kemko/nomad
1
0
Fork 0
mirror of https://github.com/kemko/nomad.git synced 2026-01-06 10:25:42 +03:00
Code Issues Packages Projects Releases Wiki Activity

exec2: add client support for unveil filesystem isolation mode (#20115)

Browse Source 
* exec2: add client support for unveil filesystem isolation mode

This PR adds support for a new filesystem isolation mode, "Unveil". The
mode introduces a "alloc_mounts" directory where tasks have user-owned
directory structure which are bind mounts into the real alloc directory
structure. This enables a task driver to use landlock (and maybe the
real unveil on openbsd one day) to isolate a task to the task owned
directory structure, providing sandboxing.

* actually create alloc-mounts-dir directory

* fix doc strings about alloc mount dir paths
This commit is contained in:
Seth Hoenig
2024-03-13 08:24:17 -05:00
committed by GitHub
parent 428103ba12
commit 05937ab75b
47 changed files with 733 additions and 563 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
drivers/java/driver.go
View File

@@ -22,6 +22,7 @@ import (
"github.com/hashicorp/nomad/helper/pluginutils/loader"
"github.com/hashicorp/nomad/plugins/base"
"github.com/hashicorp/nomad/plugins/drivers"
"github.com/hashicorp/nomad/plugins/drivers/fsisolation"
"github.com/hashicorp/nomad/plugins/drivers/utils"
"github.com/hashicorp/nomad/plugins/shared/hclspec"
pstructs "github.com/hashicorp/nomad/plugins/shared/structs"
@@ -104,7 +105,7 @@ var (
driverCapabilities = &drivers.Capabilities{
SendSignals: false,
Exec: false,
FSIsolation: drivers.FSIsolationNone,
FSIsolation: fsisolation.None,
NetIsolationModes: []drivers.NetIsolationMode{
drivers.NetIsolationModeHost,
drivers.NetIsolationModeGroup,
@@ -117,7 +118,7 @@ var (
func init() {
if runtime.GOOS == "linux" {
driverCapabilities.FSIsolation = drivers.FSIsolationChroot
driverCapabilities.FSIsolation = fsisolation.Chroot
driverCapabilities.MountConfigs = drivers.MountConfigSupportAll
}
}
@@ -455,7 +456,7 @@ func (d *Driver) StartTask(cfg *drivers.TaskConfig) (*drivers.TaskHandle, *drive
executorConfig := &executor.ExecutorConfig{
LogFile: pluginLogFile,
LogLevel: "debug",
FSIsolation: driverCapabilities.FSIsolation == drivers.FSIsolationChroot,
FSIsolation: driverCapabilities.FSIsolation == fsisolation.Chroot,
Compute: d.nomadConfig.Topology.Compute(),
}