From 6521057bb2bbfc483baf154457b38ad140136bc4 Mon Sep 17 00:00:00 2001 From: Sebastiaan van Stijn Date: Fri, 28 Jun 2024 12:36:56 +0200 Subject: [PATCH] daemon/graphdriver/overlay2: set TarOptions.InUserNS for native differ Commits b2fd67de77be8692ff343d26a9819a3c42ef8c2f (and the follow-up commit f6b80253b8bfc04b9a6ef0e6bd73e44d36778046) updated doesSupportNativeDiff to detect whether the host can support native overlay diffing with userns enabled. As a result, [useNaiveDiff] would now return "false" in cases where it previously would return "true" (and thus skip). However, [overlay2], unlike [fuse-overlay] did not take user namespaces into account, when using the native differ, and it therefore did not set the InUserNS option in TarOptions. As a result pkg/archive.createTarFile would attempt tocreate [device-nodes] through [handleTarTypeBlockCharFifo] which would fail, but the resulting error `EPERM` would be discarded, and `createTarFile` would not return early, therefor attempting to [os.LChown] the missing file, ultimately resulting in an error: failed to Lchown "/dev/console" for UID 0, GID 0: lchown /dev/console: no such file or directory This patch fixes the missing option in overlay. [useNaiveDiff]: https://github.com/moby/moby/blob/47eebd718f332f29a38455b61ee879ced5bc219b/daemon/graphdriver/overlay2/overlay.go#L248-L256 [overlay2]: https://github.com/moby/moby/blob/47eebd718f332f29a38455b61ee879ced5bc219b/daemon/graphdriver/overlay2/overlay.go#L684-L689 [fuse-overlay]: https://github.com/moby/moby/blob/47eebd718f332f29a38455b61ee879ced5bc219b/daemon/graphdriver/fuse-overlayfs/fuseoverlayfs.go#L456-L462 [device-nodes]: https://github.com/moby/moby/blob/ff1e2c0de72a1bbbe4cdbe1558da57d327899df5/pkg/archive/archive.go#L713-L720 [handleTarTypeBlockCharFifo]: https://github.com/moby/moby/blob/47eebd718f332f29a38455b61ee879ced5bc219b/pkg/archive/archive_unix.go#L110-L114 [os.LChown]: https://github.com/moby/moby/blob/ff1e2c0de72a1bbbe4cdbe1558da57d327899df5/pkg/archive/archive.go#L762-L773 Signed-off-by: Sebastiaan van Stijn --- daemon/graphdriver/overlay2/overlay.go | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/daemon/graphdriver/overlay2/overlay.go b/daemon/graphdriver/overlay2/overlay.go index 4cf157e90f..c88dbe36b3 100644 --- a/daemon/graphdriver/overlay2/overlay.go +++ b/daemon/graphdriver/overlay2/overlay.go @@ -14,6 +14,7 @@ import ( "strings" "sync" + "github.com/containerd/containerd/pkg/userns" "github.com/containerd/continuity/fs" "github.com/containerd/log" "github.com/docker/docker/daemon/graphdriver" @@ -678,7 +679,6 @@ func (d *Driver) ApplyDiff(id string, parent string, diff io.Reader) (size int64 return d.naiveDiff.ApplyDiff(id, parent, diff) } - // never reach here if we are running in UserNS applyDir := d.getDiffPath(id) logger.Debugf("Applying tar in %s", applyDir) @@ -686,6 +686,7 @@ func (d *Driver) ApplyDiff(id string, parent string, diff io.Reader) (size int64 if err := untar(diff, applyDir, &archive.TarOptions{ IDMap: d.idMap, WhiteoutFormat: archive.OverlayWhiteoutFormat, + InUserNS: userns.RunningInUserNS(), }); err != nil { return 0, err }