From 6df08e55b780b7515fb80fb7102d000d42286a9c Mon Sep 17 00:00:00 2001 From: criyle Date: Sat, 12 Dec 2020 11:53:09 -0800 Subject: [PATCH] Add ability to config container uid & gid --- container/container_cmd_linux.go | 6 ++++++ container/container_exec_linux.go | 4 ++-- container/environment_linux.go | 24 ++++++++++++++++++++---- container/protocol_linux.go | 4 +++- 4 files changed, 31 insertions(+), 7 deletions(-) diff --git a/container/container_cmd_linux.go b/container/container_cmd_linux.go index ea3fb52..6d0205d 100644 --- a/container/container_cmd_linux.go +++ b/container/container_cmd_linux.go @@ -18,6 +18,12 @@ func (c *containerServer) handleConf(conf *confCmd) error { if err := initContainer(conf.Conf); err != nil { return err } + if c.ContainerUID == 0 { + c.ContainerUID = containerUID + } + if c.ContainerGID == 0 { + c.ContainerGID = containerGID + } } return c.sendReply(&reply{}, nil) } diff --git a/container/container_exec_linux.go b/container/container_exec_linux.go index 0ae6eeb..d9a349a 100644 --- a/container/container_exec_linux.go +++ b/container/container_exec_linux.go @@ -59,8 +59,8 @@ func (c *containerServer) handleExecve(cmd *execCmd, msg *unixsocket.Msg) error if c.Cred { cred = &syscall.Credential{ - Uid: containerUID, - Gid: containerGID, + Uid: uint32(c.ContainerUID), + Gid: uint32(c.ContainerGID), NoSetGroups: true, } } diff --git a/container/environment_linux.go b/container/environment_linux.go index 2110ca5..3e50bc1 100644 --- a/container/environment_linux.go +++ b/container/environment_linux.go @@ -48,6 +48,10 @@ type Builder struct { // DomainName set container domainname (default: go-sandbox) DomainName string + + // ContainerUID & ContainerGID set the container uid / gid mapping + ContainerUID int + ContainerGID int } // CredGenerator generates uid / gid credential used by container @@ -123,6 +127,8 @@ func (b *Builder) Build() (Environment, error) { ContainerRoot: root, Mounts: mounts, Cred: b.CredGenerator != nil, + ContainerUID: b.ContainerUID, + ContainerGID: b.ContainerGID, }); err != nil { c.Destroy() return nil, err @@ -153,7 +159,7 @@ func (b *Builder) startContainer() (*container, error) { // prepare container running credential if b.CredGenerator != nil { cred = b.CredGenerator.Get() - uidMap, gidMap = getIDMapping(&cred) + uidMap, gidMap = b.getIDMapping(&cred) } else { uidMap = []syscall.SysProcIDMap{{HostID: os.Geteuid(), Size: 1}} gidMap = []syscall.SysProcIDMap{{HostID: os.Getegid(), Size: 1}} @@ -226,7 +232,17 @@ func newPassCredSocketPair() (*unixsocket.Socket, *unixsocket.Socket, error) { return ins, outs, nil } -func getIDMapping(cred *syscall.Credential) ([]syscall.SysProcIDMap, []syscall.SysProcIDMap) { +func (b *Builder) getIDMapping(cred *syscall.Credential) ([]syscall.SysProcIDMap, []syscall.SysProcIDMap) { + cUID := b.ContainerUID + if cUID == 0 { + cUID = containerUID + } + + cGID := b.ContainerGID + if cGID == 0 { + cGID = containerGID + } + uidMap := []syscall.SysProcIDMap{ { ContainerID: 0, @@ -234,7 +250,7 @@ func getIDMapping(cred *syscall.Credential) ([]syscall.SysProcIDMap, []syscall.S Size: 1, }, { - ContainerID: containerUID, + ContainerID: cUID, HostID: int(cred.Uid), Size: 1, }, @@ -247,7 +263,7 @@ func getIDMapping(cred *syscall.Credential) ([]syscall.SysProcIDMap, []syscall.S Size: 1, }, { - ContainerID: containerGID, + ContainerID: cGID, HostID: int(cred.Gid), Size: 1, }, diff --git a/container/protocol_linux.go b/container/protocol_linux.go index 665eb1e..9ed886e 100644 --- a/container/protocol_linux.go +++ b/container/protocol_linux.go @@ -56,7 +56,9 @@ type containerConfig struct { ContainerRoot string Mounts []mount.Mount - Cred bool + Cred bool + ContainerUID int + ContainerGID int } // reply is the reply message send back to controller