Skip to content

Fix secret mounting with userns_remap enabled #2723

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
jiashuChen wants to merge 2 commits into from
Closed

Fix secret mounting with userns_remap enabled #2723

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
50635a4
Fix secret mounting with userns_remap enabled
Mar 13, 2022
3c5439a
refactor to use a wrapper MkidrTemp function
Mar 16, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
37 changes: 19 additions & 18 deletions cache/contenthash/checksum_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,7 @@ import (
"github.com/moby/buildkit/snapshot"
containerdsnapshot "github.com/moby/buildkit/snapshot/containerd"
"github.com/moby/buildkit/util/leaseutil"
"github.com/moby/buildkit/util/system"
"github.com/moby/buildkit/util/winlayers"
digest "github.com/opencontainers/go-digest"
"github.com/pkg/errors"
Expand All @@ -42,7 +43,7 @@ const (

func TestChecksumSymlinkNoParentScan(t *testing.T) {
t.Parallel()
tmpdir, err := os.MkdirTemp("", "buildkit-state")
tmpdir, err := system.MkdirTemp("", "buildkit-state")
require.NoError(t, err)
defer os.RemoveAll(tmpdir)

Expand Down Expand Up @@ -71,7 +72,7 @@ func TestChecksumSymlinkNoParentScan(t *testing.T) {

func TestChecksumHardlinks(t *testing.T) {
t.Parallel()
tmpdir, err := os.MkdirTemp("", "buildkit-state")
tmpdir, err := system.MkdirTemp("", "buildkit-state")
require.NoError(t, err)
defer os.RemoveAll(tmpdir)

Expand Down Expand Up @@ -154,7 +155,7 @@ func TestChecksumHardlinks(t *testing.T) {

func TestChecksumWildcardOrFilter(t *testing.T) {
t.Parallel()
tmpdir, err := os.MkdirTemp("", "buildkit-state")
tmpdir, err := system.MkdirTemp("", "buildkit-state")
require.NoError(t, err)
defer os.RemoveAll(tmpdir)

Expand Down Expand Up @@ -211,7 +212,7 @@ func TestChecksumWildcardOrFilter(t *testing.T) {

func TestChecksumWildcardWithBadMountable(t *testing.T) {
t.Parallel()
tmpdir, err := os.MkdirTemp("", "buildkit-state")
tmpdir, err := system.MkdirTemp("", "buildkit-state")
require.NoError(t, err)
defer os.RemoveAll(tmpdir)

Expand All @@ -231,7 +232,7 @@ func TestChecksumWildcardWithBadMountable(t *testing.T) {

func TestSymlinksNoFollow(t *testing.T) {
t.Parallel()
tmpdir, err := os.MkdirTemp("", "buildkit-state")
tmpdir, err := system.MkdirTemp("", "buildkit-state")
require.NoError(t, err)
defer os.RemoveAll(tmpdir)

Expand Down Expand Up @@ -290,7 +291,7 @@ func TestSymlinksNoFollow(t *testing.T) {

func TestChecksumBasicFile(t *testing.T) {
t.Parallel()
tmpdir, err := os.MkdirTemp("", "buildkit-state")
tmpdir, err := system.MkdirTemp("", "buildkit-state")
require.NoError(t, err)
defer os.RemoveAll(tmpdir)

Expand Down Expand Up @@ -448,7 +449,7 @@ func TestChecksumIncludeExclude(t *testing.T) {
func testChecksumIncludeExclude(t *testing.T, wildcard bool) {
t.Parallel()

tmpdir, err := os.MkdirTemp("", "buildkit-state")
tmpdir, err := system.MkdirTemp("", "buildkit-state")
require.NoError(t, err)
defer os.RemoveAll(tmpdir)

Expand Down Expand Up @@ -583,7 +584,7 @@ func testChecksumIncludeExclude(t *testing.T, wildcard bool) {

func TestChecksumIncludeDoubleStar(t *testing.T) {
t.Parallel()
tmpdir, err := os.MkdirTemp("", "buildkit-state")
tmpdir, err := system.MkdirTemp("", "buildkit-state")
require.NoError(t, err)
defer os.RemoveAll(tmpdir)

Expand Down Expand Up @@ -651,7 +652,7 @@ func TestChecksumIncludeDoubleStar(t *testing.T) {

func TestChecksumIncludeSymlink(t *testing.T) {
t.Parallel()
tmpdir, err := os.MkdirTemp("", "buildkit-state")
tmpdir, err := system.MkdirTemp("", "buildkit-state")
require.NoError(t, err)
defer os.RemoveAll(tmpdir)

Expand Down Expand Up @@ -724,7 +725,7 @@ func TestChecksumIncludeSymlink(t *testing.T) {

func TestHandleChange(t *testing.T) {
t.Parallel()
tmpdir, err := os.MkdirTemp("", "buildkit-state")
tmpdir, err := system.MkdirTemp("", "buildkit-state")
require.NoError(t, err)
defer os.RemoveAll(tmpdir)

Expand Down Expand Up @@ -802,7 +803,7 @@ func TestHandleChange(t *testing.T) {

func TestHandleRecursiveDir(t *testing.T) {
t.Parallel()
tmpdir, err := os.MkdirTemp("", "buildkit-state")
tmpdir, err := system.MkdirTemp("", "buildkit-state")
require.NoError(t, err)
defer os.RemoveAll(tmpdir)

Expand Down Expand Up @@ -851,7 +852,7 @@ func TestHandleRecursiveDir(t *testing.T) {

func TestChecksumUnorderedFiles(t *testing.T) {
t.Parallel()
tmpdir, err := os.MkdirTemp("", "buildkit-state")
tmpdir, err := system.MkdirTemp("", "buildkit-state")
require.NoError(t, err)
defer os.RemoveAll(tmpdir)

Expand Down Expand Up @@ -904,7 +905,7 @@ func TestChecksumUnorderedFiles(t *testing.T) {

func TestSymlinkInPathScan(t *testing.T) {
t.Parallel()
tmpdir, err := os.MkdirTemp("", "buildkit-state")
tmpdir, err := system.MkdirTemp("", "buildkit-state")
require.NoError(t, err)
defer os.RemoveAll(tmpdir)

Expand Down Expand Up @@ -935,7 +936,7 @@ func TestSymlinkInPathScan(t *testing.T) {

func TestSymlinkNeedsScan(t *testing.T) {
t.Parallel()
tmpdir, err := os.MkdirTemp("", "buildkit-state")
tmpdir, err := system.MkdirTemp("", "buildkit-state")
require.NoError(t, err)
defer os.RemoveAll(tmpdir)

Expand Down Expand Up @@ -968,7 +969,7 @@ func TestSymlinkNeedsScan(t *testing.T) {

func TestSymlinkAbsDirSuffix(t *testing.T) {
t.Parallel()
tmpdir, err := os.MkdirTemp("", "buildkit-state")
tmpdir, err := system.MkdirTemp("", "buildkit-state")
require.NoError(t, err)
defer os.RemoveAll(tmpdir)

Expand All @@ -995,7 +996,7 @@ func TestSymlinkAbsDirSuffix(t *testing.T) {

func TestSymlinkThroughParent(t *testing.T) {
t.Parallel()
tmpdir, err := os.MkdirTemp("", "buildkit-state")
tmpdir, err := system.MkdirTemp("", "buildkit-state")
require.NoError(t, err)
defer os.RemoveAll(tmpdir)

Expand Down Expand Up @@ -1050,7 +1051,7 @@ func TestSymlinkThroughParent(t *testing.T) {

func TestSymlinkInPathHandleChange(t *testing.T) {
t.Parallel()
tmpdir, err := os.MkdirTemp("", "buildkit-state")
tmpdir, err := system.MkdirTemp("", "buildkit-state")
require.NoError(t, err)
defer os.RemoveAll(tmpdir)

Expand Down Expand Up @@ -1113,7 +1114,7 @@ func TestSymlinkInPathHandleChange(t *testing.T) {

func TestPersistence(t *testing.T) {
t.Parallel()
tmpdir, err := os.MkdirTemp("", "buildkit-state")
tmpdir, err := system.MkdirTemp("", "buildkit-state")
require.NoError(t, err)
defer os.RemoveAll(tmpdir)

Expand Down
43 changes: 22 additions & 21 deletions cache/manager_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,6 +43,7 @@ import (
"github.com/moby/buildkit/util/compression"
"github.com/moby/buildkit/util/contentutil"
"github.com/moby/buildkit/util/leaseutil"
"github.com/moby/buildkit/util/system"
"github.com/moby/buildkit/util/winlayers"
digest "github.com/opencontainers/go-digest"
ocispecs "github.com/opencontainers/image-spec/specs-go/v1"
Expand Down Expand Up @@ -74,7 +75,7 @@ func newCacheManager(ctx context.Context, opt cmOpt) (co *cmOut, cleanup func()
opt.snapshotterName = "native"
}

tmpdir, err := os.MkdirTemp("", "cachemanager")
tmpdir, err := system.MkdirTemp("", "cachemanager")
if err != nil {
return nil, nil, err
}
Expand Down Expand Up @@ -166,14 +167,14 @@ func TestSharableMountPoolCleanup(t *testing.T) {
t.Parallel()
ctx := namespaces.WithNamespace(context.Background(), "buildkit-test")

tmpdir, err := os.MkdirTemp("", "cachemanager")
tmpdir, err := system.MkdirTemp("", "cachemanager")
require.NoError(t, err)
defer os.RemoveAll(tmpdir)

// Emulate the situation where the pool dir is dirty
mountPoolDir := filepath.Join(tmpdir, "cachemounts")
require.NoError(t, os.MkdirAll(mountPoolDir, 0700))
_, err = os.MkdirTemp(mountPoolDir, "buildkit")
_, err = system.MkdirTemp(mountPoolDir, "buildkit")
require.NoError(t, err)

// Initialize cache manager and check if pool is cleaned up
Expand All @@ -193,7 +194,7 @@ func TestManager(t *testing.T) {

ctx := namespaces.WithNamespace(context.Background(), "buildkit-test")

tmpdir, err := os.MkdirTemp("", "cachemanager")
tmpdir, err := system.MkdirTemp("", "cachemanager")
require.NoError(t, err)
defer os.RemoveAll(tmpdir)

Expand Down Expand Up @@ -325,7 +326,7 @@ func TestLazyGetByBlob(t *testing.T) {
t.Parallel()
ctx := namespaces.WithNamespace(context.Background(), "buildkit-test")

tmpdir, err := os.MkdirTemp("", "cachemanager")
tmpdir, err := system.MkdirTemp("", "cachemanager")
require.NoError(t, err)
defer os.RemoveAll(tmpdir)

Expand Down Expand Up @@ -370,7 +371,7 @@ func TestMergeBlobchainID(t *testing.T) {
t.Parallel()
ctx := namespaces.WithNamespace(context.Background(), "buildkit-test")

tmpdir, err := os.MkdirTemp("", "cachemanager")
tmpdir, err := system.MkdirTemp("", "cachemanager")
require.NoError(t, err)
defer os.RemoveAll(tmpdir)

Expand Down Expand Up @@ -443,7 +444,7 @@ func TestSnapshotExtract(t *testing.T) {
t.Parallel()
ctx := namespaces.WithNamespace(context.Background(), "buildkit-test")

tmpdir, err := os.MkdirTemp("", "cachemanager")
tmpdir, err := system.MkdirTemp("", "cachemanager")
require.NoError(t, err)
defer os.RemoveAll(tmpdir)

Expand Down Expand Up @@ -583,7 +584,7 @@ func TestExtractOnMutable(t *testing.T) {
t.Parallel()
ctx := namespaces.WithNamespace(context.Background(), "buildkit-test")

tmpdir, err := os.MkdirTemp("", "cachemanager")
tmpdir, err := system.MkdirTemp("", "cachemanager")
require.NoError(t, err)
defer os.RemoveAll(tmpdir)

Expand Down Expand Up @@ -692,7 +693,7 @@ func TestSetBlob(t *testing.T) {
t.Parallel()
ctx := namespaces.WithNamespace(context.Background(), "buildkit-test")

tmpdir, err := os.MkdirTemp("", "cachemanager")
tmpdir, err := system.MkdirTemp("", "cachemanager")
require.NoError(t, err)
defer os.RemoveAll(tmpdir)

Expand Down Expand Up @@ -865,7 +866,7 @@ func TestPrune(t *testing.T) {
t.Parallel()
ctx := namespaces.WithNamespace(context.Background(), "buildkit-test")

tmpdir, err := os.MkdirTemp("", "cachemanager")
tmpdir, err := system.MkdirTemp("", "cachemanager")
require.NoError(t, err)
defer os.RemoveAll(tmpdir)

Expand Down Expand Up @@ -976,7 +977,7 @@ func TestLazyCommit(t *testing.T) {

ctx := namespaces.WithNamespace(context.Background(), "buildkit-test")

tmpdir, err := os.MkdirTemp("", "cachemanager")
tmpdir, err := system.MkdirTemp("", "cachemanager")
require.NoError(t, err)
defer os.RemoveAll(tmpdir)

Expand Down Expand Up @@ -1134,7 +1135,7 @@ func TestLoopLeaseContent(t *testing.T) {

ctx := namespaces.WithNamespace(context.Background(), "buildkit-test")

tmpdir, err := os.MkdirTemp("", "cachemanager")
tmpdir, err := system.MkdirTemp("", "cachemanager")
require.NoError(t, err)
defer os.RemoveAll(tmpdir)

Expand Down Expand Up @@ -1251,7 +1252,7 @@ func TestSharingCompressionVariant(t *testing.T) {

ctx := namespaces.WithNamespace(context.Background(), "buildkit-test")

tmpdir, err := os.MkdirTemp("", "cachemanager")
tmpdir, err := system.MkdirTemp("", "cachemanager")
require.NoError(t, err)
defer os.RemoveAll(tmpdir)

Expand Down Expand Up @@ -1519,7 +1520,7 @@ func TestConversion(t *testing.T) {

ctx := namespaces.WithNamespace(context.Background(), "buildkit-test")

tmpdir, err := os.MkdirTemp("", "cachemanager")
tmpdir, err := system.MkdirTemp("", "cachemanager")
require.NoError(t, err)
defer os.RemoveAll(tmpdir)

Expand Down Expand Up @@ -1616,7 +1617,7 @@ func TestGetRemotes(t *testing.T) {

ctx := namespaces.WithNamespace(context.Background(), "buildkit-test")

tmpdir, err := os.MkdirTemp("", "cachemanager")
tmpdir, err := system.MkdirTemp("", "cachemanager")
require.NoError(t, err)
defer os.RemoveAll(tmpdir)

Expand Down Expand Up @@ -1916,7 +1917,7 @@ func TestNondistributableBlobs(t *testing.T) {

ctx := namespaces.WithNamespace(context.Background(), "buildkit-test")

tmpdir, err := os.MkdirTemp("", "cachemanager")
tmpdir, err := system.MkdirTemp("", "cachemanager")
require.NoError(t, err)
defer os.RemoveAll(tmpdir)

Expand Down Expand Up @@ -2047,7 +2048,7 @@ func TestMergeOp(t *testing.T) {

ctx := namespaces.WithNamespace(context.Background(), "buildkit-test")

tmpdir, err := os.MkdirTemp("", "cachemanager")
tmpdir, err := system.MkdirTemp("", "cachemanager")
require.NoError(t, err)
defer os.RemoveAll(tmpdir)

Expand Down Expand Up @@ -2163,7 +2164,7 @@ func TestDiffOp(t *testing.T) {

ctx := namespaces.WithNamespace(context.Background(), "buildkit-test")

tmpdir, err := os.MkdirTemp("", "cachemanager")
tmpdir, err := system.MkdirTemp("", "cachemanager")
require.NoError(t, err)
defer os.RemoveAll(tmpdir)

Expand Down Expand Up @@ -2267,7 +2268,7 @@ func TestLoadHalfFinalizedRef(t *testing.T) {

ctx := namespaces.WithNamespace(context.Background(), "buildkit-test")

tmpdir, err := os.MkdirTemp("", "cachemanager")
tmpdir, err := system.MkdirTemp("", "cachemanager")
require.NoError(t, err)
defer os.RemoveAll(tmpdir)

Expand Down Expand Up @@ -2347,7 +2348,7 @@ func TestMountReadOnly(t *testing.T) {

ctx := namespaces.WithNamespace(context.Background(), "buildkit-test")

tmpdir, err := os.MkdirTemp("", "cachemanager")
tmpdir, err := system.MkdirTemp("", "cachemanager")
require.NoError(t, err)
defer os.RemoveAll(tmpdir)

Expand Down Expand Up @@ -2595,7 +2596,7 @@ func fileToBlob(file *os.File, compress bool) ([]byte, ocispecs.Descriptor, erro
}

func mapToSystemTarBlob(m map[string]string) ([]byte, ocispecs.Descriptor, error) {
tmpdir, err := os.MkdirTemp("", "tarcreation")
tmpdir, err := system.MkdirTemp("", "tarcreation")
if err != nil {
return nil, ocispecs.Descriptor{}, err
}
Expand Down
Loading