fix(sandbox): use wrapper-safe docker container create/run argv - #507
Merged
Conversation
LXC AppArmor docker wrappers rewrite top-level create/run and treat the first non-dash token as the image, so `docker create --name value IMAGE` failed with "invalid reference format" during sandbox init. Seed and session now use `docker container create|run` with --flag=value so vanilla Docker, Podman, and those wrappers all succeed.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
astonish sandbox initfailed on hosts whose/usr/bin/dockeris an LXC AppArmor wrapper. The wrapper rewrites top-levelcreate/runand treats the first non-dash token as the image, sodocker create --name astonish-seed-base IMAGEbecameinvalid reference format(exit 125).Seed (
SeedBaseLayerFromImage) and session start (dockerRunArgs) now use management-command form plus--flag=value:docker container create --name=… --entrypoint=/bin/true IMAGEdocker container run --detach --name=… --volume=… IMAGEVanilla Docker, Podman, and this wrapper all accept that form. Unit tests cover overlay argv, seed argv, and a model of the LXC rewrite so split
--name valuestays rejected.Verified on this host:
./astonish sandbox initcompleted and@base/rootfsis a real rootfs (bin/shpresent).Test plan
go test ./pkg/sandbox/docker(wrapper-safe argv tests)./astonish sandbox initon a host with the LXC/usr/bin/dockerwrapperastonish sandbox initon a host with vanilla Docker (no wrapper)docker container runpath)