Documentation
¶
Overview ¶
Package runc is the proc backend with a launcher that runs the zygote as the init of an OCI container. The container gets a per-grant copy of the root filesystem, the grant's run directory at /host, and user, pid, mount, network, ipc and uts namespaces. The user namespace maps to a host id range derived from the grant uid (see IDPool), so the kernel refuses fibers the host's sysctls, sysfs knobs and cgroup limits by ownership. The network namespace holds only the loopback, so fibers serve unix sockets or handed-off connections.
Index ¶
Constants ¶
const DefaultPool = "1073741824:49151"
DefaultPool is the -userns-pool default. It starts at 2^30, above every id a host hands out by convention (useradd's /etc/subuid ranges end at SUB_UID_MAX, 600100000, and LXC and kubelet pod ranges sit lower still). It holds the most slots that end below the kernel's overflow id 4294967294, so two grants rarely hash to one slot.
const SlotIDs = 65536
SlotIDs is how many host ids one grant's user namespace maps. The container's root is the first of them and the rest serve the uids and gids a rootfs may hold.
Variables ¶
var DefaultSubIDFiles = []string{"/etc/subuid", "/etc/subgid"}
DefaultSubIDFiles are the files CheckSubIDs reads when none are given.
var ErrRangeCollision = errors.New("runc: user namespace id range is held by another grant on this home")
ErrRangeCollision means a grant of another range key admitted on this home holds the slot the key hashes to. The grant can run on a home that does not hold the other one.
Functions ¶
func New ¶
New opens the backend. Without runc or the rootfs it opens as a backend that cannot warm anything. It refuses a pool that is not a usable id space or that overlaps a range the host has handed out in /etc/subuid or /etc/subgid.
No previous fiberd holds a range when the backend opens. fiberd kills every fiber of a prior epoch at reconcile, and a stale container is ended here and again when its grant is warmed. So the claims start empty, and every root filesystem copy and bundle under the state directory is a leftover to sweep.
Types ¶
type Backend ¶
Backend is the proc backend with the runc launcher.
func (*Backend) EndpointSchemes ¶
EndpointSchemes is unix only. The container's network namespace has no route out, so a tcp endpoint bound inside it could never be dialled. Fibers serve unix sockets under /host, which the host relays a tcp port to under a tcp policy, or handed-off connections (see proc.Backend.Handoff).
func (*Backend) MappedRoot ¶
MappedRoot implements backend.IDMapper.
type IDPool ¶
IDPool is the host id space grants' user namespaces are carved from. Slot i maps container ids [0, SlotIDs) to host ids [Start+i*SlotIDs, Start+(i+1)*SlotIDs).
func ParsePool ¶
ParsePool reads "START:SLOTS". The pool must fit the 32-bit id space below the overflow ids (nobody is 65534 and the kernel's overflow id 4294967294).
func (IDPool) CheckSubIDs ¶
CheckSubIDs refuses a pool that overlaps a range the host has handed out in /etc/subuid or /etc/subgid (files, or DefaultSubIDFiles when none are given). Such a range is some user's to map into namespaces of their own, and sharing host ids with it would make that user's containers and fiberd's grants one identity. A file that does not exist has nothing to overlap. A line that does not parse is an error too, since a range it hides cannot be checked.
func (IDPool) Range ¶
Range is the map of a range key, the grant's session domain or, for a grant without a tenant, its uid. A session moves between homes that each hold their own grant for it, and the domain is what those grants share. The range depends on the key and the pool alone, so every home configured with the same pool gives the session the same host ids and its checkpoint, which keeps the map it was dumped with, restores on any of them.
type Options ¶
type Options struct {
// Runc names the runc binary (default "runc").
Runc string
// Rootfs is the directory every grant's root filesystem is copied
// from. Template commands are paths inside it. Required.
Rootfs string
// StateDir holds runc's container state, the bundles and the
// per-grant root filesystem copies (default /var/lib/fiberd/runc).
StateDir string
// CRIU names the criu binary (default "criu").
CRIU string
// Commander runs criu (criu.Options.Commander). Nil runs the binary
// CRIU names.
Commander criu.Commander
// Pool is the host id space grants' user namespaces map into
// (default DefaultPool).
Pool IDPool
// SubIDFiles are the host's subordinate id files the pool must not
// overlap (default DefaultSubIDFiles). For tests.
SubIDFiles []string
}
Options configure the runc backend.
Source Files