[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [PATCH] environment: container: Do not remount network files as read
From: |
Thompson, David |
Subject: |
Re: [PATCH] environment: container: Do not remount network files as read-only. |
Date: |
Sun, 27 Mar 2016 20:32:00 -0400 |
On Sun, Mar 27, 2016 at 1:43 PM, Ludovic Courtès <address@hidden> wrote:
> I cannot reproduce the problem with this minimum test case (the two
> ‘mount’ call succeed):
>
> --8<---------------cut here---------------start------------->8---
> (use-modules (guix build syscalls)
> (gnu build linux-container))
>
> (chdir "/tmp")
> (false-if-exception (delete-file "foo"))
> (false-if-exception (umount "bar"))
> (false-if-exception (delete-file "bar"))
>
> (symlink "/etc/resolv.conf" "foo")
> (close-port (open-output-file "bar"))
> (mount "/tmp/foo" "/tmp/bar" "none" (logior MS_BIND MS_RDONLY))
> (mount "/tmp/foo" "/tmp/bar" "none" (logior MS_BIND MS_RDONLY MS_REMOUNT))
> --8<---------------cut here---------------end--------------->8---
>
> Maybe we should try to throw in ‘call-with-container’ somewhere in there
> to be closer to the actual problem, dunno.
>
> It’s a bit frustrating that we don’t understand the situation. If you
> wish, I think it’s fine to commit this patch, but please make sure to
> mention that the problem occurs when /etc/resolv.conf is a symlink, and
> add a link to this discussion.
I found the culprit! This problem occurs with *any* file remounted
read-only from a tmpfs. In Ubuntu, /etc/resolv.conf is a symlink to
/run/resolvconf/resolv.conf, and /run is a tmpfs. I did this to
confirm the issue with another file on GuixSD:
echo foobar > /run/user/foo
guix environment --container --expose=/run/user/foo --ad-hoc coreutils
Where /run/user is a tmpfs. It should fail with an exit status of 1.
I don't know why tmpfs is an issue, nor do I know how work around it.
I've been searching around for answers but haven't found any leads
yet. Any thoughts?
> (FWIW I’m planning to push have the release ready on Monday night.)
Maybe we'll have to punt on this for the release, but I really hope it
can be fixed in time! This is the last thing I need to make networked
containers "just work" on Ubuntu-based distros.
- Dave
- [PATCH] environment: container: Do not remount network files as read-only., Thompson, David, 2016/03/17
- Re: [PATCH] environment: container: Do not remount network files as read-only., Ludovic Courtès, 2016/03/18
- Re: [PATCH] environment: container: Do not remount network files as read-only., Thompson, David, 2016/03/26
- Re: [PATCH] environment: container: Do not remount network files as read-only., Ludovic Courtès, 2016/03/26
- Re: [PATCH] environment: container: Do not remount network files as read-only., Drew C, 2016/03/26
- Re: [PATCH] environment: container: Do not remount network files as read-only., Thompson, David, 2016/03/26
- Re: [PATCH] environment: container: Do not remount network files as read-only., Ludovic Courtès, 2016/03/27
- Re: [PATCH] environment: container: Do not remount network files as read-only.,
Thompson, David <=
- Re: [PATCH] environment: container: Do not remount network files as read-only., Drew C, 2016/03/26
- Re: [PATCH] environment: container: Do not remount network files as read-only., Thompson, David, 2016/03/26
- Re: [PATCH] environment: container: Do not remount network files as read-only., Drew C, 2016/03/26