Detect whether we are running in containers and act responsively. #2063
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Run a daemon that handles all the requests of finding nacl_helper, and then pass the share memory fd to client using unix socket.
| # unmount, then use lazy unmount. | ||
| # FIXME: This is a hack for running in containers, since we cannot | ||
| # unmount recursive bindmount in it. | ||
| arg='-l' |
There was a problem hiding this comment.
I believe this is a kernel bug. I'll try to reproduce on recent kernels and ask on LKML...
Detect whether we are running in containers by inspecting the environment variable $container. If we are in container, we are not able to remount or change the config in /proc/sys/*, so just skip them. We also have to patch debootstrap since we are not able to mknod and we don't want to start services in containers.
Instead of inspecting the environment variable $container, check whether we are able to do some operations and act responsively.
It is possible that /sys, /media is not mounted in a container, so check it before we bind-mount it into chroot.
| echo 0 > /proc/sys/kernel/hung_task_panic | ||
| # Don't fail since we do not have permission to write /proc/sys/* if we are | ||
| # in container. | ||
| echo 0 > /proc/sys/kernel/hung_task_panic || true |
|
|
| @@ -355,6 +390,10 @@ tmpfsmount /var/run/lock 'noexec,nosuid,nodev,size=5120k' | |||
| bindmount /var/run/dbus /var/host/dbus | |||
There was a problem hiding this comment.
2>/dev/null || true. We probably won't bind mount /var/run/dbus in verified mode.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Detect whether we are running in containers by inspecting the environment
variable $container. If we are in container, we are not able to remount
or change the config in /proc/sys/*, so just skip them. We also have
to patch debootstrap since we are not able to mknod and we don't want
to start services in containers.