diff --git a/libkpod/container_server.go b/libkpod/container_server.go index 20680ffc..f20705df 100644 --- a/libkpod/container_server.go +++ b/libkpod/container_server.go @@ -335,6 +335,7 @@ func (c *ContainerServer) LoadSandbox(id string) error { if err != nil { return err } + sb.AddHostnamePath(m.Annotations[annotations.HostnamePath]) sb.AddIP(ip) // We add a netNS only if we can load a permanent one. diff --git a/libkpod/sandbox/sandbox.go b/libkpod/sandbox/sandbox.go index 8e84dfb2..d7d6569d 100644 --- a/libkpod/sandbox/sandbox.go +++ b/libkpod/sandbox/sandbox.go @@ -151,6 +151,7 @@ type Sandbox struct { privileged bool trusted bool resolvPath string + hostnamePath string hostname string portMappings []*hostport.PortMapping stopped bool @@ -301,6 +302,16 @@ func (s *Sandbox) ResolvPath() string { return s.resolvPath } +// AddHostnamePath adds the hostname path to the sandbox +func (s *Sandbox) AddHostnamePath(hostname string) { + s.hostnamePath = hostname +} + +// HostnamePath retrieves the hostname path from a sandbox +func (s *Sandbox) HostnamePath() string { + return s.hostnamePath +} + // Hostname returns the hsotname of the sandbox func (s *Sandbox) Hostname() string { return s.hostname diff --git a/pkg/annotations/annotations.go b/pkg/annotations/annotations.go index 80f943c2..151d9390 100644 --- a/pkg/annotations/annotations.go +++ b/pkg/annotations/annotations.go @@ -52,6 +52,9 @@ const ( // ResolvPath is the resolver configuration path annotation ResolvPath = "io.kubernetes.cri-o.ResolvPath" + // HostnamePath is the path to /etc/hostname to bind mount annotation + HostnamePath = "io.kubernetes.cri-o.HostnamePath" + // SandboxID is the sandbox ID annotation SandboxID = "io.kubernetes.cri-o.SandboxID" diff --git a/server/container_create.go b/server/container_create.go index c90f2baa..126303f8 100644 --- a/server/container_create.go +++ b/server/container_create.go @@ -818,18 +818,25 @@ func (s *Server) createSandboxContainer(ctx context.Context, containerID string, options = []string{"ro"} } if sb.ResolvPath() != "" { + // TODO: selinux + // label.Relabel(sb.ResolvPath(), container.MountLabel, shared) + // bind mount the pod resolver file specgen.AddBindMount(sb.ResolvPath(), "/etc/resolv.conf", options) } + if sb.HostnamePath() != "" { + // TODO: selinux + + specgen.AddBindMount(sb.HostnamePath(), "/etc/hostname", options) + } + // Bind mount /etc/hosts for host networking containers if hostNetwork(containerConfig) { specgen.AddBindMount("/etc/hosts", "/etc/hosts", options) } - if sb.Hostname() != "" { - specgen.SetHostname(sb.Hostname()) - } + specgen.SetHostname(sb.Hostname()) specgen.AddAnnotation(annotations.Name, containerName) specgen.AddAnnotation(annotations.ContainerID, containerID) diff --git a/server/sandbox_run.go b/server/sandbox_run.go index 0cd2d644..d5e6ecc4 100644 --- a/server/sandbox_run.go +++ b/server/sandbox_run.go @@ -3,6 +3,7 @@ package server import ( "encoding/json" "fmt" + "io/ioutil" "os" "path" "path/filepath" @@ -187,12 +188,6 @@ func (s *Server) RunPodSandbox(ctx context.Context, req *pb.RunPodSandboxRequest g.SetProcessArgs([]string{s.config.PauseCommand}) } - // set hostname - hostname := req.GetConfig().Hostname - if hostname != "" { - g.SetHostname(hostname) - } - // set DNS options if req.GetConfig().GetDnsConfig() != nil { dnsServers := req.GetConfig().GetDnsConfig().Servers @@ -208,6 +203,9 @@ func (s *Server) RunPodSandbox(ctx context.Context, req *pb.RunPodSandboxRequest } return nil, err } + // TODO: selinux + // label.Relabel(sb.ResolvPath(), container.MountLabel, shared) + g.AddBindMount(resolvPath, "/etc/resolv.conf", []string{"ro"}) } @@ -301,6 +299,14 @@ func (s *Server) RunPodSandbox(ctx context.Context, req *pb.RunPodSandboxRequest return nil, err } + hostNetwork := req.GetConfig().GetLinux().GetSecurityContext().GetNamespaceOptions().HostNetwork + + hostname, err := getHostname(id, req.GetConfig().Hostname, hostNetwork) + if err != nil { + return nil, err + } + g.SetHostname(hostname) + privileged := s.privilegedSandbox(req) trusted := s.trustedSandbox(req) g.AddAnnotation(annotations.Metadata, string(metadataJSON)) @@ -399,8 +405,6 @@ func (s *Server) RunPodSandbox(ctx context.Context, req *pb.RunPodSandboxRequest g.SetLinuxResourcesCPUShares(PodInfraCPUshares) - hostNetwork := req.GetConfig().GetLinux().GetSecurityContext().GetNamespaceOptions().HostNetwork - // set up namespaces if hostNetwork { err = g.RemoveLinuxNamespace("network") @@ -456,6 +460,15 @@ func (s *Server) RunPodSandbox(ctx context.Context, req *pb.RunPodSandboxRequest g.AddAnnotation(annotations.MountPoint, mountPoint) g.SetRootPath(mountPoint) + hostnamePath := fmt.Sprintf("%s/hostname", podContainer.RunDir) + if err := ioutil.WriteFile(hostnamePath, []byte(hostname+"\n"), 0644); err != nil { + return nil, err + } + // TODO: selinux relabel + g.AddBindMount(hostnamePath, "/etc/hostname", []string{"ro"}) + g.AddAnnotation(annotations.HostnamePath, hostnamePath) + sb.AddHostnamePath(hostnamePath) + container, err := oci.NewContainer(id, containerName, podContainer.RunDir, logPath, sb.NetNs(), labels, kubeAnnotations, "", "", "", nil, id, false, false, false, sb.Privileged(), sb.Trusted(), podContainer.Dir, created, podContainer.Config.Config.StopSignal) if err != nil { return nil, err @@ -515,6 +528,23 @@ func convertPortMappings(in []*pb.PortMapping) []*hostport.PortMapping { return out } +func getHostname(id, hostname string, hostNetwork bool) (string, error) { + if hostNetwork { + if hostname == "" { + h, err := os.Hostname() + if err != nil { + return "", err + } + hostname = h + } + } else { + if hostname == "" { + hostname = id[:12] + } + } + return hostname, nil +} + func (s *Server) setPodSandboxMountLabel(id, mountLabel string) error { storageMetadata, err := s.StorageRuntimeServer().GetContainerMetadata(id) if err != nil { diff --git a/test/network.bats b/test/network.bats index 8121ca48..67fbdfc8 100644 --- a/test/network.bats +++ b/test/network.bats @@ -2,6 +2,72 @@ load helpers +@test "ensure correct hostname" { + start_crio + run crioctl pod run --config "$TESTDATA"/sandbox_config.json + echo "$output" + [ "$status" -eq 0 ] + pod_id="$output" + run crioctl ctr create --config "$TESTDATA"/container_redis.json --pod "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + ctr_id="$output" + run crioctl ctr start --id "$ctr_id" + echo "$output" + [ "$status" -eq 0 ] + + run crioctl ctr execsync --id "$ctr_id" sh -c "hostname" + echo "$output" + [ "$status" -eq 0 ] + [[ "$output" =~ "crioctl_host" ]] + run crioctl ctr execsync --id "$ctr_id" sh -c "echo \$HOSTNAME" + echo "$output" + [ "$status" -eq 0 ] + [[ "$output" =~ "crioctl_host" ]] + run crioctl ctr execsync --id "$ctr_id" sh -c "cat /etc/hostname" + echo "$output" + [ "$status" -eq 0 ] + [[ "$output" =~ "crioctl_host" ]] + + cleanup_ctrs + cleanup_pods + stop_crio +} + +@test "ensure correct hostname for hostnetwork:true" { + start_crio + hostnetworkconfig=$(cat "$TESTDATA"/sandbox_config.json | python -c 'import json,sys;obj=json.load(sys.stdin);obj["linux"]["security_context"]["namespace_options"]["host_network"] = True; obj["annotations"] = {}; obj["hostname"] = ""; json.dump(obj, sys.stdout)') + echo "$hostnetworkconfig" > "$TESTDIR"/sandbox_hostnetwork_config.json + run crioctl pod run --config "$TESTDIR"/sandbox_hostnetwork_config.json + echo "$output" + [ "$status" -eq 0 ] + pod_id="$output" + run crioctl ctr create --config "$TESTDATA"/container_redis.json --pod "$pod_id" + echo "$output" + [ "$status" -eq 0 ] + ctr_id="$output" + run crioctl ctr start --id "$ctr_id" + echo "$output" + [ "$status" -eq 0 ] + + run crioctl ctr execsync --id "$ctr_id" sh -c "hostname" + echo "$output" + [ "$status" -eq 0 ] + [[ "$output" =~ "$HOSTNAME" ]] + run crioctl ctr execsync --id "$ctr_id" sh -c "echo \$HOSTNAME" + echo "$output" + [ "$status" -eq 0 ] + [[ "$output" =~ "$HOSTNAME" ]] + run crioctl ctr execsync --id "$ctr_id" sh -c "cat /etc/hostname" + echo "$output" + [ "$status" -eq 0 ] + [[ "$output" =~ "$HOSTNAME" ]] + + cleanup_ctrs + cleanup_pods + stop_crio +} + @test "Check for valid pod netns CIDR" { start_crio run crioctl pod run --config "$TESTDATA"/sandbox_config.json