[WIP] Allow youki to run with podman in rootless #1171
Conversation
Codecov Report
@@ Coverage Diff @@
## main #1171 +/- ##
==========================================
- Coverage 69.41% 69.37% -0.05%
==========================================
Files 118 118
Lines 12446 12453 +7
==========================================
- Hits 8640 8639 -1
- Misses 3806 3814 +8 |
orimanabu
force-pushed
the
podman-rootless-wip
branch
3 times, most recently
from
69ce8ea to
b567986
Compare
|
Hi, @orimanabu I made this PR draft because you put |
| @@ -216,6 +216,21 @@ fn create_v2_cgroup_manager(_cgroup_path: PathBuf) -> Result<Box<dyn CgroupManag | |||
| bail!("cgroup v2 feature is required, but was not enabled during compile time"); | |||
| } | |||
|
|
|||
| pub fn rootless_required() -> bool { | |||
There was a problem hiding this comment.
Can I ask you to write a unit test? The path(/proc/self/uid_map) should be tested by creating a function that returns the path and separation it from the test version, like that.
https://github.com/containers/youki/blob/95d85c510f94b701c3266728edcd68d4471e80e0/crates/youki/src/main.rs#L180-L188
There was a problem hiding this comment.
Sure thing, I'll add a unit test in the next update.
There was a problem hiding this comment.
FYI: you missed the doc comment when moving the function here. 😉
|
FYI: I tried out these changes and it's goint in the right direction, but fails with the following error now:
Adding a few $ podman run --runtime $PWD/youki --rm alpine
[crates/youki/src/main.rs:144] getuid().as_raw() = 0
[crates/youki/src/main.rs:146] root_path = None
[crates/libcgroups/src/common.rs:228] content = " 0 1000 1\n 1 100000 65536\n"
[crates/youki/src/main.rs:154] rootless_required() = true
[crates/youki/src/main.rs:162] Path::new(&path).join("youki") = "/run/user/1000/youki"
[ERROR crates/youki/src/main.rs:138] 2022-11-07T21:29:36.138970068+01:00 error in executing command: failed to delete container 5affe9849620e2dfaec2f371d59d8257bead1cf97a27126b6f9f826b32204a14
Caused by:
0: failed to load runtime spec for container 5affe9849620e2dfaec2f371d59d8257bead1cf97a27126b6f9f826b32204a14
1: No such file or directory (os error 2)
Error: failed to delete container 5affe9849620e2dfaec2f371d59d8257bead1cf97a27126b6f9f826b32204a14
Caused by:
0: failed to load runtime spec for container 5affe9849620e2dfaec2f371d59d8257bead1cf97a27126b6f9f826b32204a14
1: No such file or directory (os error 2)
ERRO[0000] Removing container 5affe9849620e2dfaec2f371d59d8257bead1cf97a27126b6f9f826b32204a14 from runtime after creation failed
Error: OCI runtime error: /home/riyad/src/youki/youki: [crates/youki/src/main.rs:144] getuid().as_raw() = 0
[crates/youki/src/main.rs:146] root_path = None
[crates/libcgroups/src/common.rs:228] content = " 0 1000 1\n 1 100000 65536\n"
[crates/youki/src/main.rs:154] rootless_required() = true
[crates/youki/src/main.rs:162] Path::new(&path).join("youki") = "/run/user/1000/youki"
[crates/libcgroups/src/common.rs:228] content = " 0 1000 1\n 1 100000 65536\n"
[ERROR crates/youki/src/main.rs:138] 2022-11-07T21:29:36.121815933+01:00 error in executing command: rootless container requires valid user namespace definition
Error: rootless container requires valid user namespace definition |
| let uid_map_path = "/proc/self/uid_map"; | ||
| let content = fs::read_to_string(uid_map_path) | ||
| .unwrap_or_else(|_| panic!("failed to read {}", uid_map_path)); | ||
| if !content.contains("4294967295") { |
There was a problem hiding this comment.
Maybe we should add a comment explaining the meaning of this ... like in https://github.com/opencontainers/runc/blob/v1.1.3/libcontainer/userns/userns_linux.go#L30
|
Hey @orimanabu, are you still working on this? If you are busy with something else, and currently cannot work on this, I might use this PR as guide and try to make the other changes required to make it work. One of the concerns I have for this PR is that , there might have been a lot of changes in the files since you opened this , so you might get conflicts once you un-WIP this. Let us know if you are still working on this, and need any help, I'll be happy help as much as I can. Thanks :) |
|
Hi, @orimanabu. Sorry if I bother you, but this is kindly reminder. We would like to know if you have enough time to handle it. May I ask you to tell me? It is most important that you develop youki with a lot of fun. Please feel free to ask me for help ;) |
|
Hi, I'm very sorry to leave this PR open for so long. Please go ahead and feel free to use this PR or another to proceed. I hope I'll have spare time in winter vacation! |
|
No worries. I'll try to use this and what you have implemented, and work towards getting youki to work with podman rootless. Thanks a lot for starting this and building a road to follow :) |
When Podman starts a container in rootless, it first creates a user namespace and then starts the container as root in it. Therefore, determining rootless in youki with geteuid(2) is not sufficient. Youki should look at /proc/self/uid_map to determine if it is rootless, just like crun and runc. Signed-off-by: Manabu Ori <[email protected]>
orimanabu
force-pushed
the
podman-rootless-wip
branch
from
b567986 to
efda82d
Compare
|
Hi, $ podman unshare ./youki create test
[ERROR crates/youki/src/main.rs:138] 2023-01-18T22:56:20.672293762+09:00 error in executing command: failed to create session dbus client
Caused by:
0: failed to create container
1: failed to create session dbus client
2: Did not receive a reply. Possible causes include: the remote application did not send a reply, the message bus security policy blocked the reply, the reply timeout expired, or the network connection was broken.
Error: failed to create session dbus client
Caused by:
0: failed to create container
1: failed to create session dbus client
2: Did not receive a reply. Possible causes include: the remote application did not send a reply, the message bus security policy blocked the reply, the reply timeout expired, or the network connection was broken.Youki seemed to talk to dbus session in Manager::new() then failed. My guess is dbus authorization mechanism rejected youki. The reason is that... Dbus-broker for my user I confirmed that with strace.
[ori@localhost youki]$ strace -e sendto -o strace.log ./youki create test2
[WARN crates/libcontainer/src/process/container_init_process.rs:90] 2023-01-18T14:32:55.347765209+00:00 masked path "/proc/timer_stats" not exist
[WARN crates/libcontainer/src/process/container_init_process.rs:90] 2023-01-18T14:32:55.347800321+00:00 masked path "/proc/sched_debug" not exist
[ori@localhost youki]$ cat strace.log
sendto(3, "\0", 1, MSG_NOSIGNAL, NULL, 0) = 1
sendto(3, "AUTH EXTERNAL 31303030\r\n", 24, MSG_NOSIGNAL, NULL, 0) = 24
sendto(3, "NEGOTIATE_UNIX_FD\r\n", 19, MSG_NOSIGNAL, NULL, 0) = 19
sendto(3, "BEGIN\r\n", 7, MSG_NOSIGNAL, NULL, 0) = 7
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=381820, si_uid=1000, si_status=0, si_utime=0, si_stime=0} ---
+++ exited with 0 +++The argument of
[ori@localhost youki]$ podman unshare strace -e sendto -o strace.log ./youki create test2
[ERROR crates/youki/src/main.rs:138] 2023-01-18T23:35:17.258757674+09:00 error in executing command: failed to create session dbus client
Caused by:
0: failed to create container
1: failed to create session dbus client
2: Did not receive a reply. Possible causes include: the remote application did not send a reply, the message bus security policy blocked the reply, the reply timeout expired, or the network connection was broken.
Error: failed to create session dbus client
Caused by:
0: failed to create container
1: failed to create session dbus client
2: Did not receive a reply. Possible causes include: the remote application did not send a reply, the message bus security policy blocked the reply, the reply timeout expired, or the network connection was broken.
[ori@localhost youki]$ cat strace.log
sendto(3, "\0", 1, MSG_NOSIGNAL, NULL, 0) = 1
sendto(3, "AUTH EXTERNAL 30\r\n", 18, MSG_NOSIGNAL, NULL, 0) = 18
sendto(3, "\0", 1, MSG_NOSIGNAL, NULL, 0) = 1
sendto(3, "AUTH EXTERNAL 30\r\n", 18, MSG_NOSIGNAL, NULL, 0) = 18
+++ exited with 1 +++youki in podman user namespace tried to connect as UID I also confirm that from dbus-broker's side. So the counterplan is... Footnotes |
|
@orimanabu Thanks a lot! I also have interested in the behavior of other runtimes. Hi @Furisto Do you know anything about this issue? |
|
Hey, So I did a bit of digging, and found out this :
|
|
@YJDoc2 To be honest, I am not very familiar with this part. How about we start an issue on this and see how the community https://github.com/diwic/dbus-rs reacts to this problem? |
|
Hey, I'll open an issue on dbus-rs and see how that goes. I'm not sure if simply forking and doing minor code changes would solve this as this might require some fundamental changes to how the library connects with dbus. Maybe the dbus community might have a better idea and help us out. I'll keep this updated as things go on. Thanks! |
|
Closing as completed via #2370 , and released in v0.3.0 🎉 Thank you 🙏 |
This is a work in progress PR addressing #719.
I created this for discussion purpose, please don't merge.
This patch resolves the initial error (
Error: failed to create directory /run/youki), but still does not allow youki to run rootless in Podman.Now I got another error:
Error: failed to create session dbus clientIt seems that CgroupPath in config.json is empty, I'll look into it later.
Signed-off-by: Manabu Ori [email protected]