mirror of
https://github.com/moby/buildkit.git
synced 2026-08-09 17:18:11 +00:00
ddae5a6ea4
e.g. with busybox image:
OCI runtime create failed: container_linux.go:348:
starting container process caused "process_linux.go:402:
container init caused \"rootfs_linux.go:58:
mounting \\\"proc\\\" to rootfs \\\"/.../rootfs\\\" at \\\"/proc\\\"
caused \\\"mkdir /.../rootfs/proc: read-only file system\\\"\"": unknown
This is because we were setting the underlying snapshot readonly so the various
mountpoints (here /proc) cannot be created. This would not be necessary if
those mountpoints were present in images but they typically are not.
The right way to get around this (used e.g. by `ctr`) is to use a writeable
snapshot but to set root readonly in the OCI spec. In this configuration the
rootfs is writeable when mounts are processed but is then made readonly by the
runtime (runc) just before entering the user specified binary within the
container.
This involved a surprising amount of plumbing.
Use this new found ability in the dockerfile converter's `dispatchCopy`
function.
Signed-off-by: Ian Campbell <ijc@docker.com>
31 lines
556 B
Go
31 lines
556 B
Go
package executor
|
|
|
|
import (
|
|
"context"
|
|
"io"
|
|
|
|
"github.com/moby/buildkit/cache"
|
|
)
|
|
|
|
type Meta struct {
|
|
Args []string
|
|
Env []string
|
|
User string
|
|
Cwd string
|
|
Tty bool
|
|
ReadonlyRootFS bool
|
|
// DisableNetworking bool
|
|
}
|
|
|
|
type Mount struct {
|
|
Src cache.Mountable
|
|
Selector string
|
|
Dest string
|
|
Readonly bool
|
|
}
|
|
|
|
type Executor interface {
|
|
// TODO: add stdout/err
|
|
Exec(ctx context.Context, meta Meta, rootfs cache.Mountable, mounts []Mount, stdin io.ReadCloser, stdout, stderr io.WriteCloser) error
|
|
}
|