{"action":"created","comment":{"url":"https://api.github.com/repos/coreos/rkt/pulls/comments/62994290","id":62994290,"diff_hunk":"@@ -474,5 +476,24 @@ func main() {\n \t\tfmt.Printf(\"Annotation %s=%s\\n\", globalFlags.PrintAppAnnotation, body)\n \t}\n \n+\tif globalFlags.CheckMountNS {\n+\t\tappMountNS, err := os.Readlink(\"/proc/self/ns/mnt\")\n+\t\tif err != nil {\n+\t\t\tfmt.Fprintf(os.Stderr, \"%v\\n\", err)\n+\t\t\tos.Exit(1)\n+\t\t}\n+\t\ts1MountNS, err := os.Readlink(\"/proc/1/ns/mnt\")\n+\t\tif err != nil {\n+\t\t\tfmt.Fprintf(os.Stderr, \"%v\\n\", err)\n+\t\t\tos.Exit(1)\n+\t\t}\n+\t\tif appMountNS != s1MountNS {\n+\t\t\tfmt.Println(\"check-mountns: SUCCESS\")\n+\t\t} else {\n+\t\t\tfmt.Println(\"check-mountns: FAIL\")\n+\t\t\tos.Exit(1)","path":"tests/inspect/inspect.go","position":35,"original_position":35,"commit_id":"b604d0dae89bba9b0ce48fd22cbf5226134205a8","original_commit_id":"b604d0dae89bba9b0ce48fd22cbf5226134205a8","user":{"login":"iaguis","id":507354,"avatar_url":"https://avatars.githubusercontent.com/u/507354?v=3","gravatar_id":"","url":"https://api.github.com/users/iaguis","html_url":"https://github.com/iaguis","followers_url":"https://api.github.com/users/iaguis/followers","following_url":"https://api.github.com/users/iaguis/following{/other_user}","gists_url":"https://api.github.com/users/iaguis/gists{/gist_id}","starred_url":"https://api.github.com/users/iaguis/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/iaguis/subscriptions","organizations_url":"https://api.github.com/users/iaguis/orgs","repos_url":"https://api.github.com/users/iaguis/repos","events_url":"https://api.github.com/users/iaguis/events{/privacy}","received_events_url":"https://api.github.com/users/iaguis/received_events","type":"User","site_admin":false},"body":"sounds good","created_at":"2016-05-12T09:58:59Z","updated_at":"2016-05-12T09:58:59Z","html_url":"https://github.com/coreos/rkt/pull/2603#discussion_r62994290","pull_request_url":"https://api.github.com/repos/coreos/rkt/pulls/2603","_links":{"self":{"href":"https://api.github.com/repos/coreos/rkt/pulls/comments/62994290"},"html":{"href":"https://github.com/coreos/rkt/pull/2603#discussion_r62994290"},"pull_request":{"href":"https://api.github.com/repos/coreos/rkt/pulls/2603"}}},"pull_request":{"url":"https://api.github.com/repos/coreos/rkt/pulls/2603","id":69478442,"html_url":"https://github.com/coreos/rkt/pull/2603","diff_url":"https://github.com/coreos/rkt/pull/2603.diff","patch_url":"https://github.com/coreos/rkt/pull/2603.patch","issue_url":"https://api.github.com/repos/coreos/rkt/issues/2603","number":2603,"state":"open","locked":false,"title":"stage1/init: create a new mount ns for each app","user":{"login":"iaguis","id":507354,"avatar_url":"https://avatars.githubusercontent.com/u/507354?v=3","gravatar_id":"","url":"https://api.github.com/users/iaguis","html_url":"https://github.com/iaguis","followers_url":"https://api.github.com/users/iaguis/followers","following_url":"https://api.github.com/users/iaguis/following{/other_user}","gists_url":"https://api.github.com/users/iaguis/gists{/gist_id}","starred_url":"https://api.github.com/users/iaguis/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/iaguis/subscriptions","organizations_url":"https://api.github.com/users/iaguis/orgs","repos_url":"https://api.github.com/users/iaguis/repos","events_url":"https://api.github.com/users/iaguis/events{/privacy}","received_events_url":"https://api.github.com/users/iaguis/received_events","type":"User","site_admin":false},"body":"Up to this point, you could escape the app's chroot easily by using a\r\nsimple program downloaded from the internet [[1]][1]. To avoid this, we now\r\ncreate a new mount namespace per each app.\r\n\r\nYou can still escape the chroot if you have CAP_SYS_PTRACE and access\r\n`/proc/1/root` but this fixes the issue for images that don't need this\r\ncapability.\r\n\r\n[1]: http://www.unixwiz.net/techtips/chroot-practices.html","created_at":"2016-05-10T09:56:58Z","updated_at":"2016-05-12T09:58:59Z","closed_at":null,"merged_at":null,"merge_commit_sha":"dc07f625c2727138c15a2bcc6529586a85263f02","assignee":{"login":"iaguis","id":507354,"avatar_url":"https://avatars.githubusercontent.com/u/507354?v=3","gravatar_id":"","url":"https://api.github.com/users/iaguis","html_url":"https://github.com/iaguis","followers_url":"https://api.github.com/users/iaguis/followers","following_url":"https://api.github.com/users/iaguis/following{/other_user}","gists_url":"https://api.github.com/users/iaguis/gists{/gist_id}","starred_url":"https://api.github.com/users/iaguis/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/iaguis/subscriptions","organizations_url":"https://api.github.com/users/iaguis/orgs","repos_url":"https://api.github.com/users/iaguis/repos","events_url":"https://api.github.com/users/iaguis/events{/privacy}","received_events_url":"https://api.github.com/users/iaguis/received_events","type":"User","site_admin":false},"milestone":{"url":"https://api.github.com/repos/coreos/rkt/milestones/37","html_url":"https://github.com/coreos/rkt/milestones/v1.6.0","labels_url":"https://api.github.com/repos/coreos/rkt/milestones/37/labels","id":1705895,"number":37,"title":"v1.6.0","description":"","creator":{"login":"iaguis","id":507354,"avatar_url":"https://avatars.githubusercontent.com/u/507354?v=3","gravatar_id":"","url":"https://api.github.com/users/iaguis","html_url":"https://github.com/iaguis","followers_url":"https://api.github.com/users/iaguis/followers","following_url":"https://api.github.com/users/iaguis/following{/other_user}","gists_url":"https://api.github.com/users/iaguis/gists{/gist_id}","starred_url":"https://api.github.com/users/iaguis/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/iaguis/subscriptions","organizations_url":"https://api.github.com/users/iaguis/orgs","repos_url":"https://api.github.com/users/iaguis/repos","events_url":"https://api.github.com/users/iaguis/events{/privacy}","received_events_url":"https://api.github.com/users/iaguis/received_events","type":"User","site_admin":false},"open_issues":68,"closed_issues":31,"state":"open","created_at":"2016-04-14T12:45:50Z","updated_at":"2016-05-12T09:16:36Z","due_on":"2016-05-11T22:00:00Z","closed_at":null},"commits_url":"https://api.github.com/repos/coreos/rkt/pulls/2603/commits","review_comments_url":"https://api.github.com/repos/coreos/rkt/pulls/2603/comments","review_comment_url":"https://api.github.com/repos/coreos/rkt/pulls/comments{/number}","comments_url":"https://api.github.com/repos/coreos/rkt/issues/2603/comments","statuses_url":"https://api.github.com/repos/coreos/rkt/statuses/b604d0dae89bba9b0ce48fd22cbf5226134205a8","head":{"label":"kinvolk:iaguis/mount-ns","ref":"iaguis/mount-ns","sha":"b604d0dae89bba9b0ce48fd22cbf5226134205a8","user":{"login":"kinvolk","id":14073052,"avatar_url":"https://avatars.githubusercontent.com/u/14073052?v=3","gravatar_id":"","url":"https://api.github.com/users/kinvolk","html_url":"https://github.com/kinvolk","followers_url":"https://api.github.com/users/kinvolk/followers","following_url":"https://api.github.com/users/kinvolk/following{/other_user}","gists_url":"https://api.github.com/users/kinvolk/gists{/gist_id}","starred_url":"https://api.github.com/users/kinvolk/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kinvolk/subscriptions","organizations_url":"https://api.github.com/users/kinvolk/orgs","repos_url":"https://api.github.com/users/kinvolk/repos","events_url":"https://api.github.com/users/kinvolk/events{/privacy}","received_events_url":"https://api.github.com/users/kinvolk/received_events","type":"Organization","site_admin":false},"repo":{"id":45149715,"name":"rkt","full_name":"kinvolk/rkt","owner":{"login":"kinvolk","id":14073052,"avatar_url":"https://avatars.githubusercontent.com/u/14073052?v=3","gravatar_id":"","url":"https://api.github.com/users/kinvolk","html_url":"https://github.com/kinvolk","followers_url":"https://api.github.com/users/kinvolk/followers","following_url":"https://api.github.com/users/kinvolk/following{/other_user}","gists_url":"https://api.github.com/users/kinvolk/gists{/gist_id}","starred_url":"https://api.github.com/users/kinvolk/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kinvolk/subscriptions","organizations_url":"https://api.github.com/users/kinvolk/orgs","repos_url":"https://api.github.com/users/kinvolk/repos","events_url":"https://api.github.com/users/kinvolk/events{/privacy}","received_events_url":"https://api.github.com/users/kinvolk/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/kinvolk/rkt","description":"rkt is an App Container runtime for Linux","fork":true,"url":"https://api.github.com/repos/kinvolk/rkt","forks_url":"https://api.github.com/repos/kinvolk/rkt/forks","keys_url":"https://api.github.com/repos/kinvolk/rkt/keys{/key_id}","collaborators_url":"https://api.github.com/repos/kinvolk/rkt/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/kinvolk/rkt/teams","hooks_url":"https://api.github.com/repos/kinvolk/rkt/hooks","issue_events_url":"https://api.github.com/repos/kinvolk/rkt/issues/events{/number}","events_url":"https://api.github.com/repos/kinvolk/rkt/events","assignees_url":"https://api.github.com/repos/kinvolk/rkt/assignees{/user}","branches_url":"https://api.github.com/repos/kinvolk/rkt/branches{/branch}","tags_url":"https://api.github.com/repos/kinvolk/rkt/tags","blobs_url":"https://api.github.com/repos/kinvolk/rkt/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/kinvolk/rkt/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/kinvolk/rkt/git/refs{/sha}","trees_url":"https://api.github.com/repos/kinvolk/rkt/git/trees{/sha}","statuses_url":"https://api.github.com/repos/kinvolk/rkt/statuses/{sha}","languages_url":"https://api.github.com/repos/kinvolk/rkt/languages","stargazers_url":"https://api.github.com/repos/kinvolk/rkt/stargazers","contributors_url":"https://api.github.com/repos/kinvolk/rkt/contributors","subscribers_url":"https://api.github.com/repos/kinvolk/rkt/subscribers","subscription_url":"https://api.github.com/repos/kinvolk/rkt/subscription","commits_url":"https://api.github.com/repos/kinvolk/rkt/commits{/sha}","git_commits_url":"https://api.github.com/repos/kinvolk/rkt/git/commits{/sha}","comments_url":"https://api.github.com/repos/kinvolk/rkt/comments{/number}","issue_comment_url":"https://api.github.com/repos/kinvolk/rkt/issues/comments{/number}","contents_url":"https://api.github.com/repos/kinvolk/rkt/contents/{+path}","compare_url":"https://api.github.com/repos/kinvolk/rkt/compare/{base}...{head}","merges_url":"https://api.github.com/repos/kinvolk/rkt/merges","archive_url":"https://api.github.com/repos/kinvolk/rkt/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/kinvolk/rkt/downloads","issues_url":"https://api.github.com/repos/kinvolk/rkt/issues{/number}","pulls_url":"https://api.github.com/repos/kinvolk/rkt/pulls{/number}","milestones_url":"https://api.github.com/repos/kinvolk/rkt/milestones{/number}","notifications_url":"https://api.github.com/repos/kinvolk/rkt/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/kinvolk/rkt/labels{/name}","releases_url":"https://api.github.com/repos/kinvolk/rkt/releases{/id}","deployments_url":"https://api.github.com/repos/kinvolk/rkt/deployments","created_at":"2015-10-29T00:17:06Z","updated_at":"2016-01-13T16:51:16Z","pushed_at":"2016-05-12T09:42:20Z","git_url":"git://github.com/kinvolk/rkt.git","ssh_url":"git@github.com:kinvolk/rkt.git","clone_url":"https://github.com/kinvolk/rkt.git","svn_url":"https://github.com/kinvolk/rkt","homepage":"","size":21088,"stargazers_count":0,"watchers_count":0,"language":"Go","has_issues":false,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"coreos:master","ref":"master","sha":"623fc3140681aeff1f353717a4943e2538769c51","user":{"login":"coreos","id":3730757,"avatar_url":"https://avatars.githubusercontent.com/u/3730757?v=3","gravatar_id":"","url":"https://api.github.com/users/coreos","html_url":"https://github.com/coreos","followers_url":"https://api.github.com/users/coreos/followers","following_url":"https://api.github.com/users/coreos/following{/other_user}","gists_url":"https://api.github.com/users/coreos/gists{/gist_id}","starred_url":"https://api.github.com/users/coreos/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/coreos/subscriptions","organizations_url":"https://api.github.com/users/coreos/orgs","repos_url":"https://api.github.com/users/coreos/repos","events_url":"https://api.github.com/users/coreos/events{/privacy}","received_events_url":"https://api.github.com/users/coreos/received_events","type":"Organization","site_admin":false},"repo":{"id":26509369,"name":"rkt","full_name":"coreos/rkt","owner":{"login":"coreos","id":3730757,"avatar_url":"https://avatars.githubusercontent.com/u/3730757?v=3","gravatar_id":"","url":"https://api.github.com/users/coreos","html_url":"https://github.com/coreos","followers_url":"https://api.github.com/users/coreos/followers","following_url":"https://api.github.com/users/coreos/following{/other_user}","gists_url":"https://api.github.com/users/coreos/gists{/gist_id}","starred_url":"https://api.github.com/users/coreos/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/coreos/subscriptions","organizations_url":"https://api.github.com/users/coreos/orgs","repos_url":"https://api.github.com/users/coreos/repos","events_url":"https://api.github.com/users/coreos/events{/privacy}","received_events_url":"https://api.github.com/users/coreos/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/coreos/rkt","description":"rkt is an App Container runtime for Linux","fork":false,"url":"https://api.github.com/repos/coreos/rkt","forks_url":"https://api.github.com/repos/coreos/rkt/forks","keys_url":"https://api.github.com/repos/coreos/rkt/keys{/key_id}","collaborators_url":"https://api.github.com/repos/coreos/rkt/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/coreos/rkt/teams","hooks_url":"https://api.github.com/repos/coreos/rkt/hooks","issue_events_url":"https://api.github.com/repos/coreos/rkt/issues/events{/number}","events_url":"https://api.github.com/repos/coreos/rkt/events","assignees_url":"https://api.github.com/repos/coreos/rkt/assignees{/user}","branches_url":"https://api.github.com/repos/coreos/rkt/branches{/branch}","tags_url":"https://api.github.com/repos/coreos/rkt/tags","blobs_url":"https://api.github.com/repos/coreos/rkt/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/coreos/rkt/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/coreos/rkt/git/refs{/sha}","trees_url":"https://api.github.com/repos/coreos/rkt/git/trees{/sha}","statuses_url":"https://api.github.com/repos/coreos/rkt/statuses/{sha}","languages_url":"https://api.github.com/repos/coreos/rkt/languages","stargazers_url":"https://api.github.com/repos/coreos/rkt/stargazers","contributors_url":"https://api.github.com/repos/coreos/rkt/contributors","subscribers_url":"https://api.github.com/repos/coreos/rkt/subscribers","subscription_url":"https://api.github.com/repos/coreos/rkt/subscription","commits_url":"https://api.github.com/repos/coreos/rkt/commits{/sha}","git_commits_url":"https://api.github.com/repos/coreos/rkt/git/commits{/sha}","comments_url":"https://api.github.com/repos/coreos/rkt/comments{/number}","issue_comment_url":"https://api.github.com/repos/coreos/rkt/issues/comments{/number}","contents_url":"https://api.github.com/repos/coreos/rkt/contents/{+path}","compare_url":"https://api.github.com/repos/coreos/rkt/compare/{base}...{head}","merges_url":"https://api.github.com/repos/coreos/rkt/merges","archive_url":"https://api.github.com/repos/coreos/rkt/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/coreos/rkt/downloads","issues_url":"https://api.github.com/repos/coreos/rkt/issues{/number}","pulls_url":"https://api.github.com/repos/coreos/rkt/pulls{/number}","milestones_url":"https://api.github.com/repos/coreos/rkt/milestones{/number}","notifications_url":"https://api.github.com/repos/coreos/rkt/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/coreos/rkt/labels{/name}","releases_url":"https://api.github.com/repos/coreos/rkt/releases{/id}","deployments_url":"https://api.github.com/repos/coreos/rkt/deployments","created_at":"2014-11-11T23:13:18Z","updated_at":"2016-05-12T06:14:25Z","pushed_at":"2016-05-12T09:44:51Z","git_url":"git://github.com/coreos/rkt.git","ssh_url":"git@github.com:coreos/rkt.git","clone_url":"https://github.com/coreos/rkt.git","svn_url":"https://github.com/coreos/rkt","homepage":"","size":24756,"stargazers_count":5486,"watchers_count":5486,"language":"Go","has_issues":true,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":512,"mirror_url":null,"open_issues_count":336,"forks":512,"open_issues":336,"watchers":5486,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/coreos/rkt/pulls/2603"},"html":{"href":"https://github.com/coreos/rkt/pull/2603"},"issue":{"href":"https://api.github.com/repos/coreos/rkt/issues/2603"},"comments":{"href":"https://api.github.com/repos/coreos/rkt/issues/2603/comments"},"review_comments":{"href":"https://api.github.com/repos/coreos/rkt/pulls/2603/comments"},"review_comment":{"href":"https://api.github.com/repos/coreos/rkt/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/coreos/rkt/pulls/2603/commits"},"statuses":{"href":"https://api.github.com/repos/coreos/rkt/statuses/b604d0dae89bba9b0ce48fd22cbf5226134205a8"}}}}