Function doPrepareIDMappedOverlay

core/mount/mount_linux.go:252–301

(tmpDir string, lowerDirs []string, usernsFd int)

}

func doPrepareIDMappedOverlay(tmpDir string, lowerDirs []string, usernsFd int) (_ []string, _ func(), retErr error) {
	commonDir, err := getCommonDirectory(lowerDirs)
	if err != nil {
		return nil, nil, fmt.Errorf("failed to determine common parent: %w", err)
	}

	tempRemountsLocation, err := os.MkdirTemp(tmpDir, "ovl-idmapped")
	if err != nil {
		return nil, nil, fmt.Errorf("failed to create temporary overlay lowerdir mount location: %w", err)
	}
	cleanDir := func() {
		if err := os.Remove(tempRemountsLocation); err != nil {
			log.L.WithError(err).Infof("failed to remove idmapped directory")
		}
	}
	defer func() {
		if retErr != nil {
			cleanDir()
		}
	}()

	// IDMapMount the directory containing all the layers
	if err := IDMapMountWithAttrs(commonDir, tempRemountsLocation, usernsFd, unix.MOUNT_ATTR_RDONLY, 0); err != nil {
		return nil, nil, err
	}

	cleanMount := func() {
		// Use the Unmount helper that does retries because there can be easily an open fd
		// to the idmapped directory and when containerd forks to create a userns fd (maybe
		// for another container), it will make the mount busy for a few ms.
		err := UnmountRecursive(tempRemountsLocation, 0)
		if err != nil {
			log.L.WithError(err).Warnf("failed to unmount idmapped directory %s: %v", tempRemountsLocation, err)
		}
	}
	defer func() {
		if retErr != nil {
			cleanMount()
		}
	}()

	// Build new lower dir paths through the idmapped directory
	tmpLowerDirs := buildIDMappedPaths(lowerDirs, commonDir, tempRemountsLocation)

	cleanup := func() {
		cleanMount()
		cleanDir()
	}
	return tmpLowerDirs, cleanup, nil
}

// getCommonDirectory finds the common directory among the lowerDirs passed in.
// "/" and "." are considered invalid common directories and are treated as error