restore: add lsm-profile and lsm-mount-context options #1578
Conversation
|
could you take care of the build failures? |
|
@rst0git would you like that I take care of these build failures and push a fixed version? I'd like to cut a new release and I think it would be good to include this PR |
|
Ephemeral COPR build failed. @containers/packit-build please check. |
|
Hi @giuseppe, thank you so much for your help! I've updated the pull request to fix the build failures. I am working with Adrian (@adrianreber) on enabling container checkpointing with crun in Kubernetes. However, the static crun binary provided with the CRI-O package currently fails with Would it be possible to fix this issue in the upcoming release? |
|
@rst0git using the static binary is a kind of a "hack" and crun should be better installed using a proper package manager. How would that be fixed? Avoiding the entire dlopen part for libcriu? Wouldn't be easier if libcriu is installed as well on the system? |
The error appears when libcriu is installed on the system. We noticed that adding However, checkpointing still fails with: |
|
could you please rebase on top of #1580 ? |
By default, CRIU restores containers with the same SELinux process labels used during checkpointing. However, when restoring multiple copies of a container, this results in all containers using identical SELinux labels, which is undesirable. In addition, all containers in a Pod share the SELinux label of the infrastructure container. To restore a new container into an existing Pod, we need to specify the SELinux label to be used during restore. This patch adds `--lsm-profile` option for the `crun restore` command to enable this functionality, similar to runc [1]. [1] opencontainers/runc#3005 Signed-off-by: Radostin Stoyanov <rstoyanov@fedoraproject.org>
The lsm-mount-context option allows to specify a new mount context to be used during restore. For example, if a mountpoint has been checkpointed with context like context="system_u:object_r:container_file_t:s0:c82,c137" it is possible to change this context using --lsm-mount-context "system_u:object_r:container_file_t:s0:c204,c495" Signed-off-by: Radostin Stoyanov <rstoyanov@fedoraproject.org>
Fixes containers#1578 Signed-off-by: Radostin Stoyanov <rstoyanov@fedoraproject.org>
This pull request updates the man page with description for the `--lsm-profile` and `--lsm-mount-context` options introduced in containers#1578 Signed-off-by: Radostin Stoyanov <rstoyanov@fedoraproject.org>
`CRRuntimeSupportsPodCheckpointRestore()` is used to check if the current container runtime (e.g., runc or crun) can restore a container into an existing Pod. It does this by processing output message to check if the `--lsm-mount-context` option is supported. This option was recently added to crun [1], however, crun and runc have slightly different output messages: ``` $ crun restore--lsm-mount-contextt restore: option '--lsm-mount-context' requires an argument Try `restore --help' or `restore --usage' for more information. ``` ``` $ runc restore --lsm-mount-context ERRO[0000] flag needs an argument: -lsm-mount-context ``` This patch updates the function to support both runtimes. [1] containers/crun#1578 Signed-off-by: Radostin Stoyanov <rstoyanov@fedoraproject.org>
By default, CRIU restores containers with the same SELinux process labels used during checkpointing. However, when restoring multiple copies of a container, this results in all containers using identical SELinux labels, which is undesirable. In addition, all containers in a Pod share the SELinux label of the infrastructure container. To restore a new container into an existing Pod, we need to specify the SELinux label to be used during restore.
This pull request adds
--lsm-profileand--lsm-mount-contextoptions for thecrun restorecommand to enable this functionality, similar to runc (opencontainers/runc#3005)