From dde947199588a6710bb31230b19d764868440e7b Mon Sep 17 00:00:00 2001 From: Ayush Ranjan Date: Fri, 3 May 2024 14:47:34 -0700 Subject: [PATCH] Use container name instead of container ID to track device gofer clients. PiperOrigin-RevId: 630503719 --- pkg/sentry/kernel/kernel.go | 24 ++++++++++++------------ pkg/sentry/kernel/task_context.go | 2 +- runsc/boot/loader.go | 4 ++-- runsc/boot/restore.go | 3 ++- runsc/boot/vfs.go | 2 +- 5 files changed, 18 insertions(+), 17 deletions(-) diff --git a/pkg/sentry/kernel/kernel.go b/pkg/sentry/kernel/kernel.go index 9393097e7..9074702b4 100644 --- a/pkg/sentry/kernel/kernel.go +++ b/pkg/sentry/kernel/kernel.go @@ -347,7 +347,7 @@ type Kernel struct { // used by processes. MaxFDLimit atomicbitops.Int32 - // devGofers maps container ID to its device gofer client. + // devGofers maps containers (using its name) to its device gofer client. devGofers map[string]*devutil.GoferClient `state:"nosave"` devGofersMu sync.Mutex `state:"nosave"` @@ -943,7 +943,7 @@ func (ctx *createProcessContext) Value(key any) any { mntns.IncRef() return mntns case devutil.CtxDevGoferClient: - return ctx.kernel.getDevGoferClient(ctx.args.ContainerID) + return ctx.kernel.getDevGoferClient(ctx.kernel.ContainerName(ctx.args.ContainerID)) case inet.CtxStack: return ctx.kernel.RootNetworkNamespace().Stack() case ktime.CtxRealtimeClock: @@ -1976,7 +1976,7 @@ func (k *Kernel) GetUserCounters(uid auth.KUID) *UserCounters { // AddDevGofer initializes the dev gofer connection and starts tracking it. // It takes ownership of goferFD. -func (k *Kernel) AddDevGofer(cid string, goferFD int) error { +func (k *Kernel) AddDevGofer(contName string, goferFD int) error { client, err := devutil.NewGoferClient(k.SupervisorContext(), goferFD) if err != nil { return err @@ -1987,27 +1987,27 @@ func (k *Kernel) AddDevGofer(cid string, goferFD int) error { if k.devGofers == nil { k.devGofers = make(map[string]*devutil.GoferClient) } - k.devGofers[cid] = client + k.devGofers[contName] = client return nil } // RemoveDevGofer closes the dev gofer connection, if one exists, and stops // tracking it. -func (k *Kernel) RemoveDevGofer(cid string) { +func (k *Kernel) RemoveDevGofer(contName string) { k.devGofersMu.Lock() defer k.devGofersMu.Unlock() - client, ok := k.devGofers[cid] + client, ok := k.devGofers[contName] if !ok { return } client.Close() - delete(k.devGofers, cid) + delete(k.devGofers, contName) } -func (k *Kernel) getDevGoferClient(cid string) *devutil.GoferClient { +func (k *Kernel) getDevGoferClient(contName string) *devutil.GoferClient { k.devGofersMu.Lock() defer k.devGofersMu.Unlock() - return k.devGofers[cid] + return k.devGofers[contName] } func (k *Kernel) cleaupDevGofers() { @@ -2040,9 +2040,9 @@ func (k *Kernel) RestoreContainerMapping(containerIDs map[string]string) { } } -// TaskContainerName returns the container name for a given task. -func (k *Kernel) TaskContainerName(task *Task) string { +// ContainerName returns the container name for a given container ID. +func (k *Kernel) ContainerName(cid string) string { k.extMu.Lock() defer k.extMu.Unlock() - return k.containerNames[task.ContainerID()] + return k.containerNames[cid] } diff --git a/pkg/sentry/kernel/task_context.go b/pkg/sentry/kernel/task_context.go index b1c1f667a..afca312ca 100644 --- a/pkg/sentry/kernel/task_context.go +++ b/pkg/sentry/kernel/task_context.go @@ -105,7 +105,7 @@ func (t *Task) contextValue(key any, isTaskGoroutine bool) any { t.mountNamespace.IncRef() return t.mountNamespace case devutil.CtxDevGoferClient: - return t.k.getDevGoferClient(t.containerID) + return t.k.getDevGoferClient(t.k.ContainerName(t.containerID)) case inet.CtxStack: return t.NetworkContext() case ktime.CtxRealtimeClock: diff --git a/runsc/boot/loader.go b/runsc/boot/loader.go index 582fd5d45..f2c56f435 100644 --- a/runsc/boot/loader.go +++ b/runsc/boot/loader.go @@ -971,7 +971,7 @@ func (l *Loader) startSubcontainer(spec *specs.Spec, conf *config.Config, cid st // createContainerProcess() will consume devGoferFD and initialize a gofer // connection. This connection is owned by l.k. In case of failure, we want // to clean up this gofer connection so that the gofer process can exit. - l.k.RemoveDevGofer(cid) + l.k.RemoveDevGofer(containerName) }) } @@ -1198,7 +1198,7 @@ func (l *Loader) destroySubcontainer(cid string) error { } } // Cleanup the device gofer. - l.k.RemoveDevGofer(cid) + l.k.RemoveDevGofer(l.k.ContainerName(cid)) log.Debugf("Container destroyed, cid: %s", cid) return nil diff --git a/runsc/boot/restore.go b/runsc/boot/restore.go index 54348667f..ece168f83 100644 --- a/runsc/boot/restore.go +++ b/runsc/boot/restore.go @@ -254,7 +254,8 @@ func (r *restorer) restore(l *Loader) error { // Update all tasks in the system with their respective new container IDs. for _, task := range l.k.TaskSet().Root.Tasks() { - name := l.k.TaskContainerName(task) + oldCid := task.ContainerID() + name := l.k.ContainerName(oldCid) newCid, ok := l.containerIDs[name] if !ok { return fmt.Errorf("unable to remap task with CID %q (name: %q). Available names: %v", task.ContainerID(), name, l.containerIDs) diff --git a/runsc/boot/vfs.go b/runsc/boot/vfs.go index 36e143b64..ca998a71c 100644 --- a/runsc/boot/vfs.go +++ b/runsc/boot/vfs.go @@ -783,7 +783,7 @@ type mountInfo struct { func (c *containerMounter) prepareMounts() ([]mountInfo, error) { // If device gofer exists, connect to it. if c.devGoferFD != nil { - if err := c.k.AddDevGofer(c.containerID, c.devGoferFD.Release()); err != nil { + if err := c.k.AddDevGofer(c.containerName, c.devGoferFD.Release()); err != nil { return nil, err } }