mirror of
https://github.com/netbirdio/gvisor.git
synced 2026-05-22 17:12:49 -07:00
Jamie LiuandgVisor bot
f4b851067a
This partially reverts cl/578969556, but implements devtmpfs using fsimpl/dev (added by that CL). Note that the behavior of "devtmpfs" differs compared to before cl/578969556. Container runtime specs typically specify a tmpfs mount at /dev, which the container runtime is required to prepopulate with certain device files (https://github.com/opencontainers/runtime-spec/blob/main/config-linux.md#default-devices). Prior to cl/578969556, runsc did so by silently replacing tmpfs mounts at /dev with devtmpfs mounts. After that CL, runsc does so by silently replacing tmpfs mounts at /dev with fsimpl/dev mounts. The distinction is that devtmpfs is a singleton whereas fsimpl/dev is not, so in a multi-container sandbox, all containers shared the contents of /dev before cl/578969556, but not after that CL; this change was necessary due to differences in GPU/TPU accessibility between containers, and is also more consistent with runc (which also creates separate tmpfs mounts for /dev as specified). As a side effect, explicit devtmpfs mounts shared the same filesystem as every container's /dev before cl/578969556. Since the change to container /dev won't be reverted, our options now are: - All devtmpfs mounts share a single filesystem, which is distinct from any container's /dev. - Each devtmpfs mount gets a distinct filesystem. This CL chooses the former option for greater similarity to Linux devtmpfs semantics. (In runc, explicit devtmpfs mounts share a single filesystem, which is the *host's* /dev.) PiperOrigin-RevId: 589021563
22 lines
434 B
Python
22 lines
434 B
Python
load("//tools:defs.bzl", "go_library")
|
|
|
|
package(default_applicable_licenses = ["//:license"])
|
|
|
|
licenses(["notice"])
|
|
|
|
go_library(
|
|
name = "devtmpfs",
|
|
srcs = [
|
|
"devtmpfs.go",
|
|
"save_restore.go",
|
|
],
|
|
visibility = ["//pkg/sentry:internal"],
|
|
deps = [
|
|
"//pkg/context",
|
|
"//pkg/sentry/fsimpl/dev",
|
|
"//pkg/sentry/kernel/auth",
|
|
"//pkg/sentry/vfs",
|
|
"//pkg/sync",
|
|
],
|
|
)
|