mirror of
https://github.com/containerd/containerd.git
synced 2026-11-06 05:17:02 +00:00
Maksym Pavlenko
16d7ff4f1a
A minimal PID 1 for the PID namespace of a pod that shares it, run by containerd-shim-sandboxed-runc-v2 in place of a pause container. It stays alive so that the namespace does, ignores SIGCHLD so that the kernel reaps the orphans reparented to it, and removes every signal handler so that nothing sent from inside the pod can end it or run code in it: the kernel drops a signal sent to the init of a PID namespace when init has no handler for it. The Go runtime installs handlers for almost every signal, including the synchronous faults, SIGPROF and the signals 32 and 33 that os/signal cannot reset, so those go back to the default disposition, or are ignored for the others, through rt_sigaction. Only SIGKILL from the parent namespace ends it. It makes itself non-dumpable, so that the other processes of the pod can neither ptrace it nor open its /proc entries without CAP_SYS_PTRACE. It runs with one P, no garbage collector and parks in pause(2). It is built static like the shims and installed with them. Signed-off-by: Maksym Pavlenko <pavlenko.maksym@gmail.com>
36 lines
1.0 KiB
Makefile
36 lines
1.0 KiB
Makefile
# Copyright The containerd Authors.
|
|
|
|
# Licensed under the Apache License, Version 2.0 (the "License");
|
|
# you may not use this file except in compliance with the License.
|
|
# You may obtain a copy of the License at
|
|
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
# Unless required by applicable law or agreed to in writing, software
|
|
# distributed under the License is distributed on an "AS IS" BASIS,
|
|
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
# See the License for the specific language governing permissions and
|
|
# limitations under the License.
|
|
|
|
|
|
#linux specific settings
|
|
WHALE="+"
|
|
ONI="-"
|
|
COMMANDS += containerd-shim-runc-v2
|
|
COMMANDS += containerd-shim-sandboxed-runc-v2
|
|
COMMANDS += containerd-sandbox-init
|
|
|
|
# check GOOS for cross compile builds
|
|
ifeq ($(GOOS),linux)
|
|
ifneq ($(GOARCH),$(filter $(GOARCH),mips mipsle mips64 mips64le ppc64 loong64))
|
|
ifeq ($(STATIC),)
|
|
GO_GCFLAGS += -buildmode=pie
|
|
endif
|
|
endif
|
|
endif
|
|
|
|
# amd64 supports go test -race
|
|
ifeq ($(GOARCH),amd64)
|
|
TESTFLAGS_RACE= -race
|
|
endif
|