[lxc-devel] [PATCH 6/6] Enable lxc_fini() to destroy container on shutdown This works for any bdev-type but is only used for overlayfs and aufs now

[Christian Brauner]

On Mon, Sep 07, 2015 at 05:25:03PM +0000, Serge Hallyn wrote:
> Quoting Christian Brauner (christianvanbrauner at gmail.com):
> > Now we can e.g. implement ephemeral containers in a consistent way.
> > 
> > Signed-off-by: Christian Brauner <christianvanbrauner at gmail.com>
> > 
> >  100.0% src/lxc/
> > diff --git a/src/lxc/start.c b/src/lxc/start.c
> > index ffb8d12..1179d2c 100644
> > --- a/src/lxc/start.c
> > +++ b/src/lxc/start.c
> > @@ -83,6 +83,11 @@ const struct ns_info ns_info[LXC_NS_MAX] = {
> >  	[LXC_NS_NET] = {"net", CLONE_NEWNET}
> >  };
> >  
> > +static int bdev_destroy_wrapper(void *data);
> > +static int lxc_rmdir_onedev_wrapper(void *data);
> > +static void lxc_destroy_container_on_signal(struct lxc_handler *handler,
> > +					    const char *name);
> > +
> >  static void print_top_failing_dir(const char *path)
> >  {
> >  	size_t len = strlen(path);
> > @@ -495,6 +500,13 @@ void lxc_fini(const char *name, struct lxc_handler *handler)
> >  		close(handler->ttysock[0]);
> >  		close(handler->ttysock[1]);
> >  	}
> > +	if (handler->conf->ephemeral > 0) {
> 
> This doesn't match what was advertised - < 0 should also mean
> ephemeral.  (I really think a boolean makes the most sense,
> enforced in the conffile as must be 0|1.)

Ok.

> 
> > +		/* Only destroy when rootfs is overlayfs or aufs for now. The
> > +		 * function however, works for other bdev types as well. */
> 
> What is the reason for that limitation?

So far we only seem to use it for overlayfs and aufs based containers and I
didn't want to be hasty making it usable for any kind of container.

> 
> > +		if ((strncmp(handler->conf->rootfs.path, "overlayfs:", 10) == 0) ||
> > +		   (strncmp(handler->conf->rootfs.path, "aufs:", 5) == 0))
> > +			lxc_destroy_container_on_signal(handler, name);
> > +	}
> >  	cgroup_destroy(handler);
> >  	free(handler);
> >  }
> > @@ -1291,3 +1303,61 @@ int lxc_start(const char *name, char *const argv[], struct lxc_conf *conf,
> >  	conf->need_utmp_watch = 1;
> >  	return __lxc_start(name, conf, &start_ops, &start_arg, lxcpath, backgrounded);
> >  }
> > +
> > +static void lxc_destroy_container_on_signal(struct lxc_handler *handler,
> > +					    const char *name)
> > +{
> > +	char destroy[MAXPATHLEN];
> > +	bool bret = true;
> > +	int ret = 0;
> > +	if (handler->conf && handler->conf->rootfs.path && handler->conf->rootfs.mount) {
> > +		if (am_unpriv())
> > +			ret = userns_exec_1(handler->conf, bdev_destroy_wrapper, handler->conf);
> > +		else
> > +			bret = bdev_destroy(handler->conf);
> > +		if (ret < 0 || !bret) {
> > +			ERROR("Error destroying rootfs for %s", name);
> > +		} else {
> > +			INFO("Destroyed rootfs for %s", name);
> > +		}
> > +	}
> > +	ret = snprintf(destroy, MAXPATHLEN, "%s/%s", handler->lxcpath, name);
> > +	if (ret < 0 || ret >= MAXPATHLEN)
> > +		ERROR("Error creating string");
> > +	if (am_unpriv())
> > +		ret = userns_exec_1(handler->conf, lxc_rmdir_onedev_wrapper, destroy);
> > +	else
> > +		ret = lxc_rmdir_onedev(destroy, NULL);
> > +	if (ret < 0) {
> > +		ERROR("Error destroying container directory for %s", name);
> > +	} else {
> > +		INFO("Destroyed directory for %s", name);
> > +	}
> > +}
> > +
> > +static int bdev_destroy_wrapper(void *data)
> 
> The one in lxccontainers.c should somehow be shared.
We can put it in bdev.c and bdev.h

> 
> > +{
> > +	struct lxc_conf *conf = data;
> > +
> > +	if (setgid(0) < 0) {
> > +		ERROR("Failed to setgid to 0");
> > +		return -1;
> > +	}
> > +	if (setgroups(0, NULL) < 0)
> > +		WARN("Failed to clear groups");
> > +	if (setuid(0) < 0) {
> > +		ERROR("Failed to setuid to 0");
> > +		return -1;
> > +	}
> > +	if (!bdev_destroy(conf))
> > +		return -1;
> > +	else
> > +		return 0;
> > +}
> > +
> > +static int lxc_rmdir_onedev_wrapper(void *data)
> 
> Hm, I guess it's easier just to keep this one static in 
> the two places like you're doing.

Ok.

> 
> > +{
> > +	char *arg = (char *) data;
> > +	return lxc_rmdir_onedev(arg, NULL);
> > +}
> > +
> > -- 
> > 2.5.1
> > 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: not available
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20150908/62a1b42d/attachment.sig>