[MESOS-8257] Unified Containerizer "leaks" a target container mount path to the host FS when the target resolves to an absolute path

• Type: Bug
• Status: Accepted
• Priority: Critical
• Resolution: Unresolved
• Affects Version/s: 1.3.1, 1.4.1, 1.5.0
• Component/s: containerization
• Labels: bug containerization containerizer mountpath
• Assignee: Jason Lai
• Reporter: Jason Lai
• Shepherd: Jie Yu
• Created: 23/Nov/17 07:39
• Updated: 05/Apr/19 13:22

Description

If a target path under the root FS provisioned from an image resolves to an absolute path, it will not appear in the container root FS after pivot_root(2) is called.

A typical example is that when the target path is under /var/run (e.g. /var/run/some-dir), which is usually a symlink to an absolute path of /run in Debian images, the target path will get resolved as and created at /run/some-dir in the host root FS, after the container root FS gets provisioned. The target path will get unmounted after pivot_root(2) as it is part of the old root (host FS).

A workaround is to use /run instead of /var/run, but absolute symlinks need to be resolved within the scope of the container root FS path.

Issue Links

• blocks: MESOS-6798 Volumes in `/dev/shm` overridden by mesos containerizer