Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

runc's poststart behaviour doesn't match the runtime-spec #4347

Open
ningmingxiao opened this issue Jul 15, 2024 · 3 comments
Open

runc's poststart behaviour doesn't match the runtime-spec #4347

ningmingxiao opened this issue Jul 15, 2024 · 3 comments
Labels
Milestone

Comments

@ningmingxiao
Copy link

ningmingxiao commented Jul 15, 2024

Description

poststart run into runc create stage. doesn't match the runtime-spec
the spec say "poststart after the user-specified process is executed but before the start operation returns"
https://github.com/opencontainers/runtime-spec/blob/v1.2.0/config.md#poststart

Steps to reproduce the issue

config.json

{
    "ociVersion": "1.0.2-dev",
    "process": {
            "terminal": false,
            "user": {
                    "uid": 0,
                    "gid": 0
            },
            "args": [
                    "sh"
            ],
            "env": [
                    "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
                    "TERM=xterm"
            ],
            "cwd": "/",
            "capabilities": {
                    "bounding": [
                            "CAP_AUDIT_WRITE",
                            "CAP_KILL",
                            "CAP_NET_BIND_SERVICE"
                    ],
                    "effective": [
                            "CAP_AUDIT_WRITE",
                            "CAP_KILL",
                            "CAP_NET_BIND_SERVICE"
                    ],
                    "permitted": [
                            "CAP_AUDIT_WRITE",
                            "CAP_KILL",
                            "CAP_NET_BIND_SERVICE"
                    ],
                    "ambient": [
                            "CAP_AUDIT_WRITE",
                            "CAP_KILL",
                            "CAP_NET_BIND_SERVICE"
                    ]
            },
            "rlimits": [
                    {
                            "type": "RLIMIT_NOFILE",
                            "hard": 1024,
                            "soft": 1024
                    }
            ],
            "noNewPrivileges": true
    },
    "root": {
            "path": "rootfs",
            "readonly": false
    },
    "hostname": "runc",
    "mounts": [
            {
                    "destination": "/proc",
                    "type": "proc",
                    "source": "proc"
            },
            {
                    "destination": "/dev",
                    "type": "tmpfs",
                    "source": "tmpfs",
                    "options": [
                            "nosuid",
                            "strictatime",
                            "mode=755",
                            "size=65536k"
                    ]
            },
            {
                    "destination": "/dev/pts",
                    "type": "devpts",
                    "source": "devpts",
                    "options": [
                            "nosuid",
                            "noexec",
                            "newinstance",
                            "ptmxmode=0666",
                            "mode=0620"
                    ]
            },
            {
                    "destination": "/dev/shm",
                    "type": "tmpfs",
                    "source": "shm",
                    "options": [
                            "nosuid",
                            "noexec",
                            "nodev",
                            "mode=1777",
                            "size=65536k"
                    ]
            },
            {
                    "destination": "/dev/mqueue",
                    "type": "mqueue",
                    "source": "mqueue",
                    "options": [
                            "nosuid",
                            "noexec",
                            "nodev"
                    ]
            },
            {
                    "destination": "/sys",
                    "type": "sysfs",
                    "source": "sysfs",
                    "options": [
                            "nosuid",
                            "noexec",
                            "nodev",
                            "ro"
                    ]
            },
            {
                    "destination": "/sys/fs/cgroup",
                    "type": "cgroup",
                    "source": "cgroup",
                    "options": [
                            "nosuid",
                            "noexec",
                            "nodev",
                            "relatime",
                            "ro"
                    ]
            }
    ],
    "hooks": {
            "poststart": [
                {
                    "path": "/usr/bin/sleep",
                    "args":  ["/usr/bin/sleep","10"]
                }
            ]
    },
    "linux": {
            "resources": {
                    "devices": [
                            {
                                    "allow": false,
                                    "access": "rwm"
                            }
                    ]
            },
            "uidMappings": [
                    {
                            "containerID": 0,
                            "hostID": 1000,
                            "size": 1
                    }
            ],
            "gidMappings": [
                    {
                            "containerID": 0,
                            "hostID": 1000,
                            "size": 1
                    }
            ],
            "namespaces": [
                    {
                            "type": "pid"
                    },
                    {
                            "type": "network"
                    },
                    {
                            "type": "ipc"
                    },
                    {
                            "type": "uts"
                    },
                    {
                            "type": "mount"
                    }
            ],
            "maskedPaths": [
                    "/proc/acpi",
                    "/proc/asound",
                    "/proc/kcore",
                    "/proc/keys",
                    "/proc/latency_stats",
                    "/proc/timer_list",
                    "/proc/timer_stats",
                    "/proc/sched_debug",
                    "/sys/firmware",
                    "/proc/scsi"
            ],
            "readonlyPaths": [
                    "/proc/bus",
                    "/proc/fs",
                    "/proc/irq",
                    "/proc/sys",
                    "/proc/sysrq-trigger"
            ]
    }
}

I set

            "Poststart": [
                {
                    "path": "/usr/bin/sleep",
                    "args":  ["/usr/bin/sleep","10"]
                }
[root@localhost mycontainer]# time runc create test0001

real    0m10.199s
user    0m0.010s
sys     0m0.035s

that means poststart run in create stage.

Describe the results you received and expected

match runtime-spec

What version of runc are you using?

1.1.12

Host OS information

linux

Host kernel information

any

@ningmingxiao ningmingxiao changed the title runc's postart behaviour doesn't match the runtime-spec runc's posstart behaviour doesn't match the runtime-spec Jul 15, 2024
@ningmingxiao ningmingxiao changed the title runc's posstart behaviour doesn't match the runtime-spec runc's poststart behaviour doesn't match the runtime-spec Jul 15, 2024
@cyphar
Copy link
Member

cyphar commented Jul 15, 2024

Previous discussion in runtime-spec: opencontainers/runtime-spec#1259

@kolyshkin
Copy link
Contributor

Moved the milestone to 1.2.0.

@cyphar cyphar modified the milestones: 1.2.0, 1.3.0 Oct 21, 2024
@cyphar
Copy link
Member

cyphar commented Oct 21, 2024

Moved the milestone to 1.3.0. Dealing with this is going to take a while, and we should just get 1.2.0 out (this is a pre-existing issue anyway).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

4 participants