mirror of
https://github.com/containers/youki
synced 2024-05-23 07:56:07 +02:00
Compare commits
2 Commits
1b01e62449
...
70aea8b012
Author | SHA1 | Date | |
---|---|---|---|
Danni Xia | 70aea8b012 | ||
Vanient | f16612fc2c |
|
@ -48,6 +48,8 @@ pub(super) struct ContainerBuilderImpl {
|
|||
pub detached: bool,
|
||||
/// Default executes the specified execution of a generic command
|
||||
pub executor: Box<dyn Executor>,
|
||||
/// If do not use pivot root to jail process inside rootfs
|
||||
pub no_pivot: bool,
|
||||
}
|
||||
|
||||
impl ContainerBuilderImpl {
|
||||
|
@ -153,6 +155,7 @@ impl ContainerBuilderImpl {
|
|||
cgroup_config,
|
||||
detached: self.detached,
|
||||
executor: self.executor.clone(),
|
||||
no_pivot: self.no_pivot,
|
||||
};
|
||||
|
||||
let (init_pid, need_to_clean_up_intel_rdt_dir) =
|
||||
|
|
|
@ -26,6 +26,7 @@ pub struct InitContainerBuilder {
|
|||
bundle: PathBuf,
|
||||
use_systemd: bool,
|
||||
detached: bool,
|
||||
no_pivot: bool,
|
||||
}
|
||||
|
||||
impl InitContainerBuilder {
|
||||
|
@ -37,6 +38,7 @@ impl InitContainerBuilder {
|
|||
bundle,
|
||||
use_systemd: true,
|
||||
detached: true,
|
||||
no_pivot: false,
|
||||
}
|
||||
}
|
||||
|
||||
|
@ -51,6 +53,11 @@ impl InitContainerBuilder {
|
|||
self
|
||||
}
|
||||
|
||||
pub fn with_no_pivot(mut self, no_pivot: bool) -> Self {
|
||||
self.no_pivot = no_pivot;
|
||||
self
|
||||
}
|
||||
|
||||
/// Creates a new container
|
||||
pub fn build(self) -> Result<Container, LibcontainerError> {
|
||||
let spec = self.load_spec()?;
|
||||
|
@ -109,6 +116,7 @@ impl InitContainerBuilder {
|
|||
preserve_fds: self.base.preserve_fds,
|
||||
detached: self.detached,
|
||||
executor: self.base.executor,
|
||||
no_pivot: self.no_pivot,
|
||||
};
|
||||
|
||||
builder_impl.create()?;
|
||||
|
|
|
@ -141,6 +141,7 @@ impl TenantContainerBuilder {
|
|||
preserve_fds: self.base.preserve_fds,
|
||||
detached: self.detached,
|
||||
executor: self.base.executor,
|
||||
no_pivot: false,
|
||||
};
|
||||
|
||||
let pid = builder_impl.create()?;
|
||||
|
|
|
@ -41,4 +41,6 @@ pub struct ContainerArgs {
|
|||
pub detached: bool,
|
||||
/// Manage the functions that actually run on the container
|
||||
pub executor: Box<dyn Executor>,
|
||||
/// If do not use pivot root to jail process inside rootfs
|
||||
pub no_pivot: bool,
|
||||
}
|
||||
|
|
|
@ -342,7 +342,7 @@ pub fn container_init_process(
|
|||
// we use pivot_root, but if we are on the host mount namespace, we will
|
||||
// use simple chroot. Scary things will happen if you try to pivot_root
|
||||
// in the host mount namespace...
|
||||
if namespaces.get(LinuxNamespaceType::Mount)?.is_some() {
|
||||
if namespaces.get(LinuxNamespaceType::Mount)?.is_some() && !args.no_pivot {
|
||||
// change the root of filesystem of the process to the rootfs
|
||||
syscall.pivot_rootfs(rootfs_path).map_err(|err| {
|
||||
tracing::error!(?err, ?rootfs_path, "failed to pivot root");
|
||||
|
|
|
@ -23,6 +23,7 @@ pub fn create(args: Create, root_path: PathBuf, systemd_cgroup: bool) -> Result<
|
|||
.as_init(&args.bundle)
|
||||
.with_systemd(systemd_cgroup)
|
||||
.with_detach(true)
|
||||
.with_no_pivot(args.no_pivot)
|
||||
.build()?;
|
||||
|
||||
Ok(())
|
||||
|
|
|
@ -25,6 +25,7 @@ pub fn run(args: Run, root_path: PathBuf, systemd_cgroup: bool) -> Result<i32> {
|
|||
.as_init(&args.bundle)
|
||||
.with_systemd(systemd_cgroup)
|
||||
.with_detach(args.detach)
|
||||
.with_no_pivot(args.no_pivot)
|
||||
.build()?;
|
||||
|
||||
container
|
||||
|
|
Loading…
Reference in New Issue