By default in runsc, we have both IPv4 and IPv6 addresses enabled on all the
interfaces. However, in runc this is based on the sysctl
net.ipv6.conf.all.disable_ipv6. This CL will make runsc behave similar to runc.
- If net.ipv6.conf.all.disable_ipv6 is > 0, then only IPv4 addresses will be
enabled on the interfaces including loopback when network mode is "sandbox".
PiperOrigin-RevId: 737656607
There is a race in the test where the goroutine running Container.executeSync()
calls WaitPID() => IsSandboxRunning() which accesses Container.Sandbox.
This can race with the defer Container.Destroy which sets Sandbox = nil.
This race was introduced in 0968254ce7 ("Speed up container_test") which got
rid of the read on channel `ch`.
Fix the race by exec-ing asynchronously. This maintains the old behavior of not
checking if the exit status of sleep.
Fixes 0968254ce7 ("Speed up container_test")
PiperOrigin-RevId: 736572600
As of https://go.dev/cl/646095, the Go runtime calls
prctl(PR_SET_VMA, PR_SET_VMA_ANON_NAME) when mapping memory to annotate
mappings in /proc/self/maps. Since this is a system call made throughout the
application lifetime, it needs to be allowed through the system call filters.
PiperOrigin-RevId: 734182524
The OCI spec has entrypoint as the first argument in specs.Process.Args.
During testing, we observed inconsistencies in entrypoint resolution: it
was resolved during checkpoint but not during restore (or vice versa),
leading to spec validation failures. This CL corrects this by comparing the
absolute paths of entrypoints in spec validation.
PiperOrigin-RevId: 733200146
Exec'd processes cannot be stitched back to the original caller
and are killed after restore. So ignore failures
to restore host FDs (generally stdio) that belong
to them.
Fixes#11439
PiperOrigin-RevId: 732972054
auth.K{U/G}ID has type uint32. When uid = auth.NoID = math.MaxUint32, which is
intended to represent -1, and it is casted to int, it becomes 4294967295 on
64-bit systems as int is 8 bytes in size. So the == -1 check fails.
Fixed the bug by explicitly setting syscall args to -1 when uid.Ok() == false.
Similarly, fix the bug in runsc/fsgofer.
PiperOrigin-RevId: 728258705
- SandboxCheckpointedMetric and SandboxRestoredMetric are added for sandbox
metadata metric which indicate whether sandbox is checkpointed or restored.
- NumCheckpointedSandboxesMetric and NumRestoredSandboxesMetric are added at
the process level which will get the count of number of sandboxes being
checkpointed and restored.
PiperOrigin-RevId: 726797010
Replaces the flag "unsafe-skip-restore-spec-validation" with
"restore-spec-validation" which allows the user to set the level of restore
spec validation such as ignore, warning or enforce. This allows user to skip
validation if required. By default, the flag will be set to "enforce" which
will perform spec validation.
This is a breaking change for users who have enabled
--unsafe-skip-restore-spec-validation flag. We advise these users to use the
new flag introduced in this change: --restore-spec-validation and set it to
"warning" or "ignore". This setting (--restore-spec-validation=warning) gives
the same behavior as when the old flag was enabled.
PiperOrigin-RevId: 719045616
Previously we were only looking at stdin, which could be a pty but other stdio
fds might be redirected. In that case, we can incorrectly end up using the
stdin fd as *the* console fd, and sending all stdout/stderr to that FD,
ignoring the redirect.
Note that the behavior was actually flaky because the mechanism for choosing
which stdio fd to treat as *the* pty fd is non-deterministic (due to the map
iteration in fdimport/fdimport.go:Import) and so sometimes we would choose
the correct one.
This CL also cleans up `argsFromProcess` and `argsFromCLI`, which were setting
their `FilePayload` unnecessarily, since it is always set in `Execute`.
Fixes#11350Fixes#11349
PiperOrigin-RevId: 716733446
This test case creates one connection, then it closes one end of it. After that
it waits for a linger timeout and tries to create the second connection with
the same client source port. The test is flaky if the second half of the fist
connection isn't closed before creating the second connection.
PiperOrigin-RevId: 715924851
Lucas ManningandgVisor bot
Nayana BidariandgVisor bot
Ayush RanjanandgVisor bot
Jamie LiuandgVisor bot
Michael PrattandgVisor bot
Fabricio VoznikaandgVisor bot
Etienne PerotandgVisor bot
Stepan Koltsov
Andrei Vagin
Evan PhoenixandGitHub
Nicolas LacasseandgVisor bot
xianzhe-databricks