opencontainers / opencontainers/runc

Some namespace path joining errors together with user ns

Open
#4,138 3 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Go
Stars
13.5k
Forks
2.3k
Avg merge
2d 8h
Merged PRs (30d)
30

Description

For example, we have started a container named test, and the init process' id is 14821.

  1. [ipc] joining container test's ipc namespace together with user ns:
                "uidMappings": [{
                        "containerID": 0,
                        "hostID": 1000,
                        "size": 2000
                }],
                "gidMappings": [{
                        "containerID": 0,
                        "hostID": 1000,
                        "size": 2000
                }],
                "namespaces": [
                        {
                                "type": "ipc",
                                "path": "/proc/14821/ns/ipc"
                        },
                        {
                                "type": "user"
                        }
                ],

The result will be:

@lifubang ➜ ~/nstest $ sudo /workspaces/runc/runc run -d ipc
ERRO[0000] runc run failed: unable to start container process: error during container init: error mounting "mqueue" to rootfs at "/dev/mqueue": mount src=mqueue, dst=/dev/mqueue, dstFD=/proc/self/fd/8, flags=0xe: operation not permitted
  1. I think joining the existing pid, net, and uts namespace path will have the same issue like ipc.

I don't know whether we should support this feature or not?

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce the reported runc run -d ipc case using the shown user ID mappings and IPC namespace path, then compare it with joining the PID, network, and UTS namespace paths. Inspect the namespace setup and /dev/mqueue mount handling; done requires a decided and tested behavior for these namespace combinations.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, linux
Domain
operating-systems
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.