Time Namespace

[CheatCodeSam]

Description

Adding the time namespace.

Type of Change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation update
• Refactoring (no functional changes)
• Performance improvement
• Test updates
• CI/CD related changes
• Other (please describe):

Testing

• Added new unit tests
• Added new integration tests
• Ran existing test suite
• Tested manually (please provide steps)

Related Issues

Fixes #3259

Additional Context

[CheatCodeSam]

Hello @saku3, This should be done in terms of implementation. I'm just curious what I should add the integration tests. I have one test where it just checks if a container with a time namespace can be created at all.

[CheatCodeSam]

Works on my machine :(, using the same binary as the one built by the ci above. Weird fluke? Logs aren't helpful.

[saku3]

Thank you for the implementation.
For integration tests, you can refer to the following.
https://github.com/opencontainers/runc/blob/main/tests/integration/timens.bats

The oci-validation-go tests occasionally fail, so I think it’s fine not to worry about them for now.”

[CheatCodeSam]

Integration tests are done, it should be worth checking this out now.

[saku3]

@CheatCodeSam
Sorry for the late review.
I’d appreciate it if you could resolve the conflicts.

[CheatCodeSam]

Good to go

[utam0k]

@saku3 Could I ask you to review this PR as the first reviewer?

[saku3]

Sure, I can review it.

[saku3]

Thank you for creating this PR.
I’ve left a few comments, so I’d appreciate it if you could take a look.

Also, based on my local testing, the behavior of exec didn’t seem to work correctly, so could you please check it?

$ youki run -b tutorial a
$ cat /proc/self/timens_offsets
monotonic      172800        33
boottime       604800        67

another terminal

$ youki exec a cat /proc/self/timens_offsets
monotonic           0         0
boottime            0         0

[CheatCodeSam]

Works on my machine, :( This is ready for re-review

[saku3]

It looks good to me. Thank you.

PTAL @utam0k

[utam0k]

In dark mode, the black color blends into the background and is hard to see.

[utam0k]

Suggested change

	pub fn validate_time_namespace(spec: &Spec) -> Result<(), LibcontainerError> {
	let linux = match spec.linux() {
	Some(l) => l,
	None => return Ok(()),
	};
	match linux.time_offsets() {
	Some(s) if !s.is_empty() => s,
	_ => return Ok(()),
	};
	linux
	.namespaces()
	.as_ref()
	.and_then(|nss| nss.iter().find(|ns| ns.typ() == LinuxNamespaceType::Time))
	.ok_or(LibcontainerError::InvalidSpec(
	crate::error::ErrInvalidSpec::TimeNamespace,
	))?;
	Ok(())
	}
	pub fn validate_time_namespace(spec: &Spec) -> Result<(), LibcontainerError> {
	if let Some(linux) = spec.linux() {
	if linux.time_offsets().is_some() {
	linux
	.namespaces()
	.as_ref()
	.and_then(|nss| nss.iter().find(|ns| ns.typ() == LinuxNamespaceType::Time))
	.ok_or(LibcontainerError::InvalidSpec(
	crate::error::ErrInvalidSpec::TimeNamespace,
	))?;
	}
	}
	Ok(())
	}

[CheatCodeSam]

Thank you, I was trying to figure out a good way to do this

[utam0k]

What if the main process is running rootless?

[utam0k]

Also, I'm not sure why the intermediate process doesn't writes the offset directly.

[saku3]

Also, I'm not sure why the intermediate process doesn't writes the offset directly.

It follows runc’s implementation: even if we switch user namespaces, the owner of /proc/self/timens_offsets does not change, so the intermediate process cannot write to it and the write is done in the main process.

Ref: opencontainers/runc@e6fb7fe

[utam0k]

I see. Thanks!

[saku3]

@CheatCodeSam
How’s the status on this?

From what I can see, it looks like only a small number of changes are needed.

[CheatCodeSam]

Hey, sorry I started a new job. I'll fix it this week

[utam0k]

Hey, sorry I started a new job. I'll fix it this week

@CheatCodeSam
Please don't worry. Put your own life first.
If it seems difficult, please let me know. I'm here to help. Thanks for your contribution!