Use container name instead of container ID to track device gofer clients.

PiperOrigin-RevId: 630503719

pkg/sentry/kernel/kernel.go

@@ -347,7 +347,7 @@ type Kernel struct {
 	// used by processes.
 	MaxFDLimit atomicbitops.Int32
 
-	// devGofers maps container ID to its device gofer client.
+	// devGofers maps containers (using its name) to its device gofer client.
 	devGofers   map[string]*devutil.GoferClient `state:"nosave"`
 	devGofersMu sync.Mutex                      `state:"nosave"`
 
@@ -943,7 +943,7 @@ func (ctx *createProcessContext) Value(key any) any {
 		mntns.IncRef()
 		return mntns
 	case devutil.CtxDevGoferClient:
-		return ctx.kernel.getDevGoferClient(ctx.args.ContainerID)
+		return ctx.kernel.getDevGoferClient(ctx.kernel.ContainerName(ctx.args.ContainerID))
 	case inet.CtxStack:
 		return ctx.kernel.RootNetworkNamespace().Stack()
 	case ktime.CtxRealtimeClock:
@@ -1976,7 +1976,7 @@ func (k *Kernel) GetUserCounters(uid auth.KUID) *UserCounters {
 
 // AddDevGofer initializes the dev gofer connection and starts tracking it.
 // It takes ownership of goferFD.
-func (k *Kernel) AddDevGofer(cid string, goferFD int) error {
+func (k *Kernel) AddDevGofer(contName string, goferFD int) error {
 	client, err := devutil.NewGoferClient(k.SupervisorContext(), goferFD)
 	if err != nil {
 		return err
@@ -1987,27 +1987,27 @@ func (k *Kernel) AddDevGofer(cid string, goferFD int) error {
 	if k.devGofers == nil {
 		k.devGofers = make(map[string]*devutil.GoferClient)
 	}
-	k.devGofers[cid] = client
+	k.devGofers[contName] = client
 	return nil
 }
 
 // RemoveDevGofer closes the dev gofer connection, if one exists, and stops
 // tracking it.
-func (k *Kernel) RemoveDevGofer(cid string) {
+func (k *Kernel) RemoveDevGofer(contName string) {
 	k.devGofersMu.Lock()
 	defer k.devGofersMu.Unlock()
-	client, ok := k.devGofers[cid]
+	client, ok := k.devGofers[contName]
 	if !ok {
 		return
 	}
 	client.Close()
-	delete(k.devGofers, cid)
+	delete(k.devGofers, contName)
 }
 
-func (k *Kernel) getDevGoferClient(cid string) *devutil.GoferClient {
+func (k *Kernel) getDevGoferClient(contName string) *devutil.GoferClient {
 	k.devGofersMu.Lock()
 	defer k.devGofersMu.Unlock()
-	return k.devGofers[cid]
+	return k.devGofers[contName]
 }
 
 func (k *Kernel) cleaupDevGofers() {
@@ -2040,9 +2040,9 @@ func (k *Kernel) RestoreContainerMapping(containerIDs map[string]string) {
 	}
 }
 
-// TaskContainerName returns the container name for a given task.
-func (k *Kernel) TaskContainerName(task *Task) string {
+// ContainerName returns the container name for a given container ID.
+func (k *Kernel) ContainerName(cid string) string {
 	k.extMu.Lock()
 	defer k.extMu.Unlock()
-	return k.containerNames[task.ContainerID()]
+	return k.containerNames[cid]
 }

pkg/sentry/kernel/task_context.go

@@ -105,7 +105,7 @@ func (t *Task) contextValue(key any, isTaskGoroutine bool) any {
 		t.mountNamespace.IncRef()
 		return t.mountNamespace
 	case devutil.CtxDevGoferClient:
-		return t.k.getDevGoferClient(t.containerID)
+		return t.k.getDevGoferClient(t.k.ContainerName(t.containerID))
 	case inet.CtxStack:
 		return t.NetworkContext()
 	case ktime.CtxRealtimeClock:

runsc/boot/loader.go

@@ -971,7 +971,7 @@ func (l *Loader) startSubcontainer(spec *specs.Spec, conf *config.Config, cid st
 			// createContainerProcess() will consume devGoferFD and initialize a gofer
 			// connection. This connection is owned by l.k. In case of failure, we want
 			// to clean up this gofer connection so that the gofer process can exit.
-			l.k.RemoveDevGofer(cid)
+			l.k.RemoveDevGofer(containerName)
 		})
 	}
 
@@ -1198,7 +1198,7 @@ func (l *Loader) destroySubcontainer(cid string) error {
 		}
 	}
 	// Cleanup the device gofer.
-	l.k.RemoveDevGofer(cid)
+	l.k.RemoveDevGofer(l.k.ContainerName(cid))
 
 	log.Debugf("Container destroyed, cid: %s", cid)
 	return nil

runsc/boot/restore.go

@@ -254,7 +254,8 @@ func (r *restorer) restore(l *Loader) error {
 
 	// Update all tasks in the system with their respective new container IDs.
 	for _, task := range l.k.TaskSet().Root.Tasks() {
-		name := l.k.TaskContainerName(task)
+		oldCid := task.ContainerID()
+		name := l.k.ContainerName(oldCid)
 		newCid, ok := l.containerIDs[name]
 		if !ok {
 			return fmt.Errorf("unable to remap task with CID %q (name: %q). Available names: %v", task.ContainerID(), name, l.containerIDs)

runsc/boot/vfs.go

@@ -783,7 +783,7 @@ type mountInfo struct {
 func (c *containerMounter) prepareMounts() ([]mountInfo, error) {
 	// If device gofer exists, connect to it.
 	if c.devGoferFD != nil {
-		if err := c.k.AddDevGofer(c.containerID, c.devGoferFD.Release()); err != nil {
+		if err := c.k.AddDevGofer(c.containerName, c.devGoferFD.Release()); err != nil {
 			return nil, err
 		}
 	}