fix: Docker container ID parsing with cgroupfs driver #293
Conversation
vadorovsky
force-pushed
the
vadorovsky/docker-openrc
branch
from
0d4ad17
to
c8285c5
Compare
vadorovsky
force-pushed
the
vadorovsky/docker-openrc
branch
from
15e7b1c
to
802a07b
Compare
The format of cgroup path is different for systemd and cgroupfs drivers. For systemd driver, it's ``` 0::/system.slice/docker-d4ea646fc22c701dbb146e52db4e9125dcca2eebb2f5552f90fedbb28a0f0716.scope ``` For cgroupfs driver, it's ``` 0::/docker/2cf2e0be458a80acb354c953f7bb03de5d2d277dfcb8ebaa6575f95668a0c15f ``` Handle both formats.
And only if necessary.
vadorovsky
force-pushed
the
vadorovsky/docker-openrc
branch
from
802a07b
to
92015b8
Compare
Before this change, we were trying to handle offsets by doing pointer arithmetics (like `str + offset` where `str` is `char*` and `offset` an integer). Verifier in kernels <6.0 was not happy with that and was complaining about unchecked bounds. Fix that by making `buffer_append_str` aware of offsets and doing all the bound checks there.
vadorovsky
force-pushed
the
vadorovsky/docker-openrc
branch
from
92015b8
to
871258e
Compare
* It's cleaner. * Using `char` array was triggering verifier errors on kernel 6.0.
|
Seems good to me. I would like to make one final consideration: looking at the history the commit fix: Handle offsets and their bounds in buffer_append_str didn't solve the verifier issue, but it was solved in the next commit fix: Use container_id_buffer also for parent_buf. so is it possible to revert to the previous function signature of the function |
|
@banditopazzo There were two separate verifier issues which both of these commits were solving. 😅 fixed the verifier error on kernel 5.13 if you check out to a change before both of commits, integration tests fail for both 5.13 and 6.0. I initially didn't notice the latter, but that's the case. If you check out to the first commit, the tests for 6.0 will fail. And I think that both changes make sense (regardless of verifier errors) - the first one makes the offset checks more reliable in the whole helper, the second one uses your buffer struct consequently. :) |
The format of cgroup path is different for systemd and cgroupfs drivers.
For systemd driver, it's
For cgroupfs driver, it's
Handle both formats.