1
0
Fork 0
mirror of https://github.com/moby/moby.git synced 2022-11-09 12:21:53 -05:00
Commit graph

9 commits

Author SHA1 Message Date
Brian Goff
5ede64d63f Use rslave instead of rprivate in chrootarchive
With `rprivate` there exists a race where a reference to a mount has
propagated to the new namespace, when `rprivate` is set the parent
namespace is not able to remove the mount due to that reference.
With `rslave` unmounts will propagate correctly into the namespace and
prevent the sort of transient errors that are possible with `rprivate`.

This is a similar fix to 117c92745b

Signed-off-by: Brian Goff <cpuguy83@gmail.com>
2017-10-16 13:49:31 -04:00
Christopher Jones
069fdc8a08
[project] change syscall to /x/sys/unix|windows
Changes most references of syscall to golang.org/x/sys/
Ones aren't changes include, Errno, Signal and SysProcAttr
as they haven't been implemented in /x/sys/.

Signed-off-by: Christopher Jones <tophj@linux.vnet.ibm.com>

[s390x] switch utsname from unsigned to signed

per 33267e036f
char in s390x in the /x/sys/unix package is now signed, so
change the buildtags

Signed-off-by: Christopher Jones <tophj@linux.vnet.ibm.com>
2017-07-11 08:00:32 -04:00
Brian Goff
e6eef7eb49 Fix issue with cp to container volume dir
In some cases, attempting to `docker cp` to a container's volume dir
would fail due to the volume mounts not existing after performing a
bind-mount on the container path prior to doing a pivot_root.

This does not seem to be effecting all systems, but was found to be a
problem on centos.
The solution is to use an `rbind` rather than `bind` so that any
existing mounts are carried over.

The `MakePrivate` on `path` is no longer neccessary since we are already
doing `MakeRPrivate` on `/`.

Signed-off-by: Brian Goff <cpuguy83@gmail.com>
2016-11-03 16:01:15 -04:00
Tonis Tiigi
70dfea63ba chroot: let root be cleaned up by kernel
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
2016-10-20 15:50:46 -07:00
Tonis Tiigi
b511d1f0ca chroot: remount everything as private in new mntns
If parent of the destination path is shared, this
path will be unmounted from the parent ns even if
the path itself is private.

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
2016-10-20 15:29:23 -07:00
Phil Estes
dc950567c1 Use real chroot if daemon is running in a user namespace
The namespace unshare+pivot root is not possible when running inside a
user namespace, so fallback to the original "real" chroot code.

Docker-DCO-1.1-Signed-off-by: Phil Estes <estesp@linux.vnet.ibm.com>
2016-08-12 16:31:01 -04:00
Antonio Murdaca
7d22887b2c pkg: chrootarchive: chroot_linux: fix mount leak
When pivot_root fails we need to unmount the bind mounted path we
previously mounted in preparation for pivot_root.

Signed-off-by: Antonio Murdaca <runcom@redhat.com>
2016-06-11 00:07:41 +02:00
Antonio Murdaca
5248f5c3d1 pkg: chrootarchive: chroot_linux: fix docker build
The path we're trying to remove doesn't exist after a successful
chroot+chdir because a / is only appended after pivot_root is
successful and so we can't cleanup anymore with the old path.
Also fix leaking .pivot_root dirs under /var/lib/docker/tmp/docker-builder*
on error.

Fix https://github.com/docker/docker/issues/22587
Introduced by https://github.com/docker/docker/pull/22506

Signed-off-by: Antonio Murdaca <runcom@redhat.com>
2016-05-10 00:42:49 +02:00
Brian Goff
85988b33d2 Use pivot_root instead of chroot for chrootarchive
This fixes one issue with Docker running under a grsec kernel, which
denies chmod and mknod under chroot.

Note, if pivot_root fails it will still fallback to chroot.

Signed-off-by: Brian Goff <cpuguy83@gmail.com>
2016-05-04 19:55:34 -04:00