Added a warning when using a non-Toolbx container #1707
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -24,6 +24,7 @@ import ( | |
| "fmt" | ||
| "io" | ||
| "strconv" | ||
| "strings" | ||
| "time" | ||
|
|
||
| "github.com/HarryMichal/go-version" | ||
|
|
@@ -352,17 +353,84 @@ func IsToolboxImage(image string) (bool, error) { | |
| } | ||
|
|
||
| if info["Labels"] == nil { | ||
| return false, nil | ||
| } | ||
|
|
||
| labels := info["Labels"].(map[string]interface{}) | ||
| if labels["com.github.containers.toolbox"] != "true" && labels["com.github.debarshiray.toolbox"] != "true" { | ||
| return false, nil | ||
| } | ||
|
|
||
| return true, nil | ||
| } | ||
|
|
||
| func IsLDPRELOADEnvSet(image string) (bool, error) { | ||
| info, err := InspectImage(image) | ||
| if err != nil { | ||
| return false, fmt.Errorf("failed to inspect image %s: %s", image, err) | ||
| } | ||
|
|
||
| if info["Config"] == nil { | ||
| return false, nil | ||
| } | ||
|
|
||
| config := info["Config"].(map[string]interface{}) | ||
| if config["Env"] == nil { | ||
| return false, nil | ||
| } | ||
|
|
||
| env := config["Env"] | ||
| switch envVars := env.(type) { | ||
| case []interface{}: | ||
| for _, envVar := range envVars { | ||
| if envVarStr, ok := envVar.(string); ok { | ||
| envVarStrTrimmed := strings.TrimSpace(envVarStr) | ||
| if strings.HasPrefix(envVarStrTrimmed, "LD_PRELOAD=") { | ||
| return true, nil | ||
| } | ||
| } | ||
| } | ||
| case []string: | ||
| for _, envVar := range envVars { | ||
| envVarTrimmed := strings.TrimSpace(envVar) | ||
| if strings.HasPrefix(envVarTrimmed, "LD_PRELOAD=") { | ||
| return true, nil | ||
| } | ||
| } | ||
| default: | ||
| return false, fmt.Errorf("unexpected type '%T' of environment variables in image %s", env, image) | ||
| } | ||
|
|
||
| return false, nil | ||
| } | ||
|
|
||
| func HasImageEntrypoint(image string) (bool, error) { | ||
| info, err := InspectImage(image) | ||
| if err != nil { | ||
| return false, fmt.Errorf("failed to inspect image %s: %s", image, err) | ||
| } | ||
|
|
||
| if info["Config"] == nil { | ||
| return false, nil | ||
| } | ||
|
|
||
| config := info["Config"].(map[string]interface{}) | ||
| if config["Entrypoint"] == nil { | ||
| return false, nil | ||
| } | ||
|
|
||
| entrypoint := config["Entrypoint"] | ||
|
|
||
| switch ep := entrypoint.(type) { | ||
| case []interface{}: | ||
| return len(ep) > 0, nil | ||
| case []string: | ||
| return len(ep) > 0, nil | ||
| default: | ||
| return false, fmt.Errorf("unexpected type '%T' of entrypoint of image %s", entrypoint, image) | ||
| } | ||
| } | ||
|
|
||
| func Logs(container string, since time.Time, stderr io.Writer) error { | ||
| ctx := context.Background() | ||
| err := LogsContext(ctx, container, false, since, stderr) | ||
|
|
@@ -506,3 +574,38 @@ func SystemMigrate(ociRuntimeRequired string) error { | |
|
|
||
| return nil | ||
| } | ||
|
|
||
| func DoesImageFulfillRequirements(image string) (bool, string, error) { | ||
| var warnings []string | ||
|
|
||
| isToolboxImage, err := IsToolboxImage(image) | ||
|
There was a problem hiding this comment. We are invoking For example, here are some past commits where we optimized
The We can reduce the number of |
||
| if err != nil { | ||
| return false, "", fmt.Errorf("failed to verify image compatibility: %w", err) | ||
| } | ||
| if !isToolboxImage { | ||
| warnings = append(warnings, fmt.Sprintf("Warning: Image '%s' does not contain either of the labels 'com.github.containers.toolbox=true' and 'com.github.debarshiray.toolbox=true'", image)) | ||
| } | ||
|
|
||
| isLDPRELOADEnvSet, err := IsLDPRELOADEnvSet(image) | ||
| if err != nil { | ||
| return false, "", fmt.Errorf("failed to validate LD_PRELOAD variable settings: %w", err) | ||
| } | ||
| if isLDPRELOADEnvSet { | ||
| warnings = append(warnings, fmt.Sprintf("Warning: Image '%s' has environment variable LD_PRELOAD set, which may cause container vulnerability (Container Escape)", image)) | ||
| } | ||
|
|
||
| hasEntrypoint, err := HasImageEntrypoint(image) | ||
| if err != nil { | ||
| return false, "", fmt.Errorf("failed to check image entrypoint: %w", err) | ||
| } | ||
| if hasEntrypoint { | ||
| warnings = append(warnings, fmt.Sprintf("Warning: Image '%s' has an entrypoint defined", image)) | ||
| } | ||
|
|
||
| if len(warnings) > 0 { | ||
| warningMessage := strings.Join(warnings, "\n") | ||
| return false, warningMessage, nil | ||
| } | ||
|
|
||
| return true, "", nil | ||
| } | ||
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Decoding the JSON in this way can be fragile if the structure of the JSON changes, and over time Podman has sometimes done that. :(
See the comments in src/pkg/podman/container.go, and the
UnmarshalJSON()method of the Image object.Fortunately, Go can decode JSON on a best effort basis, which can cover-up many of the superficial changes and needs a lot less code. Here's an introductory article about how it works. Sometimes, Go can't automatically handle the changes and we need to handle it ourselves, like in the above comments.
To take advantage of this, and to avoid invoking
podman inspectrepeatedly, we can decode the JSON into anImageobject that implements the json.Unmarshaler interface. It's implemented by thecontainerInspect,containerPSandImageobjects above. The interface will limit all manual interventions during decoding in one place.Unfortunately, the JSON used by Podman to represent images differs between
podman imagesandpodman inspect --type image. TheImageobject only handles the former, but not the latter.We have the same problem for containers. That's why we have a
Containerinterface to hide the details, and it's implemented by the privatecontainerInspectandcontainerPSobjects that actually decode the JSON.So, our first step would be to have a commit that introduces an
Imageinterface, and renames the existingImageobject to make it private and makes it implement the interface. I don't know what would be the best name for the object, becauseimageImageslooks awkward, but it's also a private type so it won't be seen in too many places.Then, we have to add a second implementation of the
Imageinterface that decodes the JSON frompodman inspect --type image.Here are some commits that did the same thing for containers that you can use for help:
cmd, pkg/podman: Turn Container into an interfacecmd/run, pkg/podman: Make podman.InspectContainer() return a ContainerThen, the
IsToolboxImage()function can turn into theIsToolbx()method of theImageinterface:cmd, pkg/podman: Turn IsToolboxContainer() into Container.IsToolbx()