Method StartContainer

pkg/sentry/control/lifecycle.go:202–394

StartContainer will start a new container in the sandbox.

(args *StartContainerArgs, _ *uint32)

// StartContainer will start a new container in the sandbox.
func (l *Lifecycle) StartContainer(args *StartContainerArgs, _ *uint32) error {
	timeRequested := time.Now()
	timeRequestReceived := &timestamppb.Timestamp{
		Seconds: timeRequested.Unix(),
		Nanos:   int32(timeRequested.Nanosecond()),
	}
	log.Infof("StartContainer: %v", args)
	if len(args.Files) != len(args.DonatedFDs) {
		return fmt.Errorf("FilePayload.Files and DonatedFDs must have same number of elements (%d != %d)", len(args.Files), len(args.DonatedFDs))
	}

	l.mu.RLock()
	contNS, ok := l.ContainerNamespacesMap[args.ContainerID]
	if !ok {
		l.mu.RUnlock()
		return fmt.Errorf("mount namespace is nil for %s", args.ContainerID)
	}
	l.mu.RUnlock()

	uid := args.KUID
	gid := args.KGID
	if args.User != "" {
		if uid != 0 || gid != 0 {
			return fmt.Errorf("container spec specified both an explicit UID/GID and a user name, only one or the other may be provided")
		}
		uid, gid = user.GetExecUIDGIDFromUser(l.Kernel.SupervisorContext(), contNS.MountNamespace, args.User)
	}

	creds := auth.NewUserCredentials(
		uid,
		gid,
		nil, /* extraKGIDs */
		nil, /* capabilities */
		l.Kernel.RootUserNamespace())

	ls, err := limits.NewLinuxDistroLimitSet()
	if err != nil {
		return fmt.Errorf("error creating default limit set: %w", err)
	}
	for name, limit := range args.Limits {
		lt, ok := limits.FromLinuxResourceName[name]
		if !ok {
			return fmt.Errorf("unknown limit %q", name)
		}
		ls.SetUnchecked(lt, limit)
	}

	initArgs := kernel.CreateProcessArgs{
		Filename: args.Filename,
		Argv:     args.Argv,
		// Order Envv before SecretEnvv.
		Envv:                 append(args.Envv, args.SecretEnvv...),
		WorkingDirectory:     args.WorkingDirectory,
		Credentials:          creds,
		Umask:                0022,
		Limits:               ls,
		MaxSymlinkTraversals: linux.MaxSymlinkTraversals,
		UTSNamespace:         l.Kernel.RootUTSNamespace(),