From 87b1a5c29a08c30f6606548cf7d1c489c0b14908 Mon Sep 17 00:00:00 2001 From: Lai Jiangshan Date: Wed, 20 Jul 2016 12:24:48 +0800 Subject: [PATCH 1/3] add missing pod->remains++ Signed-off-by: Lai Jiangshan --- src/init.c | 1 + 1 file changed, 1 insertion(+) diff --git a/src/init.c b/src/init.c index 7f26fae..954f3c9 100644 --- a/src/init.c +++ b/src/init.c @@ -550,6 +550,7 @@ static int hyper_new_container(char *json, int length) //TODO full grace cleanup hyper_cleanup_container(c, pod); } + pod->remains++; return ret; } From 19f1dc012ec726d78123fa4b14c13cdd256d30dc Mon Sep 17 00:00:00 2001 From: Lai Jiangshan Date: Wed, 20 Jul 2016 15:28:55 +0800 Subject: [PATCH 2/3] refactor struct hyper_container Signed-off-by: Lai Jiangshan --- src/container.h | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/src/container.h b/src/container.h index 19f1e5f..91a7f95 100644 --- a/src/container.h +++ b/src/container.h @@ -31,6 +31,12 @@ struct port { }; struct hyper_container { + struct list_head list; + struct hyper_exec exec; + int ns; + uint32_t code; + + // configs char *id; char *rootfs; char *image; @@ -39,16 +45,12 @@ struct hyper_container { struct volume *vols; struct fsmap *maps; struct sysctl *sys; - struct port *ports; + struct port *ports; int vols_num; int maps_num; int sys_num; - int ports_num; - int ns; + int ports_num; int initialize; - uint32_t code; - struct list_head list; - struct hyper_exec exec; }; struct hyper_pod; From b0a601793efc96ca909371b8804edc8aff11b87e Mon Sep 17 00:00:00 2001 From: Lai Jiangshan Date: Wed, 20 Jul 2016 16:58:41 +0800 Subject: [PATCH 3/3] move mount /proc to hyper_container_final_init() exec can be run earlier than start container. Signed-off-by: Lai Jiangshan --- src/container.h | 1 + src/exec.c | 44 +++++++++++++++++++++++++++++--------------- 2 files changed, 30 insertions(+), 15 deletions(-) diff --git a/src/container.h b/src/container.h index 91a7f95..ec92fb4 100644 --- a/src/container.h +++ b/src/container.h @@ -33,6 +33,7 @@ struct port { struct hyper_container { struct list_head list; struct hyper_exec exec; + int finalinit; int ns; uint32_t code; diff --git a/src/exec.c b/src/exec.c index 4df4b76..ea21d83 100644 --- a/src/exec.c +++ b/src/exec.c @@ -476,20 +476,13 @@ int hyper_watch_exec_pty(struct hyper_exec *exec, struct hyper_pod *pod) } static int hyper_enter_container(struct hyper_pod *pod, - struct hyper_exec *exec) + struct hyper_container *c) { int ipcns, utsns, mntns, ret; - struct hyper_container *c; char path[512]; ret = ipcns = utsns = mntns = -1; - c = hyper_find_container(pod, exec->id); - if (c == NULL) { - fprintf(stderr, "can not find container %s\n", exec->id); - return -1; - } - sprintf(path, "/proc/%d/ns/uts", pod->init_pid); utsns = open(path, O_RDONLY| O_CLOEXEC); if (utsns < 0) { @@ -526,12 +519,6 @@ static int hyper_enter_container(struct hyper_pod *pod, /* TODO: wait for container finishing setup root */ chdir("/"); - /* already in pidns & mntns of container, mount proc filesystem */ - if (exec->init && mount("proc", "/proc", "proc", MS_NOSUID| MS_NODEV| MS_NOEXEC, NULL) < 0) { - perror("fail to mount proc filesystem for container"); - goto out; - } - ret = 0; out: close(ipcns); @@ -540,12 +527,34 @@ out: return ret; } +static int hyper_container_final_init(struct hyper_container *c) +{ + if (c->finalinit) + return 0; + + /* already in pidns & mntns of container, mount proc filesystem */ + if (mount("proc", "/proc", "proc", MS_NOSUID| MS_NODEV| MS_NOEXEC, NULL) < 0) { + perror("fail to mount proc filesystem for container"); + return -1; + } + + c->finalinit = 1; + return 0; +} + static int hyper_do_exec_cmd(struct hyper_exec *exec, struct hyper_pod *pod, int pipe) { int pid = -1, ret = -1; char path[512]; + struct hyper_container *c; int pidns; + c = hyper_find_container(pod, exec->id); + if (c == NULL) { + fprintf(stderr, "can not find container %s\n", exec->id); + return -1; + } + sprintf(path, "/proc/%d/ns/pid", pod->init_pid); pidns = open(path, O_RDONLY| O_CLOEXEC); if (pidns < 0) { @@ -571,11 +580,16 @@ static int hyper_do_exec_cmd(struct hyper_exec *exec, struct hyper_pod *pod, int goto out; } - if (hyper_enter_container(pod, exec) < 0) { + if (hyper_enter_container(pod, c) < 0) { fprintf(stderr, "enter container ns failed\n"); goto exit; } + if (hyper_container_final_init(c)) { + fprintf(stderr, "final container intialization failed\n"); + goto exit; + } + // set early env. the container env config can overwrite it setenv("HOME", "/root", 1); setenv("HOSTNAME", pod->hostname, 1);