summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--Makefile17
-rw-r--r--cmd/rootlessport/main.go353
-rwxr-xr-xcontrib/cirrus/setup_environment.sh12
-rw-r--r--contrib/spec/podman.spec.in12
-rw-r--r--libpod/networking_slirp4netns.go10
-rw-r--r--nix/default-arm64.nix2
-rw-r--r--nix/default.nix2
-rw-r--r--pkg/rootlessport/rootlessport_linux.go347
8 files changed, 394 insertions, 361 deletions
diff --git a/Makefile b/Makefile
index 8af9cfd1b..7c8c6f1c5 100644
--- a/Makefile
+++ b/Makefile
@@ -39,6 +39,7 @@ LIBPOD_INSTANCE := libpod_dev
PREFIX ?= /usr/local
BINDIR ?= ${PREFIX}/bin
LIBEXECDIR ?= ${PREFIX}/libexec
+LIBEXECPODMAN ?= ${LIBEXECDIR}/podman
MANDIR ?= ${PREFIX}/share/man
SHAREDIR_CONTAINERS ?= ${PREFIX}/share/containers
ETCDIR ?= ${PREFIX}/etc
@@ -186,7 +187,7 @@ default: all
all: binaries docs
.PHONY: binaries
-binaries: podman podman-remote ## Build podman and podman-remote binaries
+binaries: podman podman-remote rootlessport ## Build podman, podman-remote and rootlessport binaries
# Extract text following double-# for targets, as their description for
# the `help` target. Otherwise These simple-substitutions are resolved
@@ -355,6 +356,15 @@ podman-remote-darwin: ## Build podman-remote for macOS
GOARCH=$(GOARCH) \
bin/darwin/podman
+bin/rootlessport: .gopathok $(SOURCES) go.mod go.sum
+ CGO_ENABLED=$(CGO_ENABLED) \
+ $(GO) build \
+ $(BUILDFLAGS) \
+ -o $@ ./cmd/rootlessport
+
+.PHONY: rootlessport
+rootlessport: bin/rootlessport
+
###
### Secondary binary-build targets
###
@@ -718,11 +728,14 @@ install.bin-nobuild:
install ${SELINUXOPT} -d -m 755 $(DESTDIR)$(BINDIR)
install ${SELINUXOPT} -m 755 bin/podman $(DESTDIR)$(BINDIR)/podman
test -z "${SELINUXOPT}" || chcon --verbose --reference=$(DESTDIR)$(BINDIR)/podman bin/podman
+ install ${SELINUXOPT} -d -m 755 $(DESTDIR)$(LIBEXECPODMAN)
+ install ${SELINUXOPT} -m 755 bin/rootlessport $(DESTDIR)$(LIBEXECPODMAN)/rootlessport
+ test -z "${SELINUXOPT}" || chcon --verbose --reference=$(DESTDIR)$(LIBEXECPODMAN)/rootlessport bin/rootlessport
install ${SELINUXOPT} -m 755 -d ${DESTDIR}${TMPFILESDIR}
install ${SELINUXOPT} -m 644 contrib/tmpfile/podman.conf ${DESTDIR}${TMPFILESDIR}/podman.conf
.PHONY: install.bin
-install.bin: podman install.bin-nobuild
+install.bin: podman rootlessport install.bin-nobuild
.PHONY: install.man-nobuild
install.man-nobuild:
diff --git a/cmd/rootlessport/main.go b/cmd/rootlessport/main.go
new file mode 100644
index 000000000..feb9f5c06
--- /dev/null
+++ b/cmd/rootlessport/main.go
@@ -0,0 +1,353 @@
+package main
+
+import (
+ "context"
+ "encoding/json"
+ "fmt"
+ "io"
+ "io/ioutil"
+ "net"
+ "os"
+ "os/exec"
+ "path/filepath"
+
+ "github.com/containernetworking/plugins/pkg/ns"
+ "github.com/containers/podman/v3/libpod/network/types"
+ "github.com/containers/podman/v3/pkg/rootlessport"
+ "github.com/pkg/errors"
+ rkport "github.com/rootless-containers/rootlesskit/pkg/port"
+ rkbuiltin "github.com/rootless-containers/rootlesskit/pkg/port/builtin"
+ rkportutil "github.com/rootless-containers/rootlesskit/pkg/port/portutil"
+ "github.com/sirupsen/logrus"
+ "golang.org/x/sys/unix"
+)
+
+const (
+ // ReexecChildKey is used internally for the second reexec
+ ReexecChildKey = "rootlessport-child"
+ reexecChildEnvOpaque = "_CONTAINERS_ROOTLESSPORT_CHILD_OPAQUE"
+)
+
+func main() {
+ if len(os.Args) > 1 {
+ fmt.Fprintln(os.Stderr, `too many arguments, rootlessport expects a json config via STDIN`)
+ os.Exit(1)
+ }
+ var err error
+ if os.Args[0] == ReexecChildKey {
+ err = child()
+ } else {
+ err = parent()
+ }
+ if err != nil {
+ fmt.Println(err)
+ os.Exit(1)
+ }
+}
+
+func loadConfig(r io.Reader) (*rootlessport.Config, io.ReadCloser, io.WriteCloser, error) {
+ stdin, err := ioutil.ReadAll(r)
+ if err != nil {
+ return nil, nil, nil, err
+ }
+ var cfg rootlessport.Config
+ if err := json.Unmarshal(stdin, &cfg); err != nil {
+ return nil, nil, nil, err
+ }
+ if cfg.NetNSPath == "" {
+ return nil, nil, nil, errors.New("missing NetNSPath")
+ }
+ if cfg.ExitFD <= 0 {
+ return nil, nil, nil, errors.New("missing ExitFD")
+ }
+ exitFile := os.NewFile(uintptr(cfg.ExitFD), "exitfile")
+ if exitFile == nil {
+ return nil, nil, nil, errors.New("invalid ExitFD")
+ }
+ if cfg.ReadyFD <= 0 {
+ return nil, nil, nil, errors.New("missing ReadyFD")
+ }
+ readyFile := os.NewFile(uintptr(cfg.ReadyFD), "readyfile")
+ if readyFile == nil {
+ return nil, nil, nil, errors.New("invalid ReadyFD")
+ }
+ return &cfg, exitFile, readyFile, nil
+}
+
+func parent() error {
+ // load config from stdin
+ cfg, exitR, readyW, err := loadConfig(os.Stdin)
+ if err != nil {
+ return err
+ }
+
+ socketDir := filepath.Join(cfg.TmpDir, "rp")
+ err = os.MkdirAll(socketDir, 0700)
+ if err != nil {
+ return err
+ }
+
+ // create the parent driver
+ stateDir, err := ioutil.TempDir(cfg.TmpDir, "rootlessport")
+ if err != nil {
+ return err
+ }
+ defer os.RemoveAll(stateDir)
+ driver, err := rkbuiltin.NewParentDriver(&logrusWriter{prefix: "parent: "}, stateDir)
+ if err != nil {
+ return err
+ }
+ initComplete := make(chan struct{})
+ quit := make(chan struct{})
+ errCh := make(chan error)
+ // start the parent driver. initComplete will be closed when the child connected to the parent.
+ logrus.Infof("Starting parent driver")
+ go func() {
+ driverErr := driver.RunParentDriver(initComplete, quit, nil)
+ if driverErr != nil {
+ logrus.WithError(driverErr).Warn("Parent driver exited")
+ }
+ errCh <- driverErr
+ close(errCh)
+ }()
+ opaque := driver.OpaqueForChild()
+ logrus.Infof("opaque=%+v", opaque)
+ opaqueJSON, err := json.Marshal(opaque)
+ if err != nil {
+ return err
+ }
+ childQuitR, childQuitW, err := os.Pipe()
+ if err != nil {
+ return err
+ }
+ defer func() {
+ // stop the child
+ logrus.Info("Stopping child driver")
+ if err := childQuitW.Close(); err != nil {
+ logrus.WithError(err).Warn("Unable to close childQuitW")
+ }
+ }()
+
+ // reexec the child process in the child netns
+ cmd := exec.Command("/proc/self/exe")
+ cmd.Args = []string{ReexecChildKey}
+ cmd.Stdin = childQuitR
+ cmd.Stdout = &logrusWriter{prefix: "child"}
+ cmd.Stderr = cmd.Stdout
+ cmd.Env = append(os.Environ(), reexecChildEnvOpaque+"="+string(opaqueJSON))
+ childNS, err := ns.GetNS(cfg.NetNSPath)
+ if err != nil {
+ return err
+ }
+ if err := childNS.Do(func(_ ns.NetNS) error {
+ logrus.Infof("Starting child driver in child netns (%q %v)", cmd.Path, cmd.Args)
+ return cmd.Start()
+ }); err != nil {
+ return err
+ }
+
+ childErrCh := make(chan error)
+ go func() {
+ err := cmd.Wait()
+ childErrCh <- err
+ close(childErrCh)
+ }()
+
+ defer func() {
+ if err := unix.Kill(cmd.Process.Pid, unix.SIGTERM); err != nil {
+ logrus.WithError(err).Warn("Kill child process")
+ }
+ }()
+
+ logrus.Info("Waiting for initComplete")
+ // wait for the child to connect to the parent
+outer:
+ for {
+ select {
+ case <-initComplete:
+ logrus.Infof("initComplete is closed; parent and child established the communication channel")
+ break outer
+ case err := <-childErrCh:
+ if err != nil {
+ return err
+ }
+ case err := <-errCh:
+ if err != nil {
+ return err
+ }
+ }
+ }
+
+ defer func() {
+ logrus.Info("Stopping parent driver")
+ quit <- struct{}{}
+ if err := <-errCh; err != nil {
+ logrus.WithError(err).Warn("Parent driver returned error on exit")
+ }
+ }()
+
+ // let parent expose ports
+ logrus.Infof("Exposing ports %v", cfg.Mappings)
+ if err := exposePorts(driver, cfg.Mappings, cfg.ChildIP); err != nil {
+ return err
+ }
+
+ // we only need to have a socket to reload ports when we run under rootless cni
+ if cfg.RootlessCNI {
+ socketfile := filepath.Join(socketDir, cfg.ContainerID)
+ // make sure to remove the file if it exists to prevent EADDRINUSE
+ _ = os.Remove(socketfile)
+ // workaround to bypass the 108 char socket path limit
+ // open the fd and use the path to the fd as bind argument
+ fd, err := unix.Open(socketDir, unix.O_PATH, 0)
+ if err != nil {
+ return err
+ }
+ socket, err := net.ListenUnix("unixpacket", &net.UnixAddr{Name: fmt.Sprintf("/proc/self/fd/%d/%s", fd, cfg.ContainerID), Net: "unixpacket"})
+ if err != nil {
+ return err
+ }
+ err = unix.Close(fd)
+ // remove the socket file on exit
+ defer os.Remove(socketfile)
+ if err != nil {
+ logrus.Warnf("Failed to close the socketDir fd: %v", err)
+ }
+ defer socket.Close()
+ go serve(socket, driver)
+ }
+
+ logrus.Info("Ready")
+
+ // https://github.com/containers/podman/issues/11248
+ // Copy /dev/null to stdout and stderr to prevent SIGPIPE errors
+ if f, err := os.OpenFile("/dev/null", os.O_WRONLY, 0755); err == nil {
+ unix.Dup2(int(f.Fd()), 1) // nolint:errcheck
+ unix.Dup2(int(f.Fd()), 2) // nolint:errcheck
+ f.Close()
+ }
+ // write and close ReadyFD (convention is same as slirp4netns --ready-fd)
+ if _, err := readyW.Write([]byte("1")); err != nil {
+ return err
+ }
+ if err := readyW.Close(); err != nil {
+ return err
+ }
+
+ // wait for ExitFD to be closed
+ logrus.Info("Waiting for exitfd to be closed")
+ if _, err := ioutil.ReadAll(exitR); err != nil {
+ return err
+ }
+ return nil
+}
+
+func serve(listener net.Listener, pm rkport.Manager) {
+ for {
+ conn, err := listener.Accept()
+ if err != nil {
+ // we cannot log this error, stderr is already closed
+ continue
+ }
+ ctx := context.TODO()
+ err = handler(ctx, conn, pm)
+ if err != nil {
+ conn.Write([]byte(err.Error()))
+ } else {
+ conn.Write([]byte("OK"))
+ }
+ conn.Close()
+ }
+}
+
+func handler(ctx context.Context, conn io.Reader, pm rkport.Manager) error {
+ var childIP string
+ dec := json.NewDecoder(conn)
+ err := dec.Decode(&childIP)
+ if err != nil {
+ return errors.Wrap(err, "rootless port failed to decode ports")
+ }
+ portStatus, err := pm.ListPorts(ctx)
+ if err != nil {
+ return errors.Wrap(err, "rootless port failed to list ports")
+ }
+ for _, status := range portStatus {
+ err = pm.RemovePort(ctx, status.ID)
+ if err != nil {
+ return errors.Wrap(err, "rootless port failed to remove port")
+ }
+ }
+ // add the ports with the new child IP
+ for _, status := range portStatus {
+ // set the new child IP
+ status.Spec.ChildIP = childIP
+ _, err = pm.AddPort(ctx, status.Spec)
+ if err != nil {
+ return errors.Wrap(err, "rootless port failed to add port")
+ }
+ }
+ return nil
+}
+
+func exposePorts(pm rkport.Manager, portMappings []types.OCICNIPortMapping, childIP string) error {
+ ctx := context.TODO()
+ for _, i := range portMappings {
+ hostIP := i.HostIP
+ if hostIP == "" {
+ hostIP = "0.0.0.0"
+ }
+ spec := rkport.Spec{
+ Proto: i.Protocol,
+ ParentIP: hostIP,
+ ParentPort: int(i.HostPort),
+ ChildPort: int(i.ContainerPort),
+ ChildIP: childIP,
+ }
+ if err := rkportutil.ValidatePortSpec(spec, nil); err != nil {
+ return err
+ }
+ if _, err := pm.AddPort(ctx, spec); err != nil {
+ return err
+ }
+ }
+ return nil
+}
+
+func child() error {
+ // load the config from the parent
+ var opaque map[string]string
+ if err := json.Unmarshal([]byte(os.Getenv(reexecChildEnvOpaque)), &opaque); err != nil {
+ return err
+ }
+
+ // start the child driver
+ quit := make(chan struct{})
+ errCh := make(chan error)
+ go func() {
+ d := rkbuiltin.NewChildDriver(os.Stderr)
+ dErr := d.RunChildDriver(opaque, quit)
+ errCh <- dErr
+ }()
+ defer func() {
+ logrus.Info("Stopping child driver")
+ quit <- struct{}{}
+ if err := <-errCh; err != nil {
+ logrus.WithError(err).Warn("Child driver returned error on exit")
+ }
+ }()
+
+ // wait for stdin to be closed
+ if _, err := ioutil.ReadAll(os.Stdin); err != nil {
+ return err
+ }
+ return nil
+}
+
+type logrusWriter struct {
+ prefix string
+}
+
+func (w *logrusWriter) Write(p []byte) (int, error) {
+ logrus.Infof("%s%s", w.prefix, string(p))
+ return len(p), nil
+}
diff --git a/contrib/cirrus/setup_environment.sh b/contrib/cirrus/setup_environment.sh
index f2afbfef5..3786054a7 100755
--- a/contrib/cirrus/setup_environment.sh
+++ b/contrib/cirrus/setup_environment.sh
@@ -236,9 +236,19 @@ case "$TEST_FLAVOR" in
# Use existing host bits when testing is to happen inside a container
# since this script will run again in that environment.
# shellcheck disable=SC2154
- if ((CONTAINER==0)) && [[ "$TEST_ENVIRON" == "host" ]]; then
+ if [[ "$TEST_ENVIRON" == "host" ]]; then
+ if ((CONTAINER)); then
+ die "Refusing to config. host-test in container";
+ fi
remove_packaged_podman_files
make install PREFIX=/usr ETCDIR=/etc
+ elif [[ "$TEST_ENVIRON" == "container" ]]; then
+ if ((CONTAINER)); then
+ remove_packaged_podman_files
+ make install PREFIX=/usr ETCDIR=/etc
+ fi
+ else
+ die "Invalid value for $$TEST_ENVIRON=$TEST_ENVIRON"
fi
install_test_configs
diff --git a/contrib/spec/podman.spec.in b/contrib/spec/podman.spec.in
index 3a4026038..295a953ef 100644
--- a/contrib/spec/podman.spec.in
+++ b/contrib/spec/podman.spec.in
@@ -3,18 +3,8 @@
%global with_check 0
%global with_unit_test 0
%bcond_without doc
-%bcond_without debug
-%if %{with debug}
-%global _find_debuginfo_dwz_opts %{nil}
-%global _dwz_low_mem_die_limit 0
-%else
%global debug_package %{nil}
-%endif
-
-%if ! 0%{?gobuild:1}
-%define gobuild(o:) go build -buildmode pie -compiler gc -tags="rpm_crashtraceback ${BUILDTAGS:-}" -ldflags "${LDFLAGS:-} -B 0x$(head -c20 /dev/urandom|od -An -tx1|tr -d ' \n') -extldflags '-Wl,-z,relro -Wl,--as-needed -Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld '" -a -v -x %{?**};
-%endif
# podman hack directory
%define hackdir %{_builddir}/%{repo}-%{shortcommit0}
@@ -536,6 +526,8 @@ export GOPATH=%{buildroot}/%{gopath}:$(pwd)/vendor:%{gopath}
%{_usr}/lib/systemd/user/podman-auto-update.timer
%{_usr}/lib/systemd/user/podman-restart.service
%{_usr}/lib/tmpfiles.d/podman.conf
+%dir %{_libexecdir}/%{name}
+%{_libexecdir}/%{name}/rootlessport
%if 0%{?with_devel}
%files -n libpod-devel -f devel.file-list
diff --git a/libpod/networking_slirp4netns.go b/libpod/networking_slirp4netns.go
index 46cda89a9..ffd53ec2b 100644
--- a/libpod/networking_slirp4netns.go
+++ b/libpod/networking_slirp4netns.go
@@ -484,10 +484,14 @@ func (r *Runtime) setupRootlessPortMappingViaRLK(ctr *Container, netnsPath strin
}
cfgR := bytes.NewReader(cfgJSON)
var stdout bytes.Buffer
- cmd := exec.Command(fmt.Sprintf("/proc/%d/exe", os.Getpid()))
- cmd.Args = []string{rootlessport.ReexecKey}
- // Leak one end of the pipe in rootlessport process, the other will be sent to conmon
+ path, err := r.config.FindHelperBinary(rootlessport.BinaryName, false)
+ if err != nil {
+ return err
+ }
+ cmd := exec.Command(path)
+ cmd.Args = []string{rootlessport.BinaryName}
+ // Leak one end of the pipe in rootlessport process, the other will be sent to conmon
if ctr.rootlessPortSyncR != nil {
defer errorhandling.CloseQuiet(ctr.rootlessPortSyncR)
}
diff --git a/nix/default-arm64.nix b/nix/default-arm64.nix
index 8868788ae..bb958a193 100644
--- a/nix/default-arm64.nix
+++ b/nix/default-arm64.nix
@@ -77,10 +77,12 @@ let
patchShebangs .
make bin/podman
make bin/podman-remote
+ make bin/rootlessport
'';
installPhase = ''
install -Dm755 bin/podman $out/bin/podman
install -Dm755 bin/podman-remote $out/bin/podman-remote
+ install -Dm755 bin/rootlessport $out/libexec/podman/rootlessport
'';
};
in
diff --git a/nix/default.nix b/nix/default.nix
index 4d15532c2..1dc6f92b6 100644
--- a/nix/default.nix
+++ b/nix/default.nix
@@ -75,10 +75,12 @@ let
patchShebangs .
make bin/podman
make bin/podman-remote
+ make bin/rootlessport
'';
installPhase = ''
install -Dm755 bin/podman $out/bin/podman
install -Dm755 bin/podman-remote $out/bin/podman-remote
+ install -Dm755 bin/rootlessport $out/libexec/podman/rootlessport
'';
};
in
diff --git a/pkg/rootlessport/rootlessport_linux.go b/pkg/rootlessport/rootlessport_linux.go
index 37fb7ce79..7b9e5bbfa 100644
--- a/pkg/rootlessport/rootlessport_linux.go
+++ b/pkg/rootlessport/rootlessport_linux.go
@@ -12,33 +12,12 @@
package rootlessport
import (
- "context"
- "encoding/json"
- "fmt"
- "io"
- "io/ioutil"
- "net"
- "os"
- "os/exec"
- "path/filepath"
-
- "github.com/containernetworking/plugins/pkg/ns"
"github.com/containers/podman/v3/libpod/network/types"
- "github.com/containers/storage/pkg/reexec"
- "github.com/pkg/errors"
- rkport "github.com/rootless-containers/rootlesskit/pkg/port"
- rkbuiltin "github.com/rootless-containers/rootlesskit/pkg/port/builtin"
- rkportutil "github.com/rootless-containers/rootlesskit/pkg/port/portutil"
- "github.com/sirupsen/logrus"
- "golang.org/x/sys/unix"
)
const (
- // ReexecKey is the reexec key for the parent process.
- ReexecKey = "containers-rootlessport"
- // reexecChildKey is used internally for the second reexec
- reexecChildKey = "containers-rootlessport-child"
- reexecChildEnvOpaque = "_CONTAINERS_ROOTLESSPORT_CHILD_OPAQUE"
+ // BinaryName is the binary name for the parent process.
+ BinaryName = "rootlessport"
)
// Config needs to be provided to the process via stdin as a JSON string.
@@ -53,325 +32,3 @@ type Config struct {
ContainerID string
RootlessCNI bool
}
-
-func init() {
- reexec.Register(ReexecKey, func() {
- if err := parent(); err != nil {
- fmt.Println(err)
- os.Exit(1)
- }
- })
- reexec.Register(reexecChildKey, func() {
- if err := child(); err != nil {
- fmt.Println(err)
- os.Exit(1)
- }
- })
-}
-
-func loadConfig(r io.Reader) (*Config, io.ReadCloser, io.WriteCloser, error) {
- stdin, err := ioutil.ReadAll(r)
- if err != nil {
- return nil, nil, nil, err
- }
- var cfg Config
- if err := json.Unmarshal(stdin, &cfg); err != nil {
- return nil, nil, nil, err
- }
- if cfg.NetNSPath == "" {
- return nil, nil, nil, errors.New("missing NetNSPath")
- }
- if cfg.ExitFD <= 0 {
- return nil, nil, nil, errors.New("missing ExitFD")
- }
- exitFile := os.NewFile(uintptr(cfg.ExitFD), "exitfile")
- if exitFile == nil {
- return nil, nil, nil, errors.New("invalid ExitFD")
- }
- if cfg.ReadyFD <= 0 {
- return nil, nil, nil, errors.New("missing ReadyFD")
- }
- readyFile := os.NewFile(uintptr(cfg.ReadyFD), "readyfile")
- if readyFile == nil {
- return nil, nil, nil, errors.New("invalid ReadyFD")
- }
- return &cfg, exitFile, readyFile, nil
-}
-
-func parent() error {
- // load config from stdin
- cfg, exitR, readyW, err := loadConfig(os.Stdin)
- if err != nil {
- return err
- }
-
- socketDir := filepath.Join(cfg.TmpDir, "rp")
- err = os.MkdirAll(socketDir, 0700)
- if err != nil {
- return err
- }
-
- // create the parent driver
- stateDir, err := ioutil.TempDir(cfg.TmpDir, "rootlessport")
- if err != nil {
- return err
- }
- defer os.RemoveAll(stateDir)
- driver, err := rkbuiltin.NewParentDriver(&logrusWriter{prefix: "parent: "}, stateDir)
- if err != nil {
- return err
- }
- initComplete := make(chan struct{})
- quit := make(chan struct{})
- errCh := make(chan error)
- // start the parent driver. initComplete will be closed when the child connected to the parent.
- logrus.Infof("Starting parent driver")
- go func() {
- driverErr := driver.RunParentDriver(initComplete, quit, nil)
- if driverErr != nil {
- logrus.WithError(driverErr).Warn("Parent driver exited")
- }
- errCh <- driverErr
- close(errCh)
- }()
- opaque := driver.OpaqueForChild()
- logrus.Infof("Opaque=%+v", opaque)
- opaqueJSON, err := json.Marshal(opaque)
- if err != nil {
- return err
- }
- childQuitR, childQuitW, err := os.Pipe()
- if err != nil {
- return err
- }
- defer func() {
- // stop the child
- logrus.Info("Stopping child driver")
- if err := childQuitW.Close(); err != nil {
- logrus.WithError(err).Warn("Unable to close childQuitW")
- }
- }()
-
- // reexec the child process in the child netns
- cmd := exec.Command("/proc/self/exe")
- cmd.Args = []string{reexecChildKey}
- cmd.Stdin = childQuitR
- cmd.Stdout = &logrusWriter{prefix: "child"}
- cmd.Stderr = cmd.Stdout
- cmd.Env = append(os.Environ(), reexecChildEnvOpaque+"="+string(opaqueJSON))
- childNS, err := ns.GetNS(cfg.NetNSPath)
- if err != nil {
- return err
- }
- if err := childNS.Do(func(_ ns.NetNS) error {
- logrus.Infof("Starting child driver in child netns (%q %v)", cmd.Path, cmd.Args)
- return cmd.Start()
- }); err != nil {
- return err
- }
-
- childErrCh := make(chan error)
- go func() {
- err := cmd.Wait()
- childErrCh <- err
- close(childErrCh)
- }()
-
- defer func() {
- if err := unix.Kill(cmd.Process.Pid, unix.SIGTERM); err != nil {
- logrus.WithError(err).Warn("Kill child process")
- }
- }()
-
- logrus.Info("Waiting for initComplete")
- // wait for the child to connect to the parent
-outer:
- for {
- select {
- case <-initComplete:
- logrus.Infof("initComplete is closed; parent and child established the communication channel")
- break outer
- case err := <-childErrCh:
- if err != nil {
- return err
- }
- case err := <-errCh:
- if err != nil {
- return err
- }
- }
- }
-
- defer func() {
- logrus.Info("Stopping parent driver")
- quit <- struct{}{}
- if err := <-errCh; err != nil {
- logrus.WithError(err).Warn("Parent driver returned error on exit")
- }
- }()
-
- // let parent expose ports
- logrus.Infof("Exposing ports %v", cfg.Mappings)
- if err := exposePorts(driver, cfg.Mappings, cfg.ChildIP); err != nil {
- return err
- }
-
- // we only need to have a socket to reload ports when we run under rootless cni
- if cfg.RootlessCNI {
- socketfile := filepath.Join(socketDir, cfg.ContainerID)
- // make sure to remove the file if it exists to prevent EADDRINUSE
- _ = os.Remove(socketfile)
- // workaround to bypass the 108 char socket path limit
- // open the fd and use the path to the fd as bind argument
- fd, err := unix.Open(socketDir, unix.O_PATH, 0)
- if err != nil {
- return err
- }
- socket, err := net.ListenUnix("unixpacket", &net.UnixAddr{Name: fmt.Sprintf("/proc/self/fd/%d/%s", fd, cfg.ContainerID), Net: "unixpacket"})
- if err != nil {
- return err
- }
- err = unix.Close(fd)
- // remove the socket file on exit
- defer os.Remove(socketfile)
- if err != nil {
- logrus.Warnf("Failed to close the socketDir fd: %v", err)
- }
- defer socket.Close()
- go serve(socket, driver)
- }
-
- logrus.Info("Ready")
-
- // https://github.com/containers/podman/issues/11248
- // Copy /dev/null to stdout and stderr to prevent SIGPIPE errors
- if f, err := os.OpenFile("/dev/null", os.O_WRONLY, 0755); err == nil {
- unix.Dup2(int(f.Fd()), 1) // nolint:errcheck
- unix.Dup2(int(f.Fd()), 2) // nolint:errcheck
- f.Close()
- }
- // write and close ReadyFD (convention is same as slirp4netns --ready-fd)
- if _, err := readyW.Write([]byte("1")); err != nil {
- return err
- }
- if err := readyW.Close(); err != nil {
- return err
- }
-
- // wait for ExitFD to be closed
- logrus.Info("Waiting for exitfd to be closed")
- if _, err := ioutil.ReadAll(exitR); err != nil {
- return err
- }
- return nil
-}
-
-func serve(listener net.Listener, pm rkport.Manager) {
- for {
- conn, err := listener.Accept()
- if err != nil {
- // we cannot log this error, stderr is already closed
- continue
- }
- ctx := context.TODO()
- err = handler(ctx, conn, pm)
- if err != nil {
- conn.Write([]byte(err.Error()))
- } else {
- conn.Write([]byte("OK"))
- }
- conn.Close()
- }
-}
-
-func handler(ctx context.Context, conn io.Reader, pm rkport.Manager) error {
- var childIP string
- dec := json.NewDecoder(conn)
- err := dec.Decode(&childIP)
- if err != nil {
- return errors.Wrap(err, "rootless port failed to decode ports")
- }
- portStatus, err := pm.ListPorts(ctx)
- if err != nil {
- return errors.Wrap(err, "rootless port failed to list ports")
- }
- for _, status := range portStatus {
- err = pm.RemovePort(ctx, status.ID)
- if err != nil {
- return errors.Wrap(err, "rootless port failed to remove port")
- }
- }
- // add the ports with the new child IP
- for _, status := range portStatus {
- // set the new child IP
- status.Spec.ChildIP = childIP
- _, err = pm.AddPort(ctx, status.Spec)
- if err != nil {
- return errors.Wrap(err, "rootless port failed to add port")
- }
- }
- return nil
-}
-
-func exposePorts(pm rkport.Manager, portMappings []types.OCICNIPortMapping, childIP string) error {
- ctx := context.TODO()
- for _, i := range portMappings {
- hostIP := i.HostIP
- if hostIP == "" {
- hostIP = "0.0.0.0"
- }
- spec := rkport.Spec{
- Proto: i.Protocol,
- ParentIP: hostIP,
- ParentPort: int(i.HostPort),
- ChildPort: int(i.ContainerPort),
- ChildIP: childIP,
- }
- if err := rkportutil.ValidatePortSpec(spec, nil); err != nil {
- return err
- }
- if _, err := pm.AddPort(ctx, spec); err != nil {
- return err
- }
- }
- return nil
-}
-
-func child() error {
- // load the config from the parent
- var opaque map[string]string
- if err := json.Unmarshal([]byte(os.Getenv(reexecChildEnvOpaque)), &opaque); err != nil {
- return err
- }
-
- // start the child driver
- quit := make(chan struct{})
- errCh := make(chan error)
- go func() {
- d := rkbuiltin.NewChildDriver(os.Stderr)
- dErr := d.RunChildDriver(opaque, quit)
- errCh <- dErr
- }()
- defer func() {
- logrus.Info("Stopping child driver")
- quit <- struct{}{}
- if err := <-errCh; err != nil {
- logrus.WithError(err).Warn("Child driver returned error on exit")
- }
- }()
-
- // wait for stdin to be closed
- if _, err := ioutil.ReadAll(os.Stdin); err != nil {
- return err
- }
- return nil
-}
-
-type logrusWriter struct {
- prefix string
-}
-
-func (w *logrusWriter) Write(p []byte) (int, error) {
- logrus.Infof("%s%s", w.prefix, string(p))
- return len(p), nil
-}