From 989afd910e65ef85c7db6e38decbe7153a94e698 Mon Sep 17 00:00:00 2001 From: Valentin Rothberg Date: Tue, 24 Oct 2023 09:05:41 +0200 Subject: [PATCH] vendor c/{buildah,common}: appendable containers.conf strings, Part 1 This change is the first step of integrating appendable string arrays into containers.conf and starts with enabling the `Env`, `Mounts`, and `Volumes` fields in the `[Containers]` table. Both, Buildah and Podman, read (and sometimes write) the fields of the `Config` struct at various places, so I decided to migrate the fields step-by-step. The ones in this change are most critical ones for customers. Once all string slices/arrays are migrated, the docs of containers.conf will be updated. The current changes are entirely transparent to users. Signed-off-by: Valentin Rothberg --- go.mod | 4 +- go.sum | 8 +- test/system/800-config.bats | 31 ++++ .../github.com/containers/buildah/.cirrus.yml | 2 +- .../containers/buildah/chroot/run_linux.go | 153 +++++++++++------- .../containers/buildah/chroot/seccomp.go | 2 + .../buildah/chroot/seccomp_freebsd.go | 2 + .../buildah/chroot/seccomp_unsupported.go | 2 + .../buildah/imagebuildah/executor.go | 2 +- .../buildah/internal/mkcw/embed/entrypoint.gz | Bin 405 -> 405 bytes .../containers/buildah/pkg/cli/common.go | 2 +- .../common/internal/attributedstring/slice.go | 92 +++++++++++ .../containers/common/pkg/config/config.go | 9 +- .../containers/common/pkg/config/default.go | 15 +- vendor/modules.txt | 5 +- 15 files changed, 251 insertions(+), 78 deletions(-) create mode 100644 vendor/github.com/containers/common/internal/attributedstring/slice.go diff --git a/go.mod b/go.mod index 49d7ee1232..e9fc1a14c4 100644 --- a/go.mod +++ b/go.mod @@ -12,8 +12,8 @@ require ( github.com/container-orchestrated-devices/container-device-interface v0.6.1 github.com/containernetworking/cni v1.1.2 github.com/containernetworking/plugins v1.3.0 - github.com/containers/buildah v1.32.1-0.20231016164031-ade05159a485 - github.com/containers/common v0.56.1-0.20231023143107-8d0bd259cb7c + github.com/containers/buildah v1.32.1-0.20231024182922-ea815fea26a9 + github.com/containers/common v0.56.1-0.20231024140609-79773286b53a github.com/containers/conmon v2.0.20+incompatible github.com/containers/gvisor-tap-vsock v0.7.1 github.com/containers/image/v5 v5.28.0 diff --git a/go.sum b/go.sum index 42c4d53414..b70b1fdfda 100644 --- a/go.sum +++ b/go.sum @@ -249,10 +249,10 @@ github.com/containernetworking/plugins v0.8.6/go.mod h1:qnw5mN19D8fIwkqW7oHHYDHV github.com/containernetworking/plugins v0.9.1/go.mod h1:xP/idU2ldlzN6m4p5LmGiwRDjeJr6FLK6vuiUwoH7P8= github.com/containernetworking/plugins v1.3.0 h1:QVNXMT6XloyMUoO2wUOqWTC1hWFV62Q6mVDp5H1HnjM= github.com/containernetworking/plugins v1.3.0/go.mod h1:Pc2wcedTQQCVuROOOaLBPPxrEXqqXBFt3cZ+/yVg6l0= -github.com/containers/buildah v1.32.1-0.20231016164031-ade05159a485 h1:RqgxHW2iP5QJ3aRahT+KGI2aGXVZeZHTeulmeZQV0y0= -github.com/containers/buildah v1.32.1-0.20231016164031-ade05159a485/go.mod h1:gOMfotERP5Gz2pN+AnuM3ephId/YL9DmbOtVck6fWfE= -github.com/containers/common v0.56.1-0.20231023143107-8d0bd259cb7c h1:+5wIm8TWi18iu/WZhF6T9x693nmfpP9yqyrKCreDOOU= -github.com/containers/common v0.56.1-0.20231023143107-8d0bd259cb7c/go.mod h1:NGMoofxxOF8tno51JlwACw0HaUwaPS66h2N7CYJGFC0= +github.com/containers/buildah v1.32.1-0.20231024182922-ea815fea26a9 h1:z8+hkCt6vFxvP7pdz69WSABkIZBNvdGBBMRLwE7UXpQ= +github.com/containers/buildah v1.32.1-0.20231024182922-ea815fea26a9/go.mod h1:6SLsD6bQqppB1btFZSkdDHv2XxlXeqSyTUZsIroqssg= +github.com/containers/common v0.56.1-0.20231024140609-79773286b53a h1:1baXG5fPFMWklhYamf88+1vF2D5PbB2yenSKd9xLwm8= +github.com/containers/common v0.56.1-0.20231024140609-79773286b53a/go.mod h1:NGMoofxxOF8tno51JlwACw0HaUwaPS66h2N7CYJGFC0= github.com/containers/conmon v2.0.20+incompatible h1:YbCVSFSCqFjjVwHTPINGdMX1F6JXHGTUje2ZYobNrkg= github.com/containers/conmon v2.0.20+incompatible/go.mod h1:hgwZ2mtuDrppv78a/cOBNiCm6O0UMWGx1mu7P00nu5I= github.com/containers/gvisor-tap-vsock v0.7.1 h1:+Rc+sOPplrkQb/BUXeN0ug8TxjgyrIqo/9P/eNS2A4c= diff --git a/test/system/800-config.bats b/test/system/800-config.bats index 2f3984fc84..0a304569f8 100644 --- a/test/system/800-config.bats +++ b/test/system/800-config.bats @@ -111,6 +111,37 @@ See 'podman create --help'" "--module must be specified before the command" "--module=ENOENT" } +@test "podman --module - append arrays" { + skip_if_remote "--module is not supported for remote clients" + + random_data="expected_annotation_$(random_string 15)" + conf1_tmp="$PODMAN_TMPDIR/test1.conf" + conf2_tmp="$PODMAN_TMPDIR/test2.conf" + conf2_off_tmp="$PODMAN_TMPDIR/test2_off.conf" + cat > $conf1_tmp < $conf2_tmp < $conf2_off_tmp <`.") fs.StringSliceVar(&flags.Ulimit, "ulimit", defaultContainerConfig.Containers.DefaultUlimits, "ulimit options") - fs.StringArrayVarP(&flags.Volumes, "volume", "v", defaultContainerConfig.Containers.Volumes, "bind mount a volume into the container") + fs.StringArrayVarP(&flags.Volumes, "volume", "v", defaultContainerConfig.Volumes(), "bind mount a volume into the container") // Add in the usernamespace and namespaceflags usernsFlags := GetUserNSFlags(usernsResults) diff --git a/vendor/github.com/containers/common/internal/attributedstring/slice.go b/vendor/github.com/containers/common/internal/attributedstring/slice.go new file mode 100644 index 0000000000..234c9b136a --- /dev/null +++ b/vendor/github.com/containers/common/internal/attributedstring/slice.go @@ -0,0 +1,92 @@ +package attributedstring + +import ( + "bytes" + "fmt" + + "github.com/BurntSushi/toml" +) + +// Slice allows for extending a TOML string array with custom +// attributes that control how the array is marshaled into a Go string. +// +// Specifically, an Slice can be configured to avoid it being +// overridden by a subsequent unmarshal sequence. When the `append` attribute +// is specified, the array will be appended instead (e.g., `array=["9", +// {append=true}]`). +type Slice struct { // A "mixed-type array" in TOML. + // Note that the fields below _must_ be exported. Otherwise the TOML + // encoder would fail during type reflection. + Values []string + Attributes struct { // Using a struct allows for adding more attributes in the future. + Append *bool // Nil if not set by the user + } +} + +// Get returns the Slice values or an empty string slice. +func (a *Slice) Get() []string { + if a.Values == nil { + return []string{} + } + return a.Values +} + +// UnmarshalTOML is the custom unmarshal method for Slice. +func (a *Slice) UnmarshalTOML(data interface{}) error { + iFaceSlice, ok := data.([]interface{}) + if !ok { + return fmt.Errorf("unable to cast to interface array: %v", data) + } + + var loadedStrings []string + for _, x := range iFaceSlice { // Iterate over each item in the slice. + switch val := x.(type) { + case string: // Strings are directly appended to the slice. + loadedStrings = append(loadedStrings, val) + case map[string]interface{}: // The attribute struct is represented as a map. + for k, v := range val { // Iterate over all _supported_ keys. + switch k { + case "append": + boolVal, ok := v.(bool) + if !ok { + return fmt.Errorf("unable to cast append to bool: %v", k) + } + a.Attributes.Append = &boolVal + default: // Unsupported map key. + return fmt.Errorf("unsupported key %q in map: %v", k, val) + } + } + default: // Unsupported item. + return fmt.Errorf("unsupported item in attributed string slice: %v", x) + } + } + + if a.Attributes.Append != nil && *a.Attributes.Append { // If _explicitly_ configured, append the loaded slice. + a.Values = append(a.Values, loadedStrings...) + } else { // Default: override the existing Slice. + a.Values = loadedStrings + } + return nil +} + +// MarshalTOML is the custom marshal method for Slice. +func (a *Slice) MarshalTOML() ([]byte, error) { + iFaceSlice := make([]interface{}, 0, len(a.Values)) + + for _, x := range a.Values { + iFaceSlice = append(iFaceSlice, x) + } + + if a.Attributes.Append != nil { + Attributes := make(map[string]any) + Attributes["append"] = *a.Attributes.Append + iFaceSlice = append(iFaceSlice, Attributes) + } + + buf := new(bytes.Buffer) + enc := toml.NewEncoder(buf) + if err := enc.Encode(iFaceSlice); err != nil { + return nil, err + } + return buf.Bytes(), nil +} diff --git a/vendor/github.com/containers/common/pkg/config/config.go b/vendor/github.com/containers/common/pkg/config/config.go index 087f9de4ac..ab42926727 100644 --- a/vendor/github.com/containers/common/pkg/config/config.go +++ b/vendor/github.com/containers/common/pkg/config/config.go @@ -10,6 +10,7 @@ import ( "strings" "github.com/BurntSushi/toml" + "github.com/containers/common/internal/attributedstring" "github.com/containers/common/libnetwork/types" "github.com/containers/common/pkg/capabilities" "github.com/containers/common/pkg/util" @@ -71,7 +72,7 @@ type ContainersConfig struct { Devices []string `toml:"devices,omitempty"` // Volumes to add to all containers - Volumes []string `toml:"volumes,omitempty"` + Volumes attributedstring.Slice `toml:"volumes,omitempty"` // ApparmorProfile is the apparmor profile name which is used as the // default for the runtime. @@ -133,7 +134,7 @@ type ContainersConfig struct { EnableLabeledUsers bool `toml:"label_users,omitempty"` // Env is the environment variable list for container process. - Env []string `toml:"env,omitempty"` + Env attributedstring.Slice `toml:"env,omitempty"` // EnvHost Pass all host environment variables into the container. EnvHost bool `toml:"env_host,omitempty"` @@ -171,7 +172,7 @@ type ContainersConfig struct { LogTag string `toml:"log_tag,omitempty"` // Mount to add to all containers - Mounts []string `toml:"mounts,omitempty"` + Mounts attributedstring.Slice `toml:"mounts,omitempty"` // NetNS indicates how to create a network namespace for the container NetNS string `toml:"netns,omitempty"` @@ -907,7 +908,7 @@ func (c *Config) GetDefaultEnvEx(envHost, httpProxy bool) []string { } } } - return append(env, c.Containers.Env...) + return append(env, c.Containers.Env.Get()...) } // Capabilities returns the capabilities parses the Add and Drop capability diff --git a/vendor/github.com/containers/common/pkg/config/default.go b/vendor/github.com/containers/common/pkg/config/default.go index e6bac23173..6659dc5f5d 100644 --- a/vendor/github.com/containers/common/pkg/config/default.go +++ b/vendor/github.com/containers/common/pkg/config/default.go @@ -9,6 +9,7 @@ import ( "runtime" "strings" + "github.com/containers/common/internal/attributedstring" nettypes "github.com/containers/common/libnetwork/types" "github.com/containers/common/pkg/apparmor" "github.com/containers/common/pkg/cgroupv2" @@ -204,8 +205,8 @@ func defaultConfig() (*Config, error) { Devices: []string{}, EnableKeyring: true, EnableLabeling: selinuxEnabled(), - Env: []string{ - "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + Env: attributedstring.Slice{ + Values: []string{"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"}, }, EnvHost: false, HTTPProxy: true, @@ -214,7 +215,7 @@ func defaultConfig() (*Config, error) { InitPath: "", LogDriver: defaultLogDriver(), LogSizeMax: DefaultLogSizeMax, - Mounts: []string{}, + Mounts: attributedstring.Slice{}, NetNS: "private", NoHosts: false, PidNS: "private", @@ -224,7 +225,7 @@ func defaultConfig() (*Config, error) { UTSNS: "private", Umask: "0022", UserNSSize: DefaultUserNSSize, // Deprecated - Volumes: []string{}, + Volumes: attributedstring.Slice{}, }, Network: NetworkConfig{ DefaultNetwork: "podman", @@ -509,12 +510,12 @@ func (c *Config) Sysctls() []string { // Volumes returns the default set of volumes that should be mounted in containers. func (c *Config) Volumes() []string { - return c.Containers.Volumes + return c.Containers.Volumes.Get() } // Mounts returns the default set of mounts that should be mounted in containers. func (c *Config) Mounts() []string { - return c.Containers.Mounts + return c.Containers.Mounts.Get() } // Devices returns the default additional devices for containers. @@ -539,7 +540,7 @@ func (c *Config) DNSOptions() []string { // Env returns the default additional environment variables to add to containers. func (c *Config) Env() []string { - return c.Containers.Env + return c.Containers.Env.Values } // IPCNS returns the default IPC Namespace configuration to run containers with. diff --git a/vendor/modules.txt b/vendor/modules.txt index 323dbb8c4d..bf1f75a8ba 100644 --- a/vendor/modules.txt +++ b/vendor/modules.txt @@ -139,7 +139,7 @@ github.com/containernetworking/cni/pkg/version # github.com/containernetworking/plugins v1.3.0 ## explicit; go 1.20 github.com/containernetworking/plugins/pkg/ns -# github.com/containers/buildah v1.32.1-0.20231016164031-ade05159a485 +# github.com/containers/buildah v1.32.1-0.20231024182922-ea815fea26a9 ## explicit; go 1.18 github.com/containers/buildah github.com/containers/buildah/bind @@ -167,8 +167,9 @@ github.com/containers/buildah/pkg/sshagent github.com/containers/buildah/pkg/util github.com/containers/buildah/pkg/volumes github.com/containers/buildah/util -# github.com/containers/common v0.56.1-0.20231023143107-8d0bd259cb7c +# github.com/containers/common v0.56.1-0.20231024140609-79773286b53a ## explicit; go 1.18 +github.com/containers/common/internal/attributedstring github.com/containers/common/libimage github.com/containers/common/libimage/define github.com/containers/common/libimage/filter