Now we can e.g. implement ephemeral containers in a consistent way. Signed-off-by: Christian Brauner <christianvanbrau...@gmail.com>
100.0% src/lxc/ diff --git a/src/lxc/start.c b/src/lxc/start.c index ffb8d12..1179d2c 100644 --- a/src/lxc/start.c +++ b/src/lxc/start.c @@ -83,6 +83,11 @@ const struct ns_info ns_info[LXC_NS_MAX] = { [LXC_NS_NET] = {"net", CLONE_NEWNET} }; +static int bdev_destroy_wrapper(void *data); +static int lxc_rmdir_onedev_wrapper(void *data); +static void lxc_destroy_container_on_signal(struct lxc_handler *handler, + const char *name); + static void print_top_failing_dir(const char *path) { size_t len = strlen(path); @@ -495,6 +500,13 @@ void lxc_fini(const char *name, struct lxc_handler *handler) close(handler->ttysock[0]); close(handler->ttysock[1]); } + if (handler->conf->ephemeral > 0) { + /* Only destroy when rootfs is overlayfs or aufs for now. The + * function however, works for other bdev types as well. */ + if ((strncmp(handler->conf->rootfs.path, "overlayfs:", 10) == 0) || + (strncmp(handler->conf->rootfs.path, "aufs:", 5) == 0)) + lxc_destroy_container_on_signal(handler, name); + } cgroup_destroy(handler); free(handler); } @@ -1291,3 +1303,61 @@ int lxc_start(const char *name, char *const argv[], struct lxc_conf *conf, conf->need_utmp_watch = 1; return __lxc_start(name, conf, &start_ops, &start_arg, lxcpath, backgrounded); } + +static void lxc_destroy_container_on_signal(struct lxc_handler *handler, + const char *name) +{ + char destroy[MAXPATHLEN]; + bool bret = true; + int ret = 0; + if (handler->conf && handler->conf->rootfs.path && handler->conf->rootfs.mount) { + if (am_unpriv()) + ret = userns_exec_1(handler->conf, bdev_destroy_wrapper, handler->conf); + else + bret = bdev_destroy(handler->conf); + if (ret < 0 || !bret) { + ERROR("Error destroying rootfs for %s", name); + } else { + INFO("Destroyed rootfs for %s", name); + } + } + ret = snprintf(destroy, MAXPATHLEN, "%s/%s", handler->lxcpath, name); + if (ret < 0 || ret >= MAXPATHLEN) + ERROR("Error creating string"); + if (am_unpriv()) + ret = userns_exec_1(handler->conf, lxc_rmdir_onedev_wrapper, destroy); + else + ret = lxc_rmdir_onedev(destroy, NULL); + if (ret < 0) { + ERROR("Error destroying container directory for %s", name); + } else { + INFO("Destroyed directory for %s", name); + } +} + +static int bdev_destroy_wrapper(void *data) +{ + struct lxc_conf *conf = data; + + if (setgid(0) < 0) { + ERROR("Failed to setgid to 0"); + return -1; + } + if (setgroups(0, NULL) < 0) + WARN("Failed to clear groups"); + if (setuid(0) < 0) { + ERROR("Failed to setuid to 0"); + return -1; + } + if (!bdev_destroy(conf)) + return -1; + else + return 0; +} + +static int lxc_rmdir_onedev_wrapper(void *data) +{ + char *arg = (char *) data; + return lxc_rmdir_onedev(arg, NULL); +} + -- 2.5.1 _______________________________________________ lxc-devel mailing list lxc-devel@lists.linuxcontainers.org http://lists.linuxcontainers.org/listinfo/lxc-devel