Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Can't exec into a container with private time namespace #4635

Closed
lifubang opened this issue Feb 19, 2025 · 0 comments · Fixed by #4636
Closed

Can't exec into a container with private time namespace #4635

lifubang opened this issue Feb 19, 2025 · 0 comments · Fixed by #4636
Labels
kind/bug

Comments

@lifubang
Copy link
Member

Description

When we exec into a container with a private time namespace, it will get an error.

Steps to reproduce the issue

  1. Create a container with a private time namespace;
  2. Exec into this container;
  3. We will always get an error.

Describe the results you received and expected

@lifubang ➜ ~/ubuntu $ sudo ./runc.amd64 run -d test
@lifubang ➜ ~/ubuntu $ sudo ./runc.amd64 exec test true
FATA[0000] nsexec-0[10598]: failed to update /proc/10599/timens_offsets: Permission denied
FATA[0000] nsexec-1[10599]: failed to sync with parent: read(SYNC_TIMEOFFSETS_ACK): Success
ERRO[0000] exec failed: unable to start container process: error executing setns process: exit status 1

What version of runc are you using?

runc version 1.2.5
commit: v1.2.5-0-g59923ef1
spec: 1.2.0
go: go1.22.12
libseccomp: 2.5.5

Host OS information

No response

Host kernel information

No response
lifubang added a commit to lifubang/runc that referenced this issue Feb 19, 2025
@lifubang
libct/nsexec: don't update timens offset when joining a time ns
fa9f3a3 
We should configure the process's timens offset only when we need to
create new time namespace, we shouldn't do it if we are joining an
existing time namespace. (opencontainers#4635)

Signed-off-by: lfbzhm <[email protected]>
@lifubang lifubang mentioned this issue Feb 19, 2025
Merged
lifubang added a commit to lifubang/runc that referenced this issue Feb 22, 2025
@lifubang
libct: don't send config to nsexec when joining an existing timens
ad09197 
We should configure the process's timens offset only when we need to
create new time namespace, we shouldn't do it if we are joining an
existing time namespace. (opencontainers#4635)

Signed-off-by: lifubang <[email protected]>
kolyshkin pushed a commit to kolyshkin/runc that referenced this issue Feb 26, 2025
@lifubang @kolyshkin
libct: don't send config to nsexec when joining an existing timens
Loading
Loading status checks…
c5312bc 
We should configure the process's timens offset only when we need to
create new time namespace, we shouldn't do it if we are joining an
existing time namespace. (opencontainers#4635)

Signed-off-by: lifubang <[email protected]>
(cherry picked from commit ad09197)
Signed-off-by: Kir Kolyshkin <[email protected]>
@kolyshkin kolyshkin mentioned this issue Feb 26, 2025
Merged
@cyphar cyphar mentioned this issue Mar 4, 2025
Merged
@github-actions github-actions bot mentioned this issue Mar 9, 2025
Open
@rata rata mentioned this issue Mar 13, 2025
Merged
@austinvazquez austinvazquez mentioned this issue Mar 18, 2025
Merged
@github-actions github-actions bot mentioned this issue Mar 23, 2025
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
kind/bug
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

libct: don't send config to nsexec when joining an existing timens lifubang/runc
1 participant
@lifubang