vbatts/cri-o
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

Merge pull request #1337 from nalind/fix-runasuser-cache

Browse source 
imageService: cache information about images
This commit is contained in:
Mrunal Patel 2018-02-15 11:22:33 -08:00 committed by GitHub
commit ea90be40c4
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
4 changed files with 193 additions and 50 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

110
pkg/storage/image.go
View file

@ -5,6 +5,7 @@ import (
"net"
"path"
"strings"
"sync"
"github.com/containers/image/copy"
"github.com/containers/image/docker/reference"
@ -39,6 +40,7 @@ type ImageResult struct {
Size *uint64
Digest digest.Digest
ConfigDigest digest.Digest
User string
}
type indexInfo struct {
@ -46,12 +48,23 @@ type indexInfo struct {
secure bool
}
// A set of information that we prefer to cache about images, so that we can
// avoid having to reread them every time we need to return information about
// images.
type imageCacheItem struct {
user string
size *uint64
configDigest digest.Digest
}
type imageService struct {
store storage.Store
defaultTransport string
insecureRegistryCIDRs []*net.IPNet
indexConfigs map[string]*indexInfo
registries []string
imageCache map[string]imageCacheItem
imageCacheLock sync.Mutex
}
// sizer knows its size.
@ -171,16 +184,39 @@ func (svc *imageService) ListImages(systemContext *types.SystemContext, filter s
return nil, err
}
if image, err := istorage.Transport.GetStoreImage(svc.store, ref); err == nil {
var user string
var size *uint64
var configDigest digest.Digest
if cacheItem, ok := svc.imageCache[image.ID]; ok {
user, size, configDigest = cacheItem.user, cacheItem.size, cacheItem.configDigest
} else {
img, err := ref.NewImageSource(systemContext)
if err != nil {
return nil, err
}
size := imageSize(img)
configDigest, err := imageConfigDigest(img, nil)
size = imageSize(img)
configDigest, err = imageConfigDigest(img, nil)
img.Close()
if err != nil {
return nil, err
}
imageFull, err := ref.NewImage(systemContext)
if err != nil {
return nil, err
}
defer imageFull.Close()
imageConfig, err := imageFull.OCIConfig()
if err != nil {
return nil, err
}
user = imageConfig.Config.User
cacheItem := imageCacheItem{
user: user,
size: size,
configDigest: configDigest,
}
svc.imageCache[image.ID] = cacheItem
}
name, tags, digests := sortNamesByType(image.Names)
imageDigest, repoDigests := svc.makeRepoDigests(digests, tags, image.ID)
results = append(results, ImageResult{
@ -191,6 +227,7 @@ func (svc *imageService) ListImages(systemContext *types.SystemContext, filter s
Size: size,
Digest: imageDigest,
ConfigDigest: configDigest,
User: user,
})
}
} else {
@ -198,7 +235,39 @@ func (svc *imageService) ListImages(systemContext *types.SystemContext, filter s
if err != nil {
return nil, err
}
visited := make(map[string]struct{})
defer func() {
// We built a map using IDs of images that we looked
// at, so remove any items from the cache that don't
// correspond to any of those IDs.
removedIDs := make([]string, 0, len(svc.imageCache))
for imageID := range svc.imageCache {
if _, keep := visited[imageID]; !keep {
// We have cached data for an image
// with this ID, but it's not in the
// list of images now, so the image has
// been removed.
removedIDs = append(removedIDs, imageID)
}
}
// Handle the removals.
svc.imageCacheLock.Lock()
for _, removedID := range removedIDs {
delete(svc.imageCache, removedID)
}
svc.imageCacheLock.Unlock()
}()
for _, image := range images {
visited[image.ID] = struct{}{}
var user string
var size *uint64
var configDigest digest.Digest
svc.imageCacheLock.Lock()
cacheItem, ok := svc.imageCache[image.ID]
svc.imageCacheLock.Unlock()
if ok {
user, size, configDigest = cacheItem.user, cacheItem.size, cacheItem.configDigest
} else {
ref, err := istorage.Transport.ParseStoreReference(svc.store, "@"+image.ID)
if err != nil {
return nil, err
@ -207,12 +276,32 @@ func (svc *imageService) ListImages(systemContext *types.SystemContext, filter s
if err != nil {
return nil, err
}
size := imageSize(img)
configDigest, err := imageConfigDigest(img, nil)
size = imageSize(img)
configDigest, err = imageConfigDigest(img, nil)
img.Close()
if err != nil {
return nil, err
}
imageFull, err := ref.NewImage(systemContext)
if err != nil {
return nil, err
}
defer imageFull.Close()
imageConfig, err := imageFull.OCIConfig()
if err != nil {
return nil, err
}
user = imageConfig.Config.User
cacheItem := imageCacheItem{
user: user,
size: size,
configDigest: configDigest,
}
svc.imageCacheLock.Lock()
svc.imageCache[image.ID] = cacheItem
svc.imageCacheLock.Unlock()
}
name, tags, digests := sortNamesByType(image.Names)
imageDigest, repoDigests := svc.makeRepoDigests(digests, tags, image.ID)
results = append(results, ImageResult{
@ -223,6 +312,7 @@ func (svc *imageService) ListImages(systemContext *types.SystemContext, filter s
Size: size,
Digest: imageDigest,
ConfigDigest: configDigest,
User: user,
})
}
}
@ -246,6 +336,16 @@ func (svc *imageService) ImageStatus(systemContext *types.SystemContext, nameOrI
if err != nil {
return nil, err
}
imageFull, err := ref.NewImage(systemContext)
if err != nil {
return nil, err
}
defer imageFull.Close()
imageConfig, err := imageFull.OCIConfig()
if err != nil {
return nil, err
}
img, err := ref.NewImageSource(systemContext)
if err != nil {
@ -268,6 +368,7 @@ func (svc *imageService) ImageStatus(systemContext *types.SystemContext, nameOrI
Size: size,
Digest: imageDigest,
ConfigDigest: configDigest,
User: imageConfig.Config.User,
}
return &result, nil
@ -585,6 +686,7 @@ func GetImageService(store storage.Store, defaultTransport string, insecureRegis
indexConfigs: make(map[string]*indexInfo, 0),
insecureRegistryCIDRs: make([]*net.IPNet, 0),
registries: cleanRegistries,
imageCache: make(map[string]imageCacheItem),
}
insecureRegistries = append(insecureRegistries, "127.0.0.0/8")

2
server/container_create.go
View file

@ -449,7 +449,7 @@ func setupContainerUser(specgen *generate.Generator, rootfs string, sc *pb.Linux
containerUser := ""
// Case 1: run as user is set by kubelet
if sc.GetRunAsUser() != nil {
containerUser = strconv.FormatInt(sc.GetRunAsUser().Value, 10)
containerUser = strconv.FormatInt(sc.GetRunAsUser().GetValue(), 10)
} else {
// Case 2: run as username is set by kubelet
userName := sc.GetRunAsUsername()

20
server/image_list.go
View file

@ -31,20 +31,20 @@ func (s *Server) ListImages(ctx context.Context, req *pb.ListImagesRequest) (res
}
resp = &pb.ListImagesResponse{}
for _, result := range results {
if result.Size != nil {
resp.Images = append(resp.Images, &pb.Image{
resImg := &pb.Image{
Id: result.ID,
RepoTags: result.RepoTags,
RepoDigests: result.RepoDigests,
Size_: *result.Size,
})
} else {
resp.Images = append(resp.Images, &pb.Image{
Id: result.ID,
RepoTags: result.RepoTags,
RepoDigests: result.RepoDigests,
})
}
uid, username := getUserFromImage(result.User)
if uid != nil {
resImg.Uid = &pb.Int64Value{Value: *uid}
}
resImg.Username = username
if result.Size != nil {
resImg.Size_ = *result.Size
}
resp.Images = append(resp.Images, resImg)
}
logrus.Debugf("ListImagesResponse: %+v", resp)
return resp, nil

49
server/image_status.go
View file

@ -2,6 +2,8 @@ package server
import (
"fmt"
"strconv"
"strings"
"time"
"github.com/containers/storage"
@ -37,14 +39,21 @@ func (s *Server) ImageStatus(ctx context.Context, req *pb.ImageStatusRequest) (r
return nil, err
}
}
// match just the first registry as that's what kube meant
image = images[0]
var (
notfound bool
lastErr error
)
for _, image := range images {
status, err := s.StorageImageServer().ImageStatus(s.ImageContext(), image)
if err != nil {
if errors.Cause(err) == storage.ErrImageUnknown {
return &pb.ImageStatusResponse{}, nil
logrus.Warnf("imageStatus: can't find %s", image)
notfound = true
continue
}
return nil, err
logrus.Warnf("imageStatus: error getting status from %s: %v", image, err)
lastErr = err
continue
}
resp = &pb.ImageStatusResponse{
Image: &pb.Image{
@ -54,6 +63,38 @@ func (s *Server) ImageStatus(ctx context.Context, req *pb.ImageStatusRequest) (r
Size_: *status.Size,
},
}
uid, username := getUserFromImage(status.User)
if uid != nil {
resp.Image.Uid = &pb.Int64Value{Value: *uid}
}
resp.Image.Username = username
break
}
if lastErr != nil && resp == nil {
return nil, lastErr
}
if notfound && resp == nil {
return &pb.ImageStatusResponse{}, nil
}
logrus.Debugf("ImageStatusResponse: %+v", resp)
return resp, nil
}
// getUserFromImage gets uid or user name of the image user.
// If user is numeric, it will be treated as uid; or else, it is treated as user name.
func getUserFromImage(user string) (*int64, string) {
// return both empty if user is not specified in the image.
if user == "" {
return nil, ""
}
// split instances where the id may contain user:group
user = strings.Split(user, ":")[0]
// user could be either uid or user name. Try to interpret as numeric uid.
uid, err := strconv.ParseInt(user, 10, 64)
if err != nil {
// If user is non numeric, assume it's user name.
return nil, user
}
// If user is a numeric uid.
return &uid, ""
}