netbird/gvisor
0
0
Fork 0
mirror of https://github.com/netbirdio/gvisor.git synced 2026-05-22 17:12:49 -07:00
Code Issues Packages Projects Releases Wiki Activity

Do not mount /tmp into bazel container with shared mount propagation.

Browse Source 
This is the same issue as described in moby/moby#36179.
If any of the other volumes mounted in the bazel container happen to be inside
/tmp, then they will be propagated to the host mount namespace, and hence never
cleaned up by docker on container destroy.

What's worse is that the number of leaked mounts increases exponentially. See
this reproducer:
```shell
$ mkdir /tmp/gvisor
$ docker run --rm -d --name=repro -v /tmp/gvisor:/tmp/gvisor -v "/tmp:/tmp:shared" ubuntu:focal /bin/sleep infinity
5690703c0f6128eebb38180c1bbb5b9ba83018affa284bc82d78a52860321f97
$ docker kill repro
repro
$ sudo cat /proc/self/mountinfo | grep gvisor
1914 29 254:1 /tmp/gvisor /tmp/gvisor rw,relatime shared:1 - ext4 /dev/mapper/glinux_20210409-root rw,errors=remount-ro,i_version
$ docker run --rm -d --name=repro -v /tmp/gvisor:/tmp/gvisor -v "/tmp:/tmp:shared" ubuntu:focal /bin/sleep infinity
11a7cfba501277e2b61fafa46c782fbd5829629dab91ff8ca0c589bdb1d63b24
$ docker kill repro
repro
$ sudo cat /proc/self/mountinfo | grep gvisor
1914 1946 254:1 /tmp/gvisor /tmp/gvisor rw,relatime shared:1 - ext4 /dev/mapper/glinux_20210409-root rw,errors=remount-ro,i_version
1950 1914 254:1 /tmp/gvisor /tmp/gvisor rw,relatime shared:1 - ext4 /dev/mapper/glinux_20210409-root rw,errors=remount-ro,i_version
1946 29 254:1 /tmp/gvisor /tmp/gvisor rw,relatime shared:1 - ext4 /dev/mapper/glinux_20210409-root rw,errors=remount-ro,i_version
$ docker run --rm -d --name=repro -v /tmp/gvisor:/tmp/gvisor -v "/tmp:/tmp:shared" ubuntu:focal /bin/sleep infinity
11a7cfba501277e2b61fafa46c782fbd5829629dab91ff8ca0c589bdb1d63b24
$ docker kill repro
repro
$ sudo cat /proc/self/mountinfo | grep gvisor
1914 2018 254:1 /tmp/gvisor /tmp/gvisor rw,relatime shared:1 - ext4 /dev/mapper/glinux_20210409-root rw,errors=remount-ro,i_version
1950 2014 254:1 /tmp/gvisor /tmp/gvisor rw,relatime shared:1 - ext4 /dev/mapper/glinux_20210409-root rw,errors=remount-ro,i_version
1946 2010 254:1 /tmp/gvisor /tmp/gvisor rw,relatime shared:1 - ext4 /dev/mapper/glinux_20210409-root rw,errors=remount-ro,i_version
2022 1950 254:1 /tmp/gvisor /tmp/gvisor rw,relatime shared:1 - ext4 /dev/mapper/glinux_20210409-root rw,errors=remount-ro,i_version
2018 1946 254:1 /tmp/gvisor /tmp/gvisor rw,relatime shared:1 - ext4 /dev/mapper/glinux_20210409-root rw,errors=remount-ro,i_version
2014 1914 254:1 /tmp/gvisor /tmp/gvisor rw,relatime shared:1 - ext4 /dev/mapper/glinux_20210409-root rw,errors=remount-ro,i_version
2010 29 254:1 /tmp/gvisor /tmp/gvisor rw,relatime shared:1 - ext4 /dev/mapper/glinux_20210409-root rw,errors=remount-ro,i_version
```

Eventually, docker becomes prohibitively slow and starts throwing ENOSPC errors randomly.

PiperOrigin-RevId: 480986037
This commit is contained in:
Ayush Ranjan
2022-10-13 14:35:20 -07:00
committed by gVisor bot
parent e2d5663b76
commit 37d64d348f
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tools/bazel.mk
+2 -2
View File
@@ -89,9 +89,9 @@ DOCKER_RUN_OPTIONS += --rm
DOCKER_RUN_OPTIONS += --user $(UID):$(GID)
DOCKER_RUN_OPTIONS += --entrypoint ""
DOCKER_RUN_OPTIONS += --init
DOCKER_RUN_OPTIONS += -v "$(shell realpath -m $(BAZEL_CACHE)):$(BAZEL_CACHE):shared"
DOCKER_RUN_OPTIONS += -v "$(shell realpath -m $(BAZEL_CACHE)):$(BAZEL_CACHE)"
DOCKER_RUN_OPTIONS += -v "$(shell realpath -m $(GCLOUD_CONFIG)):$(GCLOUD_CONFIG)"
DOCKER_RUN_OPTIONS += -v "/tmp:/tmp:shared"
DOCKER_RUN_OPTIONS += -v "/tmp:/tmp"
DOCKER_EXEC_OPTIONS := --user $(UID):$(GID)
DOCKER_EXEC_OPTIONS += --interactive
ifeq (true,$(shell test -t 1 && echo true))