genuinetools / img

Standalone, daemon-less, unprivileged Dockerfile and OCI compatible container image builder.
https://blog.jessfraz.com/post/building-container-images-securely-on-kubernetes/
MIT License
3.89k stars 230 forks source link

Embedded runc issues #231

Closed kekoav closed 5 years ago

kekoav commented 5 years ago

I've founds some problems with how runc is embedded.

Background

The embedded runc is copied to a random /tmp file on every build invocation. The PATH is then updated to allow this runc to be used by buildkit.

The following features require runc to be on the path: build, solve, diskusage, prune.

The Bugs

  1. A new runc binary is created in /tmp every time a build is invoked. This is an unexpected and inefficient way to create temp files for the embedded runc. This can be observed simply by watching the /tmp folder grow after successive builds.
  2. When a runc binary is not installed on the system, du and prune do not work. creating worker opt failed: failed to find runc binary This is because only the build command creates the temporary file.
  3. The tests do not pass unless a system runc binary is installed. The travis config installs a separate runc at /usr/bin/runc. https://github.com/genuinetools/img/blob/013bb211567bb92374315affaf0ffa1787fb23c2/.travis.yml#L17

Proposed Solutions

  1. Keep cached versions of the embedded runc in the state directory. Ensure the cached runc is updated when the embedded value changes. Check that the cached runc matches what is embedded.
  2. Instead of only creating tmp file on builds, ensure it exists for all commands as a setup step.
  3. Remove installation of runc as a dependency for tests.

I expect I'll be able to fix these issues and submit a PR, but would like any discussion as I do.

issue-label-bot[bot] commented 5 years ago

Issue-Label Bot is automatically applying the label bug to this issue, with a confidence of 0.66. Please mark this comment with :thumbsup: or :thumbsdown: to give our bot feedback!

Links: app homepage, dashboard and code for this bot.