summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--cmd/podman/main_local.go19
-rw-r--r--go.mod3
-rw-r--r--go.sum14
-rw-r--r--libpod/boltdb_state.go11
-rw-r--r--libpod/container_internal.go3
-rw-r--r--pkg/rootless/rootless.go45
-rw-r--r--pkg/rootless/rootless_linux.go3
-rw-r--r--test/e2e/start_test.go4
-rw-r--r--vendor/github.com/containers/psgo/.travis.yml6
-rw-r--r--vendor/github.com/containers/psgo/Makefile9
-rw-r--r--vendor/github.com/containers/psgo/go.mod2
-rw-r--r--vendor/github.com/containers/psgo/go.sum8
-rw-r--r--vendor/github.com/containers/psgo/internal/cgroups/cgroups.go44
-rw-r--r--vendor/github.com/containers/psgo/internal/proc/pids.go78
-rw-r--r--vendor/modules.txt3
15 files changed, 212 insertions, 40 deletions
diff --git a/cmd/podman/main_local.go b/cmd/podman/main_local.go
index 917096e17..bdffb6b1e 100644
--- a/cmd/podman/main_local.go
+++ b/cmd/podman/main_local.go
@@ -200,17 +200,12 @@ func setupRootless(cmd *cobra.Command, args []string) error {
return errors.Wrapf(err, "could not get pause process pid file path")
}
- if _, err := os.Stat(pausePidPath); err == nil {
- became, ret, err := rootless.TryJoinFromFilePaths("", false, []string{pausePidPath})
- if err != nil {
- logrus.Errorf("cannot join pause process. You may need to remove %s and stop all containers", pausePidPath)
- logrus.Errorf("you can use `%s system migrate` to recreate the pause process and restart the containers", os.Args[0])
- logrus.Errorf(err.Error())
- os.Exit(1)
- }
- if became {
- os.Exit(ret)
- }
+ became, ret, err := rootless.TryJoinPauseProcess(pausePidPath)
+ if err != nil {
+ return err
+ }
+ if became {
+ os.Exit(ret)
}
// if there is no pid file, try to join existing containers, and create a pause process.
@@ -225,7 +220,7 @@ func setupRootless(cmd *cobra.Command, args []string) error {
paths = append(paths, ctr.Config().ConmonPidFile)
}
- became, ret, err := rootless.TryJoinFromFilePaths(pausePidPath, true, paths)
+ became, ret, err = rootless.TryJoinFromFilePaths(pausePidPath, true, paths)
if err := movePauseProcessToScope(); err != nil {
conf, err := runtime.GetConfig()
if err != nil {
diff --git a/go.mod b/go.mod
index 40a05553c..356ceaa7a 100644
--- a/go.mod
+++ b/go.mod
@@ -14,9 +14,8 @@ require (
github.com/containernetworking/cni v0.7.1
github.com/containernetworking/plugins v0.8.2
github.com/containers/buildah v1.11.3
- github.com/containers/image v3.0.2+incompatible // indirect
github.com/containers/image/v4 v4.0.1
- github.com/containers/psgo v1.3.1
+ github.com/containers/psgo v1.3.2
github.com/containers/storage v1.13.4
github.com/coreos/go-systemd v0.0.0-20190719114852-fd7a80b32e1f
github.com/coreos/pkg v0.0.0-20180928190104-399ea9e2e55f // indirect
diff --git a/go.sum b/go.sum
index 24bcc6ed8..e724b93d0 100644
--- a/go.sum
+++ b/go.sum
@@ -69,6 +69,20 @@ github.com/containers/libtrust v0.0.0-20190913040956-14b96171aa3b h1:Q8ePgVfHDpl
github.com/containers/libtrust v0.0.0-20190913040956-14b96171aa3b/go.mod h1:9rfv8iPl1ZP7aqh9YA68wnZv2NUDbXdcdPHVz0pFbPY=
github.com/containers/psgo v1.3.1 h1:1kE+jJ9Ou5f9zQT/M2IdeSclsKWsXrSFlOcnqc+F2TA=
github.com/containers/psgo v1.3.1/go.mod h1:LLiRMmxZ6FWP4bB/fOUu6kDT+4okk/ZCeeykqh0O5Ns=
+github.com/containers/psgo v1.3.2 h1:jYfppPih3S/j2Yi5O14AXjd8GfCx1ph9L3YsoK3adko=
+github.com/containers/psgo v1.3.2/go.mod h1:ENXXLQ5E1At4K0EUsGogXBJi/C28gwqkONWeLPI9fJ8=
+github.com/containers/storage v1.12.10-0.20190627120555-8eed0c36d1e3 h1:kO/YA36sGuPDFvVIzZxJp7xmwa+/wCVADxDSuFzsZwM=
+github.com/containers/storage v1.12.10-0.20190627120555-8eed0c36d1e3/go.mod h1:+RirK6VQAqskQlaTBrOG6ulDvn4si2QjFE1NZCn06MM=
+github.com/containers/storage v1.12.11 h1:r35VsROen9Kw3+LN/v4O4g7cT5zQPX06vkcjqScJ2z8=
+github.com/containers/storage v1.12.11/go.mod h1:+RirK6VQAqskQlaTBrOG6ulDvn4si2QjFE1NZCn06MM=
+github.com/containers/storage v1.12.12 h1:gao0GNzjmSX4Ai/StOHtUVIrBguC0OKyvx/ZMwBdyuY=
+github.com/containers/storage v1.12.12/go.mod h1:+RirK6VQAqskQlaTBrOG6ulDvn4si2QjFE1NZCn06MM=
+github.com/containers/storage v1.12.13 h1:GtaLCY8p1Drlk1Oew581jGvB137UaO+kpz0HII67T0A=
+github.com/containers/storage v1.12.13/go.mod h1:+RirK6VQAqskQlaTBrOG6ulDvn4si2QjFE1NZCn06MM=
+github.com/containers/storage v1.12.16 h1:zePYS1GiG8CuRqLCeA0ufx4X27K06HcJLV50DdojL+Y=
+github.com/containers/storage v1.12.16/go.mod h1:QsZp4XMJjyPNNbQHZeyNW3OmhwsWviI+7S6iOcu6a4c=
+github.com/containers/storage v1.13.1 h1:rjVirLS9fCGkUFlLDZEoGDDUugtIf46DufWvJu08wxQ=
+github.com/containers/storage v1.13.1/go.mod h1:6D8nK2sU9V7nEmAraINRs88ZEscM5C5DK+8Npp27GeA=
github.com/containers/storage v1.13.2 h1:UXZ0Ckmk6+6+4vj2M2ywruVtH97pnRoAhTG8ctd+yQI=
github.com/containers/storage v1.13.2/go.mod h1:6D8nK2sU9V7nEmAraINRs88ZEscM5C5DK+8Npp27GeA=
github.com/containers/storage v1.13.4 h1:j0bBaJDKbUHtAW1MXPFnwXJtqcH+foWeuXK1YaBV5GA=
diff --git a/libpod/boltdb_state.go b/libpod/boltdb_state.go
index e43d54eee..0bb1df7b8 100644
--- a/libpod/boltdb_state.go
+++ b/libpod/boltdb_state.go
@@ -2,6 +2,7 @@ package libpod
import (
"bytes"
+ "os"
"strings"
"sync"
@@ -658,9 +659,13 @@ func (s *BoltState) UpdateContainer(ctr *Container) error {
return err
}
- // Handle network namespace
- if err := replaceNetNS(netNSPath, ctr, newState); err != nil {
- return err
+ // Handle network namespace.
+ if os.Geteuid() == 0 {
+ // Do it only when root, either on the host or as root in the
+ // user namespace.
+ if err := replaceNetNS(netNSPath, ctr, newState); err != nil {
+ return err
+ }
}
// New state compiled successfully, swap it into the current state
diff --git a/libpod/container_internal.go b/libpod/container_internal.go
index a4dcd23be..ac921d737 100644
--- a/libpod/container_internal.go
+++ b/libpod/container_internal.go
@@ -939,6 +939,9 @@ func (c *Container) init(ctx context.Context, retainRetries bool) error {
// With the spec complete, do an OCI create
if err := c.ociRuntime.createContainer(c, nil); err != nil {
+ if strings.Contains(err.Error(), "this version of runc doesn't work on cgroups v2") {
+ logrus.Errorf("oci runtime %q does not support CGroups V2: use system migrate to mitigate", c.ociRuntime.name)
+ }
return err
}
diff --git a/pkg/rootless/rootless.go b/pkg/rootless/rootless.go
new file mode 100644
index 000000000..7e9fe9db6
--- /dev/null
+++ b/pkg/rootless/rootless.go
@@ -0,0 +1,45 @@
+package rootless
+
+import (
+ "os"
+
+ "github.com/containers/storage"
+ "github.com/pkg/errors"
+)
+
+func TryJoinPauseProcess(pausePidPath string) (bool, int, error) {
+ if _, err := os.Stat(pausePidPath); err != nil {
+ return false, -1, nil
+ }
+
+ became, ret, err := TryJoinFromFilePaths("", false, []string{pausePidPath})
+ if err == nil {
+ return became, ret, err
+ }
+
+ // It could not join the pause process, let's lock the file before trying to delete it.
+ pidFileLock, err := storage.GetLockfile(pausePidPath)
+ if err != nil {
+ // The file was deleted by another process.
+ if os.IsNotExist(err) {
+ return false, -1, nil
+ }
+ return false, -1, errors.Wrapf(err, "error acquiring lock on %s", pausePidPath)
+ }
+
+ pidFileLock.Lock()
+ defer func() {
+ if pidFileLock.Locked() {
+ pidFileLock.Unlock()
+ }
+ }()
+
+ // Now the pause PID file is locked. Try to join once again in case it changed while it was not locked.
+ became, ret, err = TryJoinFromFilePaths("", false, []string{pausePidPath})
+ if err != nil {
+ // It is still failing. We can safely remove it.
+ os.Remove(pausePidPath)
+ return false, -1, nil
+ }
+ return became, ret, err
+}
diff --git a/pkg/rootless/rootless_linux.go b/pkg/rootless/rootless_linux.go
index 6f6239e5f..05d641383 100644
--- a/pkg/rootless/rootless_linux.go
+++ b/pkg/rootless/rootless_linux.go
@@ -566,10 +566,10 @@ func TryJoinFromFilePaths(pausePidPath string, needNewNamespace bool, paths []st
r, w := os.NewFile(uintptr(fds[0]), "read file"), os.NewFile(uintptr(fds[1]), "write file")
- defer errorhandling.CloseQuiet(w)
defer errorhandling.CloseQuiet(r)
if _, _, err := becomeRootInUserNS("", path, w); err != nil {
+ w.Close()
lastErr = err
continue
}
@@ -578,7 +578,6 @@ func TryJoinFromFilePaths(pausePidPath string, needNewNamespace bool, paths []st
return false, 0, err
}
defer func() {
- errorhandling.CloseQuiet(r)
C.reexec_in_user_namespace_wait(-1, 0)
}()
diff --git a/test/e2e/start_test.go b/test/e2e/start_test.go
index 06ab6aacd..13f14183b 100644
--- a/test/e2e/start_test.go
+++ b/test/e2e/start_test.go
@@ -110,7 +110,7 @@ var _ = Describe("Podman start", func() {
start.WaitWithDefaultTimeout()
Expect(start.ExitCode()).Should(BeNumerically(">", 0))
- Eventually(podmanTest.NumberOfContainers(), defaultWaitTimeout).Should(BeZero())
+ Eventually(podmanTest.NumberOfContainers(), defaultWaitTimeout, 3.0).Should(BeZero())
})
It("podman failed to start without --rm should NOT delete the container", func() {
@@ -122,7 +122,7 @@ var _ = Describe("Podman start", func() {
start.WaitWithDefaultTimeout()
Expect(start.ExitCode()).Should(BeNumerically(">", 0))
- Eventually(podmanTest.NumberOfContainers(), defaultWaitTimeout).Should(Equal(1))
+ Eventually(podmanTest.NumberOfContainers(), defaultWaitTimeout, 3.0).Should(Equal(1))
})
It("podman start --sig-proxy should not work without --attach", func() {
diff --git a/vendor/github.com/containers/psgo/.travis.yml b/vendor/github.com/containers/psgo/.travis.yml
index 1399d24d3..c07bb140b 100644
--- a/vendor/github.com/containers/psgo/.travis.yml
+++ b/vendor/github.com/containers/psgo/.travis.yml
@@ -14,6 +14,6 @@ before_install:
- sudo apt-get install -qq bats
script:
- - make validate || travis_terminate 1
- - make build || travis_terminate 1
- - make test || travis_terminate 1
+ - make validate
+ - make build
+ - make test
diff --git a/vendor/github.com/containers/psgo/Makefile b/vendor/github.com/containers/psgo/Makefile
index 6050b9d5b..361820784 100644
--- a/vendor/github.com/containers/psgo/Makefile
+++ b/vendor/github.com/containers/psgo/Makefile
@@ -1,4 +1,5 @@
export GO111MODULE=off
+export GOPROXY=https://proxy.golang.org
SHELL= /bin/bash
GO ?= go
@@ -9,11 +10,17 @@ PROJECT := github.com/containers/psgo
BATS_TESTS := *.bats
GO_SRC=$(shell find . -name \*.go)
+GO_BUILD=$(GO) build
+# Go module support: set `-mod=vendor` to use the vendored sources
+ifeq ($(shell go help mod >/dev/null 2>&1 && echo true), true)
+ GO_BUILD=GO111MODULE=on $(GO) build -mod=vendor
+endif
+
all: validate build
.PHONY: build
build: $(GO_SRC)
- $(GO) build -buildmode=pie -o $(BUILD_DIR)/$(NAME) $(PROJECT)/sample
+ $(GO_BUILD) -buildmode=pie -o $(BUILD_DIR)/$(NAME) $(PROJECT)/sample
.PHONY: clean
clean:
diff --git a/vendor/github.com/containers/psgo/go.mod b/vendor/github.com/containers/psgo/go.mod
index a194ec196..d9d54c5f7 100644
--- a/vendor/github.com/containers/psgo/go.mod
+++ b/vendor/github.com/containers/psgo/go.mod
@@ -6,6 +6,6 @@ require (
github.com/opencontainers/runc v0.0.0-20190425234816-dae70e8efea4
github.com/pkg/errors v0.0.0-20190227000051-27936f6d90f9
github.com/sirupsen/logrus v0.0.0-20190403091019-9b3cdde74fbe
- github.com/stretchr/testify v1.3.0
+ github.com/stretchr/testify v1.4.0
golang.org/x/sys v0.0.0-20190425145619-16072639606e
)
diff --git a/vendor/github.com/containers/psgo/go.sum b/vendor/github.com/containers/psgo/go.sum
index da6c750db..bbdd99730 100644
--- a/vendor/github.com/containers/psgo/go.sum
+++ b/vendor/github.com/containers/psgo/go.sum
@@ -16,8 +16,12 @@ github.com/stretchr/objx v0.1.1 h1:2vfRuCMp5sSVIDSqO8oNnWJq7mPa6KVP3iPIwFBuy8A=
github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
github.com/stretchr/testify v1.2.2 h1:bSDNvY7ZPG5RlJ8otE/7V6gMiyenm9RtJ7IUVIAoJ1w=
github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
-github.com/stretchr/testify v1.3.0 h1:TivCn/peBQ7UY8ooIcPgZFpTNSz0Q2U6UrFlUfqbe0Q=
-github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
+github.com/stretchr/testify v1.4.0 h1:2E4SXV/wtOkTonXsotYi4li6zVWxYlZuYNCXe9XRJyk=
+github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
golang.org/x/sys v0.0.0-20190425145619-16072639606e h1:4ktJgTV34+N3qOZUc5fAaG3Pb11qzMm3PkAoTAgUZ2I=
golang.org/x/sys v0.0.0-20190425145619-16072639606e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/yaml.v2 v2.2.2 h1:ZCJp+EgiOT7lHqUV2J862kp8Qj64Jo6az82+3Td9dZw=
+gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
diff --git a/vendor/github.com/containers/psgo/internal/cgroups/cgroups.go b/vendor/github.com/containers/psgo/internal/cgroups/cgroups.go
new file mode 100644
index 000000000..eecaf87cb
--- /dev/null
+++ b/vendor/github.com/containers/psgo/internal/cgroups/cgroups.go
@@ -0,0 +1,44 @@
+// Copyright 2019 psgo authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package cgroups
+
+import (
+ "sync"
+ "syscall"
+)
+
+const (
+ CgroupRoot = "/sys/fs/cgroup"
+ cgroup2SuperMagic = 0x63677270
+)
+
+var (
+ isUnifiedOnce sync.Once
+ isUnified bool
+ isUnifiedErr error
+)
+
+// IsCgroup2UnifiedMode returns whether we are running in cgroup or cgroupv2 mode.
+func IsCgroup2UnifiedMode() (bool, error) {
+ isUnifiedOnce.Do(func() {
+ var st syscall.Statfs_t
+ if err := syscall.Statfs(CgroupRoot, &st); err != nil {
+ isUnified, isUnifiedErr = false, err
+ } else {
+ isUnified, isUnifiedErr = st.Type == cgroup2SuperMagic, nil
+ }
+ })
+ return isUnified, isUnifiedErr
+}
diff --git a/vendor/github.com/containers/psgo/internal/proc/pids.go b/vendor/github.com/containers/psgo/internal/proc/pids.go
index ff4887364..69e8befc1 100644
--- a/vendor/github.com/containers/psgo/internal/proc/pids.go
+++ b/vendor/github.com/containers/psgo/internal/proc/pids.go
@@ -1,4 +1,4 @@
-// Copyright 2018 psgo authors
+// Copyright 2018-2019 psgo authors
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
@@ -18,8 +18,11 @@ import (
"bufio"
"fmt"
"os"
+ "path/filepath"
"strconv"
"strings"
+
+ "github.com/containers/psgo/internal/cgroups"
)
// GetPIDs extracts and returns all PIDs from /proc.
@@ -49,45 +52,98 @@ func GetPIDs() ([]string, error) {
return pids, nil
}
-// pidCgroupPath returns the path to the pid's pids cgroup.
-func pidCgroupPath(pid string) (string, error) {
+// GetPIDsFromCgroup returns a strings slice of all pids listesd in pid's pids
+// cgroup. It automatically detects if we're running in unified mode or not.
+func GetPIDsFromCgroup(pid string) ([]string, error) {
+ unified, err := cgroups.IsCgroup2UnifiedMode()
+ if err != nil {
+ return nil, err
+ }
+ if unified {
+ return getPIDsFromCgroupV2(pid)
+ }
+ return getPIDsFromCgroupV1(pid)
+}
+
+// getPIDsFromCgroupV1 returns a strings slice of all pids listesd in pid's pids
+// cgroup.
+func getPIDsFromCgroupV1(pid string) ([]string, error) {
+ // First, find the corresponding path to the PID cgroup.
f, err := os.Open(fmt.Sprintf("/proc/%s/cgroup", pid))
if err != nil {
- return "", err
+ return nil, err
}
defer f.Close()
scanner := bufio.NewScanner(f)
+ cgroupPath := ""
for scanner.Scan() {
fields := strings.Split(scanner.Text(), ":")
if len(fields) != 3 {
continue
}
if fields[1] == "pids" {
- return fmt.Sprintf("/sys/fs/cgroup/pids/%s/cgroup.procs", fields[2]), nil
+ cgroupPath = fmt.Sprintf("/sys/fs/cgroup/pids/%s/cgroup.procs", fields[2])
}
}
- return "", fmt.Errorf("couldn't find pids group for PID %s", pid)
+
+ if cgroupPath == "" {
+ return nil, fmt.Errorf("couldn't find v1 pids group for PID %s", pid)
+ }
+
+ // Second, extract the PIDs inside the cgroup.
+ f, err = os.Open(cgroupPath)
+ if err != nil {
+ return nil, err
+ }
+ defer f.Close()
+
+ pids := []string{}
+ scanner = bufio.NewScanner(f)
+ for scanner.Scan() {
+ pids = append(pids, scanner.Text())
+ }
+
+ return pids, nil
}
-// GetPIDsFromCgroup returns a strings slice of all pids listesd in pid's pids
+// getPIDsFromCgroupV2 returns a strings slice of all pids listesd in pid's pids
// cgroup.
-func GetPIDsFromCgroup(pid string) ([]string, error) {
- cgroupPath, err := pidCgroupPath(pid)
+func getPIDsFromCgroupV2(pid string) ([]string, error) {
+ // First, find the corresponding path to the PID cgroup.
+ f, err := os.Open(fmt.Sprintf("/proc/%s/cgroup", pid))
if err != nil {
return nil, err
}
+ defer f.Close()
+
+ scanner := bufio.NewScanner(f)
+ cgroupSlice := ""
+ for scanner.Scan() {
+ fields := strings.Split(scanner.Text(), ":")
+ if len(fields) != 3 {
+ continue
+ }
+ cgroupSlice = fields[2]
+ break
+ }
+
+ if cgroupSlice == "" {
+ return nil, fmt.Errorf("couldn't find v2 pids group for PID %s", pid)
+ }
- f, err := os.Open(cgroupPath)
+ // Second, extract the PIDs inside the cgroup.
+ f, err = os.Open(filepath.Join(cgroups.CgroupRoot, cgroupSlice, "cgroup.procs"))
if err != nil {
return nil, err
}
defer f.Close()
pids := []string{}
- scanner := bufio.NewScanner(f)
+ scanner = bufio.NewScanner(f)
for scanner.Scan() {
pids = append(pids, scanner.Text())
}
+
return pids, nil
}
diff --git a/vendor/modules.txt b/vendor/modules.txt
index c01409444..c422598fb 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -108,12 +108,13 @@ github.com/containers/image/v4/pkg/blobinfocache/memory
github.com/containers/image/v4/pkg/blobinfocache/internal/prioritize
# github.com/containers/libtrust v0.0.0-20190913040956-14b96171aa3b
github.com/containers/libtrust
-# github.com/containers/psgo v1.3.1
+# github.com/containers/psgo v1.3.2
github.com/containers/psgo
github.com/containers/psgo/internal/capabilities
github.com/containers/psgo/internal/dev
github.com/containers/psgo/internal/proc
github.com/containers/psgo/internal/process
+github.com/containers/psgo/internal/cgroups
github.com/containers/psgo/internal/host
# github.com/containers/storage v1.13.4
github.com/containers/storage
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-01-10 14:03:24 +0000