Brian Goff
7cb8389345
By default, if a user requests a bind mount it uses private propagation. When the source path is a path within the daemon root this, along with some other propagation values that the user can use, causes issues when the daemon tries to remove a mountpoint because a container will then have a private reference to that mount which prevents removal. Unmouting with MNT_DETATCH can help this scenario on newer kernels, but ultimately this is just covering up the problem and doesn't actually free up the underlying resources until all references are destroyed. This change does essentially 2 things: 1. Change the default propagation when unspecified to `rslave` when the source path is within the daemon root path or a parent of the daemon root (because everything is using rbinds). 2. Creates a validation error on create when the user tries to specify an unacceptable propagation mode for these paths... basically the only two acceptable modes are `rslave` and `rshared`. In cases where we have used the new default propagation but the underlying filesystem is not setup to handle it (fs must hvae at least rshared propagation) instead of erroring out like we normally would, this falls back to the old default mode of `private`, which preserves backwards compatibility. Signed-off-by: Brian Goff <cpuguy83@gmail.com> (cherry picked from commit 589a0afa8cbe39b6512662fd1705873e2d236dd0) Signed-off-by: Brian Goff <cpuguy83@gmail.com>
54 lines
1.5 KiB
Go
54 lines
1.5 KiB
Go
// +build windows
|
|
|
|
package daemon
|
|
|
|
import (
|
|
"sort"
|
|
|
|
"github.com/docker/docker/api/types/mount"
|
|
"github.com/docker/docker/container"
|
|
"github.com/docker/docker/pkg/idtools"
|
|
"github.com/docker/docker/volume"
|
|
)
|
|
|
|
// setupMounts configures the mount points for a container by appending each
|
|
// of the configured mounts on the container to the OCI mount structure
|
|
// which will ultimately be passed into the oci runtime during container creation.
|
|
// It also ensures each of the mounts are lexicographically sorted.
|
|
|
|
// BUGBUG TODO Windows containerd. This would be much better if it returned
|
|
// an array of runtime spec mounts, not container mounts. Then no need to
|
|
// do multiple transitions.
|
|
|
|
func (daemon *Daemon) setupMounts(c *container.Container) ([]container.Mount, error) {
|
|
var mnts []container.Mount
|
|
for _, mount := range c.MountPoints { // type is volume.MountPoint
|
|
if err := daemon.lazyInitializeVolume(c.ID, mount); err != nil {
|
|
return nil, err
|
|
}
|
|
s, err := mount.Setup(c.MountLabel, idtools.IDPair{0, 0}, nil)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
mnts = append(mnts, container.Mount{
|
|
Source: s,
|
|
Destination: mount.Destination,
|
|
Writable: mount.RW,
|
|
})
|
|
}
|
|
|
|
sort.Sort(mounts(mnts))
|
|
return mnts, nil
|
|
}
|
|
|
|
// setBindModeIfNull is platform specific processing which is a no-op on
|
|
// Windows.
|
|
func setBindModeIfNull(bind *volume.MountPoint) {
|
|
return
|
|
}
|
|
|
|
func (daemon *Daemon) validateBindDaemonRoot(m mount.Mount) (bool, error) {
|
|
return false, nil
|
|
}
|