From 37e0bed312acd78b1c9717237ed614f64f359bf0 Mon Sep 17 00:00:00 2001 From: "Guillaume J. Charmes" Date: Tue, 4 Mar 2014 12:30:52 -0800 Subject: [PATCH 1/3] Remove loopback mount bind Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes (github: creack) Upstream-commit: 39d58129c38e8bb868a6fd9a5620837484f6d742 Component: engine --- .../engine/pkg/libcontainer/nsinit/mount.go | 27 ++++--------------- 1 file changed, 5 insertions(+), 22 deletions(-) diff --git a/components/engine/pkg/libcontainer/nsinit/mount.go b/components/engine/pkg/libcontainer/nsinit/mount.go index 9ae7ec4529..7ce90fdb64 100644 --- a/components/engine/pkg/libcontainer/nsinit/mount.go +++ b/components/engine/pkg/libcontainer/nsinit/mount.go @@ -38,9 +38,8 @@ func setupNewMountNamespace(rootfs, console string, readonly bool) error { if err := copyDevNodes(rootfs); err != nil { return fmt.Errorf("copy dev nodes %s", err) } - if err := setupLoopbackDevices(rootfs); err != nil { - return fmt.Errorf("setup loopback devices %s", err) - } + // In non-privileged mode, this fails. Discard the error. + setupLoopbackDevices(rootfs) if err := setupDev(rootfs); err != nil { return err } @@ -102,29 +101,13 @@ func copyDevNodes(rootfs string) error { func setupLoopbackDevices(rootfs string) error { for i := 0; ; i++ { - var ( - device = fmt.Sprintf("loop%d", i) - source = filepath.Join("/dev", device) - dest = filepath.Join(rootfs, "dev", device) - ) - - if _, err := os.Stat(source); err != nil { + if err := copyDevNode(rootfs, fmt.Sprintf("loop%d", i)); err != nil { if !os.IsNotExist(err) { return err } - return nil - } - if _, err := os.Stat(dest); err == nil { - os.Remove(dest) - } - f, err := os.Create(dest) - if err != nil { - return err - } - f.Close() - if err := system.Mount(source, dest, "none", syscall.MS_BIND, ""); err != nil { - return err + break } + } return nil } From 26eb6d1e5d5a86567633b2f74499ac7c9db1ecb4 Mon Sep 17 00:00:00 2001 From: "Guillaume J. Charmes" Date: Tue, 4 Mar 2014 12:32:17 -0800 Subject: [PATCH 2/3] remove /run mountpoint Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes (github: creack) Upstream-commit: c74a8b28cd723d6f12a54da16ff91a853958da5c Component: engine --- components/engine/pkg/libcontainer/nsinit/mount.go | 1 - 1 file changed, 1 deletion(-) diff --git a/components/engine/pkg/libcontainer/nsinit/mount.go b/components/engine/pkg/libcontainer/nsinit/mount.go index 7ce90fdb64..6b6929c99f 100644 --- a/components/engine/pkg/libcontainer/nsinit/mount.go +++ b/components/engine/pkg/libcontainer/nsinit/mount.go @@ -197,7 +197,6 @@ func mountSystem(rootfs string) error { {source: "tmpfs", path: filepath.Join(rootfs, "dev"), device: "tmpfs", flags: syscall.MS_NOSUID | syscall.MS_STRICTATIME, data: "mode=755"}, {source: "shm", path: filepath.Join(rootfs, "dev", "shm"), device: "tmpfs", flags: defaultMountFlags, data: "mode=1777"}, {source: "devpts", path: filepath.Join(rootfs, "dev", "pts"), device: "devpts", flags: syscall.MS_NOSUID | syscall.MS_NOEXEC, data: "newinstance,ptmxmode=0666,mode=620,gid=5"}, - {source: "tmpfs", path: filepath.Join(rootfs, "run"), device: "tmpfs", flags: syscall.MS_NOSUID | syscall.MS_NODEV | syscall.MS_STRICTATIME, data: "mode=755"}, } { if err := os.MkdirAll(m.path, 0755); err != nil && !os.IsExist(err) { return fmt.Errorf("mkdirall %s %s", m.path, err) From d5fd498efb4331c66ad537c2c6f5c1c855be6f4f Mon Sep 17 00:00:00 2001 From: "Guillaume J. Charmes" Date: Tue, 4 Mar 2014 13:21:22 -0800 Subject: [PATCH 3/3] Remove /dev tmpfs mountpoint Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes (github: creack) Upstream-commit: 57a47f5bbfe6c82f3cce32aba96fb641f7188eee Component: engine --- components/engine/pkg/libcontainer/nsinit/mount.go | 1 - 1 file changed, 1 deletion(-) diff --git a/components/engine/pkg/libcontainer/nsinit/mount.go b/components/engine/pkg/libcontainer/nsinit/mount.go index 6b6929c99f..694254ef60 100644 --- a/components/engine/pkg/libcontainer/nsinit/mount.go +++ b/components/engine/pkg/libcontainer/nsinit/mount.go @@ -194,7 +194,6 @@ func mountSystem(rootfs string) error { }{ {source: "proc", path: filepath.Join(rootfs, "proc"), device: "proc", flags: defaultMountFlags}, {source: "sysfs", path: filepath.Join(rootfs, "sys"), device: "sysfs", flags: defaultMountFlags}, - {source: "tmpfs", path: filepath.Join(rootfs, "dev"), device: "tmpfs", flags: syscall.MS_NOSUID | syscall.MS_STRICTATIME, data: "mode=755"}, {source: "shm", path: filepath.Join(rootfs, "dev", "shm"), device: "tmpfs", flags: defaultMountFlags, data: "mode=1777"}, {source: "devpts", path: filepath.Join(rootfs, "dev", "pts"), device: "devpts", flags: syscall.MS_NOSUID | syscall.MS_NOEXEC, data: "newinstance,ptmxmode=0666,mode=620,gid=5"}, } {