| 96 | |
| 97 | |
| 98 | Future<Option<ContainerLaunchInfo>> NamespacesPidIsolatorProcess::prepare( |
| 99 | const ContainerID& containerId, |
| 100 | const ContainerConfig& containerConfig) |
| 101 | { |
| 102 | ContainerLaunchInfo launchInfo; |
| 103 | |
| 104 | bool sharePidNamespace = |
| 105 | containerConfig.container_info().linux_info().share_pid_namespace(); |
| 106 | |
| 107 | if (containerId.has_parent()) { |
| 108 | // If we are a nested container, then we want to enter our |
| 109 | // parent's pid namespace before cloning a new one. |
| 110 | launchInfo.add_enter_namespaces(CLONE_NEWPID); |
| 111 | |
| 112 | // For nested container in the `DEBUG` class, we don't want to clone a |
| 113 | // new pid namespace at all, so we short circuit here. |
| 114 | if (containerConfig.has_container_class() && |
| 115 | containerConfig.container_class() == ContainerClass::DEBUG) { |
| 116 | return launchInfo; |
| 117 | } |
| 118 | } else { |
| 119 | // If sharing agent pid namespace with top-level container is disallowed, |
| 120 | // but the framework requests it by setting the `share_pid_namespace` field |
| 121 | // to true, the container launch will be rejected. |
| 122 | if (flags.disallow_sharing_agent_pid_namespace && sharePidNamespace) { |
| 123 | return Failure( |
| 124 | "Sharing agent pid namespace with " |
| 125 | "top-level container is not allowed"); |
| 126 | } |
| 127 | } |
| 128 | |
| 129 | if (!sharePidNamespace) { |
| 130 | // For the container which does not want to share pid namespace with |
| 131 | // its parent, make sure we will clone a new pid namespace for it. |
| 132 | launchInfo.add_clone_namespaces(CLONE_NEWPID); |
| 133 | |
| 134 | // Since this container is guaranteed to have its own pid |
| 135 | // namespace, we need to to mount /proc so container's pids can be |
| 136 | // shown properly. We will not see EBUSY when doing the mount as |
| 137 | // it won't be the same as the host /proc mount. |
| 138 | // |
| 139 | // NOTE: 'filesystem/linux' isolator will make sure mounts in the |
| 140 | // child mount namespace will not be propagated back to the host |
| 141 | // mount namespace. |
| 142 | *launchInfo.add_mounts() = protobuf::slave::createContainerMount( |
| 143 | "proc", "/proc", "proc", MS_NOSUID | MS_NODEV | MS_NOEXEC); |
| 144 | } else { |
| 145 | if (containerId.has_parent()) { |
| 146 | // This container shares the same pid namespace as its parent |
| 147 | // and is not a top level container. This means it might not |
| 148 | // share the same pid namespace as the agent. In this case, we |
| 149 | // will mount `/proc`. In the case where this container does |
| 150 | // share the pid namespace of the agent (because its parent |
| 151 | // shares the same pid namespace of the agent), mounting `/proc` |
| 152 | // at the same place will result in EBUSY. As a result, we |
| 153 | // always "move" (MS_MOVE) the mounts under `/proc` to a new |
| 154 | // location and mount the `/proc` again at the old location. See |
| 155 | // MESOS-9529 for details. |
nothing calls this directly
no test coverage detected