libcontainer: Use gocapability's NewPid2 #1735
Closed
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…90bc0 With: $ go get -u github.com/syndtr/gocapability/capability $ sed -i 's/db04d3cc01c8b54962a58ec7e491717d06cfcc16/33e07d32887e1e06b7c025f27ce52f62c7990bc0/' vendor.conf $ vndr $ git add git add vendor.conf vendor/github.com/syndtr Signed-off-by: W. Trevor King <wking@tremily.us>
0acfd29 to
42fa333
Compare
3 tasks
For newContainerCapList, we don't care what the current values are.
Using NewPid2 saves us a few syscalls at no cost.
For bootstrapData, this avoids crashing when there is no
container-side /proc. Previously you'd get:
container_linux.go:... starting container process caused "open
/proc/self/status: no such file or directory"
The IsNotExist check is because we do need to load the effective set.
But capsV3's Load() does that first with the capget() call. After the
capget call it hits /proc for bounding and ambient capabilities. We
don't need those, so the not-exist error isn't a problem. This is a
fairly tight binding to the current gocapability implementation, but
we vendor gocapability, so I'm not too worried about it. If it
becomes an issue we can follow up with a LoadType(which CapType) so we
can explicitly ask to only load the effective set.
Signed-off-by: W. Trevor King <wking@tremily.us>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
For
newContainerCapList, we don't care what the current values are. UsingNewPid2saves us a few syscalls at no cost.For
bootstrapData, this avoids crashing when there is no container-side/proc. Previously you'd get:The
IsNotExistcheck is because we do need to load the effective set. ButcapsV3'sLoad()does that first with thecapget()call. After thecapgetcall it hits/procfor bounding and ambient capabilities. We don't need those, so a not-exist error isn't a problem. This is a fairly tight binding to the current gocapability implementation, but we vendor gocapability, so I'm not too worried about it. If it becomes an issue we can follow up with aLoadType(which CapType)so we can explicitly ask to only load the effective set.Part of #1734.