diff options
| author | Fabricio Voznika <fvoznika@google.com> | 2018-10-18 12:41:07 -0700 |
|---|---|---|
| committer | Shentubot <shentubot@google.com> | 2018-10-18 12:42:24 -0700 |
| commit | f3ffa4db525ea1a1d36307ea9593ed7b5e014ca7 (patch) | |
| tree | e490c99350392544e21abb8953fe3c656a676221 /runsc/sandbox | |
| parent | 2a697791d1a473c76973f135f3af9240a32ad668 (diff) | |
Resolve mount paths while setting up root fs mount
It's hard to resolve symlinks inside the sandbox because rootfs and mounts
may be read-only, forcing us to create mount points inside lower layer of an
overlay, **before** the volumes are mounted.
Since the destination must already be resolved outside the sandbox when creating
mounts, take this opportunity to rewrite the spec with paths resolved.
"runsc boot" will use the "resolved" spec to load mounts. In addition, symlink
traversals were disabled while mounting containers inside the sandbox.
It haven't been able to write a good test for it. So I'm relying on manual tests
for now.
PiperOrigin-RevId: 217749904
Change-Id: I7ac434d5befd230db1488446cda03300cc0751a9
Diffstat (limited to 'runsc/sandbox')
| -rw-r--r-- | runsc/sandbox/sandbox.go | 7 |
1 files changed, 2 insertions, 5 deletions
diff --git a/runsc/sandbox/sandbox.go b/runsc/sandbox/sandbox.go index 6dc8cf7f0..923a52f7f 100644 --- a/runsc/sandbox/sandbox.go +++ b/runsc/sandbox/sandbox.go @@ -321,12 +321,9 @@ func (s *Sandbox) createSandboxProcess(spec *specs.Spec, conf *boot.Config, bund nextFD++ // Open the spec file to donate to the sandbox. - if conf.SpecFile == "" { - return fmt.Errorf("conf.SpecFile must be set") - } - specFile, err := os.Open(conf.SpecFile) + specFile, err := specutils.OpenCleanSpec(bundleDir) if err != nil { - return fmt.Errorf("error opening spec file %q: %v", conf.SpecFile, err) + return fmt.Errorf("opening spec file: %v", err) } defer specFile.Close() cmd.ExtraFiles = append(cmd.ExtraFiles, specFile) |