container: workdir resolution must consider symlink if explicitly configured
#13399
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: flouthoc The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
bot
added
the
approved
flouthoc
force-pushed
the
resolve-workdir-symlink
branch
2 times, most recently
from
cc10e2a to
841dbf3
Compare
|
Failing reproducer without this PR would be FROM alpine
RUN mkdir /tmp/destination
RUN ln -s /tmp/destination /tmp/link
WORKDIR /tmp/link
CMD ["echo", "hello"]$ podman build -t test .
$ podman run --workdir /tmp/link test |
giuseppe
reviewed
Mar 2, 2022
flouthoc
force-pushed
the
resolve-workdir-symlink
branch
from
841dbf3 to
dc26ed7
Compare
flouthoc
changed the title
symlink if explicitly configured using --workdir or implicity using others e.g podman play kubesymlink if explicitly configured using --workdir
flouthoc
changed the title
symlink if explicitly configured using --workdirsymlink if explicitly configured
flouthoc
force-pushed
the
resolve-workdir-symlink
branch
from
dc26ed7 to
ffad3fc
Compare
giuseppe
reviewed
Mar 2, 2022
flouthoc
force-pushed
the
resolve-workdir-symlink
branch
from
ffad3fc to
58dbb61
Compare
@giuseppe This is a valid concern, I have addressed this in new commit and can be verified with FROM alpine
RUN mkdir /tmp/destination
RUN ln -s /tmp/destination /tmp/link
RUN ln -s /tmp/link /tmp/link2
RUN ln -s /tmp/link2 /tmp/link3
WORKDIR /tmp/link3
CMD ["echo", "hello"]$ podman run --workdir /tmp/link3 test |
flouthoc
force-pushed
the
resolve-workdir-symlink
branch
2 times, most recently
from
8a9a7d2 to
569256e
Compare
giuseppe
reviewed
Mar 2, 2022
flouthoc
force-pushed
the
resolve-workdir-symlink
branch
from
569256e to
93a3888
Compare
…figured While resolving `workdir` we mostly create a `workdir` when `stat` fails with `ENOENT` or `ErrNotExist` however following cases are not true when user explicitly specifies a `workdir` while `running` using `--workdir` which tells `podman` to only use workdir if its exists on the container. Following configuration is implicity set with other `run` mechanism like `podman play kube` Problem with explicit `--workdir` or similar implicit config in `podman play kube` is that currently podman ignores the fact that workdir can also be a `symlink` and actual `link` could be valid. Hence following commit ensures that in such scenarios when a `workdir` is not found and we cannot create a `workdir` podman must perform a check to ensure that if `workdir` is a `symlink` and `link` is resolved successfully and resolved link is present on the container then we return as it is. Docker performs a similar behviour. Signed-off-by: Aditya R <[email protected]>
flouthoc
force-pushed
the
resolve-workdir-symlink
branch
from
93a3888 to
0bd0ad5
Compare
|
/lgtm |
github-actions
bot
added
the
locked - please file new issue/PR
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
While resolving workdir we mostly create a workdir when
statfails with
ENOENTorErrNotExisthowever following cases are nottrue when user explicitly specifies a workdir while
runningusing--workdirwhich tells podman to only use workdir if its exists onthe container. Following configuration is implicity set with other
runmechanism likepodman play kubeProblem with explicit
--workdiror similar implicit config inpodman play kubeis that currently podman ignores the fact that workdir can also bea
symlinkand actuallinkcould be valid.Hence following commit ensures that in such scenarios when a workdir
is not found and we cannot create a workdir podman must perform a
check to ensure that if workdir is a
symlinkandlinkis resolvedsuccessfully and resolved link is present on the container then we
return as it is.
Docker performs a similar behavior.
Closes: #13346