[docker_image_ctl.j2] Share UTS namespace with host OS (#4169) #4219
Conversation
Instead of updating hostname manualy on Config DB hostname change, simply share containers UTS namespace with host OS. Ideally, instead of setting `--uts=host` for every container in SONiC, this setting can be set per container if feature requires. One behaviour change is introduced in this commit, when `--privileged` or `--cap-add=CAP_SYS_ADMIN` and `--uts=host` are combined, container has privilege to change host OS and every other container hostname. Such privilege should be fixed by limiting containers capabilities. Signed-off-by: Stepan Blyschak <stepanb@mellanox.com>
| @@ -144,6 +144,7 @@ start() { | |||
| # TODO: Mellanox will remove the --tmpfs exception after SDK socket path changed in new SDK version | |||
| {%- endif %} | |||
| docker create {{docker_image_run_opt}} \ | |||
| --uts=host \{# W/A: this should be set per-docker, for those dockers which really need host's UTS namespace #} | |||
There was a problem hiding this comment.
Can you think of an instance where we would not want to share the host's UTS namespace?
There was a problem hiding this comment.
I cannot 😄
This is a modified cherry-pick following master branch.
In reply to: 387377484 [](ancestors = 387377484)
There was a problem hiding this comment.
😄 Then maybe add a "maybe" to the beginning of the comment?
There was a problem hiding this comment.
@jleveque @qiluo-msft I think swss, syncd, pmon don't need to care about the hostname, if they do IMO it looks like a design mistake. The idea behind docker containers is isolation, why do we need docker containers at all if we want to share and map inside container almost everything?
Besides, --priviledge + --uts=host will give container priviledges to change host OS hostname.
The only containers I know which need host's hostname inside container are snmp and dhcp_relay but it doesn't look like they need --priviledge option or do they?
I would like to keep this comment and revise containers isolation in sonic in general in the future.
|
why do we need this in 201811? |
|
Closed since we already fixed it in #4241 and this PR is not needed. |
Instead of updating hostname manualy on Config DB hostname change,
simply share containers UTS namespace with host OS.
Ideally, instead of setting
--uts=hostfor every container in SONiC,this setting can be set per container if feature requires.
One behaviour change is introduced in this commit, when
--privilegedor
--cap-add=CAP_SYS_ADMINand--uts=hostare combined, containerhas privilege to change host OS and every other container hostname.
Such privilege should be fixed by limiting containers capabilities.
Signed-off-by: Stepan Blyschak stepanb@mellanox.com
- What I did
- How I did it
- How to verify it
- Description for the changelog
- A picture of a cute animal (not mandatory but encouraged)