tmpfs and symlink resolution

[zhangyoufu]

# docker run --rm -i --tmpfs /conf/stack quay.io/projectquay/quay:vader
docker: Error response from daemon: OCI runtime create failed: container_linux.go:349: starting container process caused "process_linux.go:449: container init caused \"rootfs_linux.go:58: mounting \\\"tmpfs\\\" to rootfs \\\"/var/lib/docker/overlay2/698f55615c6cb50d3cd3eaa1b6ab38ab8ffdc32366fa410d8fbc596039ad8890/merged\\\" at \\\"/conf/stack\\\" caused \\\"mkdir /var/lib/docker/overlay2/698f55615c6cb50d3cd3eaa1b6ab38ab8ffdc32366fa410d8fbc596039ad8890/merged/conf: file exists\\\"\"": unknown.

/conf is a symlink pointing to /quay-registry/conf, which confuses --tmpfs.
Of course I can pass resolved path /quay-registry/conf/stack to --tmpfs as a workaround. However, this produces an unnamed volume for the original path /conf/stack, which is unwanted.

[kolyshkin]

Reproduced with bare runc.

1. Add the following into config.json (same as what docker run --tmpfs /conf/stack adds):

    {
      "destination": "/conf/stack",
      "type": "tmpfs",
      "source": "tmpfs",
      "options": [
        "noexec",
        "nosuid",
        "nodev",
        "rprivate"
      ]
    }

$ cd rootfs
$ mkdir -p /real/conf
$ ln -s /real/conf conf
$ ls -l conf 
lrwxrwxrwx. 1 kir kir 10 Dec  9 18:31 conf -> /real/conf
$ cd ..
$ runc run  -d xxx
WARN[0000] unable to terminate initProcess               error="exit status 1"
ERRO[0000] container_linux.go:367: starting container process caused: process_linux.go:495: container init caused: rootfs_linux.go:60: mounting "tmpfs" to rootfs at "/conf/stack" caused: mkdir /home/kir/go/src/github.com/opencontainers/runc/tst/rootfs/conf: file exists 

This is caused by the fact that the symlink is broken in the host context, so MkdirAll is called:

runc/libcontainer/rootfs_linux.go

Lines 305 to 313 in 544048b

	func mountToRootfs(m *configs.Mount, rootfs, mountLabel string, enableCgroupns bool) error {
	var (
	dest = m.Destination
	)
	if !strings.HasPrefix(dest, rootfs) {
	dest = filepath.Join(rootfs, dest)
	}
	switch m.Device {

...

runc/libcontainer/rootfs_linux.go

Lines 340 to 346 in 544048b

	case "tmpfs":
	copyUp := m.Extensions&configs.EXT_COPYUP == configs.EXT_COPYUP
	tmpDir := ""
	stat, err := os.Stat(dest)
	if err != nil {
	if err := os.MkdirAll(dest, 0755); err != nil {
	return err

To fix, we need to have Stat() and MkdirAll in container root scope. I'll take a look.

@zhangyoufu a workaround would be to use a relative symlink in your image, i.e.

-/conf -> /quay-registry/conf
+/conf -> quay-registry/conf

[kolyshkin]

Now, this can be fixed, but I am not sure if it is possible to do so without introducing any new and interesting attack vectors similar to say #2197.

Looking.