search

intelsdi-x / rkt

rkt is an App Container runtime for Linux
Apache License 2.0
0 stars 1 forks source link

kvm: problem with mounting single file as a volume #32

Open borqosky opened 8 years ago

borqosky commented 8 years ago

Steps to reproduce:

nginx_default.json

Got error:

kvm: network unit created: "interface-eth0.service" in "stage1/rootfs/usr/lib/systemd/system" (iface="eth0", addr="172.16.28.85/24")
stage1: warning: no volume specified for mount point "k8s-managed-etc-hosts", implicitly creating an "empty" volume. This volume will be removed when the pod is garbage-collected.
stage1: failed to configure systemd: mkdir stage1/rootfs/opt/stage2/nginx/rootfs/etc/hosts: not a directory
borqosky commented 8 years ago

@jellonek @ppalucki @mpatelcz @mstachowski : seems to prepare-app.c is ok for hacking it ? Line 156

    static const mount_point files_mount_table[] = {
        { "/etc/rkt-resolv.conf", "/etc/resolv.conf", "bind", NULL, MS_BIND },
    };

What do you think ?

jellonek commented 8 years ago

Wrong description - this is not connected with 9p.

ppalucki commented 8 years ago

is it problem only when specifying volumes by manifests ? (can I reproduce the same simply with -v host:/x/somefile.txt ?

as proposed by @jellonek we can mitigate that just mounting single directory and bind mounting required subfolder and files - but we end up we security issues realated to protecting the host filesystem

ps. please move that as an issue to coreos/rkt, its better to continue this discussion there

ppalucki commented 8 years ago

@jellonek I don't understand - it exactly problem of 9p - that it cannot share a single file

by 9p volume is treated as directory (not device and not file) that is all

squall0gd commented 8 years ago

@ppalucki: As far as I know, there is no filesystem which provide functionality of mounting single as a volume. In 'coreos' flavor, you are able to bind-mount single file into stage{1,2} rootfs. This way it isn't 9p problem, but overuse of bind-mount in 'coreos' flavor.

jellonek commented 8 years ago

Not exactly "overuse". but you are close to that what i had in mind writing this comment. It's more like "method which we used as volume provider - can not provide this functionality" as any other method than bind-mounting on host - can provide this in easy way (other possibility is to provide whole directory - or even whole rootfs of host - to container and then/there bindmount it as it's done by prepare app).