mirror of
https://github.com/containers/podman.git
synced 2025-05-20 00:27:03 +08:00
e66b788a51
This solves several problems with copying into volumes on a container that is not running. The first, and most obvious, is that we were previously entirely unable to copy into a volume that required mounting - like image volumes, volume plugins, and volumes that specified mount options. The second is that this fixed several permissions and content issues with a fresh volume and a container that has not been run before. A copy-up will not have occurred, so permissions on the volume root will not have been set and content will not have been copied into the volume. If the container is running, this is very low cost - we maintain a mount counter for named volumes, so it's just an increment in the DB if the volume actually needs mounting, and a no-op if it doesn't. Unfortunately, we also have to fix permissions, and that is rather more complicated. This involves an ugly set of manual edits to the volume state to ensure that the permissions fixes actually worked, as the code was never meant to be used in this way. It's really ugly, but necessary to reach full Docker compatibility. Fixes #24405 Signed-off-by: Matthew Heon <matthew.heon@pm.me>
91 lines
2.1 KiB
Go
91 lines
2.1 KiB
Go
//go:build !remote
|
|
|
|
package libpod
|
|
|
|
import (
|
|
"fmt"
|
|
"os"
|
|
"runtime"
|
|
|
|
"github.com/containers/podman/v5/libpod/define"
|
|
"golang.org/x/sys/unix"
|
|
)
|
|
|
|
// joinMountAndExec executes the specified function `f` inside the container's
|
|
// mount and PID namespace. That allows for having the exact view on the
|
|
// container's file system.
|
|
//
|
|
// Note, if the container is not running `f()` will be executed as is.
|
|
func (c *Container) joinMountAndExec(f func() error) error {
|
|
if c.state.State != define.ContainerStateRunning {
|
|
return f()
|
|
}
|
|
|
|
// Container's running, so we need to execute `f()` inside its mount NS.
|
|
errChan := make(chan error)
|
|
go func() {
|
|
runtime.LockOSThread()
|
|
|
|
// Join the mount and PID NS of the container.
|
|
getFD := func(ns LinuxNS) (*os.File, error) {
|
|
nsPath, err := c.namespacePath(ns)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
return os.Open(nsPath)
|
|
}
|
|
|
|
mountFD, err := getFD(MountNS)
|
|
if err != nil {
|
|
errChan <- err
|
|
return
|
|
}
|
|
defer mountFD.Close()
|
|
|
|
inHostPidNS, err := c.inHostPidNS()
|
|
if err != nil {
|
|
errChan <- fmt.Errorf("checking inHostPidNS: %w", err)
|
|
return
|
|
}
|
|
var pidFD *os.File
|
|
if !inHostPidNS {
|
|
pidFD, err = getFD(PIDNS)
|
|
if err != nil {
|
|
errChan <- err
|
|
return
|
|
}
|
|
defer pidFD.Close()
|
|
}
|
|
|
|
if err := unix.Unshare(unix.CLONE_NEWNS); err != nil {
|
|
errChan <- err
|
|
return
|
|
}
|
|
|
|
if pidFD != nil {
|
|
if err := unix.Setns(int(pidFD.Fd()), unix.CLONE_NEWPID); err != nil {
|
|
errChan <- err
|
|
return
|
|
}
|
|
}
|
|
if err := unix.Setns(int(mountFD.Fd()), unix.CLONE_NEWNS); err != nil {
|
|
errChan <- err
|
|
return
|
|
}
|
|
|
|
// Last but not least, execute the workload.
|
|
errChan <- f()
|
|
}()
|
|
return <-errChan
|
|
}
|
|
|
|
func (c *Container) resolveCopyTarget(mountPoint string, containerPath string) (string, string, *Volume, error) {
|
|
// If the container is running, we will execute the copy
|
|
// inside the container's mount namespace so we return a path
|
|
// relative to the container's root.
|
|
if c.state.State == define.ContainerStateRunning {
|
|
return "/", c.pathAbs(containerPath), nil, nil
|
|
}
|
|
return c.resolvePath(mountPoint, containerPath)
|
|
}
|