compat API: accept inline seccomp profiles#28985
Conversation
Docker-compatible clients may pass the seccomp profile JSON itself via HostConfig.SecurityOpt, as seccomp=..., instead of passing a path to a profile JSON. Detect inline JSON profiles before Windows path conversion and profile loading, and pass it directly to the seccomp loader. When inline JSON is not detected, proceed with loading the profile from path. Add unit tests for loading profile from path and inline seccomp profiles, cover Windows path-conversion behaviour for inline JSON, and add an API v2 regression test for containers/create with HostConfig.SecurityOpt. Fixes: podman-container-tools#27710 Signed-off-by: Saurabh Singh <saurabh235711@proton.me>
saurabh235711
force-pushed
the
compat-api-inline-seccomp
branch
from
b84c3ba to
6bba7c2
Compare
|
/packit retest-failed |
Luap99
left a comment
Luap99
left a comment
There was a problem hiding this comment.
Thanks I think it makes sense to accept the json as string but I Really prefer a new field for that then.
| SeccompPolicy string `json:"seccomp_policy,omitempty"` | ||
| // SeccompProfilePath is the path to a JSON file containing the | ||
| // container's Seccomp profile. | ||
| // container's Seccomp profile, or the JSON profile itself. |
There was a problem hiding this comment.
That seem not nice deisng wise.
If we want to accept inline json specgen should gain another field IMO instead of trying to multi purpose things.
Then you can avoid all the IsProfileInline() special cases.
With the new field them the docker compat API endpoint can then just set this if it accepts the json as string.
cc @mheon
There was a problem hiding this comment.
Agreed that overloading SeccompProfilePath is not ideal. Right now, it can also be set to unconfined. Do you think it makes sense to use a different field for that as well, so that SeccompProfilePath always contains a path?
There was a problem hiding this comment.
given unconfined is exposed as special value to users already we must continue to support it so lets not chnage anything for that
2 participants
Docker-compatible clients may pass the seccomp profile JSON itself via HostConfig.SecurityOpt, as seccomp=..., instead of passing a path to a profile JSON.
Detect inline JSON profiles before Windows path conversion and profile loading, and pass it directly to the seccomp loader. When inline JSON is not detected, proceed with loading the profile from path.
Add unit tests for loading profile from path and inline seccomp profiles, cover Windows path-conversion behaviour for inline JSON, and add an API v2 regression test for containers/create with HostConfig.SecurityOpt.
Fixes: #27710
Checklist
Ensure you have completed the following checklist for your pull request to be reviewed:
commits. (
git commit -s). (If needed, usegit commit -s --amend). The author email must matchthe sign-off email address. See CONTRIBUTING.md
for more information.
Fixes: #00000in commit message (if applicable)make validatepr(format/lint checks)Noneif no user-facing changes)Does this PR introduce a user-facing change?