Support running plugins in isolated containers #22712
Conversation
github-actions
bot
added
the
hashicorp-contributed-pr
|
Build Results: |
|
CI Results: |
| "managed-by": "hashicorp.com/vault", | ||
| }, | ||
| // TODO: More configurables. | ||
| // Defaulting to runsc will require installing gVisor in the GitHub runner. |
There was a problem hiding this comment.
We will probably want to check that the runsc binary is available and executable before defaulting to it, too?
There was a problem hiding this comment.
I forgot to note my plans here in the description, but that's a good shout. What I'll probably do is error if runsc isn't available in $PATH, and if people want to use runc for example, they'll need to create their own Vault "plugin runtime" in the Vault API and reference it when registering the plugin.
That lets us use a safe default that behaves predictably, and hopefully still with a helpful enough UX, because I wouldn't want Vault to suddenly start using a different container runtime if runsc gets uninstalled out of band.
Also adds a test for checking the JSON body generated by the command, and corrects the help text for -args which suggested a form that doesn't work. Finally, updates the plugin testing Dockerfile image to use ubuntu as a base so it's more forgiving for any additional testing run on top of it
This reverts commit 0a69907.
Historically it's been omitted, and it could conceivably have secret information in it, so if we want to return it in the response, it should probably only be via explicit opt-in. Skipping for now though as it's not the main purpose of the PR
This implements running plugins in containers to give them some degree of isolation from the main Vault process and other plugins. It only supports running on Linux initially, where it is easiest to manage unix socket communication across the container boundary.
The plugin lifecycle and multiplexing etc remains managed by go-plugin and therefore unchanged. See hashicorp/go-plugin#270 for the main related go-plugin PR, and hashicorp/go-secure-stdlib#84 for the bulk of the go-secure-stdlib piece.
The bulk of the implementation for running plugins in a container is in the new
github.com/hashicorp/go-secure-stdlib/plugincontainermodule, which depends on go-plugin's v1.5.0 updates to make the command execution pluggable.The main items done for this PR are:
oci_imageoption when registering a pluginplugincontainerlibrary appropriately when we run an image from the catalog withoci_imagespecifiedFollow ups will include:
runscruntime the default (will require installing it on the CI runners)