Kernel 6.12.80+ returns 'fsync=volatile' instead of just 'volatile'
in mount options, which breaks containerd's exact string matching
checks.
Fixes this issue by adding support for 'fsync=volatile' in addition
to the existing 'volatile' check in RemoveVolatileOption and
addVolatileOptionOnImageVolumeMount.
Assisted-by: Antigravity
Signed-off-by: Chris Henzie <chrishenzie@gmail.com>
If a Dockerfile is using a `VOLUME` directive and the directory exists
in the rootfs, like in this example:
FROM docker.io/library/alpine:latest
VOLUME [ "/run" ]
The alpine container image already contains a "/run" directory. This
will force the code in WithVolumes() to copy its content to the new
volume created for the VOLUME directive. This copies the content as well
as the ownership.
However, as we perform the mounts from the host POV without being inside
a userns, the idmap option will just shift the IDs in ways that will
screw up the ownerships when copied. We should only use the idmap option
when running the container inside a userns, so the ownerships are fine
(the userns will do a shift and the idmap another, to make it all seem
as if there was no UID/GID shift in the first place).
This PR does just that, remove the idmap option from mounts so we copy
the files without any ID transformations. It's simpler and easier to
reason about if we just don't mount with the idmap option here: all
files are copied just fine without ID transformations and ID
transformation is applied via the idmap option at mount time when
running the pod.
Also, note that `VOLUME` directives that refer to directories that don't
exist on the rootfs work fine (`VOLUME [ "/rata" ]` for example), as
there is no copy done in that case so the permissions weren't changed.
Signed-off-by: Rodrigo Campos <rodrigoca@microsoft.com>
Signed-off-by: krglosse <krglosse@us.ibm.com>
do not alter original slice
Signed-off-by: krglosse <krglosse@us.ibm.com>
Update core/mount/temp.go
makes sense, thank you!
Co-authored-by: Derek McGowan <derek@mcg.dev>
Signed-off-by: KodieGlosserIBM <39170759+KodieGlosserIBM@users.noreply.github.com>
do not copy mount structure unless conditional is met and adding a test case for it
Signed-off-by: krglosse <krglosse@us.ibm.com>
copy option slice when removing the element instead of giving the element an empty string
remove unneeded block
Signed-off-by: krglosse <krglosse@us.ibm.com>
simplify
Signed-off-by: krglosse <krglosse@us.ibm.com>
Chris Henzie