containers
/
podman
mirror of https://github.com/containers/podman.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #8869 from giuseppe/make-rundir-accessible 

systemd: make rundir always accessible
This commit is contained in:
OpenShift Merge Robot 2021-01-04 12:22:52 -05:00 committed by GitHub
parent f261bfc549 8c6bbfbc42
commit 6a1fbe7a56
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 26 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
libpod/oci_conmon_linux.go
View File

@ -193,6 +193,11 @@ func hasCurrentUserMapped(ctr *Container) bool {
// CreateContainer creates a container.
func (r *ConmonOCIRuntime) CreateContainer(ctr *Container, restoreOptions *ContainerCheckpointOptions) error {
// always make the run dir accessible to the current user so that the PID files can be read without
// being in the rootless user namespace.
if err := makeAccessible(ctr.state.RunDir, 0, 0); err != nil {
return err
}
if !hasCurrentUserMapped(ctr) {
for _, i := range []string{ctr.state.RunDir, ctr.runtime.config.Engine.TmpDir, ctr.config.StaticDir, ctr.state.Mountpoint, ctr.runtime.config.Engine.VolumePath} {
if err := makeAccessible(i, ctr.RootUID(), ctr.RootGID()); err != nil {

27
test/e2e/systemd_test.go
View File

@ -13,10 +13,10 @@ import (
var _ = Describe("Podman systemd", func() {
var (
tempdir string
err error
podmanTest *PodmanTestIntegration
systemd_unit_file string
tempdir string
err error
podmanTest *PodmanTestIntegration
systemdUnitFile string
)
BeforeEach(func() {
@ -27,7 +27,7 @@ var _ = Describe("Podman systemd", func() {
podmanTest = PodmanTestCreate(tempdir)
podmanTest.Setup()
podmanTest.SeedImages()
systemd_unit_file = `[Unit]
systemdUnitFile = `[Unit]
Description=redis container
[Service]
Restart=always
@ -50,7 +50,7 @@ WantedBy=multi-user.target
SkipIfRootless("rootless can not write to /etc")
SkipIfContainerized("test does not have systemd as pid 1")
sys_file := ioutil.WriteFile("/etc/systemd/system/redis.service", []byte(systemd_unit_file), 0644)
sys_file := ioutil.WriteFile("/etc/systemd/system/redis.service", []byte(systemdUnitFile), 0644)
Expect(sys_file).To(BeNil())
defer func() {
stop := SystemExec("bash", []string{"-c", "systemctl stop redis"})
@ -131,6 +131,21 @@ WantedBy=multi-user.target
Expect(conData[0].Config.SystemdMode).To(BeTrue())
})
It("podman create container with --uidmap and conmon PidFile accessible", func() {
ctrName := "testCtrUidMap"
run := podmanTest.Podman([]string{"run", "-d", "--uidmap=0:1:1000", "--name", ctrName, ALPINE, "top"})
run.WaitWithDefaultTimeout()
Expect(run.ExitCode()).To(Equal(0))
session := podmanTest.Podman([]string{"inspect", "--format", "{{.ConmonPidFile}}", ctrName})
session.WaitWithDefaultTimeout()
Expect(session.ExitCode()).To(Equal(0))
pidFile := strings.TrimSuffix(session.OutputToString(), "\n")
_, err := ioutil.ReadFile(pidFile)
Expect(err).To(BeNil())
})
It("podman create container with systemd=always triggers systemd mode", func() {
ctrName := "testCtr"
run := podmanTest.Podman([]string{"create", "--name", ctrName, "--systemd", "always", ALPINE})