{"action":"created","issue":{"url":"https://api.github.com/repos/coreos/rkt/issues/3290","repository_url":"https://api.github.com/repos/coreos/rkt","labels_url":"https://api.github.com/repos/coreos/rkt/issues/3290/labels{/name}","comments_url":"https://api.github.com/repos/coreos/rkt/issues/3290/comments","events_url":"https://api.github.com/repos/coreos/rkt/issues/3290/events","html_url":"https://github.com/coreos/rkt/pull/3290","id":183649470,"number":3290,"title":"[WIP] stage1/init: leave privileged pods without stage2 mount-ns","user":{"login":"lucab","id":98086,"avatar_url":"https://avatars.githubusercontent.com/u/98086?v=3","gravatar_id":"","url":"https://api.github.com/users/lucab","html_url":"https://github.com/lucab","followers_url":"https://api.github.com/users/lucab/followers","following_url":"https://api.github.com/users/lucab/following{/other_user}","gists_url":"https://api.github.com/users/lucab/gists{/gist_id}","starred_url":"https://api.github.com/users/lucab/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lucab/subscriptions","organizations_url":"https://api.github.com/users/lucab/orgs","repos_url":"https://api.github.com/users/lucab/repos","events_url":"https://api.github.com/users/lucab/events{/privacy}","received_events_url":"https://api.github.com/users/lucab/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/coreos/rkt/labels/component/stage1","name":"component/stage1","color":"0052cc"},{"url":"https://api.github.com/repos/coreos/rkt/labels/do%20not%20merge","name":"do not merge","color":"e11d21"},{"url":"https://api.github.com/repos/coreos/rkt/labels/needs/more-information","name":"needs/more-information","color":"fef2c0"}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":5,"created_at":"2016-10-18T10:36:26Z","updated_at":"2016-10-20T13:46:42Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/coreos/rkt/pulls/3290","html_url":"https://github.com/coreos/rkt/pull/3290","diff_url":"https://github.com/coreos/rkt/pull/3290.diff","patch_url":"https://github.com/coreos/rkt/pull/3290.patch"},"body":"Do not merge: still checking if this is the right way to fix https://github.com/coreos/rkt/issues/3272\r\n\r\n----\r\n\r\nThis PR removes `MountFlags` property from stage2 apps in pods\r\nrunning with `--insecure-options=paths`.\r\nThis will leave the service without any properties with a mount-ns\r\nrequirement, so that stage2 rootfs can be nicely degraded to a chroot\r\nwith full mount propagation.\r\n\r\nFixes: https://github.com/coreos/rkt/issues/3272"},"comment":{"url":"https://api.github.com/repos/coreos/rkt/issues/comments/255110289","html_url":"https://github.com/coreos/rkt/pull/3290#issuecomment-255110289","issue_url":"https://api.github.com/repos/coreos/rkt/issues/3290","id":255110289,"user":{"login":"lucab","id":98086,"avatar_url":"https://avatars.githubusercontent.com/u/98086?v=3","gravatar_id":"","url":"https://api.github.com/users/lucab","html_url":"https://github.com/lucab","followers_url":"https://api.github.com/users/lucab/followers","following_url":"https://api.github.com/users/lucab/following{/other_user}","gists_url":"https://api.github.com/users/lucab/gists{/gist_id}","starred_url":"https://api.github.com/users/lucab/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lucab/subscriptions","organizations_url":"https://api.github.com/users/lucab/orgs","repos_url":"https://api.github.com/users/lucab/repos","events_url":"https://api.github.com/users/lucab/events{/privacy}","received_events_url":"https://api.github.com/users/lucab/received_events","type":"User","site_admin":false},"created_at":"2016-10-20T13:46:42Z","updated_at":"2016-10-20T13:46:42Z","body":"I've piled a second commit on top of this, which should also fix the volume case. Still, by design, this will not work with a read-only rootfs.\r\n\r\nAt this point I'm not sure how this should be exposed, so asking for @coreos/rkt-maintainers about some options:\r\n 1. gate the \"gracefully degrade to chroot\" behind `--insecure-options=paths`. This \"paths\" option is now gaining a lot of side-effects, but pathmasking+devicepolicy+mountns are effectively coupled in systemd so this is hard to split\r\n 2. same as above, but only offer this chroot option for KVM. This means that stage2s in coreos flavor still can't propagate mounts between them (see https://github.com/coreos/rkt/issues/3223)\r\n 3. introduce a new insecure option to turn off mount-ns. This increment the number of flags and will have a bizarre semantic, as it will implies most of the semantic of the \"paths\" option\r\n\r\nI'm currently leaning toward option 1 (current PR) or 2, comments are appreciated."}}
{"actor":{"display_login":"lucab"}}