mirror of
https://github.com/containerd/containerd.git
synced 2026-11-06 05:17:02 +00:00
Maksym Pavlenko
be6ce30fce
A sandbox controller that reports pid 0 has no process whose /proc/<pid>/ns entries a container could join and no pause container whose shared files CRI created. Such a sandbox describes what it holds in the spec it returns on start. When the sandbox status reports pid 0, load that spec from the sandbox store and use it in two places. The pod namespaces come from its Linux.Namespaces: a namespace listed there is joined by path, one that is missing is the host namespace when the pod asked for it and an error otherwise, and a PID namespace entry without a path declares that each container gets its own. The pod shared files (/etc/hostname, /etc/hosts, /etc/resolv.conf, /dev/shm) are bind-mounted from the spec mount sources when nothing exists at the fixed CRI paths, which keep precedence. Sandboxes with a pid keep the pid derived construction unchanged, and so do Sandbox API shims that report pid 0 without a Linux section in their spec, so existing shims see no change. Signed-off-by: Maksym Pavlenko <pavlenko.maksym@gmail.com>