Commit Graph

100 Commits (8c9ff8697051ff5ee3388aa72f9d77945e87cb87)

Author SHA1 Message Date
Brian Goff d9834f872c
Add support for apparmor/selinux
Set's an apparmor profile on the OCI spec if one is configred on the
worker.
Adds selinux labels to containers (only added if selinux is enabled on
the system).

This assumes that the specified apparmor profile is already loaded on
the system and does not try to load it or even check if it is loaded.

SELinux support requires the `selinux` build tag to be added.
Likewise, `runc` would require both the `apparmor` and `selinux` build
tags.

Signed-off-by: Brian Goff <cpuguy83@gmail.com>

Vendored go-selinux to v1.8.0
Fixed tests

Signed-off-by: Tibor Vass <tibor@docker.com>
(cherry picked from commit 68bb095353)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2021-02-04 22:01:34 +01:00
Cory Bennett 9d3f55c400 move ExitError from solver/errdefs to frontend/gateway/errdefs
Signed-off-by: Cory Bennett <cbennett@netflix.com>
2020-12-07 01:09:59 +00:00
Sebastiaan van Stijn a1a85daeb5
executor: switch to docker seccomp profile
While we try to keep the containerd and docker seccomp profiles in sync,
they may not always be; this switches the executor to use the docker
seccomp profile, so that buildkit (when vendored in docker) will use
the same default seccomp profile as is used for containers.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-11-18 10:05:36 +01:00
Sebastiaan van Stijn 67bcfe699a
copy containerd.UnknownExitStatus to local const
Copy this const to a local constant to prevent importing the containerd
client in the front-end.

For consistency, I also updated the executor code to use the same const,
although not strictly needed.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-11-18 00:11:09 +01:00
Tonis Tiigi bdcee17437 executor: change mount to struct
Allows readonly passed cleanly.

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
2020-11-02 22:20:51 -08:00
Tonis Tiigi e3b05289d8 add session injection to remote loading
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
2020-11-02 22:20:44 -08:00
Cory Bennett 43d59b4aa1 update go-runc mod, use runc Started chan
Signed-off-by: Cory Bennett <cbennett@netflix.com>
2020-10-21 19:12:56 +00:00
Akihiro Suda dda009a58c
Merge pull request #1739 from tonistiigi/empty-layer
clear file mount stubs and fix empty layer cases
2020-10-21 00:42:45 +09:00
Cory Bennett b464f1e315 update go-runc to use runc.ExitError for container exec status
Signed-off-by: Cory Bennett <cbennett@netflix.com>
2020-10-20 06:44:29 +00:00
Edgar Lee 5eaecb905c
Merge pull request #1731 from coryb/issue-1714
add tty support for runc executor
2020-10-19 14:52:31 -07:00
Cory Bennett 74db85d357 syscall.Errno(0x5) == syscall.EIO
Signed-off-by: Cory Bennett <cbennett@netflix.com>
2020-10-19 21:28:39 +00:00
Tonis Tiigi 17b4ca1edf executor: remove stub files from rootfs
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
2020-10-18 23:39:17 -07:00
Cory Bennett e308ef7874 add tty support for runc executor
Signed-off-by: Cory Bennett <cbennett@netflix.com>
2020-10-16 17:36:56 +00:00
Lu Jingxiao 5e7ae230b2 Add hostname specifying for building
Fix: #1301

Signed-off-by: Lu Jingxiao <lujingxiao@huawei.com>
2020-10-14 14:45:36 +08:00
Cory Bennett 355e937e15 update gateway to add ability to run and exec into containers
Signed-off-by: Cory Bennett <cbennett@netflix.com>
2020-08-31 21:13:59 +00:00
Cory Bennett 19c0077b49 update container resize events in sequence, also move it out of exit/cancel loop to prevent blocking.
Signed-off-by: Cory Bennett <cbennett@netflix.com>
2020-08-03 01:37:38 +00:00
Cory Bennett 86e246a874 only warn on resize errors
prevent resize from blocking exit
fix edgecase where kill signal never reaches process

Signed-off-by: Cory Bennett <cbennett@netflix.com>
2020-08-01 22:40:57 +00:00
Cory Bennett f781f83a89 fix containerd executor Run/Exec to close container input on eof from stdin
Signed-off-by: Cory Bennett <cbennett@netflix.com>
2020-08-01 17:21:40 +00:00
Cory Bennett 93344a9d24 remove *pixel from winsize struct, tweak ExitError handling for ctx.Err
Signed-off-by: Cory Bennett <cbennett@netflix.com>
2020-07-31 20:22:12 +00:00
Cory Bennett 4b456f17f4 wrap errors from executor Run/Exec to allow access to exit code
Signed-off-by: Cory Bennett <cbennett@netflix.com>
2020-07-31 19:14:30 +00:00
Paul "TBBle" Hampson 603e1d7100 Don't ignore failure to setup networking
Signed-off-by: Paul "TBBle" Hampson <Paul.Hampson@Pobox.com>
2020-07-31 02:49:39 +10:00
Paul "TBBle" Hampson 8cd927c788 Refactor OCI Spec generation to use oci.SpecOpts more
This has the nice side-effect of unifying the mount- and
non-mount-changes made due to processMode and securityMode.

Signed-off-by: Paul "TBBle" Hampson <Paul.Hampson@Pobox.com>
2020-07-31 02:49:39 +10:00
Paul "TBBle" Hampson 59edca02f3 Fix linter warning about comment mismatch
Signed-off-by: Paul "TBBle" Hampson <Paul.Hampson@Pobox.com>
2020-07-31 02:49:39 +10:00
Paul "TBBle" Hampson 1527525110 Unify OCI Spec generation across all host platforms
There's only a couple of things that are host-platform limited, i.e.,
security and process modes.

Everything else is specific to a target-platform. We can tell if we're
targeting a Linux platform, either on Linux or LCOW, by the presence of
the Linux key in the generated spec.

This doesn't introduce support for LCOW, as we'd need to plumb that down
from the caller. It will probably also need massaging to work with LCOW,
as some of the setup code here is probably incorrect for LCOW, e.g.,
the bind-mounts list may be incorrect.

Signed-off-by: Paul "TBBle" Hampson <Paul.Hampson@Pobox.com>
2020-07-31 02:49:23 +10:00
Sebastiaan van Stijn f26452a847
executor/oci.GetUser(): remove unused context
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-07-30 11:31:03 +02:00
Paul "TBBle" Hampson 9fd4d731d6 Fix oci.hasPrefix to operate correctly on Windows
Due to use of filepath.Clean(), on Windows we end up operating on the
paths in Windows-slashed form, even if the inputs were Unix-slashed.

Signed-off-by: Paul "TBBle" Hampson <Paul.Hampson@Pobox.com>
2020-07-28 18:07:20 +10:00
Paul "TBBle" Hampson 13bf35d640 Run all the hasPrefix test-cases, even if one fails
This makes it easier to see what's gone wrong if they start failing.

Signed-off-by: Paul "TBBle" Hampson <Paul.Hampson@Pobox.com>
2020-07-28 18:07:20 +10:00
Tonis Tiigi 57a88b0afb lint: add misspell and unused
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
2020-07-18 08:13:57 -07:00
Cory Bennett caac945788 update godoc for Executor interface
Signed-off-by: Cory Bennett <cbennett@netflix.com>
2020-07-13 20:16:21 +00:00
Cory Bennett 5909d1642e simplify done channel handling, fix other pr comments.
Signed-off-by: Cory Bennett <cbennett@netflix.com>
2020-07-11 01:14:37 +00:00
Cory Bennett 5e91dff4ed fix error handling for exec when container fails to start
update run/exec tests for stdin and expected failures
move common tests for runc and container to shared tests package

Signed-off-by: Cory Bennett <cbennett@netflix.com>
2020-07-10 22:06:42 +00:00
Cory Bennett 6d58121c11 Update Executor interface for Run and Exec
Signed-off-by: Cory Bennett <cbennett@netflix.com>
2020-07-09 23:40:36 +00:00
Chanhun Jeong d3d9abb100 fix mount options for userns env
Signed-off-by: Chanhun Jeong <chanhun.jeong@navercorp.com>
Signed-off-by: Sunho Kim <z.sunno@navercorp.com>
2020-06-05 03:52:00 +09:00
Sebastiaan van Stijn 3ddd1fc23c
Fix goimports linting
```
[5/5] RUN --mount=target=/go/src/github.com/moby/buildkit 	gometalinter ...
0.435 util/rootless/specconv/specconv_linux.go:1:⚠️ file is not goimported (goimports)
1.320 cache/manager.go:1:⚠️ file is not goimported (goimports)
1.335 cache/manager_test.go:1:⚠️ file is not goimported (goimports)
1.337 cache/migrate_v2.go:1:⚠️ file is not goimported (goimports)
1.342 cache/refs.go:1:⚠️ file is not goimported (goimports)
1.454 cache/remotecache/registry/registry.go:1:⚠️ file is not goimported (goimports)
2.285 cmd/buildctl/build.go:1:⚠️ file is not goimported (goimports)
3.082 executor/oci/user.go:1:⚠️ file is not goimported (goimports)
4.333 session/content/content_test.go:1:⚠️ file is not goimported (goimports)
4.614 snapshot/containerd/content.go:1:⚠️ file is not goimported (goimports)
4.721 solver/errdefs/vertex.go:1:⚠️ file is not goimported (goimports)
6.066 util/network/cniprovider/cni.go:1:⚠️ file is not goimported (goimports)
ERROR: executor failed running [/bin/sh -c gometalinter --config=gometalinter.json ./...]: buildkit-runc did not terminate successfully
```

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-05-13 17:38:56 +02:00
Tonis Tiigi 90288ab716 errdefs: update to new packages
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
2020-04-24 11:25:44 -07:00
Tonis Tiigi 37b8832d00 upgrade errors checks to Is()
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
2020-04-18 22:53:38 -07:00
Tonis Tiigi fc186a8b89 oci: mount whitelist of devices on insecure security mode
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
2020-01-30 13:07:29 -08:00
Paul "TBBle" Hampson b9cf317850 Distinguish containerd failure from process exit code
Signed-off-by: Paul "TBBle" Hampson <Paul.Hampson@Pobox.com>
2020-01-30 00:39:11 +11:00
Tibor Vass 1571380b2d executor/oci: fix panic when resolv.conf does not exist
Signed-off-by: Tibor Vass <tibor@docker.com>
2019-10-10 23:24:17 +00:00
Tibor Vass 0696bf3885 executor/oci: add TestResolvConfNotExist
Signed-off-by: Tibor Vass <tibor@docker.com>
2019-10-10 23:24:17 +00:00
Tonis Tiigi 0ef435687b runcexecutor: update go-runc call after contract change
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
2019-09-11 10:57:51 -07:00
Akihiro Suda 5559a45319
Merge pull request #1139 from tonistiigi/oomscoreadj
runcexecutor: avoid setting oomscoreadj from main process
2019-08-19 15:17:59 +09:00
Tonis Tiigi a0dead0809 fix possible double release on mountable
Refactor the interface to avoid such issues in the future.

BuildKit own mounts are stateless and not affected but
a different mountable implementation could get confused.

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
2019-08-16 08:03:16 -07:00
Tonis Tiigi 25ebc26d21 runcexecutor: avoid setting oomscoreadj from main process
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
2019-08-15 23:16:02 -07:00
Tonis Tiigi 2cd19dbc34 executor: ignore workdir if already exists
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
2019-07-26 16:28:43 -07:00
Andrey Smirnov 5dbb31a212 Use oci.With helpers
Signed-off-by: Andrey Smirnov <smirnov.andrey@gmail.com>
2019-07-18 17:35:31 +03:00
Andrey Smirnov 0abd2ca506 Fix updating /sys/fs/cgroup mount to 'rw'
There were two bugs: Mount was matched by Type which is actually
`cgroup`, not `sysfs`. And the second problem was that copy of the value
was modified, not value in the slice.

Signed-off-by: Andrey Smirnov <smirnov.andrey@gmail.com>
2019-07-18 01:09:58 +03:00
Tibor Vass 144958f91d executor/oci: compile on windows
Signed-off-by: Tibor Vass <tibor@docker.com>
2019-07-09 23:38:42 +00:00
Tibor Vass 8e692507ee executor: allow setting DNSConfig to be used by resolvconf
This patch allows downstream code to pass a DNSConfig that is
then used by executor/oci.GetResolvConf.

This would allow the BuildKit-based builder in Docker to honor
the docker daemon's DNS configuration, thus fixing a feature gap
with the legacy builder.

Signed-off-by: Tibor Vass <tibor@docker.com>
2019-06-17 20:43:33 +00:00
Tonis Tiigi 7b41906d89 executor: create hosts and resolv.conf with userns root
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
2019-06-10 16:35:03 -07:00