[Propose] Isolate core_pattern in mnt namespace.

[Eric W. Biederman]

Dongsheng Yang <yangds.fnst at cn.fujitsu.com> writes:

> On 12/20/2015 05:47 PM, Eric W. Biederman wrote:
>> Dongsheng Yang <yangds.fnst at cn.fujitsu.com> writes:
>>
>>> On 12/20/2015 10:37 AM, Al Viro wrote:
>>>> On Sun, Dec 20, 2015 at 10:14:29AM +0800, Dongsheng Yang wrote:
>>>>> On 12/17/2015 07:23 PM, Dongsheng Yang wrote:
>>>>>> Hi guys,
>>>>>>       We are working on making core dump behaviour isolated in
>>>>>> container. But the problem is, the /proc/sys/kernel/core_pattern
>>>>>> is a kernel wide setting, not belongs to a container.
>>>>>>
>>>>>>       So we want to add core_pattern into mnt namespace. What
>>>>>> do you think about it?
>>>>>
>>>>> Hi Eric,
>>>>> 	I found your patch about "net: Implement the per network namespace
>>>>> sysctl infrastructure", I want to do the similar thing
>>>>> in mnt namespace. Is that suggested way?
>>>>
>>>> Why mnt namespace and not something else?
>>>
>>> Hi Al,
>>>
>>> Well, because core_pattern indicates the path to store core file.
>>> In different mnt namespace, we would like to change the path with
>>> different value.
>>>
>>> In addition, Let's considering other namespaces:
>>> UTS ns: contains informations of kernel and arch, not proper for core_pattern.
>>> IPC ns: communication informations, not proper for core_pattern
>>> PID ns: core_pattern is not related with pid
>>> net ns: obviousely no.
>>> user ns: not proper too.
>>>
>>> Then I believe it's better to do this in mnt namespace. of course,
>>> core_pattern is just one example. After this infrastructure finished,
>>> we can implement more sysctls as per-mnt if necessary, I think.
>>>
>>> Al, what do you think about this idea?
>>
>> The hard part is not the sysctl.  The hard part is starting the usermode
>> helper, in an environment that it can deal with.  The mount namespace
>> really provides you with no help there.
>
> Do you mean the core dump helper? But I think I don't want to touch it
> in my development. I think I can use non-pipe way to get what I want,
> Let me try to explain what I want here.
>
> (1). introduce a --core-path option in docker run command to specify the
> path in host to store core file in one container.
> E.g: docker run --core-path=/core/test --name=test IMAGE
>
> (2). When the container starting, docker attach a volume to it, similar
> with "-v /core/test:/var/lib/docker/coredump". That means, the path of
> /var/lib/docker/coredump in container is a link to /core/test in host.
>
> (3). Set the /proc/sys/kernel/core_pattern in container as
> "/var/lib/docker/coredump". But that should not affect the core_pattern
> in host or other containers.
>
> Then I think I can collect the core files from each container and save
> them in the paths where I want.

For your case that sounds like it would work.  Unfortunately for this to
be generally applicable and to let the OS in the contianer control it's
fate the core dump pattern needs to be supported.

Otherwise something clever in userspace that can be written now should
be sufficient to fill the gap.  There is enough information for the user
mode helper to implement the policy you would like today.

Eric