Merge pull request containerd#10564 from thaJeztah/1.7_backport_migra…

…te_userns [release/1.7 backport] pkg/userns: deprecate and migrate to github.com/moby/sys/userns
Mirantis · Aug 9, 2024 · 90367cc · 90367cc
2 parents d2fffd9 + dce0b5a
commit 90367cc
Show file tree

Hide file tree

Showing 27 changed files with 331 additions and 93 deletions.
diff --git a/archive/tar.go b/archive/tar.go
@@ -29,9 +29,10 @@ import (
  "syscall"
  "time"
 
+ "github.com/moby/sys/userns"
+
  "github.com/containerd/containerd/archive/tarheader"
  "github.com/containerd/containerd/pkg/epoch"
- "github.com/containerd/containerd/pkg/userns"
  "github.com/containerd/continuity/fs"
  "github.com/containerd/log"
 )

diff --git a/archive/tar_unix.go b/archive/tar_unix.go
@@ -27,10 +27,11 @@ import (
  "strings"
  "syscall"
 
- "github.com/containerd/containerd/pkg/userns"
+ "github.com/moby/sys/userns"
+ "golang.org/x/sys/unix"
+
  "github.com/containerd/continuity/fs"
  "github.com/containerd/continuity/sysx"
- "golang.org/x/sys/unix"
 )
 
 func chmodTarEntry(perm os.FileMode) os.FileMode {

diff --git a/diff/apply/apply_linux.go b/diff/apply/apply_linux.go
@@ -23,12 +23,12 @@ import (
  "os"
  "strings"
 
+ "github.com/moby/sys/userns"
+ "golang.org/x/sys/unix"
+
  "github.com/containerd/containerd/archive"
  "github.com/containerd/containerd/mount"
- "github.com/containerd/containerd/pkg/userns"
  "github.com/containerd/errdefs"
-
- "golang.org/x/sys/unix"
 )
 
 func apply(ctx context.Context, mounts []mount.Mount, r io.Reader, sync bool) (retErr error) {

diff --git a/go.mod b/go.mod
@@ -48,7 +48,8 @@ require (
  github.com/moby/sys/sequential v0.5.0
  github.com/moby/sys/signal v0.7.0
  github.com/moby/sys/symlink v0.2.0
- github.com/moby/sys/user v0.1.0
+ github.com/moby/sys/user v0.3.0
+ github.com/moby/sys/userns v0.1.0
  github.com/opencontainers/go-digest v1.0.0
  github.com/opencontainers/image-spec v1.1.0
  github.com/opencontainers/runtime-spec v1.1.0

diff --git a/go.sum b/go.sum
@@ -545,8 +545,10 @@ github.com/moby/sys/signal v0.7.0/go.mod h1:GQ6ObYZfqacOwTtlXvcmh9A26dVRul/hbOZn
 github.com/moby/sys/symlink v0.1.0/go.mod h1:GGDODQmbFOjFsXvfLVn3+ZRxkch54RkSiGqsZeMYowQ=
 github.com/moby/sys/symlink v0.2.0 h1:tk1rOM+Ljp0nFmfOIBtlV3rTDlWOwFRhjEeAhZB0nZc=
 github.com/moby/sys/symlink v0.2.0/go.mod h1:7uZVF2dqJjG/NsClqul95CqKOBRQyYSNnJ6BMgR/gFs=
-github.com/moby/sys/user v0.1.0 h1:WmZ93f5Ux6het5iituh9x2zAG7NFY9Aqi49jjE1PaQg=
-github.com/moby/sys/user v0.1.0/go.mod h1:fKJhFOnsCN6xZ5gSfbM6zaHGgDJMrqt9/reuj4T7MmU=
+github.com/moby/sys/user v0.3.0 h1:9ni5DlcW5an3SvRSx4MouotOygvzaXbaSrc/wGDFWPo=
+github.com/moby/sys/user v0.3.0/go.mod h1:bG+tYYYJgaMtRKgEmuueC0hJEAZWwtIbZTB+85uoHjs=
+github.com/moby/sys/userns v0.1.0 h1:tVLXkFOxVu9A64/yh59slHVv9ahO9UIev4JZusOLG/g=
+github.com/moby/sys/userns v0.1.0/go.mod h1:IHUYgu/kao6N8YZlp9Cf444ySSvCmDlmzUcYfDHOl28=
 github.com/moby/term v0.0.0-20200312100748-672ec06f55cd/go.mod h1:DdlQx2hp0Ss5/fLikoLlEeIYiATotOjgB//nb973jeo=
 github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=

diff --git a/integration/client/go.mod b/integration/client/go.mod
@@ -52,7 +52,8 @@ require (
  github.com/moby/sys/mountinfo v0.6.2 // indirect
  github.com/moby/sys/sequential v0.5.0 // indirect
  github.com/moby/sys/signal v0.7.0 // indirect
- github.com/moby/sys/user v0.1.0 // indirect
+ github.com/moby/sys/user v0.3.0 // indirect
+ github.com/moby/sys/userns v0.1.0 // indirect
  github.com/opencontainers/selinux v1.11.0 // indirect
  github.com/pelletier/go-toml v1.9.5 // indirect
  github.com/pkg/errors v0.9.1 // indirect

diff --git a/integration/client/go.sum b/integration/client/go.sum
@@ -1820,8 +1820,10 @@ github.com/moby/sys/signal v0.6.0/go.mod h1:GQ6ObYZfqacOwTtlXvcmh9A26dVRul/hbOZn
 github.com/moby/sys/signal v0.7.0 h1:25RW3d5TnQEoKvRbEKUGay6DCQ46IxAVTT9CUMgmsSI=
 github.com/moby/sys/signal v0.7.0/go.mod h1:GQ6ObYZfqacOwTtlXvcmh9A26dVRul/hbOZn88Kg8Tg=
 github.com/moby/sys/symlink v0.2.0/go.mod h1:7uZVF2dqJjG/NsClqul95CqKOBRQyYSNnJ6BMgR/gFs=
-github.com/moby/sys/user v0.1.0 h1:WmZ93f5Ux6het5iituh9x2zAG7NFY9Aqi49jjE1PaQg=
-github.com/moby/sys/user v0.1.0/go.mod h1:fKJhFOnsCN6xZ5gSfbM6zaHGgDJMrqt9/reuj4T7MmU=
+github.com/moby/sys/user v0.3.0 h1:9ni5DlcW5an3SvRSx4MouotOygvzaXbaSrc/wGDFWPo=
+github.com/moby/sys/user v0.3.0/go.mod h1:bG+tYYYJgaMtRKgEmuueC0hJEAZWwtIbZTB+85uoHjs=
+github.com/moby/sys/userns v0.1.0 h1:tVLXkFOxVu9A64/yh59slHVv9ahO9UIev4JZusOLG/g=
+github.com/moby/sys/userns v0.1.0/go.mod h1:IHUYgu/kao6N8YZlp9Cf444ySSvCmDlmzUcYfDHOl28=
 github.com/moby/term v0.0.0-20210610120745-9d4ed1856297/go.mod h1:vgPCkQMyxTZ7IDy8SXRufE172gr8+K/JE/7hHFxHW3A=
 github.com/moby/term v0.0.0-20220808134915-39b0c02b01ae/go.mod h1:E2VnQOmVuvZB6UYnnDB0qG5Nq/1tD9acaOpo6xmt0Kw=
 github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=

diff --git a/mount/mount_linux.go b/mount/mount_linux.go
@@ -26,7 +26,7 @@ import (
  "strings"
  "time"
 
- "github.com/containerd/containerd/pkg/userns"
+ "github.com/moby/sys/userns"
  "golang.org/x/sys/unix"
 )
 

diff --git a/oci/utils_unix.go b/oci/utils_unix.go
@@ -24,7 +24,7 @@ import (
  "os"
  "path/filepath"
 
- "github.com/containerd/containerd/pkg/userns"
+ "github.com/moby/sys/userns"
  specs "github.com/opencontainers/runtime-spec/specs-go"
  "golang.org/x/sys/unix"
 )

diff --git a/oci/utils_unix_test.go b/oci/utils_unix_test.go
@@ -25,9 +25,8 @@ import (
  "runtime"
  "testing"
 
+ "github.com/moby/sys/userns"
  "github.com/stretchr/testify/assert"
-
- "github.com/containerd/containerd/pkg/userns"
 )
 
 func cleanupTest() {

diff --git a/pkg/cri/sbserver/podsandbox/sandbox_run_linux.go b/pkg/cri/sbserver/podsandbox/sandbox_run_linux.go
@@ -25,6 +25,7 @@ import (
  "github.com/containerd/containerd"
  "github.com/containerd/containerd/oci"
  "github.com/containerd/containerd/plugin"
+ "github.com/moby/sys/userns"
  imagespec "github.com/opencontainers/image-spec/specs-go/v1"
  runtimespec "github.com/opencontainers/runtime-spec/specs-go"
  "github.com/opencontainers/selinux/go-selinux"
@@ -33,7 +34,6 @@ import (
 
  "github.com/containerd/containerd/pkg/cri/annotations"
  customopts "github.com/containerd/containerd/pkg/cri/opts"
- "github.com/containerd/containerd/pkg/userns"
 )
 
 func (c *Controller) sandboxContainerSpec(id string, config *runtime.PodSandboxConfig,

diff --git a/pkg/cri/sbserver/service_linux.go b/pkg/cri/sbserver/service_linux.go
@@ -20,8 +20,8 @@ import (
  "fmt"
 
  "github.com/containerd/containerd/pkg/cap"
- "github.com/containerd/containerd/pkg/userns"
  "github.com/containerd/go-cni"
+ "github.com/moby/sys/userns"
  "github.com/opencontainers/selinux/go-selinux"
  "github.com/sirupsen/logrus"
  "tags.cncf.io/container-device-interface/pkg/cdi"

diff --git a/pkg/cri/server/sandbox_run_linux.go b/pkg/cri/server/sandbox_run_linux.go
@@ -26,6 +26,7 @@ import (
  "github.com/containerd/containerd/oci"
  "github.com/containerd/containerd/plugin"
  "github.com/containerd/containerd/snapshots"
+ "github.com/moby/sys/userns"
  imagespec "github.com/opencontainers/image-spec/specs-go/v1"
  runtimespec "github.com/opencontainers/runtime-spec/specs-go"
  selinux "github.com/opencontainers/selinux/go-selinux"
@@ -34,7 +35,6 @@ import (
 
  "github.com/containerd/containerd/pkg/cri/annotations"
  customopts "github.com/containerd/containerd/pkg/cri/opts"
- "github.com/containerd/containerd/pkg/userns"
 )
 
 func (c *criService) sandboxContainerSpec(id string, config *runtime.PodSandboxConfig,

diff --git a/pkg/cri/server/service_linux.go b/pkg/cri/server/service_linux.go
@@ -20,8 +20,8 @@ import (
  "fmt"
 
  "github.com/containerd/containerd/pkg/cap"
- "github.com/containerd/containerd/pkg/userns"
  cni "github.com/containerd/go-cni"
+ "github.com/moby/sys/userns"
  "github.com/opencontainers/selinux/go-selinux"
  "github.com/sirupsen/logrus"
  "tags.cncf.io/container-device-interface/pkg/cdi"

diff --git a/pkg/userns/userns_unsupported.go → pkg/userns/userns_deprecated.go b/pkg/userns/userns_unsupported.go → pkg/userns/userns_deprecated.go
@@ -1,5 +1,3 @@
-//go:build !linux
-
 /*
  Copyright The containerd Authors.
 
@@ -16,10 +14,16 @@
  limitations under the License.
 */
 
+// Deprecated: use github.com/moby/sys/userns
 package userns
 
-// RunningInUserNS is a stub for non-Linux systems
-// Always returns false
+import "github.com/moby/sys/userns"
+
+// RunningInUserNS detects whether we are currently running in a Linux
+// user namespace and memoizes the result. It returns false on non-Linux
+// platforms.
+//
+// Deprecated: use [userns.RunningInUserNS].
 func RunningInUserNS() bool {
- return false
+ return userns.RunningInUserNS()
 }
diff --git a/pkg/userns/userns_linux.go b/pkg/userns/userns_linux.go
diff --git a/runtime/v2/runc/task/service.go b/runtime/v2/runc/task/service.go
@@ -24,6 +24,8 @@ import (
  "os"
  "sync"
 
+ "github.com/moby/sys/userns"
+
  "github.com/containerd/cgroups/v3"
  "github.com/containerd/cgroups/v3/cgroup1"
  cgroupsv2 "github.com/containerd/cgroups/v3/cgroup2"
@@ -37,7 +39,6 @@ import (
  "github.com/containerd/containerd/pkg/process"
  "github.com/containerd/containerd/pkg/shutdown"
  "github.com/containerd/containerd/pkg/stdio"
- "github.com/containerd/containerd/pkg/userns"
  "github.com/containerd/containerd/protobuf"
  ptypes "github.com/containerd/containerd/protobuf/types"
  "github.com/containerd/containerd/runtime/v2/runc"

diff --git a/snapshots/overlay/overlayutils/check.go b/snapshots/overlay/overlayutils/check.go
@@ -24,9 +24,10 @@ import (
  "path/filepath"
  "syscall"
 
+ "github.com/moby/sys/userns"
+
  kernel "github.com/containerd/containerd/contrib/seccomp/kernelversion"
  "github.com/containerd/containerd/mount"
- "github.com/containerd/containerd/pkg/userns"
  "github.com/containerd/continuity/fs"
  "github.com/containerd/log"
 )

diff --git a/sys/oom_linux.go b/sys/oom_linux.go
@@ -22,7 +22,7 @@ import (
  "strconv"
  "strings"
 
- "github.com/containerd/containerd/pkg/userns"
+ "github.com/moby/sys/userns"
  "golang.org/x/sys/unix"
 )
 

diff --git a/sys/oom_linux_test.go b/sys/oom_linux_test.go
@@ -24,7 +24,7 @@ import (
  "testing"
  "time"
 
- "github.com/containerd/containerd/pkg/userns"
+ "github.com/moby/sys/userns"
  "github.com/stretchr/testify/assert"
  "github.com/stretchr/testify/require"
 )

diff --git a/vendor/github.com/moby/sys/user/user.go b/vendor/github.com/moby/sys/user/user.go