summaryrefslogtreecommitdiffhomepage
path: root/runsc/specutils
AgeCommit message (Collapse)Author
2020-11-05Merge release-20201030.0-32-gc47f8afe2 (automated)gVisor bot
2020-11-05Fix failure setting OOM score adjustmentFabricio Voznika
When OOM score adjustment needs to be set, all the containers need to be loaded to find all containers that belong to the sandbox. However, each load signals the container to ensure it is still alive. OOM score adjustment is set during creation and deletion of every container, generating a flood of signals to all containers. The fix removes the signal check when it's not needed. There is also a race fetching OOM score adjustment value from the parent when the sandbox exits at the same time (the time it took to signal containers above made this window quite large). The fix is to store the original value in the sandbox state file and use it when the value needs to be restored. Also add more logging and made the existing ones more consistent to help with debugging. PiperOrigin-RevId: 340940799
2020-11-03Merge release-20201027.0-63-g1cfa8d58f (automated)gVisor bot
2020-11-03Fix more nogo testsTing-Yu Wang
PiperOrigin-RevId: 340536306
2020-10-28Merge release-20201019.0-72-g013d79d8e (automated)gVisor bot
2020-10-27Merge pull request #4420 from workato:dev-optionsgVisor bot
PiperOrigin-RevId: 339363816
2020-10-26Allow overriding mount options for /dev and /dev/ptsKonstantin Baranov
This is useful to optionally set /dev ro,noexec. Treat /dev and /dev/pts the same as /proc and /sys. Make sure the Type is right though. Many config.json snippets on the Internet suggest /dev is tmpfs, not devtmpfs.
2020-10-24Merge release-20201019.0-52-g3ed8ace87 (automated)gVisor bot
2020-10-23Fix nogo errors in specutilsFabricio Voznika
PiperOrigin-RevId: 338780793
2020-09-25fix seccomp test for ARM64Howard Zhang
As open syscall is not support on ARM64, change syscall from 'open' to 'openat' in no_match_name_allow Signed-off-by: Howard Zhang <howard.zhang@arm.com>
2020-09-16Merge release-20200907.0-56-gdcd532e2e (automated)gVisor bot
2020-09-15Add support for OCI seccomp filters in the sandbox.Ian Lewis
OCI configuration includes support for specifying seccomp filters. In runc, these filter configurations are converted into seccomp BPF programs and loaded into the kernel via libseccomp. runsc needs to be a static binary so, for runsc, we cannot rely on a C library and need to implement the functionality in Go. The generator added here implements basic support for taking OCI seccomp configuration and converting it into a seccomp BPF program with the same behavior as a program generated by libseccomp. - New conditional operations were added to pkg/seccomp to support operations available in OCI. - AllowAny and AllowValue were renamed to MatchAny and EqualTo to better reflect that syscalls matching the conditionals result in the provided action not simply SCMP_RET_ALLOW. - BuildProgram in pkg/seccomp no longer panics if provided an empty list of rules. It now builds a program with the architecture sanity check only. - ProgramBuilder now allows adding labels that are unused. However, backwards jumps are still not permitted. Fixes #510 PiperOrigin-RevId: 331938697
2020-09-01Merge release-20200818.0-99-g71589b7f7 (automated)gVisor bot
2020-09-01Let flags be overriden from OCI annotationsFabricio Voznika
This allows runsc flags to be set per sandbox instance. For example, K8s pod annotations can be used to enable --debug for a single pod, making troubleshoot much easier. Similarly, features like --vfs2 can be enabled for experimentation without affecting other pods in the node. Closes #3494 PiperOrigin-RevId: 329542815
2020-07-13Merge pull request #2672 from amscanne:shim-integratedgVisor bot
PiperOrigin-RevId: 321053634
2020-06-16Merge release-20200608.0-64-gbae147560 (automated)gVisor bot
2020-06-16Print spec as json when --debug is enabledFabricio Voznika
The previous format skipped many important structs that are pointers, especially for cgroups. Change to print as json, removing parts of the spec that are not relevant. Also removed debug message from gofer that can be very noisy when directories are large. PiperOrigin-RevId: 316713267
2020-06-02Merge release-20200522.0-58-gca5912d1 (automated)gVisor bot
2020-06-01More runsc changes for VFS2Fabricio Voznika
- Add /tmp handling - Apply mount options - Enable more container_test tests - Forward signals to child process when test respaws process to run as root inside namespace. Updates #1487 PiperOrigin-RevId: 314263281
2020-05-28Merge release-20200522.0-25-gf7418e21 (automated)gVisor bot
2020-05-28Move Cleanup to its own packageFabricio Voznika
PiperOrigin-RevId: 313663382
2020-05-28Merge release-20200522.0-21-ga8c1b326 (automated)gVisor bot
2020-05-28Automated rollback of changelist 309082540Fabricio Voznika
PiperOrigin-RevId: 313636920
2020-05-27Merge release-20200518.0-45-g0bc022b7 (automated)gVisor bot
2020-04-29Merge release-20200413.0-22-gd5c34ba (automated)gVisor bot
2020-04-26refactor and add test for bindmountmoricho
Signed-off-by: moricho <ikeda.morito@gmail.com>
2020-04-11Merge release-20200323.0-130-gdaf3322 (automated)gVisor bot
2020-04-10Add logging message for noNewPrivileges OCI option.Ian Lewis
noNewPrivileges is ignored if set to false since gVisor assumes that PR_SET_NO_NEW_PRIVS is always enabled. PiperOrigin-RevId: 305991947
2020-04-08Merge release-20200323.0-89-g56054fc (automated)gVisor bot
2020-04-07Add friendlier messages for frequently encountered errors.Ian Lewis
Issue #2270 Issue #1765 PiperOrigin-RevId: 305385436
2020-03-12Merge release-20200219.0-157-gf2e4b5a (automated)gVisor bot
2020-03-12Kill sandbox process when parent process terminatesFabricio Voznika
When the sandbox runs in attached more, e.g. runsc do, runsc run, the sandbox lifetime is controlled by the parent process. This wasn't working in all cases because PR_GET_PDEATHSIG doesn't propagate through execve when the process changes uid/gid. So it was getting dropped when the sandbox execve's to change to user nobody. PiperOrigin-RevId: 300601247
2020-02-06Merge release-20200127.0-85-g1b6a12a (automated)gVisor bot
2020-01-27Merge release-20200115.0-103-gd29e59a (automated)gVisor bot
2020-01-27Standardize on tools directory.Adin Scannell
PiperOrigin-RevId: 291745021
2019-10-23Merge release-20190806.1-306-g6122b41 (automated)gVisor bot
2019-10-22Merge pull request #1046 from tomlanyon:criogVisor bot
PiperOrigin-RevId: 276172466
2019-10-20Add runsc OCI annotations to support CRI-O.Tom Lanyon
Obligatory https://xkcd.com/927 Fixes #626
2019-10-10Merge release-20190806.1-261-g0653391 (automated)gVisor bot
2019-10-10Update TODO for OCI seccomp support.Ian Lewis
PiperOrigin-RevId: 274042343
2019-10-01Merge release-20190806.1-220-g90e908f (automated)gVisor bot
2019-10-01Merge pull request #917 from KentaTada:fix-clone-flagsgVisor bot
PiperOrigin-RevId: 272262368
2019-10-01Merge release-20190806.1-218-g0b02c3d (automated)gVisor bot
2019-10-01Prevent CAP_NET_RAW from appearing in execFabricio Voznika
'docker exec' was getting CAP_NET_RAW even when --net-raw=false because it was not filtered out from when copying container's capabilities. PiperOrigin-RevId: 272260451
2019-09-26runsc: add the clone flag of cgroup namespaceKenta Tada
Signed-off-by: Kenta Tada <Kenta.Tada@sony.com>
2019-09-16Merge release-20190806.1-146-g010b093 (automated)gVisor bot
2019-09-16Bring back to life features lost in recent refactorFabricio Voznika
- Sandbox logs are generated when running tests - Kokoro uploads the sandbox logs - Supports multiple parallel runs - Revive script to install locally built runsc with docker PiperOrigin-RevId: 269337274
2019-09-06Merge 0bfffbcb (automated)gVisor bot
2019-09-05Ignore the root container when calculating oom_score_adj for the sandbox.Ian Lewis
This is done because the root container for CRI is the infrastructure (pause) container and always gets a low oom_score_adj. We do this to ensure that only the oom_score_adj of user containers is used to calculated the sandbox oom_score_adj. Implemented in runsc rather than the containerd shim as it's a bit cleaner to implement here (in the shim it would require overwriting the oomScoreAdj and re-writing out the config.json again). This processing is Kubernetes(CRI) specific but we are currently only supporting CRI for multi-container support anyway. PiperOrigin-RevId: 267507706
2019-08-02Merge b461be88 (automated)gVisor bot
generated by cgit v1.2.3 (git 2.39.1) at 2024-11-15 15:29:05 +0000