Repository navigation
criu: handle the devices of a container with a user namespace - #2465
Merged
Merged
Conversation
With a user namespace the default devices are bind mounted from the host, also over a device with the same path in the configuration, hiding it. Without a user namespace the existing device is kept instead. Skip the default devices that are in the configuration. Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
A container with a user namespace cannot create device nodes, so they are bind mounted: the devices in the configuration from a tmpfs where crun creates them, the default devices from the host. CRIU was only told about the bind mounts listed in the configuration, so the checkpoint failed with: mnt: ./dev/urandom doesn't have a proper root mount Tell CRIU about the devices bind mounts explicitly, as runc does. On restore, create the devices in the configuration again on a tmpfs and give them to CRIU as the sources of their mounts, and restore the nosuid,noexec flags on all of them. Add checkpoint/restore tests with a user namespace, with and without devices in the configuration. Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
|
Ephemeral COPR build failed. @containers/packit-build please check. |
giuseppe
approved these changes
Nov 11, 2026
giuseppe
left a comment
giuseppe
left a comment
Member
There was a problem hiding this comment.
this is better, thanks!
LGTM
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This is an alternative to #2463, using a different approach:
linux.devicesagain on a tmpfs(sharing the code with create) and gives them to CRIU as the sources;
nosuid,noexecon the restored device mounts, like on theother external mounts;
device (e.g.
/dev/null) bind mounted from the host was hiding a devicewith the same path from
linux.devices, ignoring its owner and mode.The
has_user_namespacehelper and thecheckpoint-restore-usernstestare taken from #2463.
Not covered: a container with a user namespace but without a network
namespace bind mounts the host
/sys, and its checkpoint still fails(with either approach) on the submounts like selinuxfs.