrDTypeNotSupported("overlay2", backingFs) } + usingMetacopy, err := usingMetacopy(testdir) + if err != nil { + return nil, err + } + cur := idtools.CurrentIdentity() dirID := idtools.Identity{ UID: cur.UID, @@ -176,6 +182,7 @@ func Init(home string, options []string, idMap idtools.IdentityMapping) (graphdr idMap: idMap, ctr: graphdriver.NewRefCounter(graphdriver.NewFsChecker(graphdriver.FsMagicOverlay)), supportsDType: supportsDType, + usingMetacopy: usingMetacopy, locker: locker.New(), options: *opts, } @@ -213,8 +220,8 @@ func Init(home string, options []string, idMap idtools.IdentityMapping) (graphdr userxattr = "userxattr," } - logger.Debugf("backingFs=%s, projectQuotaSupported=%v, indexOff=%q, userxattr=%q", - backingFs, projectQuotaSupported, indexOff, userxattr) + logger.Debugf("backingFs=%s, projectQuotaSupported=%v, usingMetacopy=%v, indexOff=%q, userxattr=%q", + backingFs, projectQuotaSupported, usingMetacopy, indexOff, userxattr) return d, nil } @@ -266,6 +273,7 @@ func (d *Driver) Status() [][2]string { return [][2]string{ {"Backing Filesystem", backingFs}, {"Supports d_type", strconv.FormatBool(d.supportsDType)}, + {"Using metacopy", strconv.FormatBool(d.usingMetacopy)}, {"Native Overlay Diff", strconv.FormatBool(!useNaiveDiff(d.home))}, {"userxattr", strconv.FormatBool(userxattr != "")}, } diff --git a/daemon/graphdriver/overlayutils/overlayutils.go b/daemon/graphdriver/overlayutils/overlayutils.go index 5100c87bf9..85eb96016a 100644 --- a/daemon/graphdriver/overlayutils/overlayutils.go +++ b/daemon/graphdriver/overlayutils/overlayutils.go @@ -9,6 +9,7 @@ import ( "path" "path/filepath" + "github.com/containerd/containerd/pkg/userns" "github.com/docker/docker/daemon/graphdriver" "github.com/pkg/errors" "github.com/sirupsen/logrus" @@ -77,3 +78,14 @@ func SupportsOverlay(d string, checkMultipleLowers bool) error { } return nil } + +// GetOverlayXattr combines the overlay module's xattr class with the named +// xattr -- `user` when mounted inside a user namespace, and `trusted` when +// mounted in the 'root' namespace. +func GetOverlayXattr(name string) string { + class := "trusted" + if userns.RunningInUserNS() { + class = "user" + } + return fmt.Sprintf("%s.overlay.%s", class, name) +}