make gVisor write resolv.conf into the rootfs like micro-VM

follow-up to #2738

micro-VM writes /etc/resolv.conf into the bundle rootfs, under the actor's restored writes, so actors can edit it and edits survive suspend/resume. gVisor still bind mounts a per-actor file read-only:

substrate/internal/ocispec/gvisor.go

Lines 72 to 89 in 0877906

    
           // Insert resolv.conf before any volume bind mounts. 
        
           if !slices.ContainsFunc(spec.Mounts, func(m specs.Mount) bool { return m.Destination == resolvConf }) { 
        
           	i := slices.IndexFunc(spec.Mounts, func(m specs.Mount) bool { return m.Type == "bind" }) 
        
           	if i < 0 { 
        
           		i = len(spec.Mounts) 
        
           	} 
        
           	source := o.ResolvConf 
        
           	if source == "" { 
        
           		source = resolvConf 
        
           	} 
        
           	spec.Mounts = slices.Insert(spec.Mounts, i, specs.Mount{ 
        
           		Destination: resolvConf, 
        
           		Type:        "bind", 
        
           		Source:      source, 
        
           		Options:     []string{"ro"}, 
        
           	}) 
        
           }

substrate/cmd/ateworker-gvisor/sandboxnet.go

Lines 33 to 46 in 0877906

    
           func actorResolvConf(actorDirs *ateworkerpb.ActorDirs) (string, error) { 
        
           	pod, err := os.ReadFile("/etc/resolv.conf") 
        
           	if err != nil { 
        
           		return "", fmt.Errorf("reading the worker pod resolv.conf: %w", err) 
        
           	} 
        
           	path := resolvConfPath(actorDirs) 
        
           	if err := os.MkdirAll(filepath.Dir(path), 0o700); err != nil { 
        
           		return "", fmt.Errorf("creating the actor directory: %w", err) 
        
           	} 
        
           	if err := os.WriteFile(path, actornet.SandboxResolvConf(actornet.ActorVethGateway, pod), 0o644); err != nil { 
        
           		return "", fmt.Errorf("writing the actor resolv.conf: %w", err) 
        
           	} 
        
           	return path, nil 
        
           }

With #2738 /etc/hosts works the same way on both, we should do the same for resolv.conf. That also lets us drop the per-actor file, its cleanup, and the bind mount.

Docker and CRI mount it read-write too (read-only only with a read-only rootfs):
https://github.com/containerd/containerd/blob/f97f311871137b2d4dcfe4daaab0cd9c5f0a19ec/internal/cri/server/container_create.go#L1136-L1150

write resolv.conf into the gVisor rootfs like micro-VM (agent-substra…

Navigation Menu

Repository navigation

make gVisor write resolv.conf into the rootfs like micro-VM #2763

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

	// Insert resolv.conf before any volume bind mounts.
	if !slices.ContainsFunc(spec.Mounts, func(m specs.Mount) bool { return m.Destination == resolvConf }) {
	i := slices.IndexFunc(spec.Mounts, func(m specs.Mount) bool { return m.Type == "bind" })
	if i < 0 {
	i = len(spec.Mounts)
	}
	source := o.ResolvConf
	if source == "" {
	source = resolvConf
	}
	spec.Mounts = slices.Insert(spec.Mounts, i, specs.Mount{
	Destination: resolvConf,
	Type: "bind",
	Source: source,
	Options: []string{"ro"},
	})
	}

	func actorResolvConf(actorDirs *ateworkerpb.ActorDirs) (string, error) {
	pod, err := os.ReadFile("/etc/resolv.conf")
	if err != nil {
	return "", fmt.Errorf("reading the worker pod resolv.conf: %w", err)
	}
	path := resolvConfPath(actorDirs)
	if err := os.MkdirAll(filepath.Dir(path), 0o700); err != nil {
	return "", fmt.Errorf("creating the actor directory: %w", err)
	}
	if err := os.WriteFile(path, actornet.SandboxResolvConf(actornet.ActorVethGateway, pod), 0o644); err != nil {
	return "", fmt.Errorf("writing the actor resolv.conf: %w", err)
	}
	return path, nil
	}

make gVisor write resolv.conf into the rootfs like micro-VM #2763

Description

Activity

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions