Join mount namespace of another container

Start with libcontainer/rootfs_linux.go, especially prepareRoot(), and compare the reported namespace configurations with the runtime-spec root requirement. Reproduce the mount-namespace attempts and their errors; done means establishing whether runc can support this configuration and defining the required behavior or specification change.

Hi,

I'm trying to use runc to launch a container (my-container2) which joins the mount namespace of another running container (my-container1). Below is a (pretty long) description of the different configurations I've tried, and the errors I've hit.

• my-container1 is a bundle with config.json generated with runc spec and a busybox rootfs.
• my-container2 is another bundle with a minimal config, pointing to the mount namespace and rootfs of my-container1, as in the following config:

{
    "ociVersion": "1.0.0",
    "process": {
        "terminal": false,
        "user": {
            "uid": 0, "gid": 0
        },
        "args": [
            "sleep", "1h"
        ],
        "cwd": "/"
    },
    "root": {
        "path": "/home/zvic/Temp/oci/my-container1/rootfs"
    },
    "linux": {
        "namespaces": [
            {
                "type": "pid"
            },
            {
                "type": "network"
            },
            {
                "type": "ipc"
            },
            {
                "type": "uts"
            },
            {
                "type": "mount",
                "path": "/proc/9830/ns/mnt"
            }
        ]
    }
}

While my-container1 is running, I try to launch my-container2:

zvic@zvic-vbox:~/Temp/oci$ sudo ./runc run -d --bundle=my-container2 my-container2
container_linux.go:265: starting container process caused "process_linux.go:348: container init caused \"rootfs_linux.go:45: preparing rootfs caused \\\"open /proc/self/mountinfo: no such file or directory\\\"\""

I then modify my-container2 to also join the PID namespace of my-container1:

{
    "type": "pid",
    "path": "/proc/9830/ns/pid"
}

And try to launch again:

zvic@zvic-vbox:~/Temp/oci$ sudo ./runc run -d --bundle=my-container2 my-container2
container_linux.go:265: starting container process caused "process_linux.go:348: container init caused \"rootfs_linux.go:45: preparing rootfs caused \\\"no such file or directory\\\"\""

Adding some debug printing to runc, it appears that the "no such file or directory" error originates from prepareRoot(), while trying to bind-mount the rootfs:

func prepareRoot(config *configs.Config) error {
    ...
    return unix.Mount(config.Rootfs, config.Rootfs, "bind", unix.MS_BIND|unix.MS_REC, "")
}

I've also tried modifying root.path to "../my-container1/rootfs" (relative path) or to "" (empty), but got the exact same error.

I then tried setting root.path to "/", and the error became:

zvic@zvic-vbox:~/Temp/oci$ sudo ./runc run -d --bundle=my-container2 my-container2
container_linux.go:265: starting container process caused "process_linux.go:348: container init caused \"rootfs_linux.go:105: jailing process inside rootfs caused \\\"pivot_root device or resource busy\\\"\""

Adding the --no-pivot flag caused this:

zvic@zvic-vbox:~/Temp/oci$ sudo ./runc run -d --no-pivot --bundle=my-container2 my-container2
container_linux.go:265: starting container process caused "process_linux.go:348: container init caused \"rootfs_linux.go:105: jailing process inside rootfs caused \\\"too many levels of symbolic links\\\"\""

On a last and desperate attempt, I simply omitted root from the config.json of my-container2, and no-surprisingly, got the following error:

zvic@zvic-vbox:~/Temp/oci$ sudo ./runc run -d --bundle=my-container2 my-container2
Root must be specified

This is indeed seems to be forbidden by the runtime-spec, but actually is the configuration that most accurately describes the semantics I'm after (that is, joining a mount namespace in which the rootfs is already set up).