mirror of
https://github.com/opencontainers/runc.git
synced 2025-10-05 15:37:02 +08:00
7dc2486889
This addresses the following TODO in the code (added back in 2015
by commit 845fc65e5):
> // TODO: fix libcontainer's API to better support uid/gid in a typesafe way.
Historically, libcontainer internally uses strings for user, group, and
additional (aka supplementary) groups.
Yet, runc receives those credentials as part of runtime-spec's process,
which uses integers for all of them (see [1], [2]).
What happens next is:
1. runc start/run/exec converts those credentials to strings (a User
string containing "UID:GID", and a []string for additional GIDs) and
passes those onto runc init.
2. runc init converts them back to int, in the most complicated way
possible (parsing container's /etc/passwd and /etc/group).
All this conversion and, especially, parsing is totally unnecessary,
but is performed on every container exec (and start).
The only benefit of all this is, a libcontainer user could use user and
group names instead of numeric IDs (but runc itself is not using this
feature, and we don't know if there are any other users of this).
Let's remove this back and forth translation, hopefully increasing
runc exec performance.
The only remaining need to parse /etc/passwd is to set HOME environment
variable for a specified UID, in case $HOME is not explicitly set in
process.Env. This can now be done right in prepareEnv, which simplifies
the code flow a lot. Alas, we can not use standard os/user.LookupId, as
it could cache host's /etc/passwd or the current user (even with the
osusergo tag).
PS Note that the structures being changed (initConfig and Process) are
never saved to disk as JSON by runc, so there is no compatibility issue
for runc users.
Still, this is a breaking change in libcontainer, but we never promised
that libcontainer API will be stable (and there's a special package
that can handle it -- github.com/moby/sys/user). Reflect this in
CHANGELOG.
For 3998.
[1]: https://github.com/opencontainers/runtime-spec/blob/v1.0.2/config.md#posix-platform-user
[2]: https://github.com/opencontainers/runtime-spec/blob/v1.0.2/specs-go/config.go#L86
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
53 lines
980 B
Go
53 lines
980 B
Go
package libcontainer
|
|
|
|
import (
|
|
"os/user"
|
|
"slices"
|
|
"strconv"
|
|
"testing"
|
|
)
|
|
|
|
func TestPrepareEnv(t *testing.T) {
|
|
u, err := user.Current()
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
home := "HOME=" + u.HomeDir
|
|
uid, err := strconv.Atoi(u.Uid)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
|
|
tests := []struct {
|
|
env, wantEnv []string
|
|
}{
|
|
{
|
|
env: []string{},
|
|
wantEnv: []string{home},
|
|
},
|
|
{
|
|
env: []string{"HOME=/whoo", "FOO=bar"},
|
|
wantEnv: []string{"HOME=/whoo", "FOO=bar"},
|
|
},
|
|
{
|
|
env: []string{"A=a", "A=b", "A=c"},
|
|
wantEnv: []string{"A=c", home},
|
|
},
|
|
{
|
|
env: []string{"TERM=vt100", "HOME=/home/one", "HOME=/home/two", "TERM=xterm", "HOME=/home/three", "FOO=bar"},
|
|
wantEnv: []string{"TERM=xterm", "HOME=/home/three", "FOO=bar"},
|
|
},
|
|
}
|
|
|
|
for _, tc := range tests {
|
|
env, err := prepareEnv(tc.env, uid)
|
|
if err != nil {
|
|
t.Error(err)
|
|
continue
|
|
}
|
|
if !slices.Equal(env, tc.wantEnv) {
|
|
t.Errorf("want %v, got %v", tc.wantEnv, env)
|
|
}
|
|
}
|
|
}
|