rootless: use nsfs file handles to persist namespaces #27880
Conversation
giuseppe
force-pushed
the
drop-pause-process
branch
10 times, most recently
from
88d18ef to
65d8b55
Compare
|
[NON-BLOCKING] Packit jobs failed. @containers/packit-build please check. Everyone else, feel free to ignore. |
2 similar comments
|
[NON-BLOCKING] Packit jobs failed. @containers/packit-build please check. Everyone else, feel free to ignore. |
|
[NON-BLOCKING] Packit jobs failed. @containers/packit-build please check. Everyone else, feel free to ignore. |
giuseppe
force-pushed
the
drop-pause-process
branch
2 times, most recently
from
d53f620 to
0dcca5e
Compare
giuseppe
changed the title
|
@containers/podman-maintainers tests are passing, ready for review |
libpod/runtime_migrate_linux.go
Outdated
| } | ||
|
|
||
| nsHandlesPath := rootless.GetNamespaceHandlesPath(stateDir) | ||
| _ = os.Remove(nsHandlesPath) |
There was a problem hiding this comment.
should this be logged in any way?
|
|
||
| // GetNamespaceHandlesPath returns the path to the namespace handles file | ||
| // in the given state directory. | ||
| func GetNamespaceHandlesPath(stateDir string) string { |
There was a problem hiding this comment.
would it be good to drop a couple of unit tests here to prevent regression?
|
LGTM, I had a couple of sideways questions that you can decide on ... we should get somebody with more C to review this too. |
pkg/rootless/rootless_linux.c
Outdated
| int p[2]; | ||
| char pause_pid_file_path[PATH_MAX]; | ||
|
|
||
| snprintf (pause_pid_file_path, PATH_MAX, "%s/pause.pid", state_dir); |
There was a problem hiding this comment.
Would it make sense to also check for PATH_MAX here?
if (ret >= PATH_MAX)
{
errno = ENAMETOOLONG;
return -1;
}
|
What does this look like when upgrading from an older Podman without a restart? Will the user need a |
giuseppe
force-pushed
the
drop-pause-process
branch
from
0dcca5e to
86f39f4
Compare
no, it will automatically join the pause process as we do now, then save the file with the handles. There is no manual intervention required. It won't kill the pause process though, so it can be a problem if someone mixes different versions and restart the pause process |
giuseppe
force-pushed
the
drop-pause-process
branch
2 times, most recently
from
c852de4 to
fdb0407
Compare
use name_to_handle_at and open_by_handle_at to persist rootless namespaces without needing a pause process. The namespace file handles are stored in a file and can be used to rejoin the namespaces, as long as the namespaces still exist. Fall back to the pause process approach only when the kernel doesn't support nsfs handles (EOPNOTSUPP). These changes in the kernel are required (landed in Linux 6.18): https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3ab378cfa793 Signed-off-by: Giuseppe Scrivano <[email protected]>
giuseppe
force-pushed
the
drop-pause-process
branch
from
fdb0407 to
692410d
Compare
|
comments addressed |
5 participants
use name_to_handle_at and open_by_handle_at to persist rootless namespaces without needing a pause process.
The namespace file handles are stored in a file and can be used to rejoin the namespaces, as long as the namespaces still exist.
Fall back to the pause process approach only when the kernel doesn't support nsfs handles (EOPNOTSUPP).
These changes in the kernel are required (landed in Linux 6.18):
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3ab378cfa793
Checklist
Ensure you have completed the following checklist for your pull request to be reviewed:
commits. (
git commit -s). (If needed, usegit commit -s --amend). The author email must matchthe sign-off email address. See CONTRIBUTING.md
for more information.
Fixes: #00000in commit message (if applicable)make validatepr(format/lint checks)Noneif no user-facing changes)Does this PR introduce a user-facing change?