diff --git a/runsc/boot/controller.go b/runsc/boot/controller.go index 1906a4851..a989cb858 100644 --- a/runsc/boot/controller.go +++ b/runsc/boot/controller.go @@ -145,6 +145,11 @@ const ( CgroupsWriteControlFiles = "Cgroups.WriteControlFiles" ) +// ControlSocketAddr generates an abstract unix socket name for the given ID. +func ControlSocketAddr(id string) string { + return fmt.Sprintf("\x00runsc-sandbox.%s", id) +} + // controller holds the control server, and is used for communication into the // sandbox. type controller struct { diff --git a/runsc/boot/loader_test.go b/runsc/boot/loader_test.go index 3aec336f6..4ef88dacd 100644 --- a/runsc/boot/loader_test.go +++ b/runsc/boot/loader_test.go @@ -104,7 +104,7 @@ func startGofer(root string) (int, func(), error) { } func createLoader(spec *specs.Spec) (*Loader, func(), error) { - fd, err := server.CreateSocket(fmt.Sprintf("\x00loader-test.%010d", rand.Int())[:10]) + fd, err := server.CreateSocket(ControlSocketAddr(fmt.Sprintf("%010d", rand.Int())[:10])) if err != nil { return nil, nil, err } diff --git a/runsc/container/container_test.go b/runsc/container/container_test.go index 665e13cae..aaa1f00a9 100644 --- a/runsc/container/container_test.go +++ b/runsc/container/container_test.go @@ -24,7 +24,6 @@ import ( "path" "path/filepath" "reflect" - "runtime" "strconv" "strings" "testing" @@ -2714,43 +2713,3 @@ func TestSaveSystemdCgroup(t *testing.T) { t.Errorf("CompatCgroup not properly saved: want %v, got %v", cont.CompatCgroup, loadCont.CompatCgroup) } } - -// TestSandboxCommunicationUnshare checks that communication with sandboxes do -// not require being in the same network namespace. This is required to allow -// Kubernetes daemonsets/containers to communicate with sandboxes without the -// need to join the host network namespaces. -func TestSandboxCommunicationUnshare(t *testing.T) { - spec, conf := sleepSpecConf(t) - _, bundleDir, cleanup, err := testutil.SetupContainer(spec, conf) - if err != nil { - t.Fatalf("error setting up container: %v", err) - } - defer cleanup() - - args := Args{ - ID: testutil.RandomContainerID(), - Spec: spec, - BundleDir: bundleDir, - } - - cont, err := New(conf, args) - if err != nil { - t.Fatalf("Creating container: %v", err) - } - defer cont.Destroy() - - if err := cont.Start(conf); err != nil { - t.Fatalf("starting container: %v", err) - } - - runtime.LockOSThread() - defer runtime.UnlockOSThread() - if err := unix.Unshare(unix.CLONE_NEWNET); err != nil { - t.Fatalf("unix.Unshare(): %v", err) - } - - // Send a simple command to test that the sandbox can be reached. - if err := cont.SignalContainer(0, true); err != nil { - t.Errorf("SignalContainer(): %v", err) - } -} diff --git a/runsc/sandbox/sandbox.go b/runsc/sandbox/sandbox.go index de0c5b0a4..6d2d2d335 100644 --- a/runsc/sandbox/sandbox.go +++ b/runsc/sandbox/sandbox.go @@ -24,7 +24,6 @@ import ( "math" "os" "os/exec" - "path/filepath" "strconv" "strings" "syscall" @@ -55,24 +54,6 @@ import ( "gvisor.dev/gvisor/runsc/specutils" ) -// createControlSocket finds a location and creates the socket used to -// communicate with the sandbox. -func createControlSocket(rootDir, id string) (string, int, error) { - name := fmt.Sprintf("runsc-%s.sock", id) - - // Only use absolute paths to guarantee resolution from anywhere. - for _, dir := range []string{rootDir, "/var/run", "/run", "/tmp"} { - path := filepath.Join(dir, name) - log.Debugf("Attempting to create socket file %q", path) - fd, err := server.CreateSocket(path) - if err == nil { - log.Debugf("Using socket file %q", path) - return path, fd, nil - } - } - return "", -1, fmt.Errorf("unable to find location to write socket file") -} - // pid is an atomic type that implements JSON marshal/unmarshal interfaces. type pid struct { val atomicbitops.Int64 @@ -132,8 +113,6 @@ type Sandbox struct { // started, before it may be modified. OriginalOOMScoreAdj int `json:"originalOomScoreAdj"` - ControlAddress string `json:"control_address"` - // child is set if a sandbox process is a child of the current process. // // This field isn't saved to json, because only a creator of sandbox @@ -210,7 +189,6 @@ func New(conf *config.Config, args *Args) (*Sandbox, error) { UID: -1, // prevent usage before it's set. GID: -1, // prevent usage before it's set. } - // The Cleanup object cleans up partially created sandboxes when an error // occurs. Any errors occurring during cleanup itself are ignored. c := cleanup.Make(func() { @@ -544,7 +522,7 @@ func (s *Sandbox) Event(cid string) (*boot.EventOut, error) { func (s *Sandbox) sandboxConnect() (*urpc.Client, error) { log.Debugf("Connecting to sandbox %q", s.ID) - conn, err := client.ConnectTo(s.ControlAddress) + conn, err := client.ConnectTo(boot.ControlSocketAddr(s.ID)) if err != nil { return nil, s.connError(err) } @@ -642,12 +620,12 @@ func (s *Sandbox) createSandboxProcess(conf *config.Config, args *Args, startSyn } // Create a socket for the control server and donate it to the sandbox. - controlAddress, sockFD, err := createControlSocket(conf.RootDir, s.ID) + addr := boot.ControlSocketAddr(s.ID) + sockFD, err := server.CreateSocket(addr) + log.Infof("Creating sandbox process with addr: %s", addr[1:]) // skip "\00". if err != nil { - return fmt.Errorf("creating control socket %q: %v", s.ControlAddress, err) + return fmt.Errorf("creating control server socket for sandbox %q: %v", s.ID, err) } - log.Infof("Control socket: %q", s.ControlAddress) - s.ControlAddress = controlAddress donations.DonateAndClose("controller-fd", os.NewFile(uintptr(sockFD), "control_server_socket")) specFile, err := specutils.OpenSpec(args.BundleDir) @@ -1026,11 +1004,6 @@ func (s *Sandbox) IsRootContainer(cid string) bool { // is idempotent. func (s *Sandbox) destroy() error { log.Debugf("Destroy sandbox %q", s.ID) - if len(s.ControlAddress) != 0 { - if err := os.Remove(s.ControlAddress); err != nil { - log.Warningf("failed to delete control socket file %q: %v", s.ControlAddress, err) - } - } pid := s.Pid.load() if pid != 0 { log.Debugf("Killing sandbox %q", s.ID)