Add option to use file-based locking for libkpod state

Signed-off-by: Matthew Heon <mheon@redhat.com>

libkpod/config.go

@@ -21,6 +21,7 @@ const (
 	cniConfigDir        = "/etc/cni/net.d/"
 	cniBinDir           = "/opt/cni/bin/"
 	cgroupManager       = "cgroupfs"
+	lockPath            = "/run/crio.lock"
 )
 
 // Config represents the entire set of configuration values that can be set for
@@ -74,6 +75,11 @@ type RootConfig struct {
 	// LogDir is the default log directory were all logs will go unless kubelet
 	// tells us to put them somewhere else.
 	LogDir string `toml:"log_dir"`
+
+	// FileLocking specifies whether to use file-based or in-memory locking
+	// File-based locking is required when multiple users of libkpod are
+	// present on the same system
+	FileLocking bool `toml:"file_locking"`
 }
 
 // RuntimeConfig represents the "crio.runtime" TOML config table.
@@ -233,9 +239,10 @@ func (c *Config) ToFile(path string) error {
 func DefaultConfig() *Config {
 	return &Config{
 		RootConfig: RootConfig{
-			Root:    crioRoot,
-			RunRoot: crioRunRoot,
-			LogDir:  "/var/log/crio/pods",
+			Root:        crioRoot,
+			RunRoot:     crioRunRoot,
+			LogDir:      "/var/log/crio/pods",
+			FileLocking: true,
 		},
 		RuntimeConfig: RuntimeConfig{
 			Runtime:                  "/usr/bin/runc",

libkpod/container_server.go

@@ -98,6 +98,18 @@ func New(config *Config) (*ContainerServer, error) {
 	if err != nil {
 		return nil, err
 	}
+
+	var lock sync.Locker
+	if config.FileLocking {
+		fileLock, err := cstorage.GetLockfile(lockPath)
+		if err != nil {
+			return nil, fmt.Errorf("error obtaining lockfile: %v", err)
+		}
+		lock = fileLock
+	} else {
+		lock = new(sync.Mutex)
+	}
+
 	return &ContainerServer{
 		runtime:            runtime,
 		store:              store,
@@ -107,7 +119,7 @@ func New(config *Config) (*ContainerServer, error) {
 		podNameIndex:       registrar.NewRegistrar(),
 		podIDIndex:         truncindex.NewTruncIndex([]string{}),
 		imageContext:       &types.SystemContext{SignaturePolicyPath: config.SignaturePolicyPath},
-		stateLock:          new(sync.Mutex),
+		stateLock:          lock,
 		state: &containerServerState{
 			containers: oci.NewMemoryStore(),
 			sandboxes:  make(map[string]*sandbox.Sandbox),