daemon: archive in a dedicated mount namespace

Mounting a container's volumes under its rootfs directory inside the
host mount namespace causes problems with cross-namespace mount
propagation when /var/lib/docker is bind-mounted into the container as a
volume. The mount event propagates into the container's mount namespace,
overmounting the volume, but the propagated unmount events do not fully
reverse the effect. Each archive operation causes the mount table in the
container's mount namespace to grow larger and larger, until the kernel
limiton the number of mounts in a namespace is hit. The only solution to
this issue which is not subject to race conditions or other blocker
caveats is to avoid mounting volumes into the container's rootfs
directory in the host mount namespace in the first place.

Mount the container volumes inside an unshared mount namespace to
prevent any mount events from propagating into any other mount
namespace. Greatly simplify the archiving implementations by also
chrooting into the container rootfs to sidestep the need to resolve
paths in the host.

Signed-off-by: Cory Snider <csnider@mirantis.com>

daemon/archive_unix.go

@@ -4,6 +4,7 @@
 package daemon // import "github.com/docker/docker/daemon"
 
 import (
+	"context"
 	"io"
 	"os"
 	"path/filepath"
@@ -12,7 +13,6 @@ import (
 	"github.com/docker/docker/container"
 	"github.com/docker/docker/errdefs"
 	"github.com/docker/docker/pkg/archive"
-	"github.com/docker/docker/pkg/chrootarchive"
 	"github.com/docker/docker/pkg/ioutils"
 	volumemounts "github.com/docker/docker/volume/mounts"
 	"github.com/pkg/errors"
@@ -24,23 +24,13 @@ func (daemon *Daemon) containerStatPath(container *container.Container, path str
 	container.Lock()
 	defer container.Unlock()
 
-	if err = daemon.Mount(container); err != nil {
-		return nil, err
-	}
-	defer daemon.Unmount(container)
-
-	err = daemon.mountVolumes(container)
-	defer container.DetachAndUnmount(daemon.LogVolumeEvent)
+	cfs, err := daemon.openContainerFS(container)
 	if err != nil {
 		return nil, err
 	}
+	defer cfs.Close()
 
-	resolvedPath, absPath, err := container.ResolvePath(path)
-	if err != nil {
-		return nil, err
-	}
-
-	return container.StatPath(resolvedPath, absPath)
+	return cfs.Stat(context.TODO(), path)
 }
 
 // containerArchivePath creates an archive of the filesystem resource at the specified
@@ -58,66 +48,40 @@ func (daemon *Daemon) containerArchivePath(container *container.Container, path
 		}
 	}()
 
-	if err = daemon.Mount(container); err != nil {
+	cfs, err := daemon.openContainerFS(container)
+	if err != nil {
 		return nil, nil, err
 	}
 
 	defer func() {
 		if err != nil {
-			// unmount any volumes
-			container.DetachAndUnmount(daemon.LogVolumeEvent)
-			// unmount the container's rootfs
-			daemon.Unmount(container)
+			cfs.Close()
 		}
 	}()
 
-	if err = daemon.mountVolumes(container); err != nil {
-		return nil, nil, err
-	}
+	absPath := archive.PreserveTrailingDotOrSeparator(filepath.Join("/", path), path)
 
-	resolvedPath, absPath, err := container.ResolvePath(path)
+	stat, err = cfs.Stat(context.TODO(), absPath)
 	if err != nil {
 		return nil, nil, err
 	}
 
-	stat, err = container.StatPath(resolvedPath, absPath)
-	if err != nil {
-		return nil, nil, err
-	}
-
-	// We need to rebase the archive entries if the last element of the
-	// resolved path was a symlink that was evaluated and is now different
-	// than the requested path. For example, if the given path was "/foo/bar/",
-	// but it resolved to "/var/lib/docker/containers/{id}/foo/baz/", we want
-	// to ensure that the archive entries start with "bar" and not "baz". This
-	// also catches the case when the root directory of the container is
-	// requested: we want the archive entries to start with "/" and not the
-	// container ID.
-
-	// Get the source and the base paths of the container resolved path in order
-	// to get the proper tar options for the rebase tar.
-	resolvedPath = filepath.Clean(resolvedPath)
-	if filepath.Base(resolvedPath) == "." {
-		resolvedPath += string(filepath.Separator) + "."
-	}
-
-	sourceDir := resolvedPath
-	sourceBase := "."
-
+	sourceDir, sourceBase := absPath, "."
 	if stat.Mode&os.ModeDir == 0 { // not dir
-		sourceDir, sourceBase = filepath.Split(resolvedPath)
+		sourceDir, sourceBase = filepath.Split(absPath)
 	}
 	opts := archive.TarResourceRebaseOpts(sourceBase, filepath.Base(absPath))
 
-	data, err := chrootarchive.Tar(sourceDir, opts, container.BaseFS)
+	tb, err := archive.NewTarballer(sourceDir, opts)
 	if err != nil {
 		return nil, nil, err
 	}
 
+	cfs.GoInFS(context.TODO(), tb.Do)
+	data := tb.Reader()
 	content = ioutils.NewReadCloserWrapper(data, func() error {
 		err := data.Close()
-		container.DetachAndUnmount(daemon.LogVolumeEvent)
-		daemon.Unmount(container)
+		_ = cfs.Close()
 		container.Unlock()
 		return err
 	})
@@ -137,77 +101,58 @@ func (daemon *Daemon) containerExtractToDir(container *container.Container, path
 	container.Lock()
 	defer container.Unlock()
 
-	if err = daemon.Mount(container); err != nil {
-		return err
-	}
-	defer daemon.Unmount(container)
-
-	err = daemon.mountVolumes(container)
-	defer container.DetachAndUnmount(daemon.LogVolumeEvent)
+	cfs, err := daemon.openContainerFS(container)
 	if err != nil {
 		return err
 	}
+	defer cfs.Close()
 
-	// The destination path needs to be resolved to a host path, with all
-	// symbolic links followed in the scope of the container's rootfs. Note
-	// that we do not use `container.ResolvePath(path)` here because we need
-	// to also evaluate the last path element if it is a symlink. This is so
-	// that you can extract an archive to a symlink that points to a directory.
-
-	// Consider the given path as an absolute path in the container.
-	absPath := archive.PreserveTrailingDotOrSeparator(filepath.Join(string(filepath.Separator), path), path)
-
-	// This will evaluate the last path element if it is a symlink.
-	resolvedPath, err := container.GetResourcePath(absPath)
-	if err != nil {
-		return err
-	}
-
-	stat, err := os.Lstat(resolvedPath)
-	if err != nil {
-		return err
-	}
-
-	if !stat.IsDir() {
-		return errdefs.InvalidParameter(errors.New("extraction point is not a directory"))
-	}
-
-	// Need to check if the path is in a volume. If it is, it cannot be in a
-	// read-only volume. If it is not in a volume, the container cannot be
-	// configured with a read-only rootfs.
-
-	// Use the resolved path relative to the container rootfs as the new
-	// absPath. This way we fully follow any symlinks in a volume that may
-	// lead back outside the volume.
-	baseRel, err := filepath.Rel(container.BaseFS, resolvedPath)
-	if err != nil {
-		return err
-	}
-	// Make it an absolute path.
-	absPath = filepath.Join(string(filepath.Separator), baseRel)
-
-	toVolume, err := checkIfPathIsInAVolume(container, absPath)
-	if err != nil {
-		return err
-	}
-
-	if !toVolume && container.HostConfig.ReadonlyRootfs {
-		return errdefs.InvalidParameter(errors.New("container rootfs is marked read-only"))
-	}
-
-	options := daemon.defaultTarCopyOptions(noOverwriteDirNonDir)
-
-	if copyUIDGID {
-		var err error
-		// tarCopyOptions will appropriately pull in the right uid/gid for the
-		// user/group and will set the options.
-		options, err = daemon.tarCopyOptions(container, noOverwriteDirNonDir)
+	err = cfs.RunInFS(context.TODO(), func() error {
+		// The destination path needs to be resolved with all symbolic links
+		// followed. Note that we need to also evaluate the last path element if
+		// it is a symlink. This is so that you can extract an archive to a
+		// symlink that points to a directory.
+		absPath, err := filepath.EvalSymlinks(filepath.Join("/", path))
 		if err != nil {
 			return err
 		}
-	}
+		absPath = archive.PreserveTrailingDotOrSeparator(absPath, path)
 
-	if err := chrootarchive.UntarWithRoot(content, resolvedPath, options, container.BaseFS); err != nil {
+		stat, err := os.Lstat(absPath)
+		if err != nil {
+			return err
+		}
+		if !stat.IsDir() {
+			return errdefs.InvalidParameter(errors.New("extraction point is not a directory"))
+		}
+
+		// Need to check if the path is in a volume. If it is, it cannot be in a
+		// read-only volume. If it is not in a volume, the container cannot be
+		// configured with a read-only rootfs.
+		toVolume, err := checkIfPathIsInAVolume(container, absPath)
+		if err != nil {
+			return err
+		}
+
+		if !toVolume && container.HostConfig.ReadonlyRootfs {
+			return errdefs.InvalidParameter(errors.New("container rootfs is marked read-only"))
+		}
+
+		options := daemon.defaultTarCopyOptions(noOverwriteDirNonDir)
+
+		if copyUIDGID {
+			var err error
+			// tarCopyOptions will appropriately pull in the right uid/gid for the
+			// user/group and will set the options.
+			options, err = daemon.tarCopyOptions(container, noOverwriteDirNonDir)
+			if err != nil {
+				return err
+			}
+		}
+
+		return archive.Untar(content, absPath, options)
+	})
+	if err != nil {
 		return err
 	}
 
@@ -217,9 +162,6 @@ func (daemon *Daemon) containerExtractToDir(container *container.Container, path
 }
 
 func (daemon *Daemon) containerCopy(container *container.Container, resource string) (rc io.ReadCloser, err error) {
-	if resource[0] == '/' || resource[0] == '\\' {
-		resource = resource[1:]
-	}
 	container.Lock()
 
 	defer func() {
@@ -231,49 +173,36 @@ func (daemon *Daemon) containerCopy(container *container.Container, resource str
 		}
 	}()
 
-	if err := daemon.Mount(container); err != nil {
+	cfs, err := daemon.openContainerFS(container)
+	if err != nil {
 		return nil, err
 	}
-
 	defer func() {
 		if err != nil {
-			// unmount any volumes
-			container.DetachAndUnmount(daemon.LogVolumeEvent)
-			// unmount the container's rootfs
-			daemon.Unmount(container)
+			cfs.Close()
 		}
 	}()
 
-	if err := daemon.mountVolumes(container); err != nil {
-		return nil, err
-	}
-
-	basePath, err := container.GetResourcePath(resource)
-	if err != nil {
-		return nil, err
-	}
-	stat, err := os.Stat(basePath)
-	if err != nil {
-		return nil, err
-	}
-	var filter []string
-	if !stat.IsDir() {
-		d, f := filepath.Split(basePath)
-		basePath = d
-		filter = []string{f}
-	}
-	archv, err := chrootarchive.Tar(basePath, &archive.TarOptions{
-		Compression:  archive.Uncompressed,
-		IncludeFiles: filter,
-	}, container.BaseFS)
+	err = cfs.RunInFS(context.TODO(), func() error {
+		_, err := os.Stat(resource)
+		return err
+	})
 	if err != nil {
 		return nil, err
 	}
 
+	tb, err := archive.NewTarballer(resource, &archive.TarOptions{
+		Compression: archive.Uncompressed,
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	cfs.GoInFS(context.TODO(), tb.Do)
+	archv := tb.Reader()
 	reader := ioutils.NewReadCloserWrapper(archv, func() error {
 		err := archv.Close()
-		container.DetachAndUnmount(daemon.LogVolumeEvent)
-		daemon.Unmount(container)
+		_ = cfs.Close()
 		container.Unlock()
 		return err
 	})