From abd1f8da60e173e192f51b9cee36fb9ed084ffee Mon Sep 17 00:00:00 2001 From: Michael Crosby Date: Thu, 6 Mar 2014 16:32:06 -0800 Subject: [PATCH 1/2] Revert "libcontainer: Use pivot_root instead of chroot" This reverts commit 5b5c884cc8266d0c2a56da0bc2df14cc9d5d85e8. Docker-DCO-1.1-Signed-off-by: Michael Crosby (github: crosbymichael) --- libcontainer/nsinit/mount.go | 22 ++++------------------ 1 file changed, 4 insertions(+), 18 deletions(-) diff --git a/libcontainer/nsinit/mount.go b/libcontainer/nsinit/mount.go index 69d85d6..a97a379 100644 --- a/libcontainer/nsinit/mount.go +++ b/libcontainer/nsinit/mount.go @@ -5,7 +5,6 @@ package nsinit import ( "fmt" "github.com/dotcloud/docker/pkg/system" - "io/ioutil" "os" "path/filepath" "syscall" @@ -51,29 +50,16 @@ func setupNewMountNamespace(rootfs, console string, readonly bool) error { if err := system.Chdir(rootfs); err != nil { return fmt.Errorf("chdir into %s %s", rootfs, err) } - - pivotDir, err := ioutil.TempDir(rootfs, ".pivot_root") - if err != nil { - return fmt.Errorf("can't create pivot_root dir %s", pivotDir, err) + if err := system.Mount(rootfs, "/", "", syscall.MS_MOVE, ""); err != nil { + return fmt.Errorf("mount move %s into / %s", rootfs, err) } - if err := system.Pivotroot(rootfs, pivotDir); err != nil { - return fmt.Errorf("pivot_root %s", err) + if err := system.Chroot("."); err != nil { + return fmt.Errorf("chroot . %s", err) } if err := system.Chdir("/"); err != nil { return fmt.Errorf("chdir / %s", err) } - // path to pivot dir now changed, update - pivotDir = filepath.Join("/", filepath.Base(pivotDir)) - - if err := system.Unmount(pivotDir, syscall.MNT_DETACH); err != nil { - return fmt.Errorf("unmount pivot_root dir %s", err) - } - - if err := os.Remove(pivotDir); err != nil { - return fmt.Errorf("remove pivot_root dir %s", err) - } - system.Umask(0022) return nil From 31c7d134664e7c0df69bc9f3fb47d6c6d3f63f3f Mon Sep 17 00:00:00 2001 From: Michael Crosby Date: Thu, 6 Mar 2014 16:41:03 -0800 Subject: [PATCH 2/2] Revert "libcontainer: Use MS_PRIVATE instead of MS_SLAVE" This reverts commit 757b5775725fb90262cee1fa6068fa9dcbbff59f. Docker-DCO-1.1-Signed-off-by: Michael Crosby (github: crosbymichael) --- libcontainer/nsinit/mount.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libcontainer/nsinit/mount.go b/libcontainer/nsinit/mount.go index a97a379..0506b99 100644 --- a/libcontainer/nsinit/mount.go +++ b/libcontainer/nsinit/mount.go @@ -20,7 +20,7 @@ const defaultMountFlags = syscall.MS_NOEXEC | syscall.MS_NOSUID | syscall.MS_NOD // is no longer in use, the mounts will be removed automatically func setupNewMountNamespace(rootfs, console string, readonly bool) error { // mount as slave so that the new mounts do not propagate to the host - if err := system.Mount("", "/", "", syscall.MS_PRIVATE|syscall.MS_REC, ""); err != nil { + if err := system.Mount("", "/", "", syscall.MS_SLAVE|syscall.MS_REC, ""); err != nil { return fmt.Errorf("mounting / as slave %s", err) } if err := system.Mount(rootfs, rootfs, "bind", syscall.MS_BIND|syscall.MS_REC, ""); err != nil {