Switch to use fs.FS interface over directly requiring path string.
Use os.OpenRoot over continuity RootPath.
Signed-off-by: Derek McGowan <derek@mcg.dev>
UnshareAfterEnterUserns() creates a pidfd via os.StartProcess() with
CLONE_PIDFD but fails to close the file descriptor in any code path,
resulting in a file descriptor leak for every container that uses user
namespace isolation.
The leak occurs because:
- The pidfd is created when PidFD field is set in SysProcAttr
- The original defer block only calls PidfdSendSignal() and
pidfdWaitid()
- No code path calls unix.Close(pidfd) to release the file descriptor
This causes one pidfd leak per container launch when user namespace
isolation is enabled (e.g., Kubernetes pods with hostUsers: false). In
production environments with high container churn, this can exhaust the
system's file descriptor limit.
Fix the leak by adding a defer statement immediately after process
creation that ensures unix.Close(pidfd) is always called, regardless of
which code path is taken. This guarantees cleanup even if the function
returns early due to errors or lack of pidfd support.
This follows the same cleanup pattern already established in
core/mount/mount_idmapped_utils_linux.go:getUsernsFD() which properly
closes its pidfd.
Closes: #12166
Signed-off-by: Jose Fernandez <josef@netflix.com>
Now that we have 1.24.x as go min version, I think
we can remove this go code specific to a lower
version.
Signed-off-by: Jin Dong <djdongjin95@gmail.com>
This variable was introduced in 062c3a00ef,
which didn't describe it as intentional to be able to override the option.
Based on the above, I assume the use of a variable was purely convenience,
the there's no intent for packages to be able to override them, so this
patch changes these to be a regular function.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These were introduced in c818a6b13d, refactored
in 808b223536 and bdd84abf05,
and moved in a2d1a8a865, but none provided
a motivation for using a variable / alias for these.
Based on the above, I assume the use of a variable was purely convenience,
the there's no intent for packages to be able to override them, so this
patch changes these to be a regular function.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
- Use testify for asserting
- Fix various unhandled errors
- Use native t.TempDir() for temporary files
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These were added as part of b7f673790f,
to provide backward compatibility with go1.16, which we no longer
supports, so we can remove this.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
- remove redundant aliases for imports
- rename variables that shadowed imports
- use errors.Is instead of straight error comparing
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Some of these options are designed to be a no-op when used on a Spec
that doesn't match the platform for the option. However, if the given
plaform was not present, they would panic.
This patch:
- Adds an early-return for options that are only applied on a
specific platform.
- Update the GoDoc for these functions to describe they're a
no-op on other platforms.
- Adds some rudimentary unit-tests to verify their behavior.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Rather than exiting early with an error, just output that the content
does not exist locally and continue. This is helpful for displaying
multiplatform images when the content for every platform was not pulled.
If a platform that did not exist locally showed up before one that did,
the inspect would error out before even showing the content.
Signed-off-by: Derek McGowan <derek@mcg.dev>
- internal/cri/bandwidth: use lazyregexp to compile regexes on first use
- pkg/identifiers: use lazyregexp to compile regexes on first use
- pkg/progress: use lazyregexp to compile regexes on first use
- pkg/reference: use lazyregexp to compile regexes on first use
- pkg/sys: use lazyregexp to compile regexes on first use
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
We going to release v2.1 earlier than we have once expected at that time,
so extend the grace period for migration.
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
Schema 1 (`application/vnd.docker.distribution.manifest.v1+prettyjws`) has been
officially deprecated since containerd v1.7 (PR 6884), and disabled since v2.0 (PR 9765).
Users who have been seeing warnings like `conversion from schema 1 images is deprecated`
now have to rebuild the image with Schema 2 or OCI.
Schema 2 was introduced in Docker 1.10 (Feb 2016), so most users should have been already
using Schema 2 or OCI.
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
To make it as DEPRECATED, this PR does the following:
1. Changes config default to use `NetworkPluginBinDirs`;
2. Mark `NetworkPluginBinDir` as deprecated (in config version 3);
3. Add config migration from 2 to 3, which migrates `bin_dir`
in version 2 to `bin_dirs` in version 3.
Signed-off-by: Jin Dong <djdongjin95@gmail.com>
[wip] add deprecation warning
Signed-off-by: Jin Dong <djdongjin95@gmail.com>
This test produces zombies when PID 1 does not properly reap child
processes. Modifies the test to ignore these processes in the meantime.
Signed-off-by: Chris Henzie <chrishenzie@google.com>
