4df5d394e8
Done as follows:
find -name build.yml | xargs dirname | while read d ; do
t=$(linuxkit pkg show-tag $d)
./scripts/update-component-sha.sh --image ${t%:*} ${t#*:}
done
git commit -s test pkg tools blueprints examples projects/kubernetes projects/swarmd docs linuxkit.yml Makefile src
This explicitly excludes projects/* which I did not know whether to update.
Then:
git reset --hard
for i in init runc containerd ca-certificates sysctl dhcpcd getty rngd ; do
o=$(git grep -h "\(image:\|-\) *linuxkit/$i:[0-9a-f]\{40\}" origin/master:linuxkit.yml | awk '// { print $2 }')
n=$(linuxkit pkg show-tag pkg/$i)
./scripts/update-component-sha.sh "$o" "$n"
done
git commit --amend projects
This updates any projects which were using components with the same hash as the
top-level linuxkit.yml.
Signed-off-by: Ian Campbell <ijc@docker.com>
shiftfs
Shiftfs is a virtual filesystem for mapping mountpoints across user namespaces. The idea is that it would be useful for dockerds spawning containers: they can keep filesystems on the host disk in terms of real root, but mount the container roots via shiftfs, allowing containers to share a particular filesystem with different uid maps, while not having to uidshift every file on disk (and thus destroying some of the sharing properties).
The version included here is the v2 version of shiftfs, using the superblock's user namespace instead of mountopts to figure out mappings. Thus, an extra step of "marking" mounts is needed. For example:
# mkdir source
# touch source/foo # a root owned file
# mount -t shiftfs -o mark source source
# chmod 777 source
Now, let's make a user namespace:
# setuid 1000 unshare -rm
# cat /proc/self/uidmap
0 1000 1
# mkdir dest
# mount -t shiftfs source dest
# stat dest/foo | grep Uid
Access: (0644/-rw-r--r--) Uid: ( 0/ root) Gid: ( 0/ root)
And thanks to the magic of shiftfs, the file is root owned in the user namespace.