Skip to content

Commit 8ce402c

Browse files
estespestesp
authored
Merge pull request containerd#9787 from AkihiroSuda/cri-rro-kep-3857
KEP-3857: Recursive Read-only (RRO) mounts
2 parents b8654e3 + 9077d13 commit 8ce402c

File tree

16 files changed

+1292
-503
lines changed

16 files changed

+1292
-503
lines changed

‎go.mod‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -74,7 +74,7 @@ require (
7474
k8s.io/apimachinery v0.29.1
7575
k8s.io/client-go v0.29.1
7676
k8s.io/component-base v0.29.1
77-
k8s.io/cri-api v0.29.1
77+
k8s.io/cri-api v0.30.0-alpha.2.0.20240216190946-4e003cc3b0a4
7878
k8s.io/klog/v2 v2.110.1
7979
k8s.io/kubelet v0.29.1
8080
k8s.io/utils v0.0.0-20230726121419-3b25d923346b

‎go.sum‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -557,8 +557,8 @@ k8s.io/client-go v0.29.1 h1:19B/+2NGEwnFLzt0uB5kNJnfTsbV8w6TgQRz9l7ti7A=
557557
k8s.io/client-go v0.29.1/go.mod h1:TDG/psL9hdet0TI9mGyHJSgRkW3H9JZk2dNEUS7bRks=
558558
k8s.io/component-base v0.29.1 h1:MUimqJPCRnnHsskTTjKD+IC1EHBbRCVyi37IoFBrkYw=
559559
k8s.io/component-base v0.29.1/go.mod h1:fP9GFjxYrLERq1GcWWZAE3bqbNcDKDytn2srWuHTtKc=
560-
k8s.io/cri-api v0.29.1 h1:pQwYDahnAX9K8KtdV8PD1eeNexMJojEj1t/5kAMX61E=
561-
k8s.io/cri-api v0.29.1/go.mod h1:9fQTFm+wi4FLyqrkVUoMJiUB3mE74XrVvHz8uFY/sSw=
560+
k8s.io/cri-api v0.30.0-alpha.2.0.20240216190946-4e003cc3b0a4 h1:MkxF8QPcofA/nw9k03EQcMkCdP2RcyDZeF1Zda9m/3w=
561+
k8s.io/cri-api v0.30.0-alpha.2.0.20240216190946-4e003cc3b0a4/go.mod h1:9fQTFm+wi4FLyqrkVUoMJiUB3mE74XrVvHz8uFY/sSw=
562562
k8s.io/klog/v2 v2.110.1 h1:U/Af64HJf7FcwMcXyKm2RPM22WZzyR7OSpYj5tg3cL0=
563563
k8s.io/klog/v2 v2.110.1/go.mod h1:YGtd1984u+GgbuZ7e08/yBuAfKLSO0+uR1Fhi6ExXjo=
564564
k8s.io/kube-openapi v0.0.0-20231010175941-2dd684a91f00 h1:aVUu9fTY98ivBPKR9Y5w/AuzbMm96cd3YHRTU83I780=

‎internal/cri/opts/spec_linux_opts.go‎

Lines changed: 19 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,7 @@ import (
3030
runtimespec "github.com/opencontainers/runtime-spec/specs-go"
3131
"github.com/opencontainers/selinux/go-selinux/label"
3232
runtime "k8s.io/cri-api/pkg/apis/runtime/v1"
33+
crierrors "k8s.io/cri-api/pkg/errors"
3334

3435
"github.com/containerd/containerd/v2/core/containers"
3536
"github.com/containerd/containerd/v2/core/mount"
@@ -39,7 +40,7 @@ import (
3940
)
4041

4142
// WithMounts sorts and adds runtime and CRI mounts to the spec
42-
func WithMounts(osi osinterface.OS, config *runtime.ContainerConfig, extra []*runtime.Mount, mountLabel string) oci.SpecOpts {
43+
func WithMounts(osi osinterface.OS, config *runtime.ContainerConfig, extra []*runtime.Mount, mountLabel string, handler *runtime.RuntimeHandler) oci.SpecOpts {
4344
return func(ctx context.Context, client oci.Client, _ *containers.Container, s *runtimespec.Spec) (err error) {
4445
// mergeMounts merge CRI mounts with extra mounts. If a mount destination
4546
// is mounted by both a CRI mount and an extra mount, the CRI mount will
@@ -151,8 +152,24 @@ func WithMounts(osi osinterface.OS, config *runtime.ContainerConfig, extra []*ru
151152
// NOTE(random-liu): we don't change all mounts to `ro` when root filesystem
152153
// is readonly. This is different from docker's behavior, but make more sense.
153154
if mount.GetReadonly() {
154-
options = append(options, "ro")
155+
if mount.GetRecursiveReadOnly() {
156+
if handler == nil || !handler.Features.RecursiveReadOnlyMounts {
157+
return fmt.Errorf("%w: runtime handler does not support recursive read-only mounts (hostPath=%q)",
158+
crierrors.ErrRROUnsupported, mount.HostPath)
159+
}
160+
if mount.Propagation != runtime.MountPropagation_PROPAGATION_PRIVATE {
161+
return fmt.Errorf("recursive read-only mount needs private propagation, got %q (hostPath=%q)",
162+
mount.Propagation.String(), mount.HostPath)
163+
}
164+
options = append(options, "rro")
165+
} else {
166+
options = append(options, "ro")
167+
}
155168
} else {
169+
if mount.GetRecursiveReadOnly() {
170+
return fmt.Errorf("recursive read-only mount conflicts with RW mount (hostPath=%q)",
171+
mount.HostPath)
172+
}
156173
options = append(options, "rw")
157174
}
158175

‎internal/cri/server/container_create.go‎

Lines changed: 17 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -167,6 +167,14 @@ func (c *criService) CreateContainer(ctx context.Context, r *runtime.CreateConta
167167
if err != nil {
168168
return nil, fmt.Errorf("failed to get sandbox runtime: %w", err)
169169
}
170+
var runtimeHandler *runtime.RuntimeHandler
171+
for _, f := range c.runtimeHandlers {
172+
f := f
173+
if f.Name == sandbox.Metadata.RuntimeHandler {
174+
runtimeHandler = f
175+
break
176+
}
177+
}
170178
log.G(ctx).Debugf("Use OCI runtime %+v for sandbox %q and container %q", ociRuntime, sandboxID, id)
171179

172180
spec, err := c.buildContainerSpec(
@@ -182,6 +190,7 @@ func (c *criService) CreateContainer(ctx context.Context, r *runtime.CreateConta
182190
&image.ImageSpec.Config,
183191
volumeMounts,
184192
ociRuntime,
193+
runtimeHandler,
185194
)
186195
if err != nil {
187196
return nil, fmt.Errorf("failed to generate container %q spec: %w", id, err)
@@ -530,6 +539,7 @@ func (c *criService) buildContainerSpec(
530539
imageConfig *imagespec.ImageConfig,
531540
extraMounts []*runtime.Mount,
532541
ociRuntime criconfig.Runtime,
542+
runtimeHandler *runtime.RuntimeHandler,
533543
) (_ *runtimespec.Spec, retErr error) {
534544
var (
535545
specOpts []oci.SpecOpts
@@ -559,6 +569,7 @@ func (c *criService) buildContainerSpec(
559569
imageConfig,
560570
append(linuxMounts, extraMounts...),
561571
ociRuntime,
572+
runtimeHandler,
562573
)
563574
case isWindows:
564575
specOpts, err = c.buildWindowsSpec(
@@ -573,6 +584,7 @@ func (c *criService) buildContainerSpec(
573584
imageConfig,
574585
extraMounts,
575586
ociRuntime,
587+
runtimeHandler,
576588
)
577589
case isDarwin:
578590
specOpts, err = c.buildDarwinSpec(
@@ -585,6 +597,7 @@ func (c *criService) buildContainerSpec(
585597
imageConfig,
586598
extraMounts,
587599
ociRuntime,
600+
runtimeHandler,
588601
)
589602
default:
590603
return nil, fmt.Errorf("unsupported spec platform: %s", platform.OS)
@@ -609,6 +622,7 @@ func (c *criService) buildLinuxSpec(
609622
imageConfig *imagespec.ImageConfig,
610623
extraMounts []*runtime.Mount,
611624
ociRuntime criconfig.Runtime,
625+
runtimeHandler *runtime.RuntimeHandler,
612626
) (_ []oci.SpecOpts, retErr error) {
613627
specOpts := []oci.SpecOpts{
614628
oci.WithoutRunMount,
@@ -683,7 +697,7 @@ func (c *criService) buildLinuxSpec(
683697
}
684698
}()
685699

686-
specOpts = append(specOpts, customopts.WithMounts(c.os, config, extraMounts, mountLabel))
700+
specOpts = append(specOpts, customopts.WithMounts(c.os, config, extraMounts, mountLabel, runtimeHandler))
687701

688702
if !c.config.DisableProcMount {
689703
// Change the default masked/readonly paths to empty slices
@@ -841,6 +855,7 @@ func (c *criService) buildWindowsSpec(
841855
imageConfig *imagespec.ImageConfig,
842856
extraMounts []*runtime.Mount,
843857
ociRuntime criconfig.Runtime,
858+
runtimeHandler *runtime.RuntimeHandler,
844859
) (_ []oci.SpecOpts, retErr error) {
845860
var specOpts []oci.SpecOpts
846861
specOpts = append(specOpts, customopts.WithProcessCommandLineOrArgsForWindows(config, imageConfig))
@@ -935,6 +950,7 @@ func (c *criService) buildDarwinSpec(
935950
imageConfig *imagespec.ImageConfig,
936951
extraMounts []*runtime.Mount,
937952
ociRuntime criconfig.Runtime,
953+
runtimeHandler *runtime.RuntimeHandler,
938954
) (_ []oci.SpecOpts, retErr error) {
939955
specOpts := []oci.SpecOpts{
940956
customopts.WithProcessArgs(config, imageConfig),

‎internal/cri/server/container_create_linux_test.go‎

Lines changed: 19 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -255,7 +255,7 @@ func TestContainerCapabilities(t *testing.T) {
255255
c.allCaps = allCaps
256256

257257
containerConfig.Linux.SecurityContext.Capabilities = test.capability
258-
spec, err := c.buildContainerSpec(currentPlatform, testID, testSandboxID, testPid, "", testContainerName, testImageName, containerConfig, sandboxConfig, imageConfig, nil, ociRuntime)
258+
spec, err := c.buildContainerSpec(currentPlatform, testID, testSandboxID, testPid, "", testContainerName, testImageName, containerConfig, sandboxConfig, imageConfig, nil, ociRuntime, nil)
259259
require.NoError(t, err)
260260

261261
if selinux.GetEnabled() {
@@ -290,7 +290,7 @@ func TestContainerSpecTty(t *testing.T) {
290290
c := newTestCRIService()
291291
for _, tty := range []bool{true, false} {
292292
containerConfig.Tty = tty
293-
spec, err := c.buildContainerSpec(currentPlatform, testID, testSandboxID, testPid, "", testContainerName, testImageName, containerConfig, sandboxConfig, imageConfig, nil, ociRuntime)
293+
spec, err := c.buildContainerSpec(currentPlatform, testID, testSandboxID, testPid, "", testContainerName, testImageName, containerConfig, sandboxConfig, imageConfig, nil, ociRuntime, nil)
294294
require.NoError(t, err)
295295
specCheck(t, testID, testSandboxID, testPid, spec)
296296
assert.Equal(t, tty, spec.Process.Terminal)
@@ -317,7 +317,7 @@ func TestContainerSpecDefaultPath(t *testing.T) {
317317
imageConfig.Env = append(imageConfig.Env, pathenv)
318318
expected = pathenv
319319
}
320-
spec, err := c.buildContainerSpec(currentPlatform, testID, testSandboxID, testPid, "", testContainerName, testImageName, containerConfig, sandboxConfig, imageConfig, nil, ociRuntime)
320+
spec, err := c.buildContainerSpec(currentPlatform, testID, testSandboxID, testPid, "", testContainerName, testImageName, containerConfig, sandboxConfig, imageConfig, nil, ociRuntime, nil)
321321
require.NoError(t, err)
322322
specCheck(t, testID, testSandboxID, testPid, spec)
323323
assert.Contains(t, spec.Process.Env, expected)
@@ -334,7 +334,7 @@ func TestContainerSpecReadonlyRootfs(t *testing.T) {
334334
c := newTestCRIService()
335335
for _, readonly := range []bool{true, false} {
336336
containerConfig.Linux.SecurityContext.ReadonlyRootfs = readonly
337-
spec, err := c.buildContainerSpec(currentPlatform, testID, testSandboxID, testPid, "", testContainerName, testImageName, containerConfig, sandboxConfig, imageConfig, nil, ociRuntime)
337+
spec, err := c.buildContainerSpec(currentPlatform, testID, testSandboxID, testPid, "", testContainerName, testImageName, containerConfig, sandboxConfig, imageConfig, nil, ociRuntime, nil)
338338
require.NoError(t, err)
339339
specCheck(t, testID, testSandboxID, testPid, spec)
340340
assert.Equal(t, readonly, spec.Root.Readonly)
@@ -368,7 +368,7 @@ func TestContainerSpecWithExtraMounts(t *testing.T) {
368368
Readonly: false,
369369
},
370370
}
371-
spec, err := c.buildContainerSpec(currentPlatform, testID, testSandboxID, testPid, "", testContainerName, testImageName, containerConfig, sandboxConfig, imageConfig, extraMounts, ociRuntime)
371+
spec, err := c.buildContainerSpec(currentPlatform, testID, testSandboxID, testPid, "", testContainerName, testImageName, containerConfig, sandboxConfig, imageConfig, extraMounts, ociRuntime, nil)
372372
require.NoError(t, err)
373373
specCheck(t, testID, testSandboxID, testPid, spec)
374374
var mounts, sysMounts []runtimespec.Mount
@@ -435,7 +435,7 @@ func TestContainerAndSandboxPrivileged(t *testing.T) {
435435
sandboxConfig.Linux.SecurityContext = &runtime.LinuxSandboxSecurityContext{
436436
Privileged: test.sandboxPrivileged,
437437
}
438-
_, err := c.buildContainerSpec(currentPlatform, testID, testSandboxID, testPid, "", testContainerName, testImageName, containerConfig, sandboxConfig, imageConfig, nil, ociRuntime)
438+
_, err := c.buildContainerSpec(currentPlatform, testID, testSandboxID, testPid, "", testContainerName, testImageName, containerConfig, sandboxConfig, imageConfig, nil, ociRuntime, nil)
439439
if test.expectError {
440440
assert.Error(t, err)
441441
} else {
@@ -476,7 +476,7 @@ func TestPrivilegedBindMount(t *testing.T) {
476476
containerConfig.Linux.SecurityContext.Privileged = test.privileged
477477
sandboxConfig.Linux.SecurityContext.Privileged = test.privileged
478478

479-
spec, err := c.buildContainerSpec(currentPlatform, t.Name(), testSandboxID, testPid, "", testContainerName, testImageName, containerConfig, sandboxConfig, imageConfig, nil, ociRuntime)
479+
spec, err := c.buildContainerSpec(currentPlatform, t.Name(), testSandboxID, testPid, "", testContainerName, testImageName, containerConfig, sandboxConfig, imageConfig, nil, ociRuntime, nil)
480480

481481
assert.NoError(t, err)
482482
if test.expectedSysFSRO {
@@ -597,7 +597,7 @@ func TestMountPropagation(t *testing.T) {
597597
var spec runtimespec.Spec
598598
spec.Linux = &runtimespec.Linux{}
599599

600-
err := opts.WithMounts(c.os, config, []*runtime.Mount{test.criMount}, "")(context.Background(), nil, nil, &spec)
600+
err := opts.WithMounts(c.os, config, []*runtime.Mount{test.criMount}, "", nil)(context.Background(), nil, nil, &spec)
601601
if test.expectErr {
602602
require.Error(t, err)
603603
} else {
@@ -648,7 +648,7 @@ func TestPidNamespace(t *testing.T) {
648648
test := test
649649
t.Run(test.desc, func(t *testing.T) {
650650
containerConfig.Linux.SecurityContext.NamespaceOptions = &runtime.NamespaceOption{Pid: test.pidNS}
651-
spec, err := c.buildContainerSpec(currentPlatform, testID, testSandboxID, testPid, "", testContainerName, testImageName, containerConfig, sandboxConfig, imageConfig, nil, ociRuntime)
651+
spec, err := c.buildContainerSpec(currentPlatform, testID, testSandboxID, testPid, "", testContainerName, testImageName, containerConfig, sandboxConfig, imageConfig, nil, ociRuntime, nil)
652652
require.NoError(t, err)
653653
assert.Contains(t, spec.Linux.Namespaces, test.expected)
654654
})
@@ -823,7 +823,7 @@ func TestUserNamespace(t *testing.T) {
823823
sandboxUserns = test.sandboxUserNS
824824
}
825825
sandboxConfig.Linux.SecurityContext.NamespaceOptions = &runtime.NamespaceOption{UsernsOptions: sandboxUserns}
826-
spec, err := c.buildContainerSpec(currentPlatform, testID, testSandboxID, testPid, "", testContainerName, testImageName, containerConfig, sandboxConfig, imageConfig, nil, ociRuntime)
826+
spec, err := c.buildContainerSpec(currentPlatform, testID, testSandboxID, testPid, "", testContainerName, testImageName, containerConfig, sandboxConfig, imageConfig, nil, ociRuntime, nil)
827827

828828
if test.err {
829829
require.Error(t, err)
@@ -853,7 +853,7 @@ func TestNoDefaultRunMount(t *testing.T) {
853853
ociRuntime := config.Runtime{}
854854
c := newTestCRIService()
855855

856-
spec, err := c.buildContainerSpec(currentPlatform, testID, testSandboxID, testPid, "", testContainerName, testImageName, containerConfig, sandboxConfig, imageConfig, nil, ociRuntime)
856+
spec, err := c.buildContainerSpec(currentPlatform, testID, testSandboxID, testPid, "", testContainerName, testImageName, containerConfig, sandboxConfig, imageConfig, nil, ociRuntime, nil)
857857
assert.NoError(t, err)
858858
for _, mount := range spec.Mounts {
859859
assert.NotEqual(t, "/run", mount.Destination)
@@ -1282,7 +1282,7 @@ func TestMaskedAndReadonlyPaths(t *testing.T) {
12821282
sandboxConfig.Linux.SecurityContext = &runtime.LinuxSandboxSecurityContext{
12831283
Privileged: test.privileged,
12841284
}
1285-
spec, err := c.buildContainerSpec(currentPlatform, testID, testSandboxID, testPid, "", testContainerName, testImageName, containerConfig, sandboxConfig, imageConfig, nil, ociRuntime)
1285+
spec, err := c.buildContainerSpec(currentPlatform, testID, testSandboxID, testPid, "", testContainerName, testImageName, containerConfig, sandboxConfig, imageConfig, nil, ociRuntime, nil)
12861286
require.NoError(t, err)
12871287
if !test.privileged { // specCheck presumes an unprivileged container
12881288
specCheck(t, testID, testSandboxID, testPid, spec)
@@ -1335,7 +1335,7 @@ func TestHostname(t *testing.T) {
13351335
sandboxConfig.Linux.SecurityContext = &runtime.LinuxSandboxSecurityContext{
13361336
NamespaceOptions: &runtime.NamespaceOption{Network: test.networkNs},
13371337
}
1338-
spec, err := c.buildContainerSpec(currentPlatform, testID, testSandboxID, testPid, "", testContainerName, testImageName, containerConfig, sandboxConfig, imageConfig, nil, ociRuntime)
1338+
spec, err := c.buildContainerSpec(currentPlatform, testID, testSandboxID, testPid, "", testContainerName, testImageName, containerConfig, sandboxConfig, imageConfig, nil, ociRuntime, nil)
13391339
require.NoError(t, err)
13401340
specCheck(t, testID, testSandboxID, testPid, spec)
13411341
assert.Contains(t, spec.Process.Env, test.expectedEnv)
@@ -1348,7 +1348,7 @@ func TestDisableCgroup(t *testing.T) {
13481348
ociRuntime := config.Runtime{}
13491349
c := newTestCRIService()
13501350
c.config.DisableCgroup = true
1351-
spec, err := c.buildContainerSpec(currentPlatform, "test-id", "sandbox-id", 1234, "", "container-name", testImageName, containerConfig, sandboxConfig, imageConfig, nil, ociRuntime)
1351+
spec, err := c.buildContainerSpec(currentPlatform, "test-id", "sandbox-id", 1234, "", "container-name", testImageName, containerConfig, sandboxConfig, imageConfig, nil, ociRuntime, nil)
13521352
require.NoError(t, err)
13531353

13541354
t.Log("resource limit should not be set")
@@ -1503,7 +1503,7 @@ additional-group-for-root:x:22222:root
15031503
containerConfig.Linux.SecurityContext = test.securityContext
15041504
imageConfig.User = test.imageConfigUser
15051505

1506-
spec, err := c.buildContainerSpec(currentPlatform, testID, testSandboxID, testPid, "", testContainerName, testImageName, containerConfig, sandboxConfig, imageConfig, nil, ociRuntime)
1506+
spec, err := c.buildContainerSpec(currentPlatform, testID, testSandboxID, testPid, "", testContainerName, testImageName, containerConfig, sandboxConfig, imageConfig, nil, ociRuntime, nil)
15071507
require.NoError(t, err)
15081508

15091509
spec.Root.Path = tempRootDir // simulating /etc/{passwd, group}
@@ -1579,7 +1579,7 @@ func TestNonRootUserAndDevices(t *testing.T) {
15791579
},
15801580
}
15811581

1582-
spec, err := c.buildContainerSpec(currentPlatform, t.Name(), testSandboxID, testPid, "", testContainerName, testImageName, containerConfig, sandboxConfig, imageConfig, nil, config.Runtime{})
1582+
spec, err := c.buildContainerSpec(currentPlatform, t.Name(), testSandboxID, testPid, "", testContainerName, testImageName, containerConfig, sandboxConfig, imageConfig, nil, config.Runtime{}, nil)
15831583
assert.NoError(t, err)
15841584

15851585
assert.Equal(t, test.expectedDeviceUID, *spec.Linux.Devices[0].UID)
@@ -1653,7 +1653,7 @@ func TestPrivilegedDevices(t *testing.T) {
16531653
PrivilegedWithoutHostDevices: test.privilegedWithoutHostDevices,
16541654
PrivilegedWithoutHostDevicesAllDevicesAllowed: test.privilegedWithoutHostDevicesAllDevicesAllowed,
16551655
}
1656-
spec, err := c.buildContainerSpec(currentPlatform, t.Name(), testSandboxID, testPid, "", testContainerName, testImageName, containerConfig, sandboxConfig, imageConfig, nil, ociRuntime)
1656+
spec, err := c.buildContainerSpec(currentPlatform, t.Name(), testSandboxID, testPid, "", testContainerName, testImageName, containerConfig, sandboxConfig, imageConfig, nil, ociRuntime, nil)
16571657
assert.NoError(t, err)
16581658

16591659
hostDevicesRaw, err := oci.HostDevices()
@@ -1708,7 +1708,7 @@ func TestBaseOCISpec(t *testing.T) {
17081708
testPid := uint32(1234)
17091709
containerConfig, sandboxConfig, imageConfig, specCheck := getCreateContainerTestData()
17101710

1711-
spec, err := c.buildContainerSpec(currentPlatform, testID, testSandboxID, testPid, "", testContainerName, testImageName, containerConfig, sandboxConfig, imageConfig, nil, ociRuntime)
1711+
spec, err := c.buildContainerSpec(currentPlatform, testID, testSandboxID, testPid, "", testContainerName, testImageName, containerConfig, sandboxConfig, imageConfig, nil, ociRuntime, nil)
17121712
assert.NoError(t, err)
17131713

17141714
specCheck(t, testID, testSandboxID, testPid, spec)
@@ -2040,7 +2040,7 @@ containerEdits:
20402040
},
20412041
} {
20422042
t.Run(test.description, func(t *testing.T) {
2043-
spec, err := c.buildContainerSpec(currentPlatform, testID, testSandboxID, testPid, "", testContainerName, testImageName, containerConfig, sandboxConfig, imageConfig, nil, ociRuntime)
2043+
spec, err := c.buildContainerSpec(currentPlatform, testID, testSandboxID, testPid, "", testContainerName, testImageName, containerConfig, sandboxConfig, imageConfig, nil, ociRuntime, nil)
20442044
require.NoError(t, err)
20452045

20462046
specCheck(t, testID, testSandboxID, testPid, spec)

‎internal/cri/server/container_create_test.go‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -70,7 +70,7 @@ func TestGeneralContainerSpec(t *testing.T) {
7070
c := newTestCRIService()
7171
testSandboxID := "sandbox-id"
7272
testContainerName := "container-name"
73-
spec, err := c.buildContainerSpec(currentPlatform, testID, testSandboxID, testPid, "", testContainerName, testImageName, containerConfig, sandboxConfig, imageConfig, nil, ociRuntime)
73+
spec, err := c.buildContainerSpec(currentPlatform, testID, testSandboxID, testPid, "", testContainerName, testImageName, containerConfig, sandboxConfig, imageConfig, nil, ociRuntime, nil)
7474
require.NoError(t, err)
7575
specCheck(t, testID, testSandboxID, testPid, spec)
7676
}
@@ -147,7 +147,7 @@ func TestPodAnnotationPassthroughContainerSpec(t *testing.T) {
147147
PodAnnotations: test.podAnnotations,
148148
}
149149
spec, err := c.buildContainerSpec(currentPlatform, testID, testSandboxID, testPid, "", testContainerName, testImageName,
150-
containerConfig, sandboxConfig, imageConfig, nil, ociRuntime)
150+
containerConfig, sandboxConfig, imageConfig, nil, ociRuntime, nil)
151151
assert.NoError(t, err)
152152
assert.NotNil(t, spec)
153153
specCheck(t, testID, testSandboxID, testPid, spec)
@@ -512,7 +512,7 @@ func TestContainerAnnotationPassthroughContainerSpec(t *testing.T) {
512512
ContainerAnnotations: test.containerAnnotations,
513513
}
514514
spec, err := c.buildContainerSpec(currentPlatform, testID, testSandboxID, testPid, "", testContainerName, testImageName,
515-
containerConfig, sandboxConfig, imageConfig, nil, ociRuntime)
515+
containerConfig, sandboxConfig, imageConfig, nil, ociRuntime, nil)
516516
assert.NoError(t, err)
517517
assert.NotNil(t, spec)
518518
specCheck(t, testID, testSandboxID, testPid, spec)

0 commit comments

Comments
 (0)