From a2b92abfb7064434bf1ed67461bfe18c9b45347d Mon Sep 17 00:00:00 2001 From: utam0k Date: Sat, 20 Nov 2021 15:52:04 +0900 Subject: [PATCH 01/27] use a command instead of label to run benchmark. --- .github/workflows/benchmark_execution_time.yml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/workflows/benchmark_execution_time.yml b/.github/workflows/benchmark_execution_time.yml index ca9275c9b..2971acb64 100644 --- a/.github/workflows/benchmark_execution_time.yml +++ b/.github/workflows/benchmark_execution_time.yml @@ -1,12 +1,12 @@ name: Benchmark execution time comparison with the main branch on: - pull_request: - branches: [main] + issue_comment: + types: [created, edited, deleted] jobs: building-pr-branch: - if: contains( github.event.pull_request.labels.*.name, 'benchmark-exec-time' ) + if: (github.event.issue.pull_request != null) && github.event.comment.body == '!github easy-benchmark' runs-on: ubuntu-latest steps: @@ -35,7 +35,7 @@ jobs: path: ./youki building-main-branch: - if: contains( github.event.pull_request.labels.*.name, 'benchmark-exec-time' ) + if: (github.event.issue.pull_request != null) && github.event.comment.body == '!github easy-benchmark' runs-on: ubuntu-latest steps: @@ -66,7 +66,7 @@ jobs: path: ./youki benchmark-exec: - if: contains( github.event.pull_request.labels.*.name, 'benchmark-exec-time' ) + if: (github.event.issue.pull_request != null) && github.event.comment.body == '!github easy-benchmark' needs: - building-pr-branch - building-main-branch From 0dd9bb115669b932f066cefbc9a0469da77dc6bf Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 22 Nov 2021 01:09:08 +0000 Subject: [PATCH 02/27] Bump libc from 0.2.107 to 0.2.108 Bumps [libc](https://github.com/rust-lang/libc) from 0.2.107 to 0.2.108. - [Release notes](https://github.com/rust-lang/libc/releases) - [Commits](https://github.com/rust-lang/libc/compare/0.2.107...0.2.108) --- updated-dependencies: - dependency-name: libc dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] --- Cargo.lock | 4 ++-- crates/libcgroups/Cargo.toml | 2 +- crates/libcontainer/Cargo.toml | 2 +- crates/libseccomp/Cargo.toml | 2 +- 4 files changed, 5 insertions(+), 5 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 7edc2b90d..20d2627ed 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -611,9 +611,9 @@ dependencies = [ [[package]] name = "libc" -version = "0.2.107" +version = "0.2.108" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "fbe5e23404da5b4f555ef85ebed98fb4083e55a00c317800bc2a50ede9f3d219" +checksum = "8521a1b57e76b1ec69af7599e75e38e7b7fad6610f037db8c79b127201b5d119" [[package]] name = "libcgroups" diff --git a/crates/libcgroups/Cargo.toml b/crates/libcgroups/Cargo.toml index a8146577b..5dc81c8a2 100644 --- a/crates/libcgroups/Cargo.toml +++ b/crates/libcgroups/Cargo.toml @@ -19,7 +19,7 @@ serde = { version = "1.0", features = ["derive"] } rbpf = {version = "0.1.0", optional = true } libbpf-sys = { version = "0.5.0-2", optional = true } errno = { version = "0.2.8", optional = true } -libc = { version = "0.2.107", optional = true } +libc = { version = "0.2.108", optional = true } [dev-dependencies] oci-spec = { git = "https://github.com/containers/oci-spec-rs", rev = "54c5e386f01ab37c9305cc4a83404eb157e42440", features = ["proptests"] } diff --git a/crates/libcontainer/Cargo.toml b/crates/libcontainer/Cargo.toml index 58f732191..cfa070dc8 100644 --- a/crates/libcontainer/Cargo.toml +++ b/crates/libcontainer/Cargo.toml @@ -14,7 +14,7 @@ crossbeam-channel = "0.5" dbus = "0.9.5" fastrand = "1.4.1" futures = { version = "0.3", features = ["thread-pool"] } -libc = "0.2.107" +libc = "0.2.108" log = "0.4" mio = { version = "0.8.0", features = ["os-ext", "os-poll"] } nix = "0.23.0" diff --git a/crates/libseccomp/Cargo.toml b/crates/libseccomp/Cargo.toml index 129b414ae..37dd867b5 100644 --- a/crates/libseccomp/Cargo.toml +++ b/crates/libseccomp/Cargo.toml @@ -6,7 +6,7 @@ edition = "2021" build = "build.rs" [dependencies] -libc = "0.2.107" +libc = "0.2.108" [build-dependencies] pkg-config = "0.3.22" From bda6f5fd6ffe8ac2b8728e552bbf66c3131186bb Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 22 Nov 2021 01:09:14 +0000 Subject: [PATCH 03/27] Bump anyhow from 1.0.45 to 1.0.47 Bumps [anyhow](https://github.com/dtolnay/anyhow) from 1.0.45 to 1.0.47. - [Release notes](https://github.com/dtolnay/anyhow/releases) - [Commits](https://github.com/dtolnay/anyhow/compare/1.0.45...1.0.47) --- updated-dependencies: - dependency-name: anyhow dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] --- Cargo.lock | 4 ++-- crates/test_framework/Cargo.toml | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 7edc2b90d..6a509b214 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -19,9 +19,9 @@ dependencies = [ [[package]] name = "anyhow" -version = "1.0.45" +version = "1.0.47" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ee10e43ae4a853c0a3591d4e2ada1719e553be18199d9da9d4a83f5927c2f5c7" +checksum = "38d9ff5d688f1c13395289f67db01d4826b46dd694e7580accdc3e8430f2d98e" [[package]] name = "ascii" diff --git a/crates/test_framework/Cargo.toml b/crates/test_framework/Cargo.toml index 635e4b572..318fa52e4 100644 --- a/crates/test_framework/Cargo.toml +++ b/crates/test_framework/Cargo.toml @@ -6,5 +6,5 @@ edition = "2021" # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html [dependencies] -anyhow = "1.0.45" +anyhow = "1.0.47" crossbeam = "0.8.1" \ No newline at end of file From 9d86ea0beb283abc1ed1da2bfa8cb3e2a0f6244e Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 23 Nov 2021 00:38:12 +0000 Subject: [PATCH 04/27] Bump anyhow from 1.0.47 to 1.0.48 Bumps [anyhow](https://github.com/dtolnay/anyhow) from 1.0.47 to 1.0.48. - [Release notes](https://github.com/dtolnay/anyhow/releases) - [Commits](https://github.com/dtolnay/anyhow/compare/1.0.47...1.0.48) --- updated-dependencies: - dependency-name: anyhow dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] --- Cargo.lock | 4 ++-- crates/test_framework/Cargo.toml | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 2d909f896..effc014f1 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -19,9 +19,9 @@ dependencies = [ [[package]] name = "anyhow" -version = "1.0.47" +version = "1.0.48" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "38d9ff5d688f1c13395289f67db01d4826b46dd694e7580accdc3e8430f2d98e" +checksum = "62e1f47f7dc0422027a4e370dd4548d4d66b26782e513e98dca1e689e058a80e" [[package]] name = "ascii" diff --git a/crates/test_framework/Cargo.toml b/crates/test_framework/Cargo.toml index 318fa52e4..1bb9dde94 100644 --- a/crates/test_framework/Cargo.toml +++ b/crates/test_framework/Cargo.toml @@ -6,5 +6,5 @@ edition = "2021" # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html [dependencies] -anyhow = "1.0.47" +anyhow = "1.0.48" crossbeam = "0.8.1" \ No newline at end of file From 6a496886a83366ea0bc1ad1bfbc72a4806602b81 Mon Sep 17 00:00:00 2001 From: David Gibson Date: Tue, 23 Nov 2021 15:26:20 +1100 Subject: [PATCH 05/27] Create a subdirectory under XDG_RUNTIME_DIR When using a root state directory from $XDG_RUNTIME_DIR, or from it's default value of /run/user/, we don't add a tag specific to youki to the path. That means the directories for individual containers will be placed directly in the general use runtime dir. That's against normal conventions, and could mean that "youki list" will see files or directories from other software as if they were youki managed containers. Therefore, add "youki" to the base runtime path from XDG. fixes #487 Signed-off-by: David Gibson --- crates/youki/src/main.rs | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) diff --git a/crates/youki/src/main.rs b/crates/youki/src/main.rs index d61d3584b..afd73bb98 100644 --- a/crates/youki/src/main.rs +++ b/crates/youki/src/main.rs @@ -5,7 +5,7 @@ mod commands; mod logger; use std::fs; -use std::path::PathBuf; +use std::path::{Path, PathBuf}; use anyhow::bail; use anyhow::Context; @@ -145,15 +145,18 @@ fn determine_root_path(root_path: Option) -> Result { } // see https://specifications.freedesktop.org/basedir-spec/basedir-spec-latest.html + let uid = getuid().as_raw(); if let Ok(path) = std::env::var("XDG_RUNTIME_DIR") { - return Ok(PathBuf::from(path)); + let path = Path::new(&path).join("youki"); + if create_dir_all_with_mode(&path, uid, Mode::S_IRWXU).is_ok() { + return Ok(path); + } } // XDG_RUNTIME_DIR is not set, try the usual location - let uid = getuid().as_raw(); - let runtime_dir = PathBuf::from(format!("/run/user/{}", uid)); - if create_dir_all_with_mode(&runtime_dir, uid, Mode::S_IRWXU).is_ok() { - return Ok(runtime_dir); + let path = PathBuf::from(format!("/run/user/{}/youki", uid)); + if create_dir_all_with_mode(&path, uid, Mode::S_IRWXU).is_ok() { + return Ok(path); } if let Ok(path) = std::env::var("HOME") { From b301d778ee12744cf816a70ad99b1f92a49c537e Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 24 Nov 2021 00:45:59 +0000 Subject: [PATCH 06/27] Bump futures-io from 0.3.17 to 0.3.18 Bumps [futures-io](https://github.com/rust-lang/futures-rs) from 0.3.17 to 0.3.18. - [Release notes](https://github.com/rust-lang/futures-rs/releases) - [Changelog](https://github.com/rust-lang/futures-rs/blob/master/CHANGELOG.md) - [Commits](https://github.com/rust-lang/futures-rs/compare/0.3.17...0.3.18) --- updated-dependencies: - dependency-name: futures-io dependency-type: indirect update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] --- Cargo.lock | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index effc014f1..f295be652 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -430,9 +430,9 @@ dependencies = [ [[package]] name = "futures-io" -version = "0.3.17" +version = "0.3.18" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "522de2a0fe3e380f1bc577ba0474108faf3f6b18321dbf60b3b9c39a75073377" +checksum = "e481354db6b5c353246ccf6a728b0c5511d752c08da7260546fc0933869daa11" [[package]] name = "futures-macro" From 24e8e87ac63f1e20727fc8aaa7e9aeb76d332024 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 24 Nov 2021 00:46:05 +0000 Subject: [PATCH 07/27] Bump futures-core from 0.3.17 to 0.3.18 Bumps [futures-core](https://github.com/rust-lang/futures-rs) from 0.3.17 to 0.3.18. - [Release notes](https://github.com/rust-lang/futures-rs/releases) - [Changelog](https://github.com/rust-lang/futures-rs/blob/master/CHANGELOG.md) - [Commits](https://github.com/rust-lang/futures-rs/compare/0.3.17...0.3.18) --- updated-dependencies: - dependency-name: futures-core dependency-type: indirect update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] --- Cargo.lock | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index effc014f1..cbb5900cb 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -412,9 +412,9 @@ dependencies = [ [[package]] name = "futures-core" -version = "0.3.17" +version = "0.3.18" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "88d1c26957f23603395cd326b0ffe64124b818f4449552f960d815cfba83a53d" +checksum = "629316e42fe7c2a0b9a65b47d159ceaa5453ab14e8f0a3c5eedbb8cd55b4a445" [[package]] name = "futures-executor" From d55771a4bc0170d4f8b423a9ad521fa59621e427 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 24 Nov 2021 00:46:10 +0000 Subject: [PATCH 08/27] Bump crc32fast from 1.2.1 to 1.2.2 Bumps [crc32fast](https://github.com/srijs/rust-crc32fast) from 1.2.1 to 1.2.2. - [Release notes](https://github.com/srijs/rust-crc32fast/releases) - [Commits](https://github.com/srijs/rust-crc32fast/compare/v1.2.1...v1.2.2) --- updated-dependencies: - dependency-name: crc32fast dependency-type: indirect update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] --- Cargo.lock | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index effc014f1..50dc8693c 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -138,9 +138,9 @@ dependencies = [ [[package]] name = "crc32fast" -version = "1.2.1" +version = "1.2.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "81156fece84ab6a9f2afdb109ce3ae577e42b1228441eded99bd77f627953b1a" +checksum = "3825b1e8580894917dc4468cb634a1b4e9745fddc854edad72d9c04644c0319f" dependencies = [ "cfg-if", ] From 9b81aa625fa606e5544070879aaa7c80616f1bad Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 24 Nov 2021 00:46:30 +0000 Subject: [PATCH 09/27] Bump futures-channel from 0.3.17 to 0.3.18 Bumps [futures-channel](https://github.com/rust-lang/futures-rs) from 0.3.17 to 0.3.18. - [Release notes](https://github.com/rust-lang/futures-rs/releases) - [Changelog](https://github.com/rust-lang/futures-rs/blob/master/CHANGELOG.md) - [Commits](https://github.com/rust-lang/futures-rs/compare/0.3.17...0.3.18) --- updated-dependencies: - dependency-name: futures-channel dependency-type: indirect update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] --- Cargo.lock | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index effc014f1..17db56940 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -402,9 +402,9 @@ dependencies = [ [[package]] name = "futures-channel" -version = "0.3.17" +version = "0.3.18" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5da6ba8c3bb3c165d3c7319fc1cc8304facf1fb8db99c5de877183c08a273888" +checksum = "7fc8cd39e3dbf865f7340dce6a2d401d24fd37c6fe6c4f0ee0de8bfca2252d27" dependencies = [ "futures-core", "futures-sink", @@ -412,9 +412,9 @@ dependencies = [ [[package]] name = "futures-core" -version = "0.3.17" +version = "0.3.18" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "88d1c26957f23603395cd326b0ffe64124b818f4449552f960d815cfba83a53d" +checksum = "629316e42fe7c2a0b9a65b47d159ceaa5453ab14e8f0a3c5eedbb8cd55b4a445" [[package]] name = "futures-executor" @@ -449,9 +449,9 @@ dependencies = [ [[package]] name = "futures-sink" -version = "0.3.17" +version = "0.3.18" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "36ea153c13024fe480590b3e3d4cad89a0cfacecc24577b68f86c6ced9c2bc11" +checksum = "996c6442437b62d21a32cd9906f9c41e7dc1e19a9579843fad948696769305af" [[package]] name = "futures-task" From d9233e24112c031e2d48f92ee9c5c9fca48255b1 Mon Sep 17 00:00:00 2001 From: David Gibson Date: Wed, 24 Nov 2021 14:21:29 +1100 Subject: [PATCH 10/27] Use /tmp/youki- rather than /tmp/youki/ in determine_root_path determine_root_path goes through various options to find a state storage location, the last of which is /tmp/youki/. If a user (say, UID 1000) uses youki, and this final option is selected, /tmp/youki will be created as well as /tmp/youki/1000. Both will be created owned by UID 1000 and with write permissions only for that user. Them, if another user (say, UID 1001) attempts to use youki and the same final option is selected, it will fail, because it cannot create /tmp/youki/1001 under the /tmp/youki owned by UID 1000. There's really no way to safely create a multi-user shared subdirectory in /tmp, so instead we should create our per-user directory directly under /tmp. We do this by calling it /tmp/youki- instead. fixes #496 Signed-off-by: David Gibson --- crates/youki/src/main.rs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/crates/youki/src/main.rs b/crates/youki/src/main.rs index afd73bb98..67657a56d 100644 --- a/crates/youki/src/main.rs +++ b/crates/youki/src/main.rs @@ -168,7 +168,7 @@ fn determine_root_path(root_path: Option) -> Result { } } - let tmp_dir = PathBuf::from(format!("/tmp/youki/{}", uid)); + let tmp_dir = PathBuf::from(format!("/tmp/youki-{}", uid)); if create_dir_all_with_mode(&tmp_dir, uid, Mode::S_IRWXU).is_ok() { return Ok(tmp_dir); } From 6748fa2c3eaca51af667b20ed473e02ef4afabb9 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 24 Nov 2021 08:26:26 +0000 Subject: [PATCH 11/27] Bump futures from 0.3.17 to 0.3.18 Bumps [futures](https://github.com/rust-lang/futures-rs) from 0.3.17 to 0.3.18. - [Release notes](https://github.com/rust-lang/futures-rs/releases) - [Changelog](https://github.com/rust-lang/futures-rs/blob/master/CHANGELOG.md) - [Commits](https://github.com/rust-lang/futures-rs/compare/0.3.17...0.3.18) --- updated-dependencies: - dependency-name: futures dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] --- Cargo.lock | 37 ++++++++++--------------------------- 1 file changed, 10 insertions(+), 27 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 70baa7570..8a87f7638 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -387,9 +387,9 @@ checksum = "3f9eec918d3f24069decb9af1554cad7c880e2da24a9afd88aca000531ab82c1" [[package]] name = "futures" -version = "0.3.17" +version = "0.3.18" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "a12aa0eb539080d55c3f2d45a67c3b58b6b0773c1a3ca2dfec66d58c97fd66ca" +checksum = "8cd0210d8c325c245ff06fd95a3b13689a1a276ac8cfa8e8720cb840bfb84b9e" dependencies = [ "futures-channel", "futures-core", @@ -418,9 +418,9 @@ checksum = "629316e42fe7c2a0b9a65b47d159ceaa5453ab14e8f0a3c5eedbb8cd55b4a445" [[package]] name = "futures-executor" -version = "0.3.17" +version = "0.3.18" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "45025be030969d763025784f7f355043dc6bc74093e4ecc5000ca4dc50d8745c" +checksum = "7b808bf53348a36cab739d7e04755909b9fcaaa69b7d7e588b37b6ec62704c97" dependencies = [ "futures-core", "futures-task", @@ -436,12 +436,10 @@ checksum = "e481354db6b5c353246ccf6a728b0c5511d752c08da7260546fc0933869daa11" [[package]] name = "futures-macro" -version = "0.3.17" +version = "0.3.18" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "18e4a4b95cea4b4ccbcf1c5675ca7c4ee4e9e75eb79944d07defde18068f79bb" +checksum = "a89f17b21645bc4ed773c69af9c9a0effd4a3f1a3876eadd453469f8854e7fdd" dependencies = [ - "autocfg", - "proc-macro-hack", "proc-macro2", "quote", "syn", @@ -455,17 +453,16 @@ checksum = "996c6442437b62d21a32cd9906f9c41e7dc1e19a9579843fad948696769305af" [[package]] name = "futures-task" -version = "0.3.17" +version = "0.3.18" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "1d3d00f4eddb73e498a54394f228cd55853bdf059259e8e7bc6e69d408892e99" +checksum = "dabf1872aaab32c886832f2276d2f5399887e2bd613698a02359e4ea83f8de12" [[package]] name = "futures-util" -version = "0.3.17" +version = "0.3.18" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "36568465210a3a6ee45e1f165136d68671471a501e632e9a98d96872222b5481" +checksum = "41d22213122356472061ac0f1ab2cee28d2bac8491410fd68c2af53d1cedb83e" dependencies = [ - "autocfg", "futures-channel", "futures-core", "futures-io", @@ -475,8 +472,6 @@ dependencies = [ "memchr", "pin-project-lite", "pin-utils", - "proc-macro-hack", - "proc-macro-nested", "slab", ] @@ -936,18 +931,6 @@ dependencies = [ "version_check", ] -[[package]] -name = "proc-macro-hack" -version = "0.5.19" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "dbf0c48bc1d91375ae5c3cd81e3722dff1abcf81a30960240640d223f59fe0e5" - -[[package]] -name = "proc-macro-nested" -version = "0.1.7" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "bc881b2c22681370c6a780e47af9840ef841837bc98118431d4e1868bd0c1086" - [[package]] name = "proc-macro2" version = "1.0.32" From 19a0c7453bacd3349d64a7395a1080043c41e66b Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 24 Nov 2021 08:26:31 +0000 Subject: [PATCH 12/27] Bump futures-task from 0.3.17 to 0.3.18 Bumps [futures-task](https://github.com/rust-lang/futures-rs) from 0.3.17 to 0.3.18. - [Release notes](https://github.com/rust-lang/futures-rs/releases) - [Changelog](https://github.com/rust-lang/futures-rs/blob/master/CHANGELOG.md) - [Commits](https://github.com/rust-lang/futures-rs/compare/0.3.17...0.3.18) --- updated-dependencies: - dependency-name: futures-task dependency-type: indirect update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] --- Cargo.lock | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 70baa7570..3371cea65 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -455,9 +455,9 @@ checksum = "996c6442437b62d21a32cd9906f9c41e7dc1e19a9579843fad948696769305af" [[package]] name = "futures-task" -version = "0.3.17" +version = "0.3.18" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "1d3d00f4eddb73e498a54394f228cd55853bdf059259e8e7bc6e69d408892e99" +checksum = "dabf1872aaab32c886832f2276d2f5399887e2bd613698a02359e4ea83f8de12" [[package]] name = "futures-util" From f12082a9a69bfdd239aeed4ef7fc04b76cb9dcce Mon Sep 17 00:00:00 2001 From: Furisto <24721048+Furisto@users.noreply.github.com> Date: Sun, 21 Nov 2021 20:01:11 +0100 Subject: [PATCH 13/27] Apply resource restrictions in rootless mode --- crates/libcgroups/src/common.rs | 4 ++++ .../libcontainer/src/container/builder_impl.rs | 4 ++-- .../process/container_intermediate_process.rs | 17 ++++++++--------- crates/libcontainer/src/rootless.rs | 1 - 4 files changed, 14 insertions(+), 12 deletions(-) diff --git a/crates/libcgroups/src/common.rs b/crates/libcgroups/src/common.rs index 45f05e663..9d3e54872 100644 --- a/crates/libcgroups/src/common.rs +++ b/crates/libcgroups/src/common.rs @@ -176,6 +176,10 @@ pub fn create_cgroup_manager>( match cgroup_setup { CgroupSetup::Legacy | CgroupSetup::Hybrid => { + if systemd_cgroup { + bail!("resource control with systemd is not supported on cgroup v1"); + } + log::info!("cgroup manager V1 will be used"); Ok(Box::new(v1::manager::Manager::new(cgroup_path.into())?)) } diff --git a/crates/libcontainer/src/container/builder_impl.rs b/crates/libcontainer/src/container/builder_impl.rs index 633933585..47bdb312c 100644 --- a/crates/libcontainer/src/container/builder_impl.rs +++ b/crates/libcontainer/src/container/builder_impl.rs @@ -57,7 +57,7 @@ impl<'a> ContainerBuilderImpl<'a> { let cgroups_path = utils::get_cgroup_path(linux.cgroups_path(), &self.container_id); let cmanager = libcgroups::common::create_cgroup_manager( &cgroups_path, - self.use_systemd, + self.use_systemd || self.rootless.is_some(), &self.container_id, )?; let process = self.spec.process().as_ref().context("No process in spec")?; @@ -142,7 +142,7 @@ impl<'a> ContainerBuilderImpl<'a> { let cgroups_path = utils::get_cgroup_path(linux.cgroups_path(), &self.container_id); let cmanager = libcgroups::common::create_cgroup_manager( &cgroups_path, - self.use_systemd, + self.use_systemd || self.rootless.is_some(), &self.container_id, )?; diff --git a/crates/libcontainer/src/process/container_intermediate_process.rs b/crates/libcontainer/src/process/container_intermediate_process.rs index 547e7a9db..4bde50d3f 100644 --- a/crates/libcontainer/src/process/container_intermediate_process.rs +++ b/crates/libcontainer/src/process/container_intermediate_process.rs @@ -47,7 +47,7 @@ pub fn container_intermediate_process( // root in the user namespace likely is mapped to an non-priviliged user // on the parent user namespace. command.set_id(Uid::from_raw(0), Gid::from_raw(0)).context( - "Failed to configure uid and gid root in the beginning of a new user namespace", + "failed to configure uid and gid root in the beginning of a new user namespace", )?; } @@ -68,14 +68,13 @@ pub fn container_intermediate_process( // this needs to be done before we create the init process, so that the init // process will already be captured by the cgroup - if args.rootless.is_none() { - apply_cgroups( - args.cgroup_manager.as_ref(), - linux.resources().as_ref(), - args.init, - ) - .context("failed to apply cgroups")? - } + + apply_cgroups( + args.cgroup_manager.as_ref(), + linux.resources().as_ref(), + args.init, + ) + .context("failed to apply cgroups")?; // We have to record the pid of the child (container init process), since // the child will be inside the pid namespace. We can't rely on child_ready diff --git a/crates/libcontainer/src/rootless.rs b/crates/libcontainer/src/rootless.rs index 5ea61b0fd..edf711000 100644 --- a/crates/libcontainer/src/rootless.rs +++ b/crates/libcontainer/src/rootless.rs @@ -36,7 +36,6 @@ impl<'a> Rootless<'a> { if user_namespace.is_some() && user_namespace.unwrap().path().is_none() { log::debug!("rootless container should be created"); - log::warn!("resource constraints are unimplemented for rootless containers"); validate(spec).context("The spec failed to comply to rootless requirement")?; let mut rootless = Rootless::from(linux); From 190a0bad38876fe590b055c0a3f6b0060787e405 Mon Sep 17 00:00:00 2001 From: Furisto <24721048+Furisto@users.noreply.github.com> Date: Sun, 21 Nov 2021 20:50:30 +0100 Subject: [PATCH 14/27] Add session dbus connection --- crates/libcgroups/src/common.rs | 6 +++++- crates/libcgroups/src/systemd/dbus/client.rs | 9 ++++++++- crates/libcgroups/src/systemd/manager.rs | 7 +++++-- 3 files changed, 18 insertions(+), 4 deletions(-) diff --git a/crates/libcgroups/src/common.rs b/crates/libcgroups/src/common.rs index 9d3e54872..475be0c23 100644 --- a/crates/libcgroups/src/common.rs +++ b/crates/libcgroups/src/common.rs @@ -188,11 +188,15 @@ pub fn create_cgroup_manager>( if !systemd::booted() { bail!("systemd cgroup flag passed, but systemd support for managing cgroups is not available"); } - log::info!("systemd cgroup manager will be used"); + + let use_system = nix::unistd::geteuid().is_root(); + + log::info!("systemd cgroup manager with system bus {} will be used", use_system); return Ok(Box::new(systemd::manager::Manager::new( DEFAULT_CGROUP_ROOT.into(), cgroup_path.into(), container_name.into(), + use_system )?)); } log::info!("cgroup manager V2 will be used"); diff --git a/crates/libcgroups/src/systemd/dbus/client.rs b/crates/libcgroups/src/systemd/dbus/client.rs index 6576ed0d2..26f8f3dfc 100644 --- a/crates/libcgroups/src/systemd/dbus/client.rs +++ b/crates/libcgroups/src/systemd/dbus/client.rs @@ -12,11 +12,18 @@ pub struct Client { } impl Client { - pub fn new() -> Result { + /// Uses the system bus to communicate with systemd + pub fn new_system() -> Result { let conn = Connection::new_system()?; Ok(Client { conn }) } + /// Uses the session bus to communicate with systemd + pub fn new_session() -> Result { + let conn = Connection::new_session()?; + Ok(Client { conn }) + } + fn create_proxy(&self) -> Proxy<&Connection> { self.conn.with_proxy( "org.freedesktop.systemd1", diff --git a/crates/libcgroups/src/systemd/manager.rs b/crates/libcgroups/src/systemd/manager.rs index dbe7d247c..295190659 100644 --- a/crates/libcgroups/src/systemd/manager.rs +++ b/crates/libcgroups/src/systemd/manager.rs @@ -61,7 +61,7 @@ impl Display for CgroupsPath { } impl Manager { - pub fn new(root_path: PathBuf, cgroups_path: PathBuf, container_name: String) -> Result { + pub fn new(root_path: PathBuf, cgroups_path: PathBuf, container_name: String, use_system: bool) -> Result { // TODO: create the systemd unit using a dbus client. let destructured_path = Self::destructure_cgroups_path(cgroups_path)?; let (cgroups_path, parent) = Self::construct_cgroups_path(&destructured_path)?; @@ -74,7 +74,10 @@ impl Manager { container_name, unit_name: Self::get_unit_name(&destructured_path), destructured_path, - client: Client::new().context("failed to create dbus client")?, + client: match use_system { + true => Client::new_system().context("failed to create system dbus client")?, + false => Client::new_session().context("failed to create session dbus client")?, + } }) } From c6b91abf355f8f08ebbbc3af518501f8137fde76 Mon Sep 17 00:00:00 2001 From: Furisto <24721048+Furisto@users.noreply.github.com> Date: Wed, 24 Nov 2021 00:08:02 +0100 Subject: [PATCH 15/27] Define & implement trait for systemd client --- crates/libcgroups/src/systemd/dbus/client.rs | 59 ++++++++++++++++++-- 1 file changed, 53 insertions(+), 6 deletions(-) diff --git a/crates/libcgroups/src/systemd/dbus/client.rs b/crates/libcgroups/src/systemd/dbus/client.rs index 26f8f3dfc..7d8aff2d9 100644 --- a/crates/libcgroups/src/systemd/dbus/client.rs +++ b/crates/libcgroups/src/systemd/dbus/client.rs @@ -3,25 +3,54 @@ use anyhow::{Context, Result}; use dbus::arg::{RefArg, Variant}; use dbus::blocking::{Connection, Proxy}; use std::collections::HashMap; +use std::path::PathBuf; use std::time::Duration; +pub trait SystemdClient { + fn is_system(&self) -> bool; + + fn start_transient_unit( + &self, + container_name: &str, + pid: u32, + parent: &str, + unit_name: &str, + ) -> Result<()>; + + fn stop_transient_unit(&self, unit_name: &str) -> Result<()>; + + fn set_unit_properties( + &self, + unit_name: &str, + properties: &HashMap<&str, Box>, + ) -> Result<()>; + + fn systemd_version(&self) -> Result; + + fn control_cgroup_root(&self) -> Result; +} + /// Client is a wrapper providing higher level API and abatraction around dbus. /// For more information see https://www.freedesktop.org/wiki/Software/systemd/dbus/ pub struct Client { conn: Connection, + system: bool, } impl Client { /// Uses the system bus to communicate with systemd pub fn new_system() -> Result { let conn = Connection::new_system()?; - Ok(Client { conn }) + Ok(Client { conn, system: true }) } /// Uses the session bus to communicate with systemd pub fn new_session() -> Result { let conn = Connection::new_session()?; - Ok(Client { conn }) + Ok(Client { + conn, + system: false, + }) } fn create_proxy(&self) -> Proxy<&Connection> { @@ -31,11 +60,17 @@ impl Client { Duration::from_millis(5000), ) } +} + +impl SystemdClient for Client { + fn is_system(&self) -> bool { + self.system + } /// start_transient_unit is a higher level API for starting a unit /// for a specific container under systemd. /// See https://www.freedesktop.org/wiki/Software/systemd/dbus for more details. - pub fn start_transient_unit( + fn start_transient_unit( &self, container_name: &str, pid: u32, @@ -77,6 +112,8 @@ impl Client { properties.push(("DefaultDependencies", Variant(Box::new(false)))); properties.push(("PIDs", Variant(Box::new(vec![pid])))); + log::debug!("START UNIT: {:?}", properties); + proxy .start_transient_unit(unit_name, "replace", properties, vec![]) .with_context(|| { @@ -88,7 +125,7 @@ impl Client { Ok(()) } - pub fn stop_transient_unit(&self, unit_name: &str) -> Result<()> { + fn stop_transient_unit(&self, unit_name: &str) -> Result<()> { let proxy = self.create_proxy(); proxy @@ -97,7 +134,7 @@ impl Client { Ok(()) } - pub fn set_unit_properties( + fn set_unit_properties( &self, unit_name: &str, properties: &HashMap<&str, Box>, @@ -115,7 +152,7 @@ impl Client { Ok(()) } - pub fn systemd_version(&self) -> Result { + fn systemd_version(&self) -> Result { let proxy = self.create_proxy(); let version = proxy @@ -130,4 +167,14 @@ impl Client { Ok(version) } + + fn control_cgroup_root(&self) -> Result { + let proxy = self.create_proxy(); + + let cgroup_root = proxy + .control_group() + .context("failed to get systemd control group")?; + PathBuf::try_from(cgroup_root) + .with_context(|| format!("parse systemd control cgroup into path")) + } } From 64fd60dda3370cb43ad8a33e8f2e2b349685e5bb Mon Sep 17 00:00:00 2001 From: Furisto <24721048+Furisto@users.noreply.github.com> Date: Wed, 24 Nov 2021 19:11:00 +0100 Subject: [PATCH 16/27] Systemd manager updates - Use systemd client to find systemd cgroup root - Add error context - Manager debug impl - Comments - Set default slice name for rootless and rootfull containers --- crates/libcgroups/src/common.rs | 9 +- crates/libcgroups/src/systemd/manager.rs | 163 +++++++++++++++++------ 2 files changed, 128 insertions(+), 44 deletions(-) diff --git a/crates/libcgroups/src/common.rs b/crates/libcgroups/src/common.rs index 475be0c23..c32bfa4c1 100644 --- a/crates/libcgroups/src/common.rs +++ b/crates/libcgroups/src/common.rs @@ -190,13 +190,16 @@ pub fn create_cgroup_manager>( } let use_system = nix::unistd::geteuid().is_root(); - - log::info!("systemd cgroup manager with system bus {} will be used", use_system); + + log::info!( + "systemd cgroup manager with system bus {} will be used", + use_system + ); return Ok(Box::new(systemd::manager::Manager::new( DEFAULT_CGROUP_ROOT.into(), cgroup_path.into(), container_name.into(), - use_system + use_system, )?)); } log::info!("cgroup manager V2 will be used"); diff --git a/crates/libcgroups/src/systemd/manager.rs b/crates/libcgroups/src/systemd/manager.rs index 295190659..39ea5ccee 100644 --- a/crates/libcgroups/src/systemd/manager.rs +++ b/crates/libcgroups/src/systemd/manager.rs @@ -2,7 +2,7 @@ #![allow(unused_variables)] use std::{ collections::HashMap, - fmt::Display, + fmt::{Debug, Display}, fs::{self}, os::unix::fs::PermissionsExt, path::Component::RootDir, @@ -18,7 +18,7 @@ use super::{ controller_type::{ControllerType, CONTROLLER_TYPES}, cpu::Cpu, cpuset::CpuSet, - dbus::client::Client, + dbus::client::{Client, SystemdClient}, memory::Memory, pids::Pids, }; @@ -32,14 +32,21 @@ const CGROUP_PROCS: &str = "cgroup.procs"; const CGROUP_CONTROLLERS: &str = "cgroup.controllers"; const CGROUP_SUBTREE_CONTROL: &str = "cgroup.subtree_control"; -/// SystemDCGroupManager is a driver for managing cgroups via systemd. pub struct Manager { + /// Root path of the cgroup hierarchy e.g. /sys/fs/cgroup root_path: PathBuf, + /// Path relative to the root path e.g. /system.slice/youki-569d5ce3afe1074769f67.scope for rootfull containers + /// and e.g. /user.slice/user-1000/user@1000.service/youki-569d5ce3afe1074769f67.scope for rootless containers cgroups_path: PathBuf, + /// Combination of root path and cgroups path full_path: PathBuf, + /// Destructured cgroups path as specified in the runtime spec e.g. system.slice:youki:569d5ce3afe1074769f67 destructured_path: CgroupsPath, + /// Name of the container e.g. 569d5ce3afe1074769f67 container_name: String, + /// Name of the systemd unit e.g. youki-569d5ce3afe1074769f67.scope unit_name: String, + /// Client for communicating with systemd client: Client, } @@ -60,11 +67,37 @@ impl Display for CgroupsPath { } } +// custom debug impl as Manager contains fields that do not implement Debug +// and therefore Debug cannot be derived +impl Debug for Manager { + fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result { + f.debug_struct("Manager") + .field("root_path", &self.root_path) + .field("cgroups_path", &self.cgroups_path) + .field("full_path", &self.full_path) + .field("destructured_path", &self.destructured_path) + .field("container_name", &self.container_name) + .field("unit_name", &self.unit_name) + .finish() + } +} + impl Manager { - pub fn new(root_path: PathBuf, cgroups_path: PathBuf, container_name: String, use_system: bool) -> Result { - // TODO: create the systemd unit using a dbus client. - let destructured_path = Self::destructure_cgroups_path(cgroups_path)?; - let (cgroups_path, parent) = Self::construct_cgroups_path(&destructured_path)?; + pub fn new( + root_path: PathBuf, + cgroups_path: PathBuf, + container_name: String, + use_system: bool, + ) -> Result { + let destructured_path = Self::destructure_cgroups_path(&cgroups_path) + .with_context(|| format!("failed to destructure cgroups path {:?}", cgroups_path))?; + let client = match use_system { + true => Client::new_system().context("failed to create system dbus client")?, + false => Client::new_session().context("failed to create session dbus client")?, + }; + + let (cgroups_path, parent) = Self::construct_cgroups_path(&destructured_path, &client) + .context("failed to construct cgroups path")?; let full_path = root_path.join_safely(&cgroups_path)?; Ok(Manager { @@ -74,15 +107,11 @@ impl Manager { container_name, unit_name: Self::get_unit_name(&destructured_path), destructured_path, - client: match use_system { - true => Client::new_system().context("failed to create system dbus client")?, - false => Client::new_session().context("failed to create session dbus client")?, - } + client, }) } - fn destructure_cgroups_path(cgroups_path: PathBuf) -> Result { - log::debug!("CGROUPS PATH IS {:?}", cgroups_path); + fn destructure_cgroups_path(cgroups_path: &Path) -> Result { // cgroups path may never be empty as it is defaulted to `/youki` // see 'get_cgroup_path' under utils.rs. // if cgroups_path was provided it should be of the form [slice]:[prefix]:[name], @@ -95,11 +124,11 @@ impl Manager { name = cgroups_path .strip_prefix("/youki/")? .to_str() - .ok_or_else(|| anyhow!("failed to parse cgroupsPath field"))?; + .ok_or_else(|| anyhow!("failed to parse cgroups path"))?; } else { let parts = cgroups_path .to_str() - .ok_or_else(|| anyhow!("failed to parse cgroupsPath field"))? + .ok_or_else(|| anyhow!("failed to parse cgroups path"))? .split(':') .collect::>(); parent = parts[0]; @@ -124,6 +153,33 @@ impl Manager { cgroups_path.name.clone() } + // get_cgroups_path generates a cgroups path from the one provided by the user via cgroupsPath. + // an example of the final path: "/system.slice/docker-foo.scope" + fn construct_cgroups_path( + cgroups_path: &CgroupsPath, + client: &dyn SystemdClient, + ) -> Result<(PathBuf, PathBuf)> { + let mut parent = match client.is_system() { + true => PathBuf::from("/system.slice"), + false => PathBuf::from("/user.slice"), + }; + + // if the user provided a '.slice' (as in a branch of a tree) + // we need to convert it to a filesystem path. + if !cgroups_path.parent.is_empty() { + parent = Self::expand_slice(&cgroups_path.parent)?; + } + + let systemd_root = client.control_cgroup_root()?; + let unit_name = Self::get_unit_name(cgroups_path); + let cgroups_path = systemd_root + .join_safely(&parent) + .with_context(|| format!("failed to join {:?} with {:?}", systemd_root, parent))? + .join_safely(&unit_name) + .with_context(|| format!("failed to join {:?} with {:?}", parent, unit_name))?; + Ok((cgroups_path, parent)) + } + // systemd represents slice hierarchy using `-`, so we need to follow suit when // generating the path of slice. For example, 'test-a-b.slice' becomes // '/test.slice/test-a.slice/test-a-b.slice'. @@ -144,7 +200,7 @@ impl Manager { } for component in slice_name.split('-') { if component.is_empty() { - anyhow!("Invalid slice name: {}", slice); + anyhow!("invalid slice name: {}", slice); } // Append the component to the path and to the prefix. path = format!("{}/{}{}{}", path, prefix, component, suffix); @@ -153,23 +209,6 @@ impl Manager { Ok(Path::new(&path).to_path_buf()) } - // get_cgroups_path generates a cgroups path from the one provided by the user via cgroupsPath. - // an example of the final path: "/machine.slice/docker-foo.scope" - fn construct_cgroups_path(cgroups_path: &CgroupsPath) -> Result<(PathBuf, PathBuf)> { - // the root slice is under 'machine.slice'. - let mut parent = PathBuf::from("/system.slice"); - // if the user provided a '.slice' (as in a branch of a tree) - // we need to convert it to a filesystem path. - if !cgroups_path.parent.is_empty() { - parent = Self::expand_slice(&cgroups_path.parent)?; - } - let unit_name = Self::get_unit_name(cgroups_path); - let cgroups_path = parent - .join_safely(&unit_name) - .with_context(|| format!("failed to join {:?} with {:?}", parent, unit_name))?; - Ok((cgroups_path, parent)) - } - /// create_unified_cgroup verifies sure that *each level* in the downward path from the root cgroup /// down to the cgroup_path provided by the user is a valid cgroup hierarchy, /// containing the attached controllers and that it contains the container pid. @@ -266,6 +305,10 @@ impl CgroupManager for Manager { ) })?; + let cg = self.client.control_cgroup_root().context("cgroup root")?; + log::debug!("CONTROL GROUP ROOT: {:?}", cg); + log::debug!("MANAGER {:?}", self); + Ok(()) } @@ -332,8 +375,48 @@ impl CgroupManager for Manager { #[cfg(test)] mod tests { + use crate::systemd::dbus::client::SystemdClient; + use super::*; + struct TestSystemdClient {} + + impl SystemdClient for TestSystemdClient { + fn is_system(&self) -> bool { + true + } + + fn start_transient_unit( + &self, + container_name: &str, + pid: u32, + parent: &str, + unit_name: &str, + ) -> Result<()> { + Ok(()) + } + + fn stop_transient_unit(&self, unit_name: &str) -> Result<()> { + Ok(()) + } + + fn set_unit_properties( + &self, + unit_name: &str, + properties: &HashMap<&str, Box>, + ) -> Result<()> { + Ok(()) + } + + fn systemd_version(&self) -> Result { + Ok(245) + } + + fn control_cgroup_root(&self) -> Result { + Ok(PathBuf::from("/")) + } + } + #[test] fn expand_slice_works() -> Result<()> { assert_eq!( @@ -347,11 +430,10 @@ mod tests { #[test] fn get_cgroups_path_works_with_a_complex_slice() -> Result<()> { let cgroups_path = - Manager::destructure_cgroups_path(PathBuf::from("test-a-b.slice:docker:foo")) - .expect(""); + Manager::destructure_cgroups_path(Path::new("test-a-b.slice:docker:foo")).expect(""); assert_eq!( - Manager::construct_cgroups_path(&cgroups_path)?.0, + Manager::construct_cgroups_path(&cgroups_path, &TestSystemdClient {})?.0, PathBuf::from("/test.slice/test-a.slice/test-a-b.slice/docker-foo.scope"), ); @@ -361,10 +443,10 @@ mod tests { #[test] fn get_cgroups_path_works_with_a_simple_slice() -> Result<()> { let cgroups_path = - Manager::destructure_cgroups_path(PathBuf::from("machine.slice:libpod:foo")).expect(""); + Manager::destructure_cgroups_path(Path::new("machine.slice:libpod:foo")).expect(""); assert_eq!( - Manager::construct_cgroups_path(&cgroups_path)?.0, + Manager::construct_cgroups_path(&cgroups_path, &TestSystemdClient {})?.0, PathBuf::from("/machine.slice/libpod-foo.scope"), ); @@ -373,11 +455,10 @@ mod tests { #[test] fn get_cgroups_path_works_with_scope() -> Result<()> { - let cgroups_path = - Manager::destructure_cgroups_path(PathBuf::from(":docker:foo")).expect(""); + let cgroups_path = Manager::destructure_cgroups_path(Path::new(":docker:foo")).expect(""); assert_eq!( - Manager::construct_cgroups_path(&cgroups_path)?.0, + Manager::construct_cgroups_path(&cgroups_path, &TestSystemdClient {})?.0, PathBuf::from("/system.slice/docker-foo.scope"), ); From 419284137ec62327d4cd787161439bd135302fac Mon Sep 17 00:00:00 2001 From: Furisto <24721048+Furisto@users.noreply.github.com> Date: Wed, 24 Nov 2021 19:28:03 +0100 Subject: [PATCH 17/27] Check if unprivileged user namespaces are enabled --- crates/libcontainer/src/rootless.rs | 17 +++++++++++++++++ crates/youki/src/commands/info.rs | 8 +++++++- 2 files changed, 24 insertions(+), 1 deletion(-) diff --git a/crates/libcontainer/src/rootless.rs b/crates/libcontainer/src/rootless.rs index edf711000..88240ee9a 100644 --- a/crates/libcontainer/src/rootless.rs +++ b/crates/libcontainer/src/rootless.rs @@ -2,6 +2,7 @@ use crate::{namespaces::Namespaces, utils}; use anyhow::{bail, Context, Result}; use nix::unistd::Pid; use oci_spec::runtime::{Linux, LinuxIdMapping, LinuxNamespace, LinuxNamespaceType, Mount, Spec}; +use std::fs; use std::path::Path; use std::process::Command; use std::{env, path::PathBuf}; @@ -104,6 +105,22 @@ pub fn rootless_required() -> bool { matches!(std::env::var("YOUKI_USE_ROOTLESS").as_deref(), Ok("true")) } +pub fn unprivileged_user_ns_enabled() -> Result { + let user_ns_sysctl = Path::new("/proc/sys/kernel/unprivileged_userns_clone"); + if !user_ns_sysctl.exists() { + return Ok(true); + } + + let content = + fs::read_to_string(user_ns_sysctl).context("failed to read unprivileged userns clone")?; + + match content.trim().parse::()? { + 0 => Ok(false), + 1 => Ok(true), + v => bail!("failed to parse unprivileged userns value: {}", v), + } +} + /// Validates that the spec contains the required information for /// running in rootless mode fn validate(spec: &Spec) -> Result<()> { diff --git a/crates/youki/src/commands/info.rs b/crates/youki/src/commands/info.rs index 2f9bca37f..146159853 100644 --- a/crates/youki/src/commands/info.rs +++ b/crates/youki/src/commands/info.rs @@ -3,6 +3,7 @@ use std::{collections::HashSet, fs, path::Path}; use anyhow::Result; use clap::Parser; +use libcontainer::rootless; use procfs::{CpuInfo, Meminfo}; use libcgroups::{common::CgroupSetup, v2::controller_type::ControllerType}; @@ -176,7 +177,12 @@ pub fn print_namespaces() { println!(" {:<16}enabled", "mount"); print_feature_status(&content, "CONFIG_UTS_NS", FeatureDisplay::new("uts")); print_feature_status(&content, "CONFIG_IPC_NS", FeatureDisplay::new("ipc")); - print_feature_status(&content, "CONFIG_USER_NS", FeatureDisplay::new("user")); + + let user_display = match rootless::unprivileged_user_ns_enabled() { + Ok(false) => FeatureDisplay::with_status("user", "enabled (root only)", "disabled"), + _ => FeatureDisplay::new("user"), + }; + print_feature_status(&content, "CONFIG_USER_NS", user_display); print_feature_status(&content, "CONFIG_PID_NS", FeatureDisplay::new("pid")); print_feature_status(&content, "CONFIG_NET_NS", FeatureDisplay::new("network")); // While the CONFIG_CGROUP_NS kernel feature exists, it is obsolete and should not be used. CGroup namespaces From 9cff02435bab5e61c66e56b9787a22e376babbe0 Mon Sep 17 00:00:00 2001 From: Furisto <24721048+Furisto@users.noreply.github.com> Date: Wed, 24 Nov 2021 19:42:21 +0100 Subject: [PATCH 18/27] Cleanup --- crates/libcgroups/src/common.rs | 4 ---- crates/libcgroups/src/systemd/dbus/client.rs | 4 ++-- crates/libcgroups/src/systemd/manager.rs | 4 ---- 3 files changed, 2 insertions(+), 10 deletions(-) diff --git a/crates/libcgroups/src/common.rs b/crates/libcgroups/src/common.rs index c32bfa4c1..81d1b054f 100644 --- a/crates/libcgroups/src/common.rs +++ b/crates/libcgroups/src/common.rs @@ -176,10 +176,6 @@ pub fn create_cgroup_manager>( match cgroup_setup { CgroupSetup::Legacy | CgroupSetup::Hybrid => { - if systemd_cgroup { - bail!("resource control with systemd is not supported on cgroup v1"); - } - log::info!("cgroup manager V1 will be used"); Ok(Box::new(v1::manager::Manager::new(cgroup_path.into())?)) } diff --git a/crates/libcgroups/src/systemd/dbus/client.rs b/crates/libcgroups/src/systemd/dbus/client.rs index 7d8aff2d9..d2ab1e13a 100644 --- a/crates/libcgroups/src/systemd/dbus/client.rs +++ b/crates/libcgroups/src/systemd/dbus/client.rs @@ -174,7 +174,7 @@ impl SystemdClient for Client { let cgroup_root = proxy .control_group() .context("failed to get systemd control group")?; - PathBuf::try_from(cgroup_root) - .with_context(|| format!("parse systemd control cgroup into path")) + PathBuf::try_from(&cgroup_root) + .with_context(|| format!("parse systemd control cgroup {} into path", cgroup_root)) } } diff --git a/crates/libcgroups/src/systemd/manager.rs b/crates/libcgroups/src/systemd/manager.rs index 39ea5ccee..4f66c1519 100644 --- a/crates/libcgroups/src/systemd/manager.rs +++ b/crates/libcgroups/src/systemd/manager.rs @@ -305,10 +305,6 @@ impl CgroupManager for Manager { ) })?; - let cg = self.client.control_cgroup_root().context("cgroup root")?; - log::debug!("CONTROL GROUP ROOT: {:?}", cg); - log::debug!("MANAGER {:?}", self); - Ok(()) } From f92b265b80a14987af8766e9074d6d6b303d10e0 Mon Sep 17 00:00:00 2001 From: Furisto <24721048+Furisto@users.noreply.github.com> Date: Thu, 25 Nov 2021 20:25:22 +0100 Subject: [PATCH 19/27] Ensure rootless containers work on v1 --- .../process/container_intermediate_process.rs | 27 ++++++++++++------- crates/youki/src/main.rs | 5 ++++ 2 files changed, 22 insertions(+), 10 deletions(-) diff --git a/crates/libcontainer/src/process/container_intermediate_process.rs b/crates/libcontainer/src/process/container_intermediate_process.rs index 4bde50d3f..66ce9c5da 100644 --- a/crates/libcontainer/src/process/container_intermediate_process.rs +++ b/crates/libcontainer/src/process/container_intermediate_process.rs @@ -22,6 +22,23 @@ pub fn container_intermediate_process( let linux = spec.linux().as_ref().context("no linux in spec")?; let namespaces = Namespaces::from(linux.namespaces().as_ref()); + // this needs to be done before we create the init process, so that the init + // process will already be captured by the cgroup. It also needs to be done + // before we enter the user namespace because if a privileged user starts a + // rootless container on a cgroup v1 system we can still fullfill resource + // restrictions through the cgroup fs support (delegation through systemd is + // not supported for v1 by us). This only works if the user has not yet been + // mapped to an unprivileged user by the user namespace however. + // In addition this needs to be done before we enter the cgroup namespace as + // the cgroup of the process will form the root of the cgroup hierarchy in + // the cgroup namespace. + apply_cgroups( + args.cgroup_manager.as_ref(), + linux.resources().as_ref(), + args.init, + ) + .context("failed to apply cgroups")?; + // if new user is specified in specification, this will be true and new // namespace will be created, check // https://man7.org/linux/man-pages/man7/user_namespaces.7.html for more @@ -66,16 +83,6 @@ pub fn container_intermediate_process( .with_context(|| format!("Failed to enter pid namespace: {:?}", pid_namespace))?; } - // this needs to be done before we create the init process, so that the init - // process will already be captured by the cgroup - - apply_cgroups( - args.cgroup_manager.as_ref(), - linux.resources().as_ref(), - args.init, - ) - .context("failed to apply cgroups")?; - // We have to record the pid of the child (container init process), since // the child will be inside the pid namespace. We can't rely on child_ready // to send us the correct pid. diff --git a/crates/youki/src/main.rs b/crates/youki/src/main.rs index 67657a56d..f1ea9fd67 100644 --- a/crates/youki/src/main.rs +++ b/crates/youki/src/main.rs @@ -112,6 +112,11 @@ fn main() -> Result<()> { eprintln!("log init failed: {:?}", e); } + log::debug!( + "started by user {} with {:?}", + nix::unistd::geteuid(), + std::env::args_os() + ); let root_path = determine_root_path(opts.root)?; let systemd_cgroup = opts.systemd_cgroup; From bbcbb90091cd5901c370fbbcd108be30202ee060 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 26 Nov 2021 00:50:09 +0000 Subject: [PATCH 20/27] Bump serde_json from 1.0.71 to 1.0.72 Bumps [serde_json](https://github.com/serde-rs/json) from 1.0.71 to 1.0.72. - [Release notes](https://github.com/serde-rs/json/releases) - [Commits](https://github.com/serde-rs/json/compare/v1.0.71...v1.0.72) --- updated-dependencies: - dependency-name: serde_json dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] --- Cargo.lock | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 8a87f7638..149103ec9 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -1087,9 +1087,9 @@ dependencies = [ [[package]] name = "serde_json" -version = "1.0.71" +version = "1.0.72" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "063bf466a64011ac24040a49009724ee60a57da1b437617ceb32e53ad61bfb19" +checksum = "d0ffa0837f2dfa6fb90868c2b5468cad482e175f7dad97e7421951e663f2b527" dependencies = [ "itoa", "ryu", From aeb98d619f17f255c3d87155a63b6b12009877d0 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 26 Nov 2021 00:50:26 +0000 Subject: [PATCH 21/27] Bump syn from 1.0.81 to 1.0.82 Bumps [syn](https://github.com/dtolnay/syn) from 1.0.81 to 1.0.82. - [Release notes](https://github.com/dtolnay/syn/releases) - [Commits](https://github.com/dtolnay/syn/compare/1.0.81...1.0.82) --- updated-dependencies: - dependency-name: syn dependency-type: indirect update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] --- Cargo.lock | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 8a87f7638..52ffca487 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -1138,9 +1138,9 @@ checksum = "73473c0e59e6d5812c5dfe2a064a6444949f089e20eec9a2e5506596494e4623" [[package]] name = "syn" -version = "1.0.81" +version = "1.0.82" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f2afee18b8beb5a596ecb4a2dce128c719b4ba399d34126b9e4396e3f9860966" +checksum = "8daf5dd0bb60cbd4137b1b587d2fc0ae729bc07cf01cd70b36a1ed5ade3b9d59" dependencies = [ "proc-macro2", "quote", From 54cbd15fa876a0209558fa7e0bfbcfcf65f55fc9 Mon Sep 17 00:00:00 2001 From: utam0k Date: Sun, 28 Nov 2021 13:50:46 +0900 Subject: [PATCH 22/27] make complex loglevel decision easy to understand. (#482) * make complex loglevel decision easy to understand. * guard env val for unit tests. * make some unit tests serial to handle env val. --- crates/youki/src/logger.rs | 76 ++++++++++++++++++++++++++++++++++---- 1 file changed, 68 insertions(+), 8 deletions(-) diff --git a/crates/youki/src/logger.rs b/crates/youki/src/logger.rs index 7647c0ee0..1f7753e3d 100644 --- a/crates/youki/src/logger.rs +++ b/crates/youki/src/logger.rs @@ -8,6 +8,8 @@ use std::io::Write; use std::path::PathBuf; use std::str::FromStr; +const LOG_LEVEL_ENV_NAME: &str = "YOUKI_LOG_LEVEL"; + /// If in debug mode, default level is debug to get maximum logging #[cfg(debug_assertions)] const DEFAULT_LOG_LEVEL: &str = "debug"; @@ -27,13 +29,7 @@ pub fn init( log_file: Option, log_format: Option, ) -> Result<()> { - let filter: Cow = if log_debug_flag { - "debug".into() - } else if let Ok(level) = std::env::var("YOUKI_LOG_LEVEL") { - level.into() - } else { - DEFAULT_LOG_LEVEL.into() - }; + let log_level = detect_log_level(log_debug_flag); let formatter = match log_format.as_deref() { None | Some(LOG_FORMAT_TEXT) => text_write, Some(LOG_FORMAT_JSON) => json_write, @@ -51,7 +47,7 @@ pub fn init( env_logger::Target::Stderr }; env_logger::Builder::new() - .filter_level(LevelFilter::from_str(filter.as_ref()).context("failed to parse log level")?) + .filter_level(log_level.context("failed to parse log level")?) .format(formatter) .target(target) .init(); @@ -59,6 +55,17 @@ pub fn init( Ok(()) } +fn detect_log_level(is_debug: bool) -> Result { + let filter: Cow = if is_debug { + "debug".into() + } else if let Ok(level) = std::env::var(LOG_LEVEL_ENV_NAME) { + level.into() + } else { + DEFAULT_LOG_LEVEL.into() + }; + Ok(LevelFilter::from_str(filter.as_ref())?) +} + fn json_write(f: &mut F, record: &log::Record) -> std::io::Result<()> where F: Write, @@ -93,3 +100,56 @@ where Ok(()) } + +#[cfg(test)] +mod tests { + use serial_test::serial; + + use super::*; + use std::env; + struct LogLevelGuard { + original_level: Option, + } + + impl LogLevelGuard { + fn new(level: &str) -> Result { + let original_level = env::var(LOG_LEVEL_ENV_NAME).ok(); + env::set_var(LOG_LEVEL_ENV_NAME, level); + Ok(Self { original_level }) + } + } + impl Drop for LogLevelGuard { + fn drop(self: &mut LogLevelGuard) { + if let Some(level) = self.original_level.as_ref() { + env::set_var(LOG_LEVEL_ENV_NAME, level); + } else { + env::remove_var(LOG_LEVEL_ENV_NAME); + } + } + } + + #[test] + fn test_detect_log_level_is_debug() { + let _guard = LogLevelGuard::new("error").unwrap(); + assert_eq!(detect_log_level(true).unwrap(), LevelFilter::Debug) + } + + #[test] + #[serial] + fn test_detect_log_level_default() { + let _guard = LogLevelGuard::new("error").unwrap(); + env::remove_var(LOG_LEVEL_ENV_NAME); + if cfg!(debug_assertions) { + assert_eq!(detect_log_level(false).unwrap(), LevelFilter::Debug) + } else { + assert_eq!(detect_log_level(false).unwrap(), LevelFilter::Warn) + } + } + + #[test] + #[serial] + fn test_detect_log_level_from_env() { + let _guard = LogLevelGuard::new("error").unwrap(); + assert_eq!(detect_log_level(false).unwrap(), LevelFilter::Error) + } +} From 1a14c43c5bec422208c889fc25d3276fc0258cf8 Mon Sep 17 00:00:00 2001 From: Furisto <24721048+Furisto@users.noreply.github.com> Date: Sun, 28 Nov 2021 20:29:18 +0100 Subject: [PATCH 23/27] Review feedback - Add cgroups path to error context - Correct spelling mistake - Update sequence diagram - Implement TryFrom for CgroupsPath --- crates/libcgroups/src/systemd/manager.rs | 86 +++++++++++-------- .../process/container_intermediate_process.rs | 2 +- docs/.drawio.svg | 74 ++++++++-------- 3 files changed, 86 insertions(+), 76 deletions(-) diff --git a/crates/libcgroups/src/systemd/manager.rs b/crates/libcgroups/src/systemd/manager.rs index 4f66c1519..4b0d9c93f 100644 --- a/crates/libcgroups/src/systemd/manager.rs +++ b/crates/libcgroups/src/systemd/manager.rs @@ -61,6 +61,42 @@ struct CgroupsPath { name: String, } +impl TryFrom<&Path> for CgroupsPath { + type Error = anyhow::Error; + + fn try_from(cgroups_path: &Path) -> Result { + // cgroups path may never be empty as it is defaulted to `/youki` + // see 'get_cgroup_path' under utils.rs. + // if cgroups_path was provided it should be of the form [slice]:[prefix]:[name], + // for example: "system.slice:docker:1234". + let mut parent = ""; + let prefix; + let name; + if cgroups_path.starts_with("/youki") { + prefix = "youki"; + name = cgroups_path + .strip_prefix("/youki/")? + .to_str() + .ok_or_else(|| anyhow!("failed to parse cgroups path {:?}", cgroups_path))?; + } else { + let parts = cgroups_path + .to_str() + .ok_or_else(|| anyhow!("failed to parse cgroups path {:?}", cgroups_path))? + .split(':') + .collect::>(); + parent = parts[0]; + prefix = parts[1]; + name = parts[2]; + } + + Ok(CgroupsPath { + parent: parent.to_owned(), + prefix: prefix.to_owned(), + name: name.to_owned(), + }) + } +} + impl Display for CgroupsPath { fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result { write!(f, "{}:{}:{}", self.parent, self.prefix, self.name) @@ -89,7 +125,9 @@ impl Manager { container_name: String, use_system: bool, ) -> Result { - let destructured_path = Self::destructure_cgroups_path(&cgroups_path) + let destructured_path = cgroups_path + .as_path() + .try_into() .with_context(|| format!("failed to destructure cgroups path {:?}", cgroups_path))?; let client = match use_system { true => Client::new_system().context("failed to create system dbus client")?, @@ -111,38 +149,6 @@ impl Manager { }) } - fn destructure_cgroups_path(cgroups_path: &Path) -> Result { - // cgroups path may never be empty as it is defaulted to `/youki` - // see 'get_cgroup_path' under utils.rs. - // if cgroups_path was provided it should be of the form [slice]:[prefix]:[name], - // for example: "system.slice:docker:1234". - let mut parent = ""; - let prefix; - let name; - if cgroups_path.starts_with("/youki") { - prefix = "youki"; - name = cgroups_path - .strip_prefix("/youki/")? - .to_str() - .ok_or_else(|| anyhow!("failed to parse cgroups path"))?; - } else { - let parts = cgroups_path - .to_str() - .ok_or_else(|| anyhow!("failed to parse cgroups path"))? - .split(':') - .collect::>(); - parent = parts[0]; - prefix = parts[1]; - name = parts[2]; - } - - Ok(CgroupsPath { - parent: parent.to_owned(), - prefix: prefix.to_owned(), - name: name.to_owned(), - }) - } - /// get_unit_name returns the unit (scope) name from the path provided by the user /// for example: foo:docker:bar returns in '/docker-bar.scope' fn get_unit_name(cgroups_path: &CgroupsPath) -> String { @@ -425,8 +431,9 @@ mod tests { #[test] fn get_cgroups_path_works_with_a_complex_slice() -> Result<()> { - let cgroups_path = - Manager::destructure_cgroups_path(Path::new("test-a-b.slice:docker:foo")).expect(""); + let cgroups_path = Path::new("test-a-b.slice:docker:foo") + .try_into() + .context("construct path")?; assert_eq!( Manager::construct_cgroups_path(&cgroups_path, &TestSystemdClient {})?.0, @@ -438,8 +445,9 @@ mod tests { #[test] fn get_cgroups_path_works_with_a_simple_slice() -> Result<()> { - let cgroups_path = - Manager::destructure_cgroups_path(Path::new("machine.slice:libpod:foo")).expect(""); + let cgroups_path = Path::new("machine.slice:libpod:foo") + .try_into() + .context("construct path")?; assert_eq!( Manager::construct_cgroups_path(&cgroups_path, &TestSystemdClient {})?.0, @@ -451,7 +459,9 @@ mod tests { #[test] fn get_cgroups_path_works_with_scope() -> Result<()> { - let cgroups_path = Manager::destructure_cgroups_path(Path::new(":docker:foo")).expect(""); + let cgroups_path = Path::new(":docker:foo") + .try_into() + .context("construct path")?; assert_eq!( Manager::construct_cgroups_path(&cgroups_path, &TestSystemdClient {})?.0, diff --git a/crates/libcontainer/src/process/container_intermediate_process.rs b/crates/libcontainer/src/process/container_intermediate_process.rs index 66ce9c5da..1f265ab07 100644 --- a/crates/libcontainer/src/process/container_intermediate_process.rs +++ b/crates/libcontainer/src/process/container_intermediate_process.rs @@ -25,7 +25,7 @@ pub fn container_intermediate_process( // this needs to be done before we create the init process, so that the init // process will already be captured by the cgroup. It also needs to be done // before we enter the user namespace because if a privileged user starts a - // rootless container on a cgroup v1 system we can still fullfill resource + // rootless container on a cgroup v1 system we can still fulfill resource // restrictions through the cgroup fs support (delegation through systemd is // not supported for v1 by us). This only works if the user has not yet been // mapped to an unprivileged user by the user namespace however. diff --git a/docs/.drawio.svg b/docs/.drawio.svg index c2fcf5cc9..505da318f 100644 --- a/docs/.drawio.svg +++ b/docs/.drawio.svg @@ -1,4 +1,4 @@ - + @@ -115,13 +115,13 @@ - - - + + + -
+
@@ -133,18 +133,18 @@
- + fork(2) - - - + + + -
+
@@ -154,16 +154,16 @@
- + send identifier mapping request - + -
+
unshare(CLONE_NEWUSER) @@ -171,18 +171,18 @@
- + unshare(CLONE_NEWUSER) - + - + -
+
write uid mapping @@ -190,16 +190,16 @@
- + write uid mapping - + -
+
write gid mapping @@ -207,18 +207,18 @@
- + write gid mapping - - - + + + -
+
@@ -228,7 +228,7 @@
- + send mapping written @@ -410,13 +410,13 @@ - + - + -
+
setup cgroup @@ -424,17 +424,17 @@
- + setup cgroup - - + + -
+
unshare(CLONE_NEWPID) @@ -442,16 +442,16 @@
- + unshare(CLONE_NEWPID) - + -
+
set uid and gid @@ -459,7 +459,7 @@
- + set uid and gid From 824f1abd13d2aca00c8d37632f20679503b67e84 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 29 Nov 2021 01:11:53 +0000 Subject: [PATCH 24/27] Bump anyhow from 1.0.48 to 1.0.50 Bumps [anyhow](https://github.com/dtolnay/anyhow) from 1.0.48 to 1.0.50. - [Release notes](https://github.com/dtolnay/anyhow/releases) - [Commits](https://github.com/dtolnay/anyhow/compare/1.0.48...1.0.50) --- updated-dependencies: - dependency-name: anyhow dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] --- Cargo.lock | 4 ++-- crates/test_framework/Cargo.toml | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 5930f20a3..951a65e07 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -19,9 +19,9 @@ dependencies = [ [[package]] name = "anyhow" -version = "1.0.48" +version = "1.0.50" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "62e1f47f7dc0422027a4e370dd4548d4d66b26782e513e98dca1e689e058a80e" +checksum = "ecc78c299ae753905840c5d3ba036c51f61ce5a98a83f98d9c9d29dffd427f71" [[package]] name = "ascii" diff --git a/crates/test_framework/Cargo.toml b/crates/test_framework/Cargo.toml index 1bb9dde94..f48bf2aeb 100644 --- a/crates/test_framework/Cargo.toml +++ b/crates/test_framework/Cargo.toml @@ -6,5 +6,5 @@ edition = "2021" # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html [dependencies] -anyhow = "1.0.48" +anyhow = "1.0.50" crossbeam = "0.8.1" \ No newline at end of file From a316afc6e6537e2bb7afda078540b92b88332378 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 29 Nov 2021 01:12:10 +0000 Subject: [PATCH 25/27] Bump ryu from 1.0.5 to 1.0.6 Bumps [ryu](https://github.com/dtolnay/ryu) from 1.0.5 to 1.0.6. - [Release notes](https://github.com/dtolnay/ryu/releases) - [Commits](https://github.com/dtolnay/ryu/compare/1.0.5...1.0.6) --- updated-dependencies: - dependency-name: ryu dependency-type: indirect update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] --- Cargo.lock | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 5930f20a3..42020b7a4 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -1055,9 +1055,9 @@ checksum = "f497285884f3fcff424ffc933e56d7cbca511def0c9831a7f9b5f6153e3cc89b" [[package]] name = "ryu" -version = "1.0.5" +version = "1.0.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "71d301d4193d031abdd79ff7e3dd721168a9572ef3fe51a1517aba235bd8f86e" +checksum = "3c9613b5a66ab9ba26415184cfc41156594925a9cf3a2057e57f31ff145f6568" [[package]] name = "scopeguard" From e24f6f8abe1989a3739d22597ac074c667f21199 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 29 Nov 2021 01:12:17 +0000 Subject: [PATCH 26/27] Bump getset from 0.1.1 to 0.1.2 Bumps [getset](https://github.com/Hoverbear/getset) from 0.1.1 to 0.1.2. - [Release notes](https://github.com/Hoverbear/getset/releases) - [Commits](https://github.com/Hoverbear/getset/compare/0.1.1...0.1.2) --- updated-dependencies: - dependency-name: getset dependency-type: indirect update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] --- Cargo.lock | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 5930f20a3..567420218 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -488,9 +488,9 @@ dependencies = [ [[package]] name = "getset" -version = "0.1.1" +version = "0.1.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "24b328c01a4d71d2d8173daa93562a73ab0fe85616876f02500f53d82948c504" +checksum = "e45727250e75cc04ff2846a66397da8ef2b3db8e40e0cef4df67950a07621eb9" dependencies = [ "proc-macro-error", "proc-macro2", From 8792762cb6b8365eac702296e147d65d4324ee13 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 29 Nov 2021 01:12:26 +0000 Subject: [PATCH 27/27] Bump procfs from 0.11.0 to 0.11.1 Bumps [procfs](https://github.com/eminence/procfs) from 0.11.0 to 0.11.1. - [Release notes](https://github.com/eminence/procfs/releases) - [Commits](https://github.com/eminence/procfs/compare/v0.11.0...v0.11.1) --- updated-dependencies: - dependency-name: procfs dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] --- Cargo.lock | 4 ++-- crates/integration_test/Cargo.toml | 2 +- crates/libcgroups/Cargo.toml | 2 +- crates/libcontainer/Cargo.toml | 2 +- crates/youki/Cargo.toml | 2 +- 5 files changed, 6 insertions(+), 6 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 5930f20a3..4b256605d 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -942,9 +942,9 @@ dependencies = [ [[package]] name = "procfs" -version = "0.11.0" +version = "0.11.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "3f2e7eea7c1d7beccbd5acc1e37ac844afccf176525674aad26ece3de1fc7733" +checksum = "7718b88dae7b9b9be183ee274b10554b9aded035539230245275d7bc543fc0a4" dependencies = [ "bitflags", "byteorder", diff --git a/crates/integration_test/Cargo.toml b/crates/integration_test/Cargo.toml index 8c6699996..cd81f72e8 100644 --- a/crates/integration_test/Cargo.toml +++ b/crates/integration_test/Cargo.toml @@ -13,7 +13,7 @@ version = "=3.0.0-beta.5" default-features = true [dependencies] -procfs = "0.11.0" +procfs = "0.11.1" uuid = "0.8" rand = "0.8.0" tar = "0.4" diff --git a/crates/libcgroups/Cargo.toml b/crates/libcgroups/Cargo.toml index 5dc81c8a2..2e102c7e1 100644 --- a/crates/libcgroups/Cargo.toml +++ b/crates/libcgroups/Cargo.toml @@ -9,7 +9,7 @@ cgroupsv2_devices = ["rbpf", "libbpf-sys", "errno", "libc"] [dependencies] nix = "0.23.0" -procfs = "0.11.0" +procfs = "0.11.1" log = "0.4" anyhow = "1.0" oci-spec = { git = "https://github.com/containers/oci-spec-rs", rev = "54c5e386f01ab37c9305cc4a83404eb157e42440" } diff --git a/crates/libcontainer/Cargo.toml b/crates/libcontainer/Cargo.toml index cfa070dc8..18aae2487 100644 --- a/crates/libcontainer/Cargo.toml +++ b/crates/libcontainer/Cargo.toml @@ -20,7 +20,7 @@ mio = { version = "0.8.0", features = ["os-ext", "os-poll"] } nix = "0.23.0" oci-spec = { git = "https://github.com/containers/oci-spec-rs", rev = "54c5e386f01ab37c9305cc4a83404eb157e42440" } path-clean = "0.1.0" -procfs = "0.11.0" +procfs = "0.11.1" prctl = "1.0.0" libcgroups = { version = "0.1.0", path = "../libcgroups" } libseccomp = { version = "0.1.0", path = "../libseccomp" } diff --git a/crates/youki/Cargo.toml b/crates/youki/Cargo.toml index 8a9d85261..ddaa90900 100644 --- a/crates/youki/Cargo.toml +++ b/crates/youki/Cargo.toml @@ -21,7 +21,7 @@ nix = "0.23.0" oci-spec = { git = "https://github.com/containers/oci-spec-rs", rev = "d6fb1e91742313cd0d0085937e2d6df5d4669720" } once_cell = "1.6.0" pentacle = "1.0.0" -procfs = "0.11.0" +procfs = "0.11.1" serde = { version = "1.0", features = ["derive"] } serde_json = "1.0" tabwriter = "1"