fix(exec): inherit precreate hook changes in exec sessions - #29367
Open
anujbolewar wants to merge 1 commit into
Open
fix(exec): inherit precreate hook changes in exec sessions#29367anujbolewar wants to merge 1 commit into
anujbolewar wants to merge 1 commit into
Conversation
precreate hooks may change the container's process spec, and that modified spec is what the runtime launches. podman inspect and the exec capability handling already read the on-disk spec from the bundle, but exec itself built its process spec from the container's stored config, which is set before hooks run. As a result env vars (and other process settings) added by a precreate hook were missing from exec sessions. Read the on-disk spec in prepareProcessExec so exec sessions see the same environment as the container's init process. If the on-disk spec does not exist, because the container has never been started, fall back to the stored config as before. Add a bats regression test with a precreate hook that sets an env var, and verify podman exec sees it. Fixes podman-container-tools#29347 Signed-off-by: Anuj Bolewar <anujbolewar@gmail.com>
|
[NON-BLOCKING] Packit jobs failed. @containers/packit-build please check. Everyone else, feel free to ignore. |
1 similar comment
|
[NON-BLOCKING] Packit jobs failed. @containers/packit-build please check. Everyone else, feel free to ignore. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
A precreate hook that changes the container's process spec, for example one that appends an env var to process.env, is reflected in the running container: the container's init process sees it, podman inspect shows it, and exec capability handling already reads the on-disk spec. But podman exec itself still built its process spec from the container's stored config, which predates the hooks. So env vars added by a precreate hook were missing from exec sessions.
Reproducer (from issue #29347): install a precreate hook that runs jq '.process.env += ["FOO=BAR"]', run a container, then
podman exec <ctr> env— FOO=BAR is absent even though the container's init process has it.Fix
prepareProcessExec now reads the on-disk spec from the bundle (same source as podman inspect and setProcessCapabilitiesExec) instead of the stored pre-hook config, so exec sessions inherit process changes made by precreate hooks. When the on-disk spec does not exist (container never started) it falls back to the stored config, preserving previous behavior.
Tests
Added a bats regression test in test/system/075-exec.bats: a precreate hook appends PODMAN_HOOK_VAR to process.env, and the test asserts
podman exec printenv PODMAN_HOOK_VARreturns it.Fixes #29347