Add Linux personality support #1012
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
A lot of people use the Linux `personality` support to allow a 64 bit machine to emulate a 32 bit machine. In particular if you just run 32 bit binaries, many build processes will fail as `uname` will still return a value appropriate for a 64 bit system. Including the personality syscall wil change this to reflect the value from a 32 bit system, such as `i686` rather than `x86_64`. Note that this patch only supports the base 32 bit/64 bit calls. The other options are largely obsolete and rarely used. I left flexibility to add other base domains and to add flags in future, but I am not sure there is any demand for them. The only use case I found in the recent past was the `ADDR_NO_RANDOMIZE` option that disables ASLR, which older versions of Emacs required, but generally they set this themselves, so it is not needed as a Runc option, and it is a serious security reduction. The 32 bit option is different as if you are running 32 bit containers for build, they generally do not know they are "supposed" to run 32 bit, and so this option allows you do do the equivalent of running a `chroot` with `linux32` as is often done on non containerised build systems. Signed-off-by: Justin Cormack <justin.cormack@docker.com>
df6e99e to
5cc25d0
Compare
|
hey @justincormack , I have reviewed this with the internal team here and we agree this should be the correct solution to the problem. Thanks for pulling this together. |
|
LGTM |
|
LGTM As this introduces an |
|
the schema file is not updated |
|
Ah you're right. I'm driving home now. Would you open an issue?
…On Tue, Dec 17, 2019, 16:06 Giuseppe Scrivano ***@***.***> wrote:
the schema file is not updated
—
You are receiving this because you modified the open/close state.
Reply to this email directly, view it on GitHub
<#1012?email_source=notifications&email_token=AAAQL2MQLHFPAL4LGGNR2T3QZE5L5A5CNFSM4HSH6QTKYY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOEHD6NOY#issuecomment-566748859>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/AAAQL2OLTOISXAONLQHIY43QZE5L5ANCNFSM4HSH6QTA>
.
|
|
opened here: #1023 |
|
and a PR: #1024 |
|
Thank you!
…On Tue, Dec 17, 2019, 17:16 Giuseppe Scrivano ***@***.***> wrote:
and a PR: #1024 <#1024>
—
You are receiving this because you modified the open/close state.
Reply to this email directly, view it on GitHub
<#1012?email_source=notifications&email_token=AAAQL2PX4MNHBUZ3CAON6PDQZFFR7A5CNFSM4HSH6QTKYY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOEHEEPNI#issuecomment-566773685>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/AAAQL2MHDWPM2NSTRAXYJFDQZFFR7ANCNFSM4HSH6QTA>
.
|
Closed
m5p3nc3r
referenced
this pull request
in doanac/docker-ce
Jan 29, 2020
containerd/containerd#3990 The problem: You run an armv8 server (such as an AWS Gravitron) and then set up a 32-bit armhf LXC container to run Docker inside of. When DOCKER_BUILDKIT=1 builds are performed they will pick up the OS/Arch properly but hit /proc/cpuinfo for the Variant. It results in something like: linux/arm/v8 which isn't even something you can use. This change allows us to override the logic with something like GOARCH_VARIANT=v7 so that it will work properly. Signed-off-by: Andy Doan <andy@foundries.io>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
A lot of people use the Linux
personalitysupport to allow a 64 bit machineto emulate a 32 bit machine. In particular if you just run 32 bit binaries, many
build processes will fail as
unamewill still return a value appropriate fora 64 bit system. Including the personality syscall wil change this to reflect the
value from a 32 bit system, such as
i686rather thanx86_64.Note that this patch only supports the base 32 bit/64 bit calls. The other options
are largely obsolete and rarely used. I left flexibility to add other base domains
and to add flags in future, but I am not sure there is any demand for them. The
only use case I found in the recent past was the
ADDR_NO_RANDOMIZEoption thatdisables ASLR, which older versions of Emacs required, but generally they set this
themselves, so it is not needed as a Runc option, and it is a serious security
reduction. The 32 bit option is different as if you are running 32 bit containers
for build, they generally do not know they are "supposed" to run 32 bit, and so
this option allows you do do the equivalent of running a
chrootwithlinux32as is often done on non containerised build systems.
Signed-off-by: Justin Cormack justin.cormack@docker.com