Re: Review Request 45690: Ensured the bind mount root is a shared mount in its own peer group.

[Cong Wang]

---
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/45690/#review127173
---


Ship it!




Ship It!

- Cong Wang


On April 5, 2016, 6:25 p.m., Jie Yu wrote:
> 
> ---
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/45690/
> ---
> 
> (Updated April 5, 2016, 6:25 p.m.)
> 
> 
> Review request for mesos, Ian Downes and Cong Wang.
> 
> 
> Bugs: MESOS-4662
> https://issues.apache.org/jira/browse/MESOS-4662
> 
> 
> Repository: mesos
> 
> 
> Description
> ---
> 
> This is for the port mapping isolator.
> 
> This is a simple test I did on a fresh Fedora23 box:
> ```
> Jies-MacBook-Pro:fedora23 jie$ vagrant ssh
> Last login: Mon Apr  4 17:27:28 2016 from 10.0.2.2
> [vagrant@localhost ~]$ sudo mkdir /var/run/netns
> [vagrant@localhost ~]$ cat /proc/self/mountinfo
> ...
> 23 58 0:20 / /run rw,nosuid,nodev shared:22 - tmpfs tmpfs rw,seclabel,mode=755
> ...
> [vagrant@localhost ~]$ sudo mount --bind /var/run/netns /var/run/netns
> [vagrant@localhost ~]$ cat /proc/self/mountinfo
> ...
> 23 58 0:20 / /run rw,nosuid,nodev shared:22 - tmpfs tmpfs rw,seclabel,mode=755
> 72 23 0:20 /netns /run/netns rw,nosuid,nodev shared:22 - tmpfs tmpfs 
> rw,seclabel,mode=755
> ...
> [vagrant@localhost ~]$ sudo mount --make-shared /var/run/netns
> [vagrant@localhost ~]$ cat /proc/self/mountinfo
> ...
> 23 58 0:20 / /run rw,nosuid,nodev shared:22 - tmpfs tmpfs rw,seclabel,mode=755
> 72 23 0:20 /netns /run/netns rw,nosuid,nodev shared:22 - tmpfs tmpfs 
> rw,seclabel,mode=755
> ...
> [vagrant@localhost ~]$ sudo touch /var/run/netns/$$ && sudo mount --bind 
> /proc/self/ns/net /var/run/netns/$$
> [vagrant@localhost ~]$ cat /proc/self/mountinfo
> ...
> 23 58 0:20 / /run rw,nosuid,nodev shared:22 - tmpfs tmpfs rw,seclabel,mode=755
> 72 23 0:20 /netns /run/netns rw,nosuid,nodev shared:22 - tmpfs tmpfs 
> rw,seclabel,mode=755
> 74 72 0:3 / /run/netns/1526 rw shared:28 - nsfs nsfs rw
> 75 23 0:3 / /run/netns/1526 rw shared:28 - nsfs nsfs rw
> ```
> 
> As you can see above, a single bind mount creates two entries in the mount 
> table (`/run/netns/1526`). This is because /run/netns is in the same peer 
> group as /run. So a single mount operation under /run/netns will be 
> propergated to /run as well, creating two mounts. This will confuse the 
> recovery logic in the port mapping isolator.
> 
> 
> Diffs
> -
> 
>   src/slave/containerizer/mesos/isolators/network/port_mapping.cpp 
> 323c84a3d960a196d8ba87f753814e9d43a07957 
> 
> Diff: https://reviews.apache.org/r/45690/diff/
> 
> 
> Testing
> ---
> 
> sudo make check on Fedora 23
> 
> 
> Thanks,
> 
> Jie Yu
> 
>

Re: Review Request 45690: Ensured the bind mount root is a shared mount in its own peer group.

[Jie Yu]

---
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/45690/
---

(Updated April 5, 2016, 6:25 p.m.)


Review request for mesos, Ian Downes and Cong Wang.


Bugs: MESOS-4662
https://issues.apache.org/jira/browse/MESOS-4662


Repository: mesos


Description (updated)
---

This is for the port mapping isolator.

This is a simple test I did on a fresh Fedora23 box:
```
Jies-MacBook-Pro:fedora23 jie$ vagrant ssh
Last login: Mon Apr  4 17:27:28 2016 from 10.0.2.2
[vagrant@localhost ~]$ sudo mkdir /var/run/netns
[vagrant@localhost ~]$ cat /proc/self/mountinfo
...
23 58 0:20 / /run rw,nosuid,nodev shared:22 - tmpfs tmpfs rw,seclabel,mode=755
...
[vagrant@localhost ~]$ sudo mount --bind /var/run/netns /var/run/netns
[vagrant@localhost ~]$ cat /proc/self/mountinfo
...
23 58 0:20 / /run rw,nosuid,nodev shared:22 - tmpfs tmpfs rw,seclabel,mode=755
72 23 0:20 /netns /run/netns rw,nosuid,nodev shared:22 - tmpfs tmpfs 
rw,seclabel,mode=755
...
[vagrant@localhost ~]$ sudo mount --make-shared /var/run/netns
[vagrant@localhost ~]$ cat /proc/self/mountinfo
...
23 58 0:20 / /run rw,nosuid,nodev shared:22 - tmpfs tmpfs rw,seclabel,mode=755
72 23 0:20 /netns /run/netns rw,nosuid,nodev shared:22 - tmpfs tmpfs 
rw,seclabel,mode=755
...
[vagrant@localhost ~]$ sudo touch /var/run/netns/$$ && sudo mount --bind 
/proc/self/ns/net /var/run/netns/$$
[vagrant@localhost ~]$ cat /proc/self/mountinfo
...
23 58 0:20 / /run rw,nosuid,nodev shared:22 - tmpfs tmpfs rw,seclabel,mode=755
72 23 0:20 /netns /run/netns rw,nosuid,nodev shared:22 - tmpfs tmpfs 
rw,seclabel,mode=755
74 72 0:3 / /run/netns/1526 rw shared:28 - nsfs nsfs rw
75 23 0:3 / /run/netns/1526 rw shared:28 - nsfs nsfs rw
```

As you can see above, a single bind mount creates two entries in the mount 
table (`/run/netns/1526`). This is because /run/netns is in the same peer group 
as /run. So a single mount operation under /run/netns will be propergated to 
/run as well, creating two mounts. This will confuse the recovery logic in the 
port mapping isolator.


Diffs
-

  src/slave/containerizer/mesos/isolators/network/port_mapping.cpp 
323c84a3d960a196d8ba87f753814e9d43a07957 

Diff: https://reviews.apache.org/r/45690/diff/


Testing
---

sudo make check on Fedora 23


Thanks,

Jie Yu

Re: Review Request 45690: Ensured the bind mount root is a shared mount in its own peer group.

[Jie Yu]

> On April 5, 2016, 5:03 p.m., Cong Wang wrote:
> > src/slave/containerizer/mesos/isolators/network/port_mapping.cpp, line 1963
> > 
> >
> > It is still not clear why we need to handle this case, at least I don't 
> > see Fedora needs it. If it is really needed by some distro, please add some 
> > comments to explain this.

Updated the description with a simple test.


- Jie


---
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/45690/#review127136
---


On April 5, 2016, 5:25 p.m., Jie Yu wrote:
> 
> ---
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/45690/
> ---
> 
> (Updated April 5, 2016, 5:25 p.m.)
> 
> 
> Review request for mesos, Ian Downes and Cong Wang.
> 
> 
> Bugs: MESOS-4662
> https://issues.apache.org/jira/browse/MESOS-4662
> 
> 
> Repository: mesos
> 
> 
> Description
> ---
> 
> This is for the port mapping isolator.
> 
> This is a simple test I did on a fresh Fedora23 box:
> ```
> Jies-MacBook-Pro:fedora23 jie$ vagrant ssh
> Last login: Mon Apr  4 17:27:28 2016 from 10.0.2.2
> [vagrant@localhost ~]$ sudo mkdir /var/run/netns
> [vagrant@localhost ~]$ cat /proc/self/mountinfo
> ...
> 23 58 0:20 / /run rw,nosuid,nodev shared:22 - tmpfs tmpfs rw,seclabel,mode=755
> ...
> [vagrant@localhost ~]$ sudo mount --bind /var/run/netns /var/run/netns
> [vagrant@localhost ~]$ cat /proc/self/mountinfo
> ...
> 23 58 0:20 / /run rw,nosuid,nodev shared:22 - tmpfs tmpfs rw,seclabel,mode=755
> 72 23 0:20 /netns /run/netns rw,nosuid,nodev shared:22 - tmpfs tmpfs 
> rw,seclabel,mode=755
> ...
> [vagrant@localhost ~]$ sudo touch /var/run/netns/$$ && sudo mount --bind 
> /proc/self/ns/net /var/run/netns/$$
> [vagrant@localhost ~]$ cat /proc/self/mountinfo
> ...
> 23 58 0:20 / /run rw,nosuid,nodev shared:22 - tmpfs tmpfs rw,seclabel,mode=755
> 72 23 0:20 /netns /run/netns rw,nosuid,nodev shared:22 - tmpfs tmpfs 
> rw,seclabel,mode=755
> 74 72 0:3 / /run/netns/1526 rw shared:28 - nsfs nsfs rw
> 75 23 0:3 / /run/netns/1526 rw shared:28 - nsfs nsfs rw
> ```
> 
> As you can see above, a single bind mount creates two entries in the mount 
> table (`/run/netns/1526`). This is because /run/netns is in the same peer 
> group as /run. So a single mount operation under /run/netns will be 
> propergated to /run as well, creating two mounts. This will confuse the 
> recovery logic in the port mapping isolator.
> 
> 
> Diffs
> -
> 
>   src/slave/containerizer/mesos/isolators/network/port_mapping.cpp 
> 323c84a3d960a196d8ba87f753814e9d43a07957 
> 
> Diff: https://reviews.apache.org/r/45690/diff/
> 
> 
> Testing
> ---
> 
> sudo make check on Fedora 23
> 
> 
> Thanks,
> 
> Jie Yu
> 
>

Re: Review Request 45690: Ensured the bind mount root is a shared mount in its own peer group.

[Jie Yu]

---
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/45690/
---

(Updated April 5, 2016, 5:25 p.m.)


Review request for mesos, Ian Downes and Cong Wang.


Bugs: MESOS-4662
https://issues.apache.org/jira/browse/MESOS-4662


Repository: mesos


Description (updated)
---

This is for the port mapping isolator.

This is a simple test I did on a fresh Fedora23 box:
```
Jies-MacBook-Pro:fedora23 jie$ vagrant ssh
Last login: Mon Apr  4 17:27:28 2016 from 10.0.2.2
[vagrant@localhost ~]$ sudo mkdir /var/run/netns
[vagrant@localhost ~]$ cat /proc/self/mountinfo
...
23 58 0:20 / /run rw,nosuid,nodev shared:22 - tmpfs tmpfs rw,seclabel,mode=755
...
[vagrant@localhost ~]$ sudo mount --bind /var/run/netns /var/run/netns
[vagrant@localhost ~]$ cat /proc/self/mountinfo
...
23 58 0:20 / /run rw,nosuid,nodev shared:22 - tmpfs tmpfs rw,seclabel,mode=755
72 23 0:20 /netns /run/netns rw,nosuid,nodev shared:22 - tmpfs tmpfs 
rw,seclabel,mode=755
...
[vagrant@localhost ~]$ sudo touch /var/run/netns/$$ && sudo mount --bind 
/proc/self/ns/net /var/run/netns/$$
[vagrant@localhost ~]$ cat /proc/self/mountinfo
...
23 58 0:20 / /run rw,nosuid,nodev shared:22 - tmpfs tmpfs rw,seclabel,mode=755
72 23 0:20 /netns /run/netns rw,nosuid,nodev shared:22 - tmpfs tmpfs 
rw,seclabel,mode=755
74 72 0:3 / /run/netns/1526 rw shared:28 - nsfs nsfs rw
75 23 0:3 / /run/netns/1526 rw shared:28 - nsfs nsfs rw
```

As you can see above, a single bind mount creates two entries in the mount 
table (`/run/netns/1526`). This is because /run/netns is in the same peer group 
as /run. So a single mount operation under /run/netns will be propergated to 
/run as well, creating two mounts. This will confuse the recovery logic in the 
port mapping isolator.


Diffs
-

  src/slave/containerizer/mesos/isolators/network/port_mapping.cpp 
323c84a3d960a196d8ba87f753814e9d43a07957 

Diff: https://reviews.apache.org/r/45690/diff/


Testing
---

sudo make check on Fedora 23


Thanks,

Jie Yu

Re: Review Request 45690: Ensured the bind mount root is a shared mount in its own peer group.

[Cong Wang]

---
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/45690/#review127136
---




src/slave/containerizer/mesos/isolators/network/port_mapping.cpp (line 1963)


It is still not clear why we need to handle this case, at least I don't see 
Fedora needs it. If it is really needed by some distro, please add some 
comments to explain this.


- Cong Wang


On April 4, 2016, 5:30 p.m., Jie Yu wrote:
> 
> ---
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/45690/
> ---
> 
> (Updated April 4, 2016, 5:30 p.m.)
> 
> 
> Review request for mesos, Ian Downes and Cong Wang.
> 
> 
> Bugs: MESOS-4662
> https://issues.apache.org/jira/browse/MESOS-4662
> 
> 
> Repository: mesos
> 
> 
> Description
> ---
> 
> This is for the port mapping isolator.
> 
> 
> Diffs
> -
> 
>   src/slave/containerizer/mesos/isolators/network/port_mapping.cpp 
> 323c84a3d960a196d8ba87f753814e9d43a07957 
> 
> Diff: https://reviews.apache.org/r/45690/diff/
> 
> 
> Testing
> ---
> 
> sudo make check on Fedora 23
> 
> 
> Thanks,
> 
> Jie Yu
> 
>

Re: Review Request 45690: Ensured the bind mount root is a shared mount in its own peer group.

[Mesos ReviewBot]

---
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/45690/#review126947
---



Patch looks great!

Reviews applied: [45520, 45690]

Passed command: export OS='ubuntu:14.04' CONFIGURATION='--verbose' 
COMPILER='gcc' ENVIRONMENT='GLOG_v=1 MESOS_VERBOSE=1'; ./support/docker_build.sh

- Mesos ReviewBot


On April 4, 2016, 5:30 p.m., Jie Yu wrote:
> 
> ---
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/45690/
> ---
> 
> (Updated April 4, 2016, 5:30 p.m.)
> 
> 
> Review request for mesos, Ian Downes and Cong Wang.
> 
> 
> Bugs: MESOS-4662
> https://issues.apache.org/jira/browse/MESOS-4662
> 
> 
> Repository: mesos
> 
> 
> Description
> ---
> 
> This is for the port mapping isolator.
> 
> 
> Diffs
> -
> 
>   src/slave/containerizer/mesos/isolators/network/port_mapping.cpp 
> 323c84a3d960a196d8ba87f753814e9d43a07957 
> 
> Diff: https://reviews.apache.org/r/45690/diff/
> 
> 
> Testing
> ---
> 
> sudo make check on Fedora 23
> 
> 
> Thanks,
> 
> Jie Yu
> 
>

Review Request 45690: Ensured the bind mount root is a shared mount in its own peer group.

[Jie Yu]

---
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/45690/
---

Review request for mesos, Ian Downes and Cong Wang.


Bugs: MESOS-4662
https://issues.apache.org/jira/browse/MESOS-4662


Repository: mesos


Description
---

This is for the port mapping isolator.


Diffs
-

  src/slave/containerizer/mesos/isolators/network/port_mapping.cpp 
323c84a3d960a196d8ba87f753814e9d43a07957 

Diff: https://reviews.apache.org/r/45690/diff/


Testing
---

sudo make check on Fedora 23


Thanks,

Jie Yu