opencontainers / runtime-spec

OCI Runtime Specification
http://www.opencontainers.org
Apache License 2.0
3.18k stars 539 forks source link

Ensure that devices are under /dev #1147

Open c3d opened 2 years ago

c3d commented 2 years ago

In the Linux device specification, all the examples indicate devices created under /dev. However, it is not specified if this is necessary or mandated.

We recently ran across a test that specifically puts devices under /mnt, and that makes me wonder if this is legitimate. This notably causes possible problems with VM-based runtimes such as Kata containers. Without specific precautions, they would be forced to scan volumes in search for device nodes, in order to make necessary adjustments.

I believe that the wording should be improved to explicitly state that devices can be placed anywhere, but that they MUST be referenced from the devices array, and not left anywhere in the file systems. (This is an update, the old suggestion was: "can only be placed under /dev on Linux, and that having device nodes anywhere else has undefined behaviour", but I realized this could break existing usage).

kolyshkin commented 2 years ago

In my humble opinion, /dev is just a convention, and UNIX/Linux do not impose any specific restriction as to where device nodes can or should be created, and therefore OCI spec should not enforce any restrictions either.

OTOH your scenario might be valid, too, so if you can either elaborate on it (does Kata containers need to explicitly find all device nodes in container filesystem? what for? is it currently only looking under /dev?), or just open a PR to modify/amend the existing wording in the spec, and we can discuss it further right there in the PR.