oci: WithDefaultUnixDevices(): remove tun/tap from the default devices #6923
Conversation
A container should not have access to tun/tap device, unless it is explicitly specified in configuration. This device was already removed from docker's default, and runc's default; - opencontainers/runc@2ce40b6 - https://github.com/moby/moby//commit/9c4570a958df42d1ad19364b1a8da55b891d850a Per the commit message in runc, this should also fix these messages; > Apr 26 03:46:56 foo.bar systemd[1]: Couldn't stat device /dev/char/10:200: No such file or directory coming from systemd on every container start, when the systemd cgroup driver is used, and the system runs an old (< v240) version of systemd (the message was presumably eliminated by [1]). [1]: systemd/systemd@d5aecba Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
|
@kolyshkin @AkihiroSuda PTAL |
|
Was having a chat with @tianon, and he raised the question "how stable are these fixed numbers guaranteed to be"? Curious; would it be an idea (and is there a good way?) to dynamically find the major/minor numbers (with a |
Practically, they are set in stone. Not that there is any standard saying that /dev/net/tun is 10:200 or /dev/null is 1:3, but I bet these will never ever change. |
no standard but 10:200 show in the https://www.kernel.org/doc/Documentation/networking/tuntap.txt doc 😂 |
Yes, that was roughly my expectation; "unlikely" to change (famous last words! 😂); was wondering if that's documented somewhere (and if there would be a place to document it, or to "formalise" it). I guess if they ever decide to change that, we'll notice that pretty fast. |
|
kindly request that this is backported to release/1.5 and/or release/1.6 |
Go ahead please cc @thaJeztah |
thaJeztah
added
cherry-picked/1.5.x
A container should not have access to tun/tap device, unless it is explicitly
specified in configuration.
This device was already removed from docker's default, and runc's default;
Per the commit message in runc, this should also fix these messages;
coming from systemd on every container start, when the systemd cgroup driver
is used, and the system runs an old (< v240) version of systemd
(the message was presumably eliminated by 1).