Documentation
¶
Overview ¶
Package mounts owns the host-side lifecycle of per-sandbox external-storage mounts. Mount tools (mountpoint-s3, sshfs, mount.nfs, rclone) run on the host in a sandboxd-owned directory tree at /var/lib/sandboxd/mounts/<id>/<i>/ and are bind-mounted into the target container. Cross-tenant isolation is enforced by the kernel's mount namespace: containers cannot see other containers' bind sources.
Index ¶
- type Config
- type ContainerBind
- type Manager
- func (m *Manager) Close()
- func (m *Manager) HostBindsFor(sandboxID string) []ContainerBind
- func (m *Manager) MountAll(ctx context.Context, sandboxID string, mounts []models.MountSpec) ([]ContainerBind, error)
- func (m *Manager) Reestablish(ctx context.Context, sandboxID string, mounts []models.MountSpec) error
- func (m *Manager) Sweep(keep map[string]struct{})
- func (m *Manager) UnmountAll(sandboxID string) error
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Config ¶
type Config struct {
RootDir string // /var/lib/sandboxd/mounts
CredDir string // /run/sandboxd
WaitTimeout time.Duration // how long to wait for a mount to become ready
}
Config controls the manager's filesystem layout and timeouts.
type ContainerBind ¶
ContainerBind is the daemon-internal description of a host→container bind mount produced by the mount manager. The docker client converts each one into a HostConfig.Binds entry at container create time.
type Manager ¶
type Manager struct {
// contains filtered or unexported fields
}
Manager owns mount processes for every active sandbox.
func New ¶
New constructs a Manager. The root and cred directories are created with mode 0700 if they don't already exist. Returns an error if either path is not absolute.
func (*Manager) Close ¶
func (m *Manager) Close()
Close stops the supervisor. Existing mounts are left in place so an orderly sandboxd restart can re-establish them.
func (*Manager) HostBindsFor ¶
func (m *Manager) HostBindsFor(sandboxID string) []ContainerBind
HostBindsFor returns the binds the docker client should add to the create request for a sandbox whose mounts are already established.
func (*Manager) MountAll ¶
func (m *Manager) MountAll(ctx context.Context, sandboxID string, mounts []models.MountSpec) ([]ContainerBind, error)
MountAll mounts every spec for a sandbox. On any failure already-mounted entries are torn down before returning.
func (*Manager) Reestablish ¶
func (m *Manager) Reestablish(ctx context.Context, sandboxID string, mounts []models.MountSpec) error
Reestablish ensures a sandbox's mounts are running, mounting any that are missing. Called by the reconciler at startup and periodically.
func (*Manager) Sweep ¶
Sweep removes per-sandbox mount directories under RootDir that are not in keep. For each orphan it best-effort:
- finds any FUSE process whose argv mentions the orphan path and SIGKILLs it
- umount(s) every mountpoint under the orphan dir, lazily if needed
- removes the orphan directory tree
Intended for sandboxd startup, after the reconciler has computed the set of sandboxes that should still exist. A crash mid-MountAll can leave a FUSE process attached to a directory whose sandbox row is gone or whose container never came up; without this sweep those mounts pile up forever.
func (*Manager) UnmountAll ¶
UnmountAll tears down every mount for a sandbox. Always best-effort.
Source Files
Directories