|
| 1 | +From f8c088be055b72e58005ef9e56cf4f4008bbc5dd Mon Sep 17 00:00:00 2001 |
| 2 | +From: Brian Goff <cpuguy83@gmail.com> |
| 3 | +Date: Tue, 7 May 2024 21:55:36 +0000 |
| 4 | +Subject: [PATCH] Lookup docker-proxy in libexec paths |
| 5 | + |
| 6 | +This allows distros to put docker-proxy under libexec paths as is done |
| 7 | +for docker-init. |
| 8 | + |
| 9 | +Also expands the lookup to to not require a `docker/` subdir in libexec |
| 10 | +subdir. |
| 11 | +Since it is a generic helper that may be used for something else in the |
| 12 | +future, this is only done for binaries with a `docker-`. |
| 13 | + |
| 14 | +Backported to moby 24.0.9 for AZL 2.0 |
| 15 | + |
| 16 | +Signed-off-by: Brian Goff <cpuguy83@gmail.com> |
| 17 | +Signed-off-by: Henry Beberman <henry.beberman@microsoft.com> |
| 18 | + |
| 19 | +diff -Naur a/daemon/config/config_linux.go b/daemon/config/config_linux.go |
| 20 | +--- a/daemon/config/config_linux.go 2024-02-01 00:12:23.000000000 +0000 |
| 21 | ++++ b/daemon/config/config_linux.go 2024-06-25 18:18:00.929394951 +0000 |
| 22 | +@@ -5,6 +5,7 @@ |
| 23 | + "net" |
| 24 | + "os/exec" |
| 25 | + "path/filepath" |
| 26 | ++ "strings" |
| 27 | + |
| 28 | + "github.com/containerd/cgroups/v3" |
| 29 | + "github.com/docker/docker/api/types" |
| 30 | +@@ -118,14 +119,13 @@ |
| 31 | + return DefaultInitBinary |
| 32 | + } |
| 33 | + |
| 34 | +-// LookupInitPath returns an absolute path to the "docker-init" binary by searching relevant "libexec" directories (per FHS 3.0 & 2.3) followed by PATH |
| 35 | +-func (conf *Config) LookupInitPath() (string, error) { |
| 36 | +- binary := conf.GetInitPath() |
| 37 | ++// lookupBinPath returns an absolute path to the provided binary by searching relevant "libexec" locations (per FHS 3.0 & 2.3) followed by PATH |
| 38 | ++func lookupBinPath(binary string) (string, error) { |
| 39 | + if filepath.IsAbs(binary) { |
| 40 | + return binary, nil |
| 41 | + } |
| 42 | + |
| 43 | +- for _, dir := range []string{ |
| 44 | ++ lookupPaths := []string{ |
| 45 | + // FHS 3.0: "/usr/libexec includes internal binaries that are not intended to be executed directly by users or shell scripts. Applications may use a single subdirectory under /usr/libexec." |
| 46 | + // https://refspecs.linuxfoundation.org/FHS_3.0/fhs/ch04s07.html |
| 47 | + "/usr/local/libexec/docker", |
| 48 | +@@ -135,7 +135,16 @@ |
| 49 | + // https://refspecs.linuxfoundation.org/FHS_2.3/fhs-2.3.html#USRLIBLIBRARIESFORPROGRAMMINGANDPA |
| 50 | + "/usr/local/lib/docker", |
| 51 | + "/usr/lib/docker", |
| 52 | +- } { |
| 53 | ++ } |
| 54 | ++ |
| 55 | ++ // According to FHS 3.0, it is not necessary to have a subdir here (see note and reference above). |
| 56 | ++ // If the binary has a `docker-` prefix, let's look it up without the dir prefix. |
| 57 | ++ if strings.HasPrefix(binary, "docker-") { |
| 58 | ++ lookupPaths = append(lookupPaths, "/usr/local/libexec") |
| 59 | ++ lookupPaths = append(lookupPaths, "/usr/libexec") |
| 60 | ++ } |
| 61 | ++ |
| 62 | ++ for _, dir := range lookupPaths { |
| 63 | + // exec.LookPath has a fast-path short-circuit for paths that contain "/" (skipping the PATH lookup) that then verifies whether the given path is likely to be an actual executable binary (so we invoke that instead of reimplementing the same checks) |
| 64 | + if file, err := exec.LookPath(filepath.Join(dir, binary)); err == nil { |
| 65 | + return file, nil |
| 66 | +@@ -146,6 +155,11 @@ |
| 67 | + return exec.LookPath(binary) |
| 68 | + } |
| 69 | + |
| 70 | ++// LookupInitPath returns an absolute path to the "docker-init" binary by searching relevant "libexec" directories (per FHS 3.0 & 2.3) followed by PATH |
| 71 | ++func (conf *Config) LookupInitPath() (string, error) { |
| 72 | ++ return lookupBinPath(conf.GetInitPath()) |
| 73 | ++} |
| 74 | ++ |
| 75 | + // GetResolvConf returns the appropriate resolv.conf |
| 76 | + // Check setupResolvConf on how this is selected |
| 77 | + func (conf *Config) GetResolvConf() string { |
| 78 | +@@ -214,7 +228,7 @@ |
| 79 | + |
| 80 | + var err error |
| 81 | + // use rootlesskit-docker-proxy for exposing the ports in RootlessKit netns to the initial namespace. |
| 82 | +- cfg.BridgeConfig.UserlandProxyPath, err = exec.LookPath(rootless.RootlessKitDockerProxyBinary) |
| 83 | ++ cfg.BridgeConfig.UserlandProxyPath, err = lookupBinPath(rootless.RootlessKitDockerProxyBinary) |
| 84 | + if err != nil { |
| 85 | + return errors.Wrapf(err, "running with RootlessKit, but %s not installed", rootless.RootlessKitDockerProxyBinary) |
| 86 | + } |
0 commit comments