Replace the manual handling of mounts with the contianerd's mount package - #840
Open
cmainas wants to merge 1 commit into
Open
Replace the manual handling of mounts with the contianerd's mount package#840cmainas wants to merge 1 commit into
cmainas wants to merge 1 commit into
Conversation
Replace the manual handling of mount options and mount calls with containerd's mount package, and use securejoin to resolve mount targets and copy destinations inside the monitor rootfs, so that symlinks in image-controlled paths cannot redirect them outside of it. containerd's option parser cannot translate propagation flags and the kernel ignores per-mount VFS flags when a bind mount is created. Therefore, split the mount options into three groups: the options forwarded to containerd, the propagation flags and the per-mount VFS flags. For bind mounts urunc reapplies the VFS flags, preserving the CL_UNPRIVILEGED locked flags of the source mount when running inside a user namespace. also, since we switch from moby/sys/mount to containerd's mount package we also switch from a lzy unmount to a strict one, which is necessary since we want to attach the block devices to the sandbox. Also fix getMonitorDevices to not append an empty device entry when /dev/net/tun does not exist on the host. Leftover from previous PR Signed-off-by: Charalampos Mainas <cmainas@nubificus.co.uk>
cmainas
force-pushed
the
feat_containerd_mount_secure_join
branch
from
July 20, 2026 19:46
d47cd30 to
7add7b8
Compare
✅ Deploy Preview for urunc canceled.
|
✅ Deploy Preview for urunc canceled.
|
4 tasks
cmainas
force-pushed
the
feat_containerd_mount_secure_join
branch
from
July 29, 2026 16:59
7add7b8 to
ec2cdb8
Compare
cmainas
force-pushed
the
feat_containerd_mount_secure_join
branch
5 times, most recently
from
August 3, 2026 07:38
1a5b996 to
c218c7c
Compare
cmainas
marked this pull request as ready for review
August 3, 2026 07:38
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Replace all the manual handling of mounts (option parsing, mount calls, unmounting) with containerd's mount package. Furthermore, use
SecureJointo safely resolve mount targets and copy destinations inside the monitor rootfs, so symlinks in image-controlled paths cannot redirect a mount outside of it.Since containerd does not parse propagation flags correctly (ignores them) and because the kernel ignores per-mount VFS flags when a bind mount is created, we split the mount options in three groups: the options forwarded to containerd, the propagation flags and the per-mount VFS flags. For bind mounts we reapply the VFS flags, preserving the CL_UNPRIVILEGED locked flags of the source mount when running inside a user namespace.
Also, since we switch from moby/sys/mount to containerd's mount package we also switch from a lazy unmount to a strict one, which is necessary since we want to attach the block devices to the sandbox.
At last, fix getMonitorDevices to not append an empty device entry when
/dev/net/tundoes not exist on the host. Leftover from #835Related issues
How was this tested?
with e2e tests
LLM usage
Opus 4.8 to update all calls for mounts
Checklist
make lint).make test_ctr,make test_nerdctl,make test_docker,make test_crictl).