Go 1.24 introduced stricter checks for os.DirFS (via os.Root), which causes failures when /etc/passwd or /etc/group are absolute symlinks pointing outside the mount root (common in NixOS).
This patch introduces a helper that detects absolute symlinks and resolves them relative to the rootfs before opening, preventing the 'path escapes from parent' error.
Fixes#12683
Signed-off-by: Paulo Oliveira <paulo.hco47@gmail.com>
This commit makes all of the recommended changes to use the `testing`
package helper functions instead of doing the equivalent longhand
versions of the same thing.
This change was needed in order to properly detect errors, as the code
would previously skip running `tenv` stating that it had been deprecated
in favor of `usetesting`.
Signed-off-by: Enji Cooper <yaneurabeya@gmail.com>
Switch to use fs.FS interface over directly requiring path string.
Use os.OpenRoot over continuity RootPath.
Signed-off-by: Derek McGowan <derek@mcg.dev>
This variable was introduced in 062c3a00ef,
which didn't describe it as intentional to be able to override the option.
Based on the above, I assume the use of a variable was purely convenience,
the there's no intent for packages to be able to override them, so this
patch changes these to be a regular function.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These were introduced in c818a6b13d, refactored
in 808b223536 and bdd84abf05,
and moved in a2d1a8a865, but none provided
a motivation for using a variable / alias for these.
Based on the above, I assume the use of a variable was purely convenience,
the there's no intent for packages to be able to override them, so this
patch changes these to be a regular function.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
- Use testify for asserting
- Fix various unhandled errors
- Use native t.TempDir() for temporary files
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These were added as part of b7f673790f,
to provide backward compatibility with go1.16, which we no longer
supports, so we can remove this.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
- remove redundant aliases for imports
- rename variables that shadowed imports
- use errors.Is instead of straight error comparing
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Some of these options are designed to be a no-op when used on a Spec
that doesn't match the platform for the option. However, if the given
plaform was not present, they would panic.
This patch:
- Adds an early-return for options that are only applied on a
specific platform.
- Update the GoDoc for these functions to describe they're a
no-op on other platforms.
- Adds some rudimentary unit-tests to verify their behavior.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The CDI device injection spec opt was mistakenly added to the OCI
package which brought in an unintended dependency on CDI and its
transitive dependencies.
Signed-off-by: Derek McGowan <derek@mcg.dev>
Commit 8437c567d8 migrated the use of the
userns package to the github.com/moby/sys/user module.
After further discussion with maintainers, it was decided to move the
userns package to a separate module, as it has no direct relation with
"user" operations (other than having "user" in its name).
This patch migrates our code to use the new module.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The userns package in libcontainer was integrated into the moby/sys/user
module at commit [3778ae603c706494fd1e2c2faf83b406e38d687d][1].
This patch deprecates the containerd fork of that package, and adds it as
an alias for the moby/sys/user/userns package.
[1]: 3778ae603c
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
There's a couple spots where we know exactly how large
the destination buffer should be, so pre-size these to
avoid any reallocs to a higher capacity.
Signed-off-by: Danny Canter <danny@dcantah.dev>
Allow the api to stay at the same v1 go package name and keep using a
1.x version number. This indicates the API is still at 1.x and allows
sharing proto types with containerd 1.6 and 1.7 releases.
Signed-off-by: Derek McGowan <derek@mcg.dev>
This includes migrating from cdi.GetRegistry() to cdi.Configure() and
using top-level cdi Refresh and InjectDevices functions as applicable.
Signed-off-by: Evan Lezar <elezar@nvidia.com>
