Skip to content

Commit d05cd0c

Browse files
r10rr10r
authored
Merge pull request #47 from drachenfels-de/fixes
Fix race, update API and container image
2 parents cbc79e1 + eee7558 commit d05cd0c

File tree

10 files changed

+101
-107
lines changed

10 files changed

+101
-107
lines changed

‎Dockerfile‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,8 @@ ARG installcmd=install_all
33

44
#ENV PKGS="psmisc util-linux"
55

6-
ENV GOLANG_SRC=https://golang.org/dl/go1.16.2.linux-amd64.tar.gz
7-
ENV GOLANG_CHECKSUM=542e936b19542e62679766194364f45141fde55169db2d8d01046555ca9eb4b8
6+
ENV GOLANG_SRC=https://golang.org/dl/go1.16.3.linux-amd64.tar.gz
7+
ENV GOLANG_CHECKSUM=951a3c7c6ce4e56ad883f97d9db74d3d6d80d5fec77455c6ada6c1f7ac4776d2
88

99
ENV CNI_PLUGINS_GIT_REPO=https://github.com/containernetworking/plugins.git
1010
ENV CNI_PLUGINS_GIT_VERSION=v0.9.1
@@ -13,18 +13,18 @@ ENV CONMON_GIT_REPO=https://github.com/containers/conmon.git
1313
ENV CONMON_GIT_VERSION=v2.0.27
1414

1515
ENV CRIO_GIT_REPO=https://github.com/cri-o/cri-o.git
16-
ENV CRIO_GIT_VERSION=v1.20.1
16+
ENV CRIO_GIT_VERSION=v1.20.2
1717

1818
ENV CRICTL_CHECKSUM=44d5f550ef3f41f9b53155906e0229ffdbee4b19452b4df540265e29572b899c
1919
ENV CRICTL_URL="https://github.com/kubernetes-sigs/cri-tools/releases/download/v1.20.0/crictl-v1.20.0-linux-amd64.tar.gz"
2020

2121
# see https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.20.md
22-
ENV K8S_CHECKSUM=37738bc8430b0832f32c6d13cdd68c376417270568cd9b31a1ff37e96cfebcc1e2970c72bed588f626e35ed8273671c77200f0d164e67809b5626a2a99e3c5f5
23-
ENV K8S_URL="https://dl.k8s.io/v1.20.4/kubernetes-server-linux-amd64.tar.gz"
22+
ENV K8S_CHECKSUM=ac936e05aef7bb887a5fb57d50f8c384ee395b5f34c85e5c0effd8709db042359f63247d4a6ae2c0831fe019cd3029465377117e42fff1b00a8e4b7473b88db9
23+
ENV K8S_URL="https://dl.k8s.io/v1.20.6/kubernetes-server-linux-amd64.tar.gz"
2424

2525
## development
2626
ENV LXC_GIT_REPO=https://github.com/lxc/lxc.git
27-
ENV LXC_GIT_VERSION=master
27+
ENV LXC_GIT_VERSION=b9f3cd48ecfed02e4218b55ea1b46273e429a083
2828

2929
ENV LXCRI_GIT_REPO=https://github.com/lxc/lxcri.git
3030
ENV LXCRI_GIT_VERSION=main

‎cgroup.go‎

Lines changed: 17 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -97,7 +97,7 @@ func configureCgroup(rt *Runtime, c *Container) error {
9797
}
9898

9999
if pids := c.Spec.Linux.Resources.Pids; pids != nil {
100-
if err := c.SetConfigItem("lxc.cgroup2.pids.max", fmt.Sprintf("%d", pids.Limit)); err != nil {
100+
if err := c.setConfigItem("lxc.cgroup2.pids.max", fmt.Sprintf("%d", pids.Limit)); err != nil {
101101
return err
102102
}
103103
}
@@ -122,30 +122,30 @@ func configureCgroupPath(rt *Runtime, c *Container) error {
122122
c.CgroupDir = c.Spec.Linux.CgroupsPath
123123
}
124124

125-
if err := c.SetConfigItem("lxc.cgroup.relative", "0"); err != nil {
125+
if err := c.setConfigItem("lxc.cgroup.relative", "0"); err != nil {
126126
return err
127127
}
128128

129129
// @since lxc @a900cbaf257c6a7ee9aa73b09c6d3397581d38fb
130130
// checking for on of the config items shuld be enough, because they were introduced together ...
131131
// lxc.cgroup.dir.payload and lxc.cgroup.dir.monitor
132-
splitCgroup := c.SupportsConfigItem("lxc.cgroup.dir.container", "lxc.cgroup.dir.monitor")
132+
splitCgroup := c.supportsConfigItem("lxc.cgroup.dir.container", "lxc.cgroup.dir.monitor")
133133

134134
if !splitCgroup || rt.MonitorCgroup == "" {
135-
return c.SetConfigItem("lxc.cgroup.dir", c.CgroupDir)
135+
return c.setConfigItem("lxc.cgroup.dir", c.CgroupDir)
136136
}
137137

138138
c.MonitorCgroupDir = filepath.Join(rt.MonitorCgroup, c.ContainerID+".scope")
139139

140-
if err := c.SetConfigItem("lxc.cgroup.dir.container", c.CgroupDir); err != nil {
140+
if err := c.setConfigItem("lxc.cgroup.dir.container", c.CgroupDir); err != nil {
141141
return err
142142
}
143-
if err := c.SetConfigItem("lxc.cgroup.dir.monitor", c.MonitorCgroupDir); err != nil {
143+
if err := c.setConfigItem("lxc.cgroup.dir.monitor", c.MonitorCgroupDir); err != nil {
144144
return err
145145
}
146146

147-
if c.SupportsConfigItem("lxc.cgroup.dir.monitor.pivot") {
148-
if err := c.SetConfigItem("lxc.cgroup.dir.monitor.pivot", rt.MonitorCgroup); err != nil {
147+
if c.supportsConfigItem("lxc.cgroup.dir.monitor.pivot") {
148+
if err := c.setConfigItem("lxc.cgroup.dir.monitor.pivot", rt.MonitorCgroup); err != nil {
149149
return err
150150
}
151151
}
@@ -191,16 +191,16 @@ func configureDeviceController(c *Container) error {
191191
}
192192
// decompose
193193
val := fmt.Sprintf("%s %s:%s %s", blockDevice, maj, min, dev.Access)
194-
if err := c.SetConfigItem(key, val); err != nil {
194+
if err := c.setConfigItem(key, val); err != nil {
195195
return err
196196
}
197197
val = fmt.Sprintf("%s %s:%s %s", charDevice, maj, min, dev.Access)
198-
if err := c.SetConfigItem(key, val); err != nil {
198+
if err := c.setConfigItem(key, val); err != nil {
199199
return err
200200
}
201201
case blockDevice, charDevice:
202202
val := fmt.Sprintf("%s %s:%s %s", dev.Type, maj, min, dev.Access)
203-
if err := c.SetConfigItem(key, val); err != nil {
203+
if err := c.setConfigItem(key, val); err != nil {
204204
return err
205205
}
206206
default:
@@ -216,32 +216,32 @@ func configureCPUController(clxc *Runtime, slinux *specs.LinuxCPU) error {
216216
clxc.Log.Debug().Msg("TODO configure cgroup cpu controller")
217217
/*
218218
if cpu.Shares != nil && *cpu.Shares > 0 {
219-
if err := clxc.SetConfigItem("lxc.cgroup2.cpu.shares", fmt.Sprintf("%d", *cpu.Shares)); err != nil {
219+
if err := clxc.setConfigItem("lxc.cgroup2.cpu.shares", fmt.Sprintf("%d", *cpu.Shares)); err != nil {
220220
return err
221221
}
222222
}
223223
if cpu.Quota != nil && *cpu.Quota > 0 {
224-
if err := clxc.SetConfigItem("lxc.cgroup2.cpu.cfs_quota_us", fmt.Sprintf("%d", *cpu.Quota)); err != nil {
224+
if err := clxc.setConfigItem("lxc.cgroup2.cpu.cfs_quota_us", fmt.Sprintf("%d", *cpu.Quota)); err != nil {
225225
return err
226226
}
227227
}
228228
if cpu.Period != nil && *cpu.Period != 0 {
229-
if err := clxc.SetConfigItem("lxc.cgroup2.cpu.cfs_period_us", fmt.Sprintf("%d", *cpu.Period)); err != nil {
229+
if err := clxc.setConfigItem("lxc.cgroup2.cpu.cfs_period_us", fmt.Sprintf("%d", *cpu.Period)); err != nil {
230230
return err
231231
}
232232
}
233233
if cpu.Cpus != "" {
234-
if err := clxc.SetConfigItem("lxc.cgroup2.cpuset.cpus", cpu.Cpus); err != nil {
234+
if err := clxc.setConfigItem("lxc.cgroup2.cpuset.cpus", cpu.Cpus); err != nil {
235235
return err
236236
}
237237
}
238238
if cpu.RealtimePeriod != nil && *cpu.RealtimePeriod > 0 {
239-
if err := clxc.SetConfigItem("lxc.cgroup2.cpu.rt_period_us", fmt.Sprintf("%d", *cpu.RealtimePeriod)); err != nil {
239+
if err := clxc.setConfigItem("lxc.cgroup2.cpu.rt_period_us", fmt.Sprintf("%d", *cpu.RealtimePeriod)); err != nil {
240240
return err
241241
}
242242
}
243243
if cpu.RealtimeRuntime != nil && *cpu.RealtimeRuntime > 0 {
244-
if err := clxc.SetConfigItem("lxc.cgroup2.cpu.rt_runtime_us", fmt.Sprintf("%d", *cpu.RealtimeRuntime)); err != nil {
244+
if err := clxc.setConfigItem("lxc.cgroup2.cpu.rt_runtime_us", fmt.Sprintf("%d", *cpu.RealtimeRuntime)); err != nil {
245245
return err
246246
}
247247
}

‎container.go‎

Lines changed: 17 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -31,17 +31,21 @@ type ContainerConfig struct {
3131
// The ContainerID should match the following pattern `[a-z][a-z0-9-_]+`
3232
ContainerID string
3333

34-
BundlePath string
34+
// BundlePath is the OCI bundle path.
35+
BundlePath string
36+
3537
ConsoleSocket string `json:",omitempty"`
3638

37-
// PidFile is the absolute PID file path
38-
// for the container monitor process (ExecStart)
39+
// MonitorCgroupDir is the cgroup directory path
40+
// for the liblxc monitor process `lxcri-start`
41+
// relative to the cgroup root.
3942
MonitorCgroupDir string
4043

4144
CgroupDir string
4245

4346
// LogFile is the liblxc log file path
4447
LogFile string
48+
4549
// LogLevel is the liblxc log level
4650
LogLevel string
4751

@@ -59,7 +63,7 @@ func (c Container) syncFifoPath() string {
5963
}
6064

6165
// RuntimePath returns the absolute path to the given sub path
62-
// within the container root.
66+
// within the container runtime directory.
6367
func (c Container) RuntimePath(subPath ...string) string {
6468
return filepath.Join(c.runtimeDir, filepath.Join(subPath...))
6569
}
@@ -151,7 +155,7 @@ func (c *Container) isMonitorRunning() bool {
151155
}
152156

153157
// if WNOHANG was specified and one or more child(ren) specified by pid exist,
154-
// but have not yet changed state, then 0 is returned
158+
// but have not yet exited, then 0 is returned
155159
if pid == 0 {
156160
return true
157161
}
@@ -205,7 +209,7 @@ func (c *Container) waitStarted(ctx context.Context) error {
205209
return ctx.Err()
206210
default:
207211
if !c.isMonitorRunning() {
208-
return fmt.Errorf("monitor already died")
212+
return nil
209213
}
210214
initState, _ := c.getContainerInitState()
211215
if initState != specs.StateCreated {
@@ -308,9 +312,9 @@ func (c *Container) kill(ctx context.Context, signum unix.Signal) error {
308312
return nil
309313
}
310314

311-
// GetConfigItem is a wrapper function and returns the
312-
// first value returned by *lxc.Container.ConfigItem
313-
func (c *Container) GetConfigItem(key string) string {
315+
// getConfigItem is a wrapper function and returns the
316+
// first value returned by lxc.Container.ConfigItem
317+
func (c *Container) getConfigItem(key string) string {
314318
vals := c.LinuxContainer.ConfigItem(key)
315319
if len(vals) > 0 {
316320
first := vals[0]
@@ -323,9 +327,9 @@ func (c *Container) GetConfigItem(key string) string {
323327
return ""
324328
}
325329

326-
// SetConfigItem is a wrapper for *lxc.Container.SetConfigItem.
330+
// setConfigItem is a wrapper for lxc.Container.setConfigItem.
327331
// and only adds additional logging.
328-
func (c *Container) SetConfigItem(key, value string) error {
332+
func (c *Container) setConfigItem(key, value string) error {
329333
err := c.LinuxContainer.SetConfigItem(key, value)
330334
if err != nil {
331335
return fmt.Errorf("failed to set config item '%s=%s': %w", key, value, err)
@@ -334,8 +338,8 @@ func (c *Container) SetConfigItem(key, value string) error {
334338
return nil
335339
}
336340

337-
// SupportsConfigItem is a wrapper for *lxc.Container.IsSupportedConfig item.
338-
func (c *Container) SupportsConfigItem(keys ...string) bool {
341+
// supportsConfigItem is a wrapper for lxc.Container.IsSupportedConfig item.
342+
func (c *Container) supportsConfigItem(keys ...string) bool {
339343
canCheck := lxc.VersionAtLeast(4, 0, 6)
340344
if !canCheck {
341345
c.Log.Warn().Msg("lxc.IsSupportedConfigItem is broken in liblxc < 4.0.6")

‎create.go‎

Lines changed: 20 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -97,13 +97,13 @@ func configureContainer(rt *Runtime, c *Container) error {
9797
}
9898

9999
if c.Spec.Process.OOMScoreAdj != nil {
100-
if err := c.SetConfigItem("lxc.proc.oom_score_adj", fmt.Sprintf("%d", *c.Spec.Process.OOMScoreAdj)); err != nil {
100+
if err := c.setConfigItem("lxc.proc.oom_score_adj", fmt.Sprintf("%d", *c.Spec.Process.OOMScoreAdj)); err != nil {
101101
return err
102102
}
103103
}
104104

105105
if c.Spec.Process.NoNewPrivileges {
106-
if err := c.SetConfigItem("lxc.no_new_privs", "1"); err != nil {
106+
if err := c.setConfigItem("lxc.no_new_privs", "1"); err != nil {
107107
return err
108108
}
109109
}
@@ -122,7 +122,7 @@ func configureContainer(rt *Runtime, c *Container) error {
122122
if err := writeSeccompProfile(profilePath, c.Spec.Linux.Seccomp); err != nil {
123123
return err
124124
}
125-
if err := c.SetConfigItem("lxc.seccomp.profile", profilePath); err != nil {
125+
if err := c.setConfigItem("lxc.seccomp.profile", profilePath); err != nil {
126126
return err
127127
}
128128
}
@@ -139,7 +139,7 @@ func configureContainer(rt *Runtime, c *Container) error {
139139
}
140140

141141
// make sure autodev is disabled
142-
if err := c.SetConfigItem("lxc.autodev", "0"); err != nil {
142+
if err := c.setConfigItem("lxc.autodev", "0"); err != nil {
143143
return err
144144
}
145145

@@ -190,7 +190,7 @@ func configureContainer(rt *Runtime, c *Container) error {
190190
}
191191

192192
for key, val := range c.Spec.Linux.Sysctl {
193-
if err := c.SetConfigItem("lxc.sysctl."+key, val); err != nil {
193+
if err := c.setConfigItem("lxc.sysctl."+key, val); err != nil {
194194
return err
195195
}
196196
}
@@ -207,7 +207,7 @@ func configureContainer(rt *Runtime, c *Container) error {
207207
}
208208
seenLimits = append(seenLimits, name)
209209
val := fmt.Sprintf("%d:%d", limit.Soft, limit.Hard)
210-
if err := c.SetConfigItem("lxc.prlimit."+name, val); err != nil {
210+
if err := c.setConfigItem("lxc.prlimit."+name, val); err != nil {
211211
return err
212212
}
213213
}
@@ -226,7 +226,7 @@ func configureHostname(rt *Runtime, c *Container) error {
226226
if c.Spec.Hostname == "" {
227227
return nil
228228
}
229-
if err := c.SetConfigItem("lxc.uts.name", c.Spec.Hostname); err != nil {
229+
if err := c.setConfigItem("lxc.uts.name", c.Spec.Hostname); err != nil {
230230
return err
231231
}
232232

@@ -256,20 +256,20 @@ func configureRootfs(rt *Runtime, c *Container) error {
256256
if !filepath.IsAbs(rootfs) {
257257
rootfs = filepath.Join(c.BundlePath, rootfs)
258258
}
259-
if err := c.SetConfigItem("lxc.rootfs.path", rootfs); err != nil {
259+
if err := c.setConfigItem("lxc.rootfs.path", rootfs); err != nil {
260260
return err
261261
}
262262

263-
if err := c.SetConfigItem("lxc.rootfs.mount", rootfs); err != nil {
263+
if err := c.setConfigItem("lxc.rootfs.mount", rootfs); err != nil {
264264
return err
265265
}
266266

267-
if err := c.SetConfigItem("lxc.rootfs.managed", "0"); err != nil {
267+
if err := c.setConfigItem("lxc.rootfs.managed", "0"); err != nil {
268268
return err
269269
}
270270

271271
// Resources not created by the container runtime MUST NOT be deleted by it.
272-
if err := c.SetConfigItem("lxc.ephemeral", "0"); err != nil {
272+
if err := c.setConfigItem("lxc.ephemeral", "0"); err != nil {
273273
return err
274274
}
275275

@@ -280,20 +280,20 @@ func configureRootfs(rt *Runtime, c *Container) error {
280280
if c.Spec.Root.Readonly {
281281
rootfsOptions = append(rootfsOptions, "ro")
282282
}
283-
if err := c.SetConfigItem("lxc.rootfs.options", strings.Join(rootfsOptions, ",")); err != nil {
283+
if err := c.setConfigItem("lxc.rootfs.options", strings.Join(rootfsOptions, ",")); err != nil {
284284
return err
285285
}
286286
return nil
287287
}
288288

289289
func configureReadonlyPaths(c *Container) error {
290-
rootmnt := c.GetConfigItem("lxc.rootfs.mount")
290+
rootmnt := c.getConfigItem("lxc.rootfs.mount")
291291
if rootmnt == "" {
292292
return fmt.Errorf("lxc.rootfs.mount unavailable")
293293
}
294294
for _, p := range c.Spec.Linux.ReadonlyPaths {
295295
mnt := fmt.Sprintf("%s %s %s %s", filepath.Join(rootmnt, p), strings.TrimPrefix(p, "/"), "bind", "bind,ro,optional")
296-
if err := c.SetConfigItem("lxc.mount.entry", mnt); err != nil {
296+
if err := c.setConfigItem("lxc.mount.entry", mnt); err != nil {
297297
return fmt.Errorf("failed to make path readonly: %w", err)
298298
}
299299
}
@@ -306,7 +306,7 @@ func configureApparmor(c *Container) error {
306306
if aaprofile == "" {
307307
aaprofile = "unconfined"
308308
}
309-
return c.SetConfigItem("lxc.apparmor.profile", aaprofile)
309+
return c.setConfigItem("lxc.apparmor.profile", aaprofile)
310310
}
311311

312312
// configureCapabilities configures the linux capabilities / privileges granted to the container processes.
@@ -326,7 +326,7 @@ func configureCapabilities(c *Container) error {
326326
}
327327
}
328328

329-
return c.SetConfigItem("lxc.cap.keep", keepCaps)
329+
return c.setConfigItem("lxc.cap.keep", keepCaps)
330330
}
331331

332332
// NOTE keep in sync with cmd/lxcri-hook#ociHooksAndState
@@ -359,22 +359,22 @@ func configureHooks(rt *Runtime, c *Container) error {
359359
c.Spec.Hooks = &hooks
360360

361361
// pass context information as environment variables to hook scripts
362-
if err := c.SetConfigItem("lxc.hook.version", "1"); err != nil {
362+
if err := c.setConfigItem("lxc.hook.version", "1"); err != nil {
363363
return err
364364
}
365365

366366
if len(c.Spec.Hooks.Prestart) > 0 || len(c.Spec.Hooks.CreateRuntime) > 0 {
367-
if err := c.SetConfigItem("lxc.hook.pre-mount", rt.libexec(ExecHook)); err != nil {
367+
if err := c.setConfigItem("lxc.hook.pre-mount", rt.libexec(ExecHook)); err != nil {
368368
return err
369369
}
370370
}
371371
if len(c.Spec.Hooks.CreateContainer) > 0 {
372-
if err := c.SetConfigItem("lxc.hook.mount", rt.libexec(ExecHook)); err != nil {
372+
if err := c.setConfigItem("lxc.hook.mount", rt.libexec(ExecHook)); err != nil {
373373
return err
374374
}
375375
}
376376
if len(c.Spec.Hooks.StartContainer) > 0 {
377-
if err := c.SetConfigItem("lxc.hook.start", rt.libexec(ExecHook)); err != nil {
377+
if err := c.setConfigItem("lxc.hook.start", rt.libexec(ExecHook)); err != nil {
378378
return err
379379
}
380380
}

0 commit comments

Comments
 (0)