When polling for input on stdin (in Terminal == false cases), don't
close the write end of the pipe that we're using to relay data from
stdin to the container unless poll() tells us that we got a POLLHUP.
Assuming that was the case when POLLIN wasn't set meant that we'd close
it as soon as poll() returned and there was no activity on the
descriptor, and if poll() only returned because we had output from the
container to relay back, we were doing so prematurely.
Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
Closes: #756
Approved by: rhatdan
runCollectOutput() tries to read error messages that may have been
written to pipes by the container runtime. Instead of setting them to
non-blocking and producing an error when we fail to read data, leave
them blocking so that we wait until the write end of a pipe is closed
before we give up on reading from it.
Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
Closes: #754
Approved by: rhatdan
Provide RunOption fields for callers to give us stdio as an
io.ReadCloser and a pair of io.WriteClosers, or nil to use
os.Stdin/os.Stdout/os.Stderr.
Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
Closes: #754
Approved by: rhatdan
Make sure that we don't trigger error messages in runc when $TMPDIR,
which affects os.TempDir(), is itself a symbolic link.
Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
Closes: #746
Approved by: rhatdan
When running buildah code on Atomic Hosts, we need to make sure
the absolute path for the bundlePath is used or operations
will fail.
Signed-off-by: baude <bbaude@redhat.com>
Closes: #745
Approved by: nalind
RunOptions.Mounts has been mistakenly ignored since #700; handle them.
Process the options on the bind mounts in RunOptions.Mounts the same way
we handle the ones in Builder.CommonBuildOpts.Volumes, so that flags
that control read-only/read-write usage, SELinux labeling, and mount
propagation will work.
Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
Closes: #739
Approved by: rhatdan
If the runtime's "create" command fails, we try to collect error
messages from the pipes that we hooked up to its stdio in anticipation
of running a container without a TTY. We should only bother with that
when the container isn't attached to a TTY, which is the only time those
pipe descriptor slices are populated, so that we don't panic when we try
to read an item from an empty slice.
Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
Closes: #740
Approved by: rhatdan
In Run(), when the userspec doesn't specify a group, if the specified
user has supplemental group memberships, pass them along to the runtime.
Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
Closes: #700
Approved by: rhatdan
Move the thread that launches the runtime helper into its own OS thread,
have it create its own mount namespace, and bind mount anything that we
want to eventually bind mount into the container, into a subdirectory of
the bundle directory, before running the helper.
When deciding what to bind mount in, make the volumes specified by the
user our highest priority, in case they've been specified in order to
override our default settings for a given location. This required
breaking up setupMounts() to keep the complexity tests from complaining.
When we use a user namespace with the host IPC namespace, bind mount
/dev/shm and /dev/mqueue instead of mounting fresh copies.
If we're told to use a user namespace with the host PID namespace,
return an error, because that doesn't work.
When we use a user namespace with the host network namespace, bind mount
/sys instead of mounting a fresh one.
When we use the host UTS namespace, don't try to set a hostname.
Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
Closes: #700
Approved by: rhatdan
Use CNI to configure networks for containers for which we create new
network namespaces.
Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
Closes: #700
Approved by: rhatdan
Use ID mapping information when setting permissions on content that we
add to the container, and on secrets that we copy in, on pipes that we
use for stdio, and when extracting the whole filesystem as a "layer".
Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
Closes: #700
Approved by: rhatdan
Add options to the CLI that specify which cgroups we execute "run"
commands under, and controlling how we set up namespaces for them.
Pass them down to Builders that we create, and allow them to be
overridden by options passed to Builder.Run().
Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
Closes: #700
Approved by: rhatdan
If we're creating a user namespace, we always need to supply at least
one mapping for the UID and GID maps. If we're not given any mappings,
map the ranges that are available to us, instead of assuming we can map
all possible values, in case we're already in a user namespace.
Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
Closes: #700
Approved by: rhatdan
Read UID/GID mapping information when creating or importing containers,
and if there is mapping information, use it when building runtime
configurations.
Mounting sysfs in a user namespace requires that we also have our own
network namespace, so default to creating one for that case.
Switch permissions on files that we bind in so that they're writable
from inside of the container.
Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
Closes: #700
Approved by: rhatdan
Instead of using the runtime's "run" command to have it handle the
entire life cycle of a process when we need to launch one, do it
ourselves, and handle passing the data between our stdio and the
container's.
This will make it possible for us to set up networking using CNI between
the "create" and "start" phases, and head off permissions problems when
the process in the container can't read or write to the invoking user's
terminal or stdio.
Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
Closes: #708
Approved by: rhatdan
Break Builder.Run()'s "running runc" parts into their own method, in
preparation for making that part larger.
Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
Closes: #708
Approved by: rhatdan
We are currently volume mounting /etc/hosts and /etc/resolv.conf into the
container, SELinux is preventing these files from being written while in the
container. THis patch will create a temporary hosts and resolv.conf, that
will be labeled correctly and volume mounted into the container.
This will also fix an issue where if you used buildah bud --host it was
modifying the real /etc/hosts file.
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
Make the PullPolicy field in BuilderOptions structures and the the
Terminal field in RunOptions their own types.
Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
Closes: #705
Approved by: rhatdan
If the host is in FIPS mode and /etc/system-fips exists
/run/secrets/system-fips is created in the container so that
the container can run in FIPS mode as well.
Vendor in libpod/pkg/secrets and remove the duplicate secrets code
in buildah.
Also remove the hidden --default-mounts-file flag that was being used for test,
as it is not needed anymore and makes the code simpler.
Signed-off-by: umohnani8 <umohnani@redhat.com>
Closes: #603
Approved by: rhatdan
Also vendor in the latest imagebuilder code and all the packages
that come with it.
Note: imagebuilder.NewBuilderForReader has been removed from imagebuilder
so I had to split the function up into two different calls.
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
Closes: #517
Approved by: rhatdan
* Changed addHostsToFile to make it easy to test
* Changed .travis.yml and Makefile to run all unit tests except ./tests/
* Added unit-tests to addHosts, addHostsToFile and addRlimits
Signed-off-by: Boaz Shuster <ripcurld.github@gmail.com>
Closes: #529
Approved by: rhatdan
Just have to refuse to use previous created containers when doing a run.
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
Closes: #500
Approved by: rhatdan
Add the remaining --volume and --shm-size flags to buildah bud and from
--volume supports the following options: rw, ro, z, Z, private, slave, shared
Signed-off-by: umohnani8 <umohnani@redhat.com>
Closes: #491
Approved by: rhatdan
Avoid opening the file in write mode if we are not going to write
anything.
Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
Closes: #487
Approved by: rhatdan
When populating a container from a container image with a
volume directory, we need to copy the content of the source
directory into the target. The code was mistakenly looking
for a file not a directory.
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
Closes: #471
Approved by: nalind
When we warn about not processing a secrets configuration file, actually
skip anything we might have salvaged from it to make our behavior match
the warning.
Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
Closes: #380
Approved by: rhatdan
I have made a subpackage of libpod to handle chrootuser,
using the user code from buildah.
This patch removes user handling from buildah and uses
projectatomic/libpod/pkg/chrootuser
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
Closes: #377
Approved by: nalind
Don't worry about not being able to populate temporary volumes using the
contents of the location in the image where they're expected to be
mounted if we fail to do so because that location doesn't exist.
Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
Closes: #248
Approved by: rhatdan
When ensuring that the working directory exists before running a
command, make sure we create the location that we set in the
configuration file that we pass to runc.
Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
Closes: #241
Approved by: rhatdan
run: The latest version of runtime-spec dropped the Platform field, so
stop trying to set it when generating a configuration for a runtime.
Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
Closes: #201
Approved by: rhatdan
When "run" isn't explicitly given a command, mix the command and
entrypoint options and configured values together correctly.
Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
Closes: #160
Approved by: rhatdan
Ensure that volume points are created, if they don't exist, when they're
defined in a Dockerfile (#151), and that if we create them, we create
them with 0755 permissions (#152).
When processing RUN instructions or the run command, if we're not
mounting something in a volume's location, create a copy of the volume's
initial contents under the container directory and bind mount that.
Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
Closes: #154
Approved by: rhatdan
Add a --volume/-v flag to "buildah run" to allow volume bind mounts to
be specified on the command line.
Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
Closes: #144
Approved by: rhatdan
Impove error reporting by wrapping all returned err functions with
error.Wrapf
Signed-off-by: Dan Walsh <dwalsh@redhat.com>
Closes: #124
Approved by: nalind
Signed-off-by: Dan Walsh <dwalsh@redhat.com>
Closes: #125
Approved by: nalind
Make sure that we don't mount a tmpfs in volume locations where Run()
has been told to mount something else.
Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
Closes: #121
Approved by: rhatdan
Daniel J Walsh
Nalin Dahyabhai
baude
pixdrift
umohnani8
Boaz Shuster
Giuseppe Scrivano
TomSweeneyRedHat