From 3ee4b0638580fde3d8403d6e257224e0d2d6fbf8 Mon Sep 17 00:00:00 2001 From: "W. Trevor King" Date: Tue, 9 May 2017 15:02:05 -0700 Subject: [PATCH] config-linux: Specify relationships for new namespaces These were contentious [1,2], so they weren't part of the previous commit. I still think we want to say something about these relationships. For example, if you ask for a new uts namespace but do not set the optional hostname, having the seed defined means that the hostname in the container UTS namespace is well-defined (it will be whatever the hostname was in the runtime UTS namespace). This is less of an issue for the mount namespace, because with root.path REQUIRED, there's no way to avoid clobbering whatever mounts you got from your seed (which makes not asking for a new mount namespace exciting ;). We already have some of "runtime namespace" conditions (e.g. when linux.namespaces[].path is unset), so runtimes should already have implementation-specific wording around what the runtime namespaces are (we don't explicitly make them implementation-defined, although we probably should). Anyhow, that's not a new concept added by this commit. If we want to explicitly make the parent / seed implementation-defined and not tied to the implementation-defined runtime namespaces, I guess we could do that (by rejecting this commit). But I think "I want this container to run in a new user/pid namespace that is a child of the runtime user/pid namespace" should be something that has a portable config expression. Otherwise it becomes very unclear what to put in the hostID field for (u|g)idMappings, because you don't know what namespace will be used to interpret the hostIDs. [1]: https://github.com/opencontainers/runtime-spec/pull/767#discussion_r115591844 [2]: https://github.com/opencontainers/runtime-spec/pull/767#discussion_r115592437 Signed-off-by: W. Trevor King --- config-linux.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/config-linux.md b/config-linux.md index f0603535a..b28bd6c98 100644 --- a/config-linux.md +++ b/config-linux.md @@ -40,6 +40,9 @@ The following parameters can be specified to setup namespaces: The runtime MUST [generate an error](runtime.md#errors) if `path` is not associated with a namespace of type `type`. If `path` is not specified, the runtime MUST create a new [container namespace](glossary.md#container-namespace) of type `type`. + For hierarchical namespaces (e.g. `pid`, `user`), the new container namespace MUST be a child of the [runtime namespace](glossary.md#runtime-namespace) of that type. + For seeded namespaces (e.g. `mount`, `uts`), the new container namespace MUST be seeded by the runtime namespace of that type. + When `type` is not `user`, new namespaces MUST be owned by the container `user` namespace. If a namespace type is not specified in the `namespaces` array, the container MUST inherit the [runtime namespace](glossary.md#runtime-namespace) of that type. If a `namespaces` field contains duplicated namespaces with same `type`, the runtime MUST [generate an error](runtime.md#errors).