summaryrefslogtreecommitdiffhomepage
path: root/runsc/boot
diff options
context:
space:
mode:
Diffstat (limited to 'runsc/boot')
-rw-r--r--runsc/boot/controller.go12
-rw-r--r--runsc/boot/fds.go13
-rw-r--r--runsc/boot/fs.go12
-rw-r--r--runsc/boot/loader.go18
4 files changed, 22 insertions, 33 deletions
diff --git a/runsc/boot/controller.go b/runsc/boot/controller.go
index dc9359092..f5b0d371c 100644
--- a/runsc/boot/controller.go
+++ b/runsc/boot/controller.go
@@ -186,10 +186,8 @@ type StartArgs struct {
// CID is the ID of the container to start.
CID string
- // FilePayload contains, in order:
- // * stdin, stdout, and stderr.
- // * the file descriptor over which the sandbox will
- // request files from its root filesystem.
+ // FilePayload contains the file descriptor over which the sandbox will
+ // request files from its root filesystem.
urpc.FilePayload
}
@@ -217,8 +215,8 @@ func (cm *containerManager) Start(args *StartArgs, _ *struct{}) error {
if path.Clean(args.CID) != args.CID {
return fmt.Errorf("container ID shouldn't contain directory traversals such as \"..\": %q", args.CID)
}
- if len(args.FilePayload.Files) < 4 {
- return fmt.Errorf("start arguments must contain stdin, stderr, and stdout followed by at least one file for the container root gofer")
+ if len(args.FilePayload.Files) == 0 {
+ return fmt.Errorf("start arguments must contain at least one file for the container root")
}
err := cm.l.startContainer(cm.l.k, args.Spec, args.Conf, args.CID, args.FilePayload.Files)
@@ -320,7 +318,7 @@ func (cm *containerManager) Restore(o *RestoreOpts, _ *struct{}) error {
cm.l.k = k
// Set up the restore environment.
- fds := &fdDispenser{fds: cm.l.goferFDs}
+ fds := &fdDispenser{fds: cm.l.ioFDs}
renv, err := createRestoreEnvironment(cm.l.spec, cm.l.conf, fds)
if err != nil {
return fmt.Errorf("error creating RestoreEnvironment: %v", err)
diff --git a/runsc/boot/fds.go b/runsc/boot/fds.go
index 91c698fea..9de5a78b1 100644
--- a/runsc/boot/fds.go
+++ b/runsc/boot/fds.go
@@ -16,6 +16,7 @@ package boot
import (
"fmt"
+ "syscall"
"gvisor.googlesource.com/gvisor/pkg/sentry/context"
"gvisor.googlesource.com/gvisor/pkg/sentry/fs"
@@ -27,19 +28,15 @@ import (
// createFDMap creates an fd map that contains stdin, stdout, and stderr. If
// console is true, then ioctl calls will be passed through to the host fd.
-func createFDMap(ctx context.Context, k *kernel.Kernel, l *limits.LimitSet, console bool, stdioFDs []int) (*kernel.FDMap, error) {
- if len(stdioFDs) != 3 {
- return nil, fmt.Errorf("stdioFDs should contain exactly 3 FDs (stdin, stdout, and stderr), but %d FDs received", len(stdioFDs))
- }
-
+func createFDMap(ctx context.Context, k *kernel.Kernel, l *limits.LimitSet, console bool) (*kernel.FDMap, error) {
fdm := k.NewFDMap()
defer fdm.DecRef()
// Maps sandbox fd to host fd.
fdMap := map[int]int{
- 0: stdioFDs[0],
- 1: stdioFDs[1],
- 2: stdioFDs[2],
+ 0: syscall.Stdin,
+ 1: syscall.Stdout,
+ 2: syscall.Stderr,
}
mounter := fs.FileOwnerFromContext(ctx)
diff --git a/runsc/boot/fs.go b/runsc/boot/fs.go
index 45843fe7b..5ec9a7d03 100644
--- a/runsc/boot/fs.go
+++ b/runsc/boot/fs.go
@@ -82,7 +82,7 @@ func (f *fdDispenser) empty() bool {
// createMountNamespace creates a mount namespace containing the root filesystem
// and all mounts. 'rootCtx' is used to walk directories to find mount points.
-func createMountNamespace(userCtx context.Context, rootCtx context.Context, spec *specs.Spec, conf *Config, goferFDs []int) (*fs.MountNamespace, error) {
+func createMountNamespace(userCtx context.Context, rootCtx context.Context, spec *specs.Spec, conf *Config, ioFDs []int) (*fs.MountNamespace, error) {
mounts := compileMounts(spec)
// Create a tmpfs mount where we create and mount a root filesystem for
// each child container.
@@ -90,7 +90,7 @@ func createMountNamespace(userCtx context.Context, rootCtx context.Context, spec
Type: tmpfs,
Destination: childContainersDir,
})
- fds := &fdDispenser{fds: goferFDs}
+ fds := &fdDispenser{fds: ioFDs}
rootInode, err := createRootMount(rootCtx, spec, conf, fds, mounts)
if err != nil {
return nil, fmt.Errorf("failed to create root mount: %v", err)
@@ -595,13 +595,13 @@ func subtargets(root string, mnts []specs.Mount) []string {
// setFileSystemForProcess is used to set up the file system and amend the procArgs accordingly.
// procArgs are passed by reference and the FDMap field is modified.
-func setFileSystemForProcess(procArgs *kernel.CreateProcessArgs, spec *specs.Spec, conf *Config, stdioFDs, goferFDs []int, console bool, creds *auth.Credentials, ls *limits.LimitSet, k *kernel.Kernel, cid string) error {
+func setFileSystemForProcess(procArgs *kernel.CreateProcessArgs, spec *specs.Spec, conf *Config, ioFDs []int, console bool, creds *auth.Credentials, ls *limits.LimitSet, k *kernel.Kernel, cid string) error {
ctx := procArgs.NewContext(k)
// Create the FD map, which will set stdin, stdout, and stderr. If
// console is true, then ioctl calls will be passed through to the host
// fd.
- fdm, err := createFDMap(ctx, k, ls, console, stdioFDs)
+ fdm, err := createFDMap(ctx, k, ls, console)
if err != nil {
return fmt.Errorf("error importing fds: %v", err)
}
@@ -625,7 +625,7 @@ func setFileSystemForProcess(procArgs *kernel.CreateProcessArgs, spec *specs.Spe
mns := k.RootMountNamespace()
if mns == nil {
// Create the virtual filesystem.
- mns, err := createMountNamespace(ctx, rootCtx, spec, conf, goferFDs)
+ mns, err := createMountNamespace(ctx, rootCtx, spec, conf, ioFDs)
if err != nil {
return fmt.Errorf("error creating mounts: %v", err)
}
@@ -637,7 +637,7 @@ func setFileSystemForProcess(procArgs *kernel.CreateProcessArgs, spec *specs.Spe
// Create the container's root filesystem mount.
log.Infof("Creating new process in child container.")
- fds := &fdDispenser{fds: append([]int{}, goferFDs...)}
+ fds := &fdDispenser{fds: append([]int{}, ioFDs...)}
rootInode, err := createRootMount(rootCtx, spec, conf, fds, nil)
if err != nil {
return fmt.Errorf("error creating filesystem for container: %v", err)
diff --git a/runsc/boot/loader.go b/runsc/boot/loader.go
index faaf3e800..623d04171 100644
--- a/runsc/boot/loader.go
+++ b/runsc/boot/loader.go
@@ -79,11 +79,8 @@ type Loader struct {
watchdog *watchdog.Watchdog
- // stdioFDs contains stdin, stdout, and stderr.
- stdioFDs []int
-
- // goferFDs are the FDs that attach the sandbox to the gofers.
- goferFDs []int
+ // ioFDs are the FDs that attach the sandbox to the gofers.
+ ioFDs []int
// spec is the base configuration for the root container.
spec *specs.Spec
@@ -143,7 +140,7 @@ func init() {
// New initializes a new kernel loader configured by spec.
// New also handles setting up a kernel for restoring a container.
-func New(spec *specs.Spec, conf *Config, controllerFD, deviceFD int, goferFDs []int, console bool) (*Loader, error) {
+func New(spec *specs.Spec, conf *Config, controllerFD, deviceFD int, ioFDs []int, console bool) (*Loader, error) {
if err := usage.Init(); err != nil {
return nil, fmt.Errorf("Error setting up memory usage: %v", err)
}
@@ -277,8 +274,7 @@ func New(spec *specs.Spec, conf *Config, controllerFD, deviceFD int, goferFDs []
conf: conf,
console: console,
watchdog: watchdog,
- stdioFDs: []int{syscall.Stdin, syscall.Stdout, syscall.Stderr},
- goferFDs: goferFDs,
+ ioFDs: ioFDs,
spec: spec,
startSignalForwarding: startSignalForwarding,
rootProcArgs: procArgs,
@@ -390,8 +386,7 @@ func (l *Loader) run() error {
&l.rootProcArgs,
l.spec,
l.conf,
- l.stdioFDs,
- l.goferFDs,
+ l.ioFDs,
l.console,
l.rootProcArgs.Credentials,
l.rootProcArgs.Limits,
@@ -479,8 +474,7 @@ func (l *Loader) startContainer(k *kernel.Kernel, spec *specs.Spec, conf *Config
&procArgs,
spec,
conf,
- ioFDs[:3], // stdioFDs
- ioFDs[3:], // goferFDs
+ ioFDs,
false,
creds,
procArgs.Limits,
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-23 22:20:33 +0000