{"action":"created","issue":{"url":"https://api.github.com/repos/kubernetes/kubernetes/issues/36423","repository_url":"https://api.github.com/repos/kubernetes/kubernetes","labels_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/36423/labels{/name}","comments_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/36423/comments","events_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/36423/events","html_url":"https://github.com/kubernetes/kubernetes/pull/36423","id":187923951,"number":36423,"title":"CRI: Support root and nobody user.","user":{"login":"Random-Liu","id":5821883,"avatar_url":"https://avatars.githubusercontent.com/u/5821883?v=3","gravatar_id":"","url":"https://api.github.com/users/Random-Liu","html_url":"https://github.com/Random-Liu","followers_url":"https://api.github.com/users/Random-Liu/followers","following_url":"https://api.github.com/users/Random-Liu/following{/other_user}","gists_url":"https://api.github.com/users/Random-Liu/gists{/gist_id}","starred_url":"https://api.github.com/users/Random-Liu/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Random-Liu/subscriptions","organizations_url":"https://api.github.com/users/Random-Liu/orgs","repos_url":"https://api.github.com/users/Random-Liu/repos","events_url":"https://api.github.com/users/Random-Liu/events{/privacy}","received_events_url":"https://api.github.com/users/Random-Liu/received_events","type":"User","site_admin":false},"labels":[{"id":134645591,"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/area/kubelet-api","name":"area/kubelet-api","color":"fbca04","default":false},{"id":176978828,"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/cla:%20yes","name":"cla: yes","color":"bfe5bf","default":false},{"id":116719829,"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/component/kubelet","name":"component/kubelet","color":"0052cc","default":false},{"id":349530249,"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/release-note-none","name":"release-note-none","color":"c2e0c6","default":false},{"id":253450895,"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/size/S","name":"size/S","color":"77bb00","default":false},{"id":173493665,"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/team/node","name":"team/node","color":"d2b48c","default":false}],"state":"open","locked":false,"assignee":{"login":"feiskyer","id":676637,"avatar_url":"https://avatars.githubusercontent.com/u/676637?v=3","gravatar_id":"","url":"https://api.github.com/users/feiskyer","html_url":"https://github.com/feiskyer","followers_url":"https://api.github.com/users/feiskyer/followers","following_url":"https://api.github.com/users/feiskyer/following{/other_user}","gists_url":"https://api.github.com/users/feiskyer/gists{/gist_id}","starred_url":"https://api.github.com/users/feiskyer/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/feiskyer/subscriptions","organizations_url":"https://api.github.com/users/feiskyer/orgs","repos_url":"https://api.github.com/users/feiskyer/repos","events_url":"https://api.github.com/users/feiskyer/events{/privacy}","received_events_url":"https://api.github.com/users/feiskyer/received_events","type":"User","site_admin":false},"assignees":[{"login":"feiskyer","id":676637,"avatar_url":"https://avatars.githubusercontent.com/u/676637?v=3","gravatar_id":"","url":"https://api.github.com/users/feiskyer","html_url":"https://github.com/feiskyer","followers_url":"https://api.github.com/users/feiskyer/followers","following_url":"https://api.github.com/users/feiskyer/following{/other_user}","gists_url":"https://api.github.com/users/feiskyer/gists{/gist_id}","starred_url":"https://api.github.com/users/feiskyer/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/feiskyer/subscriptions","organizations_url":"https://api.github.com/users/feiskyer/orgs","repos_url":"https://api.github.com/users/feiskyer/repos","events_url":"https://api.github.com/users/feiskyer/events{/privacy}","received_events_url":"https://api.github.com/users/feiskyer/received_events","type":"User","site_admin":false},{"login":"yujuhong","id":10524058,"avatar_url":"https://avatars.githubusercontent.com/u/10524058?v=3","gravatar_id":"","url":"https://api.github.com/users/yujuhong","html_url":"https://github.com/yujuhong","followers_url":"https://api.github.com/users/yujuhong/followers","following_url":"https://api.github.com/users/yujuhong/following{/other_user}","gists_url":"https://api.github.com/users/yujuhong/gists{/gist_id}","starred_url":"https://api.github.com/users/yujuhong/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/yujuhong/subscriptions","organizations_url":"https://api.github.com/users/yujuhong/orgs","repos_url":"https://api.github.com/users/yujuhong/repos","events_url":"https://api.github.com/users/yujuhong/events{/privacy}","received_events_url":"https://api.github.com/users/yujuhong/received_events","type":"User","site_admin":false}],"milestone":{"url":"https://api.github.com/repos/kubernetes/kubernetes/milestones/23","html_url":"https://github.com/kubernetes/kubernetes/milestones/v1.5","labels_url":"https://api.github.com/repos/kubernetes/kubernetes/milestones/23/labels","id":1945978,"number":23,"title":"v1.5","description":"","creator":{"login":"lavalamp","id":647318,"avatar_url":"https://avatars.githubusercontent.com/u/647318?v=3","gravatar_id":"","url":"https://api.github.com/users/lavalamp","html_url":"https://github.com/lavalamp","followers_url":"https://api.github.com/users/lavalamp/followers","following_url":"https://api.github.com/users/lavalamp/following{/other_user}","gists_url":"https://api.github.com/users/lavalamp/gists{/gist_id}","starred_url":"https://api.github.com/users/lavalamp/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lavalamp/subscriptions","organizations_url":"https://api.github.com/users/lavalamp/orgs","repos_url":"https://api.github.com/users/lavalamp/repos","events_url":"https://api.github.com/users/lavalamp/events{/privacy}","received_events_url":"https://api.github.com/users/lavalamp/received_events","type":"User","site_admin":false},"open_issues":288,"closed_issues":457,"state":"open","created_at":"2016-08-16T21:47:28Z","updated_at":"2016-11-08T19:08:12Z","due_on":"2016-12-09T00:00:00Z","closed_at":null},"comments":8,"created_at":"2016-11-08T07:51:04Z","updated_at":"2016-11-08T19:20:49Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/kubernetes/kubernetes/pulls/36423","html_url":"https://github.com/kubernetes/kubernetes/pull/36423","diff_url":"https://github.com/kubernetes/kubernetes/pull/36423.diff","patch_url":"https://github.com/kubernetes/kubernetes/pull/36423.patch"},"body":"https://github.com/kubernetes/kubernetes/pull/33239 and https://github.com/kubernetes/kubernetes/pull/34811 combined together broke the cri e2e test. https://k8s-testgrid.appspot.com/google-gce#gci-gce-cri\r\n\r\nThe reason is that:\r\n1) In dockershim and dockertools, we assume that `Image.Config.User` should be an integer. However, sometimes when user build the image with `USER nobody:nobody` or `USER root:root`, the field will become `nobody:nobody` and `root:root`. This makes dockershim to always return error.\r\n2) The new kube-dns-autoscaler image is using `USER nobody:nobody`. (See https://github.com/kubernetes-incubator/cluster-proportional-autoscaler/blob/master/Dockerfile.in#L21)\r\n\r\nThis doesn't break the normal e2e test, because in dockertools [we only inspect image uid if `RunAsNonRoot` is set](https://github.com/kubernetes/kubernetes/blob/master/pkg/kubelet/dockertools/docker_manager.go#L2333-L2338), which is just a coincidence. However, in kuberuntime, [we always inspect image uid first](https://github.com/kubernetes/kubernetes/blob/master/pkg/kubelet/kuberuntime/kuberuntime_container.go#L141).\r\n\r\nThis PR adds literal `root` and `nobody` support. One problem is that `nobody` is not quite the same in different OS distros. Usually it should be `65534`, but some os distro doesn't follow that. For example, Fedora is using `99`. (See https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/thread/Q5GCKZ7Q7PAUQW66EV7IBJGSRJWYXBBH/?sort=date)\r\n\r\nPossible solution:\r\n* Option 1: ~~Just use `65534`. This is fine because currently we only need to know whether the user is root or not.~~ Actually, we need to pass the user id to runtime when creating a container.\r\n* Option 2: Return the uid as string in CRI, and let kuberuntime handle the string directly.\r\n\r\nThis PR is using option 1.\r\n\r\n@yujuhong @feiskyer \r\n/cc @kubernetes/sig-node\r\n/cc @MrHohn \r\n\r\n<!-- Reviewable:start -->\r\n---\r\nThis change is [<img src=\"https://reviewable.kubernetes.io/review_button.svg\" height=\"34\" align=\"absmiddle\" alt=\"Reviewable\"/>](https://reviewable.kubernetes.io/reviews/kubernetes/kubernetes/36423)\r\n<!-- Reviewable:end -->\r\n"},"comment":{"url":"https://api.github.com/repos/kubernetes/kubernetes/issues/comments/259232517","html_url":"https://github.com/kubernetes/kubernetes/pull/36423#issuecomment-259232517","issue_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/36423","id":259232517,"user":{"login":"Random-Liu","id":5821883,"avatar_url":"https://avatars.githubusercontent.com/u/5821883?v=3","gravatar_id":"","url":"https://api.github.com/users/Random-Liu","html_url":"https://github.com/Random-Liu","followers_url":"https://api.github.com/users/Random-Liu/followers","following_url":"https://api.github.com/users/Random-Liu/following{/other_user}","gists_url":"https://api.github.com/users/Random-Liu/gists{/gist_id}","starred_url":"https://api.github.com/users/Random-Liu/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Random-Liu/subscriptions","organizations_url":"https://api.github.com/users/Random-Liu/orgs","repos_url":"https://api.github.com/users/Random-Liu/repos","events_url":"https://api.github.com/users/Random-Liu/events{/privacy}","received_events_url":"https://api.github.com/users/Random-Liu/received_events","type":"User","site_admin":false},"created_at":"2016-11-08T19:20:49Z","updated_at":"2016-11-08T19:20:49Z","body":"Offline discussed with @yujuhong.\r\n\r\nFor option 1.\r\n* We can't perform any check on empty UID.\r\n* We will rely more on runtime's default behaviour - If no user is specified in container config, it should create container with default user specified in the image.\r\n\r\nFor option 2.\r\n* We still can't perform check on string UID.\r\n* We rely less on the runtime's default behaviour, kubelet will always explicitly set user id in the container config.\r\n\r\nIt seems that option 2 is a better solution here."}}
{"actor":{"display_login":"Random-Liu"}}