From edc946e08163a7e916a20b84d8bce5778ebb373a Mon Sep 17 00:00:00 2001 From: Yifan Gu Date: Fri, 10 Jun 2016 13:43:58 -0700 Subject: [PATCH] rkt: Error out when the gid is empty. Since appc requires gid to be non-empty today (https://github.com/appc/spec/issues/623), we have to error out when gid is empty instead of using the root gid. --- pkg/kubelet/rkt/rkt.go | 9 ++++++--- pkg/kubelet/rkt/rkt_test.go | 2 ++ 2 files changed, 8 insertions(+), 3 deletions(-) diff --git a/pkg/kubelet/rkt/rkt.go b/pkg/kubelet/rkt/rkt.go index 47a16dc455e..4c5c3b08e6f 100644 --- a/pkg/kubelet/rkt/rkt.go +++ b/pkg/kubelet/rkt/rkt.go @@ -554,13 +554,16 @@ func setApp(imgManifest *appcschema.ImageManifest, c *api.Container, opts *kubec // If 'User' or 'Group' are still empty at this point, // then apply the root UID and GID. - // TODO(yifan): Instead of using root GID, we should use - // the GID which the user is in. + // TODO(yifan): If only the GID is empty, rkt should be able to determine the GID + // using the /etc/passwd file in the image. + // See https://github.com/appc/docker2aci/issues/175. + // Maybe we can remove this check in the future. if app.User == "" { app.User = "0" + app.Group = "0" } if app.Group == "" { - app.Group = "0" + return fmt.Errorf("cannot determine the GID of the app %q", imgManifest.Name) } // Set working directory. diff --git a/pkg/kubelet/rkt/rkt_test.go b/pkg/kubelet/rkt/rkt_test.go index dc2152cc6af..99a13c77305 100644 --- a/pkg/kubelet/rkt/rkt_test.go +++ b/pkg/kubelet/rkt/rkt_test.go @@ -846,6 +846,8 @@ func generateMemoryIsolator(t *testing.T, request, limit string) appctypes.Isola func baseApp(t *testing.T) *appctypes.App { return &appctypes.App{ + User: "0", + Group: "0", Exec: appctypes.Exec{"/bin/foo", "bar"}, SupplementaryGIDs: []int{4, 5, 6}, WorkingDirectory: "/foo",