Add ability to config container uid & gid

This commit is contained in:
criyle 2020-12-12 11:53:09 -08:00
parent 928a0a4631
commit 6df08e55b7
4 changed files with 31 additions and 7 deletions

View File

@ -18,6 +18,12 @@ func (c *containerServer) handleConf(conf *confCmd) error {
if err := initContainer(conf.Conf); err != nil {
return err
}
if c.ContainerUID == 0 {
c.ContainerUID = containerUID
}
if c.ContainerGID == 0 {
c.ContainerGID = containerGID
}
}
return c.sendReply(&reply{}, nil)
}

View File

@ -59,8 +59,8 @@ func (c *containerServer) handleExecve(cmd *execCmd, msg *unixsocket.Msg) error
if c.Cred {
cred = &syscall.Credential{
Uid: containerUID,
Gid: containerGID,
Uid: uint32(c.ContainerUID),
Gid: uint32(c.ContainerGID),
NoSetGroups: true,
}
}

View File

@ -48,6 +48,10 @@ type Builder struct {
// DomainName set container domainname (default: go-sandbox)
DomainName string
// ContainerUID & ContainerGID set the container uid / gid mapping
ContainerUID int
ContainerGID int
}
// CredGenerator generates uid / gid credential used by container
@ -123,6 +127,8 @@ func (b *Builder) Build() (Environment, error) {
ContainerRoot: root,
Mounts: mounts,
Cred: b.CredGenerator != nil,
ContainerUID: b.ContainerUID,
ContainerGID: b.ContainerGID,
}); err != nil {
c.Destroy()
return nil, err
@ -153,7 +159,7 @@ func (b *Builder) startContainer() (*container, error) {
// prepare container running credential
if b.CredGenerator != nil {
cred = b.CredGenerator.Get()
uidMap, gidMap = getIDMapping(&cred)
uidMap, gidMap = b.getIDMapping(&cred)
} else {
uidMap = []syscall.SysProcIDMap{{HostID: os.Geteuid(), Size: 1}}
gidMap = []syscall.SysProcIDMap{{HostID: os.Getegid(), Size: 1}}
@ -226,7 +232,17 @@ func newPassCredSocketPair() (*unixsocket.Socket, *unixsocket.Socket, error) {
return ins, outs, nil
}
func getIDMapping(cred *syscall.Credential) ([]syscall.SysProcIDMap, []syscall.SysProcIDMap) {
func (b *Builder) getIDMapping(cred *syscall.Credential) ([]syscall.SysProcIDMap, []syscall.SysProcIDMap) {
cUID := b.ContainerUID
if cUID == 0 {
cUID = containerUID
}
cGID := b.ContainerGID
if cGID == 0 {
cGID = containerGID
}
uidMap := []syscall.SysProcIDMap{
{
ContainerID: 0,
@ -234,7 +250,7 @@ func getIDMapping(cred *syscall.Credential) ([]syscall.SysProcIDMap, []syscall.S
Size: 1,
},
{
ContainerID: containerUID,
ContainerID: cUID,
HostID: int(cred.Uid),
Size: 1,
},
@ -247,7 +263,7 @@ func getIDMapping(cred *syscall.Credential) ([]syscall.SysProcIDMap, []syscall.S
Size: 1,
},
{
ContainerID: containerGID,
ContainerID: cGID,
HostID: int(cred.Gid),
Size: 1,
},

View File

@ -56,7 +56,9 @@ type containerConfig struct {
ContainerRoot string
Mounts []mount.Mount
Cred bool
Cred bool
ContainerUID int
ContainerGID int
}
// reply is the reply message send back to controller