GetResolvConf read and wrote the package-level notFirstRun and
lastNotEmpty flags inside its flightcontrol callback. flightcontrol
only serializes calls with the same key, so calls for different roots,
or for resolv.conf and resolv-host.conf at once, raced on them. Make
both flags atomic.Bool; the sequential behavior is unchanged.
Add a test that generates resolv.conf for several roots concurrently;
it reports the race under -race without the fix.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
The resize goroutine calls ptm.Resize (os.File.Fd) and only exits once
runcProcess.Shutdown() cancels its context, which ran after the cleanup
had already closed ptm. A resize racing with process exit could read a
closed or reused fd, so TIOCSWINSZ could hit an unrelated descriptor.
Stop and join the resize loop before the pty is closed.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
In NoProcessSandbox mode the build container runs in the PID namespace
of buildkitd, so a process that a step leaves running in the background
is not killed when the step ends. runc still creates a new session
keyring for every container, and each leftover process keeps that
keyring alive. Each of them takes one key from the per-user quota of the
daemon user (kernel.keys.maxkeys, 200 by default for non-root). Once the
quota is used up, every new container fails with:
unable to join session keyring: unable to create session key: disk
quota exceeded
Restarting buildkitd ends the leftover processes and frees the keys, so
long-running rootless daemons hit this again after some days.
Run runc with --no-new-keyring in this mode, so the build containers
use the session keyring of buildkitd. They already share the PID
namespace and procfs with the daemon, and runc treats the per-container
keyring as best-effort isolation, so this removes nothing the mode
provides. ProcessSandbox mode is unchanged.
Fixes#7310
Refs #6247
Signed-off-by: Joao Otavio Manieri <69759037+JoaoManierii@users.noreply.github.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Read proxy CA bundles through RegularInRoot before accessing their contents.
Keep temporary writes and replacement confined to a retained root handle.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
(cherry picked from commit 914ed29f24515cf7dbfeff1c169538123945437b)
Propagate proxy CA cleanup failures from both Linux executors so builds
cannot succeed when the temporary certificate cannot be removed.
Restore certificate bundles byte-for-byte while preserving build-time changes
and report process and cleanup failures together.
Based on: moby/buildkit#7043
Co-authored-by: bbartels <23058572+bbartels@users.noreply.github.com>
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
(cherry picked from commit 62a1b69ee38bc68b23e7c096bbb7372ed13af6e1)
Open the proxy CA bundle with O_NONBLOCK before checking that it
is a regular file. This prevents cleanup from hanging when a build
replaces the bundle path with a FIFO that has no writer.
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
(cherry picked from commit ed6a9a02de11435e43a42efa6bbde835c08ebe3d)
(cherry picked from commit 567f0e193d2aefa47de3cb430b71946e8f68f40a)
Store the resolved certificate bundle target relative to the rootfs
and resolve it again during cleanup. This prevents cleanup from
following a container-retargeted symlink through the stale worker path.
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
(cherry picked from commit 573ec15277605de470a7c969b182b7ef4c495e7d)
(cherry picked from commit 51eb362664370570cd8f569ea76cd10ebf22fa0f)
Route proxy-network traffic through HTTP_PROXY and HTTPS_PROXY from the
buildkitd environment. Propagate ALL_PROXY to gateway execs and document
upstream proxy behavior.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
The rootless spec conversion removes the /sys mount, so the runtime never
creates its mount point in the rootfs. A rootful build gets that empty
directory, which meant the same LLB left different mount points behind
depending on whether the worker was rootless.
Recreate the mount points of the removed mounts after the container has
exited, rather than cleaning them up from the rootful result, which would
change existing output and need a compatibility version bump. Creating
them up front would instead turn a mount point that the image does not
ship into a directory the build can write to. Nested destinations are
skipped: the runtime creates those inside the parent mount, where they
never reach the rootfs.
Fixes#6686
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
BuildKit records mount-stub cleanup before rootless conversion finishes changing the mount list, which can leave rootful and rootless builds with different empty directories.
This change registers cleanup after rootless conversion, when the mount list is final, and uses that list for cleanup.
Signed-off-by: Leo Li <cheerleaderleo@outlook.com>
- Updated multiple instances across various files to replace errors.Errorf with errors.New for error message creation.
- This change enhances consistency in error handling throughout the codebase.
Signed-off-by: Matthieu MOREL <matthieu.morel35@gmail.com>
Bump containerd/containerd/api, containerd/containerd/v2, and
docker/cli to current critical direct versions. Regenerate vendor and
accept required transitive/go directive updates from containerd.
Adjust resource pointer helpers for Go 1.26 gopls modernize lint.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Open the resolved mount source with GENERIC_READ instead of DELETE.
The nonzero desired access keeps the share-mode pin effective, while
omitting FILE_SHARE_DELETE still prevents the source from being renamed
or deleted before HCS realizes the mount.
Avoid requiring delete permission on legitimate mount sources, which
caused access denied failures for WCOW bind mounts. Keep write sharing
enabled so writable cache contents continue to work normally.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
(cherry picked from commit 2523c023ecac816c8131ea08b37f9b84145d5acc)
(cherry picked from commit 0669f4b974)
Resolve the selected cache subpath through the same handle used to
pin it, then verify that resolved target is still within the cache
root before passing it as the mount source.
This closes the check-to-use gap where containment verification and
pinning could observe different path objects. It also avoids handing
HCS the original path containing attacker-controlled reparse points.
Open the pinned directory with delete access while omitting delete
sharing, so the selected resolved directory cannot be renamed, deleted,
or swapped before HCS consumes the mount source. Keep write sharing
enabled so writable cache contents can still be modified while the
handle is alive.
Keep the HCS-facing source in the normal DOS path form when possible,
so this does not introduce a new \\?\ path format requirement for WCOW
mount realization.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
(cherry picked from commit d854e00d473958b6e164f2e821eab902245705ad)
(cherry picked from commit 44c0ed6b1c)
The Windows cache mount is realized later by HCS from the resolved host
path, so verification alone leaves a check-to-use window in which the
verified entry could be swapped for a junction escaping the cache root
(concurrent cache access). Hold the verified source open with
GENERIC_READ and a share mode that omits FILE_SHARE_DELETE until the
mount is released, so the entry cannot be renamed or deleted (and thus
swapped) during that window. GENERIC_READ rather than DELETE is used so a
concurrent read/traverse open by the mount stack still succeeds;
validated against a real HCS worker (benign cache mounts still mount and
the escape is still rejected).
Add a unit test asserting the source cannot be renamed while pinned and
can be renamed after release.
Signed-off-by: Dawei Wei <wei.dawei.cn@gmail.com>
(cherry picked from commit 39a7b40489a036134a93502ea3d84d71dca072ea)
(cherry picked from commit 473663bad0)
On Windows, RUN --mount=type=cache,source=<subdir> resolved the source
subpath with fs.RootPath, which does not follow Windows reparse points.
A junction placed inside the cache root could therefore point to a path
outside the cache, and the resolved source was mounted into the build
container, exposing host files outside the intended cache subdirectory.
Resolve the real path of both the cache root and the selected source via
GetFinalPathNameByHandle (which follows junctions and symlinks) and reject
any source that resolves outside the cache root.
Add Windows unit tests for the resolver and end-to-end regression tests
for the junction escape (Windows) and the symlink escape (Linux).
Signed-off-by: Dawei Wei <wei.dawei.cn@gmail.com>
(cherry picked from commit 70370e18de3cc7545fcf7f986612a28a803f59d2)
(cherry picked from commit a9155a456b)
BuildKit injects OTEL_TRACES_EXPORTER (and the OTLP endpoint/protocol)
into the build environment whenever a tracing socket is configured, and
it did so unconditionally -- appending its values after any the build
already set. That made it impossible to opt out or override them; for
example `--opt env.OTEL_TRACES_EXPORTER=none` had no effect because
BuildKit re-added OTEL_TRACES_EXPORTER=otlp afterwards.
Only inject the trace-exporter variables the build has not already set,
so a build can override them or opt out of tracing.
Fixes#4972
Signed-off-by: Kunalbehbud <b.kunal2002@gmail.com>
Ref and rootfs helpers may read paths supplied by frontends or build outputs.
Reject non-regular files before reading them into memory so device and FIFO
paths cannot feed no-EOF streams into parsers or bundle injection logic.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Resolving a username to uid/gid read /etc/passwd and /etc/group via
os.Open with no upper bound, letting a crafted image force unbounded
memory use during user resolution. Cap reads at 10MiB and reject
non-regular files in both the OCI executor and the chown user resolver.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
(cherry picked from commit 83cfc1e0ea1dcf8816f259ee6720b8694ab874e5)
The github.com/mitchellh/hashstructure/v2 module was archived, and
there's a maintained fork in the gohugoio org.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Delay containerd stdin CloseIO until BuildKit's stdin reader reaches EOF.
This avoids racing the shim FIFO copy path, where closing stdin before
the copy completes can leave execs stuck or missing stdin data.
Add a client gateway regression that runs concurrent execs writing stdin
into files and verifies every payload is present.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Keep exec network modes limited to sandbox, host, and none, and pass proxy
network configuration separately through solve and executor runtime state.
Proxy execs now use bridge-style egress by default, host egress only for host
network mode with entitlement, and no proxy for none mode. Add integration
coverage for bridge, host, and none proxy behavior across OCI and containerd
workers.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Forward non-tty stdin through an os.Pipe so runc receives an *os.File
instead of the caller's reader. This lets runc exit after the container
process is killed without waiting on Go's internal stdin copy.
Add gateway coverage for graceful pid1 exit, release-based cleanup, and
explicit SIGKILL while pid1 stdin is still open.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Add integration coverage for exec proxy source policy conversion. The test
requests /foo, rewrites it to /bar, and verifies exported content and
provenance materials use the converted source.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Record successful GET responses through the exec proxy as provenance
materials and report incomplete material coverage as a typed solve error.
Thread proxy policy and capture state through typed executor/network options.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Add a build request option that rewrites default exec networking to an
internal proxy network while preserving explicit none networking.
Route HTTP and HTTPS traffic through a BuildKit-owned proxy namespace, enforce
source policy checks for proxied requests, and inject a temporary CA into Linux
rootfs trust bundles for HTTPS interception.
Share namespace pooling between CNI and proxy providers, and cover proxy mode
with unit and integration tests.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Change how the runc executor kills runc processes by removing the
previous warning message that occurred every 50 milliseconds with a bit
more precision in how it sends the warning.
The previous version could potentially successfully kill the runc
process and then the runc process could take some time to exit. It would
spam the logs every 50 milliseconds until the process exited and would
attempt to rekill a container that was already marked as killed.
This change makes it so we detect a successful kill. If we detect a
successful kill, we then wait for the process while writing a warning to
the log that the process is taking a long time to end. We print one
message 50 milliseconds after the kill and then an additional one with
the exact time it took to exit after the exit succeeds.
If the kill is not successful, we stay in the same loop as previously
existed.
Signed-off-by: Jonathan A. Sternberg <jonathan.sternberg@docker.com>
Update non-generated code for the newer lint recommendations by using typed
atomic values, strings.Cut, and slices.Backward where applicable.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Update golangci-lint and adjust code for new gosec diagnostics. Use
root-scoped filesystem operations where appropriate, preserve explicit
user path behavior for SSH keys, and avoid background contexts in
request-scoped cleanup paths.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Merge the `tracing/env` and `tracing/exec` package into a single package
with some common types shared between the two.
Signed-off-by: Jonathan A. Sternberg <jonathan.sternberg@docker.com>
Use os.OpenRoot for resolv.conf and hosts state file creation, and
adapt executor callers and tests to the root-relative helper API.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Add executor.ValidContainerID and enforce it in runc/containerd Run paths.
Only runc executor used the ID in filesystem operations.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
(cherry picked from commit 789df2422341960b7549d14ea475add43e73cd74)
Replace duplicate nopCloser, nopWriteCloser, and bufferCloser
type definitions across test and production code with the
shared iohelper.NopWriteCloser type.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Tonis Tiigi