From 8f61032ec4dba329a7206c0d17c184d276db575d Mon Sep 17 00:00:00 2001 From: Akihiro Suda Date: Wed, 15 May 2019 20:51:48 +0900 Subject: [PATCH 1/2] bump up rootlesskit to v0.4.1 Now the child process is killed when the parent dies (rootless-containers/rootlesskit#66) https://github.com/rootless-containers/rootlesskit/compare/e92d5e7...27a0c7a Signed-off-by: Akihiro Suda (cherry picked from commit 00c92a671933c0e3f9b67940746d31144902929f) Signed-off-by: Akihiro Suda --- hack/dockerfile/install/rootlesskit.installer | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/hack/dockerfile/install/rootlesskit.installer b/hack/dockerfile/install/rootlesskit.installer index 78726405af..912f1cfeb4 100755 --- a/hack/dockerfile/install/rootlesskit.installer +++ b/hack/dockerfile/install/rootlesskit.installer @@ -1,7 +1,7 @@ #!/bin/sh -# v0.4.0 -ROOTLESSKIT_COMMIT=e92d5e772ee7e103aecf380c5874a40c52876ff0 +# v0.4.1 +ROOTLESSKIT_COMMIT=27a0c7a2483732b33d4192c1d178c83c6b9e202d install_rootlesskit() { case "$1" in From 853816ae79e20eaf7fd7466797f39b5262bcd39f Mon Sep 17 00:00:00 2001 From: Akihiro Suda Date: Wed, 15 May 2019 20:52:59 +0900 Subject: [PATCH 2/2] dockerd-rootless.sh: use exec Killing the shell script process does not kill the forked process. This commit switches to `exec` so that the executed process can be easily killed. Signed-off-by: Akihiro Suda (cherry picked from commit 34cc5c24d052facb802331b8703664e5dc0ea10c) Signed-off-by: Akihiro Suda --- contrib/dockerd-rootless.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/contrib/dockerd-rootless.sh b/contrib/dockerd-rootless.sh index 3206134608..214162f626 100755 --- a/contrib/dockerd-rootless.sh +++ b/contrib/dockerd-rootless.sh @@ -75,7 +75,7 @@ if [ -z $_DOCKERD_ROOTLESS_CHILD ]; then # namespace from being unexpectedly unmounted when `/etc/resolv.conf` is recreated on the host # (by either systemd-networkd or NetworkManager) # * /run: copy-up is required so that we can create /run/docker (hardcoded for plugins) in our namespace - $rootlesskit \ + exec $rootlesskit \ --net=$net --mtu=$mtu \ --disable-host-loopback --port-driver=builtin \ --copy-up=/etc --copy-up=/run \ @@ -86,5 +86,5 @@ else # remove the symlinks for the existing files in the parent namespace if any, # so that we can create our own files in our mount namespace. rm -f /run/docker /run/xtables.lock - dockerd $@ + exec dockerd $@ fi