From 930337624250945472001136e7bcb8e5b102bb87 Mon Sep 17 00:00:00 2001 From: Akihiro Suda Date: Sun, 2 May 2021 04:41:34 +0900 Subject: [PATCH] Swarm config: use absolute paths for mount destination strings Needed for runc >= 1.0.0-rc94. See runc issue 2928. Signed-off-by: Akihiro Suda Signed-off-by: Sebastiaan van Stijn --- container/container.go | 11 +++++++++++ container/container_unix.go | 3 ++- container/container_windows.go | 3 ++- 3 files changed, 15 insertions(+), 2 deletions(-) diff --git a/container/container.go b/container/container.go index 3da63743ab..f6c7d51c55 100644 --- a/container/container.go +++ b/container/container.go @@ -717,6 +717,17 @@ func getSecretTargetPath(r *swarmtypes.SecretReference) string { return filepath.Join(containerSecretMountPath, r.File.Name) } +// getConfigTargetPath makes sure that config paths inside the container are +// absolute, as required by the runtime spec, and enforced by runc >= 1.0.0-rc94. +// see https://github.com/opencontainers/runc/issues/2928 +func getConfigTargetPath(r *swarmtypes.ConfigReference) string { + if filepath.IsAbs(r.File.Name) { + return r.File.Name + } + + return filepath.Join(containerConfigMountPath, r.File.Name) +} + // CreateDaemonEnvironment creates a new environment variable slice for this container. func (container *Container) CreateDaemonEnvironment(tty bool, linkedEnv []string) []string { // Setup environment diff --git a/container/container_unix.go b/container/container_unix.go index d5c9837532..7a49ff55aa 100644 --- a/container/container_unix.go +++ b/container/container_unix.go @@ -27,6 +27,7 @@ const ( // for the graceful container stop before forcefully terminating it. DefaultStopTimeout = 10 + containerConfigMountPath = "/" containerSecretMountPath = "/run/secrets" ) @@ -242,7 +243,7 @@ func (container *Container) SecretMounts() ([]Mount, error) { } mounts = append(mounts, Mount{ Source: fPath, - Destination: r.File.Name, + Destination: getConfigTargetPath(r), Writable: false, }) } diff --git a/container/container_windows.go b/container/container_windows.go index 11e255d82e..22e77b15af 100644 --- a/container/container_windows.go +++ b/container/container_windows.go @@ -12,6 +12,7 @@ import ( ) const ( + containerConfigMountPath = `C:\` containerSecretMountPath = `C:\ProgramData\Docker\secrets` containerInternalSecretMountPath = `C:\ProgramData\Docker\internal\secrets` containerInternalConfigsDirPath = `C:\ProgramData\Docker\internal\configs` @@ -87,7 +88,7 @@ func (container *Container) CreateConfigSymlinks() error { if configRef.File == nil { continue } - resolvedPath, _, err := container.ResolvePath(configRef.File.Name) + resolvedPath, _, err := container.ResolvePath(getConfigTargetPath(configRef)) if err != nil { return err }