Use user-specific temp directory if set #41
Conversation
console.go
Outdated
| @@ -50,7 +50,7 @@ func NewConsoleSocket(path string) (*Socket, error) { | |||
| // NewTempConsoleSocket returns a temp console socket for use with a container | |||
| // On Close(), the socket is deleted | |||
| func NewTempConsoleSocket() (*Socket, error) { | |||
| dir, err := ioutil.TempDir("", "pty") | |||
| dir, err := ioutil.TempDir(os.Getenv("XDG_RUNTIME_DIR"), "pty") | |||
There was a problem hiding this comment.
I think for this one, we need to set the sticky bit on the temp dir that we are creating so that it does not get auto pruned after 6hrs when the socket is not updated. Here is the runc code for this.
root := "/run/runc"
if os.Geteuid() != 0 {
runtimeDir := os.Getenv("XDG_RUNTIME_DIR")
if runtimeDir != "" {
root = runtimeDir + "/runc"
// According to the XDG specification, we need to set anything in
// XDG_RUNTIME_DIR to have a sticky bit if we don't want it to get
// auto-pruned.
if err := os.MkdirAll(root, 0700); err != nil {
fatal(err)
}
if err := os.Chmod(root, 0700|os.ModeSticky); err != nil {
fatal(err)
}
}
}This allows non-privileged users to use containerd. This is part of a larger track of work integrating containerd into Cloudfoundry's garden with support for rootless. [#156343575] Signed-off-by: Julia Nedialkova <julianedialkova@hotmail.com> Signed-off-by: Tom Godkin <tgodkin@pivotal.io>
|
@crosbymichael bump just incase github didn't update you on the force push :) |
|
@Callisto13 do you know if there is a distinction between the stickybit being on the directory or the files inside for auto prune? |
|
@crosbymichael @Callisto13 The XDG Base Directory Specification is ambiguous on this topic, it's unclear (at least to me) whether the spec describes files as any file or as non-directories. Although, it appears that systemd creates sockets in subdirectories of |
|
LGTM Thanks for looking into this more @BooleanCat |
This allows non-privileged users to use containerd. This is part of a
larger track of work integrating containerd into Cloudfoundry's garden
with support for rootless.
This is linked to containerd/containerd#2325
[#156343575]
Signed-off-by: Claudia Beresford cberesford@pivotal.io