netbird/gvisor
0
0
Fork 0
mirror of https://github.com/netbirdio/gvisor.git synced 2026-05-22 17:12:49 -07:00
Code Issues Packages Projects Releases Wiki Activity

Run tools/install_containerd.sh without sudo -H.

Browse Source 
This script was being run as root. This script clones containerd and builds it.
On some Ubuntu versions, sudo(1) does not change the home directory. On
oldkernel machines from BuildKite, this script was running with
$HOME=/home/agent. As a result, root was writing and creating files in
/home/agent/.cache/go-build/. Other tests that call `go build` that were
scheduled to run on such VMs would fail due to permission issues because
/home/agent/.cache/go-build/ is owned by root.

Run the tools/install_containerd.sh script sudo -H so that the home directory
is set appropriately and all packages are built and installed with root user's
cache in /root/.cache/.

Also fixed lint errors in tools/install_containerd.sh and got rid of redundant
sudo calls. Added the check that the script must be run as root.

Co-authored-by: Andrei Vagin <avagin@gmail.com>
Acknowledgements: Andrei Vagin discovered this issue.
PiperOrigin-RevId: 511661564
This commit is contained in:
Ayush Ranjan
2023-02-22 19:43:15 -08:00
committed by gVisor bot
co-authored by Andrei Vagin
parent 192bfb03fb
commit 3370d6c007
2 changed files with 23 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Makefile
+1 -1
View File
@@ -327,7 +327,7 @@ fsstress-test: load-basic $(RUNTIME_BIN)
# Specific containerd version tests.
containerd-test-%: load-basic_alpine load-basic_python load-basic_busybox load-basic_symlink-resolv load-basic_httpd load-basic_ubuntu $(RUNTIME_BIN)
@$(call install_runtime,$(RUNTIME),) # Clear flags.
@sudo tools/install_containerd.sh $*
@sudo -H tools/install_containerd.sh $*
ifeq (,$(STAGED_BINARIES))
@$(call sudocopy,//shim:containerd-shim-runsc-v1,"$$(dirname $$(which containerd))")
else
tools/install_containerd.sh
+22 -9
View File
@@ -16,9 +16,21 @@
set -xeo pipefail
# This script should be run with 'sudo -H'. $HOME must be set correctly because
# we invoke other scripts below that build Go binaries. In some operating
# systems, sudo(8) does not change $HOME by default. In such cases, root user
# ends up creating files in ~/.cache/go-build for the non-root user. This can
# cause future invocations of go build to fail due to permission issues.
if [[ "$EUID" -ne 0 ]]; then
echo "Run this script with sudo -H"
exit 1
fi
declare -r CONTAINERD_VERSION=${1:-1.3.0}
declare -r CONTAINERD_MAJOR="$(echo ${CONTAINERD_VERSION} | awk -F '.' '{ print $1; }')"
declare -r CONTAINERD_MINOR="$(echo ${CONTAINERD_VERSION} | awk -F '.' '{ print $2; }')"
CONTAINERD_MAJOR="$(echo "${CONTAINERD_VERSION}" | awk -F '.' '{ print $1; }')"
declare -r CONTAINERD_MAJOR
CONTAINERD_MINOR="$(echo "${CONTAINERD_VERSION}" | awk -F '.' '{ print $2; }')"
declare -r CONTAINERD_MINOR
declare -r CRITOOLS_VERSION=${CRITOOLS_VERSION:-1.18.0}
if [[ "${CONTAINERD_MAJOR}" -eq 1 ]] && [[ "${CONTAINERD_MINOR}" -le 4 ]]; then
@@ -39,7 +51,7 @@ install_helper() {
declare -r TAG="${2}"
# Clone the repository.
mkdir -p "${GOPATH}"/src/$(dirname "${PACKAGE}") && \
mkdir -p "${GOPATH}"/src/"$(dirname "${PACKAGE}")" && \
git clone https://"${PACKAGE}" "${GOPATH}"/src/"${PACKAGE}"
# Checkout and build the repository.
@@ -77,14 +89,15 @@ while true; do
done
# Install containerd & cri-tools.
declare -rx GOPATH=$(mktemp -d --tmpdir gopathXXXXX)
GOPATH=$(mktemp -d --tmpdir gopathXXXXX)
declare -rx GOPATH
install_helper github.com/containerd/containerd "v${CONTAINERD_VERSION}"
install_helper github.com/kubernetes-sigs/cri-tools "v${CRITOOLS_VERSION}"
# Configure containerd-shim.
declare -r shim_config_path=/etc/containerd/runsc/config.toml
mkdir -p $(dirname ${shim_config_path})
cat > ${shim_config_path} <<-EOF
mkdir -p "$(dirname "${shim_config_path}")"
tee ${shim_config_path} <<-EOF
log_path = "/tmp/shim-logs/"
log_level = "debug"
@@ -97,7 +110,7 @@ EOF
# Configure CNI.
(cd "${GOPATH}" && src/github.com/containerd/containerd/script/setup/install-cni)
cat <<EOF | sudo tee /etc/cni/net.d/10-bridge.conf
tee /etc/cni/net.d/10-bridge.conf <<EOF
{
"cniVersion": "0.3.1",
"name": "bridge",
@@ -114,7 +127,7 @@ cat <<EOF | sudo tee /etc/cni/net.d/10-bridge.conf
}
}
EOF
cat <<EOF | sudo tee /etc/cni/net.d/99-loopback.conf
tee /etc/cni/net.d/99-loopback.conf <<EOF
{
"cniVersion": "0.3.1",
"type": "loopback"
@@ -122,7 +135,7 @@ cat <<EOF | sudo tee /etc/cni/net.d/99-loopback.conf
EOF
# Configure crictl.
cat <<EOF | sudo tee /etc/crictl.yaml
tee /etc/crictl.yaml <<EOF
runtime-endpoint: unix:///run/containerd/containerd.sock
EOF