diff --git a/daemon/graphdriver/overlay2/check.go b/daemon/graphdriver/overlay2/check.go index af5bc34650..03c33b8aa1 100644 --- a/daemon/graphdriver/overlay2/check.go +++ b/daemon/graphdriver/overlay2/check.go @@ -10,6 +10,7 @@ import ( "path/filepath" "syscall" + "github.com/containerd/containerd/mount" "github.com/containerd/containerd/pkg/userns" "github.com/docker/docker/pkg/system" "github.com/pkg/errors" @@ -107,3 +108,74 @@ func doesSupportNativeDiff(d string) error { return nil } + +// Forked from https://github.com/containers/storage/blob/05c69f1b2a5871d170c07dc8d2eec69c681e143b/drivers/overlay/check.go +// +// usingMetacopy checks if overlayfs's metacopy feature is active. When active, +// overlayfs will only copy up metadata (as opposed to the whole file) when a +// metadata-only operation is performed. Affected inodes will be marked with +// the "(trusted|user).overlay.metacopy" xattr. +// +// The CONFIG_OVERLAY_FS_METACOPY option, the overlay.metacopy parameter, or +// the metacopy mount option can all enable metacopy mode. For more details on +// this feature, see filesystems/overlayfs.txt in the kernel documentation +// tree. +// +// Note that the mount option should never be relevant should never come up the +// daemon has control over all of its own mounts and presently does not request +// metacopy. Nonetheless, a user or kernel distributor may enable metacopy, so +// we should report in the daemon whether or not we detect its use. +func usingMetacopy(d string) (bool, error) { + td, err := os.MkdirTemp(d, "metacopy-check") + if err != nil { + return false, err + } + defer func() { + if err := os.RemoveAll(td); err != nil { + logger.WithError(err).Warnf("failed to remove check directory %v", td) + } + }() + + l1, l2, work, merged := filepath.Join(td, "l1"), filepath.Join(td, "l2"), filepath.Join(td, "work"), filepath.Join(td, "merged") + for _, dir := range []string{l1, l2, work, merged} { + if err := os.Mkdir(dir, 0755); err != nil { + return false, err + } + } + + // Create empty file in l1 with 0700 permissions for metacopy test + if err := os.WriteFile(filepath.Join(l1, "f"), []byte{}, 0700); err != nil { + return false, err + } + + opts := fmt.Sprintf("lowerdir=%s,upperdir=%s,workdir=%s", l1, l2, work) + m := mount.Mount{ + Type: "overlay", + Source: "overlay", + Options: []string{opts}, + } + + if err := m.Mount(merged); err != nil { + return false, errors.Wrap(err, "failed to mount overlay for metacopy check") + } + defer func() { + if err := mount.UnmountAll(merged, 0); err != nil { + logger.WithError(err).Warnf("failed to unmount check directory %v", merged) + } + }() + + // Make a change that only impacts the inode, in the upperdir + if err := os.Chmod(filepath.Join(merged, "f"), 0600); err != nil { + return false, errors.Wrap(err, "error changing permissions on file for metacopy check") + } + + // ...and check if the pulled-up copy is marked as metadata-only + xattr, err := system.Lgetxattr(filepath.Join(l2, "f"), "trusted.overlay.metacopy") + if err != nil { + return false, errors.Wrap(err, "metacopy flag was not set on file in the upperdir") + } + usingMetacopy := xattr != nil + + logger.WithField("usingMetacopy", usingMetacopy).Debug("successfully detected metacopy status") + return usingMetacopy, nil +} diff --git a/daemon/graphdriver/overlay2/overlay.go b/daemon/graphdriver/overlay2/overlay.go index 3a3267467f..ef243163c8 100644 --- a/daemon/graphdriver/overlay2/overlay.go +++ b/daemon/graphdriver/overlay2/overlay.go @@ -99,6 +99,7 @@ type Driver struct { options overlayOptions naiveDiff graphdriver.DiffDriver supportsDType bool + usingMetacopy bool locker *locker.Locker } @@ -159,6 +160,11 @@ func Init(home string, options []string, idMap idtools.IdentityMapping) (graphdr return nil, overlayutils.ErrDTypeNotSupported("overlay2", backingFs) } + usingMetacopy, err := usingMetacopy(testdir) + if err != nil { + return nil, err + } + cur := idtools.CurrentIdentity() dirID := idtools.Identity{ UID: cur.UID, @@ -176,6 +182,7 @@ func Init(home string, options []string, idMap idtools.IdentityMapping) (graphdr idMap: idMap, ctr: graphdriver.NewRefCounter(graphdriver.NewFsChecker(graphdriver.FsMagicOverlay)), supportsDType: supportsDType, + usingMetacopy: usingMetacopy, locker: locker.New(), options: *opts, } @@ -213,8 +220,8 @@ func Init(home string, options []string, idMap idtools.IdentityMapping) (graphdr userxattr = "userxattr," } - logger.Debugf("backingFs=%s, projectQuotaSupported=%v, indexOff=%q, userxattr=%q", - backingFs, projectQuotaSupported, indexOff, userxattr) + logger.Debugf("backingFs=%s, projectQuotaSupported=%v, usingMetacopy=%v, indexOff=%q, userxattr=%q", + backingFs, projectQuotaSupported, usingMetacopy, indexOff, userxattr) return d, nil } @@ -266,6 +273,7 @@ func (d *Driver) Status() [][2]string { return [][2]string{ {"Backing Filesystem", backingFs}, {"Supports d_type", strconv.FormatBool(d.supportsDType)}, + {"Using metacopy", strconv.FormatBool(d.usingMetacopy)}, {"Native Overlay Diff", strconv.FormatBool(!useNaiveDiff(d.home))}, {"userxattr", strconv.FormatBool(userxattr != "")}, }