defer creation of sysctl until after all namespaces have been created #983
Conversation
|
@flouthoc @giuseppe PTAL, I am not even sure if this is the right place to do this.. but thought I'd try it on a hunch. see containers/podman#15200 for more info of why this is needed |
There was a problem hiding this comment.
How does runc does it, i am not sure but upon quick look it looks like it does it much early while processing the init https://github.com/opencontainers/runc/blob/main/libcontainer/standard_init_linux.go#L133
|
Maybe hack would be to only process |
|
I think |
|
@giuseppe WDYT ? |
|
@flouthoc can you point out where the UTS NS is configured here? I only see references to userNS. this is my first time really looking around crun |
cdoern
force-pushed
the
utsns-sysctl
branch
2 times, most recently
from
f30b3b2 to
737b32b
Compare
|
This pull request introduces 1 alert when merging 737b32b into b66340c - view on LGTM.com new alerts:
|
|
This pull request introduces 1 alert when merging ea16be0 into b66340c - view on LGTM.com new alerts:
|
there is a bug in rootless podman that does not allow users to set kernel.domainname because the uts namespace is not set up before the sysctl's are added. I moved the libcrun_set_sysctl down to a point where i think all of the namespaces have been created I also made a new function libcrun_set_additional_sysctl in which sysctls that need the namespaces set up are added later Signed-off-by: Charlie Doern <[email protected]>
|
This pull request introduces 1 alert when merging 87d102e into b66340c - view on LGTM.com new alerts:
|
@cdoern I think this might be better workaround as suggested in patch here containers/podman#15200 (comment) but modifying OCI spec to support |
|
let's close this PR for now, I don't think this approach can solve the issue we have seen |
|
Ok, I'll work on the OCI spec approach |
there is a bug in rootless podman that does not allow users to set
kernel.domainname because the uts namespace is not set up before the sysctl's are
added.
I moved the libcrun_set_sysctl down to a point where i think all of the namespaces have been created
Signed-off-by: Charlie Doern [email protected]