Documentation
¶
Overview ¶
Package mounts prepares what a container mounts read-only before fiberd builds its runtime. A Pod without privileges gets /sys/fs/cgroup and /proc/sys read-only from its container runtime. Every host runtime makes cgroup leaves under the first, and CRIU writes four kernel sysctls under the second to give a restored fiber the pids and IPC ids it had.
cmd/fiberd calls Prepare at startup before narrowing capabilities, for every runtime but the stub, so no home has to prepare anything. Prepare touches only a mount it finds read-only. On a standalone host it does nothing, and after a success a second call does nothing either.
Index ¶
Constants ¶
This section is empty.
Variables ¶
var CRIUSysctls = []string{
"/proc/sys/kernel/ns_last_pid",
"/proc/sys/kernel/msg_next_id",
"/proc/sys/kernel/sem_next_id",
"/proc/sys/kernel/shm_next_id",
}
CRIUSysctls are the kernel sysctls CRIU writes during a restore. The first pins the next pid, the others the next System V IPC ids, so a restored fiber gets back the identifiers it was dumped with.
var ErrSysctlsReadOnly = errors.New("mounts: the CRIU sysctls stayed read-only")
ErrSysctlsReadOnly is in the error Prepare returns when a CRIU sysctl could not be made writable. The cgroup mount is ready by then, so fiberd can start, and the proc backend offers the warm tier alone.
Functions ¶
func Prepare ¶
func Prepare() error
Prepare makes the cgroup v2 mount at /sys/fs/cgroup and each file in CRIUSysctls writable where the container left them read-only, and leaves what is already writable alone. It needs CAP_SYS_ADMIN in its mount namespace. A cgroup failure is returned at once. Every sysctl is tried, and their failures are returned together, wrapped in ErrSysctlsReadOnly.
Types ¶
This section is empty.
Source Files