- What I did
Use refcounted mounter introduced in#45698 when doing diff and export. This is to reuse already mounted rootfs of a container and avoid breaking overlay by mounting an workdir layer as a lowerdir of other mounts.

Also added an integration test to verify.

- How I did it
See individual commits.

- How to verify it

$ make DOCKER_GRAPHDRIVER=overlayfs TEST_INTEGRATION_USE_SNAPSHOTTER=1 TEST_FILTER='TestOverlayfs' test-integration

Test with#45698 reverted

INFO: Testing against a local daemon=== RUN   TestOverlayfs=== RUN   TestOverlayfs/diff    overlayfs_test.go:80: diff caused overlayfs kernel warning: <4>[520803.140901] overlayfs: lowerdir is in-use as upperdir/workdir of another mount, accessing files from both mounts will result in undefined behavior.=== RUN   TestOverlayfs/export    overlayfs_test.go:80: export caused overlayfs kernel warning: <4>[520803.156318] overlayfs: upperdir is in-use as upperdir/workdir of another mount, accessing files from both mounts will result in undefined behavior.    overlayfs_test.go:80: export caused overlayfs kernel warning: <4>[520803.156462] overlayfs: workdir is in-use as upperdir/workdir of another mount, accessing files from both mounts will result in undefined behavior.=== RUN   TestOverlayfs/cp_to_container    overlayfs_test.go:80: cp to container caused overlayfs kernel warning: <4>[520803.177945] overlayfs: upperdir is in-use as upperdir/workdir of another mount, accessing files from both mounts will result in undefined behavior.    overlayfs_test.go:80: cp to container caused overlayfs kernel warning: <4>[520803.178382] overlayfs: workdir is in-use as upperdir/workdir of another mount, accessing files from both mounts will result in undefined behavior.=== RUN   TestOverlayfs/cp_from_container    overlayfs_test.go:80: cp from container caused overlayfs kernel warning: <4>[520803.193088] overlayfs: upperdir is in-use as upperdir/workdir of another mount, accessing files from both mounts will result in undefined behavior.    overlayfs_test.go:80: cp from container caused overlayfs kernel warning: <4>[520803.193471] overlayfs: workdir is in-use as upperdir/workdir of another mount, accessing files from both mounts will result in undefined behavior.--- FAIL: TestOverlayfs (1.07s)    --- FAIL: TestOverlayfs/diff (0.02s)    --- FAIL: TestOverlayfs/export (0.02s)    --- FAIL: TestOverlayfs/cp_to_container (0.02s)    --- FAIL: TestOverlayfs/cp_from_container (0.02s)FAIL

Before this PR

INFO: Testing against a local daemon=== RUN   TestOverlayfs=== RUN   TestOverlayfs/diff    overlayfs_test.go:80: diff caused overlayfs kernel warning: <4>[520341.301322] overlayfs: lowerdir is in-use as upperdir/workdir of another mount, accessing files from both mounts will result in undefined behavior.=== RUN   TestOverlayfs/export    overlayfs_test.go:80: export caused overlayfs kernel warning: <4>[520341.314918] overlayfs: upperdir is in-use as upperdir/workdir of another mount, accessing files from both mounts will result in undefined behavior.    overlayfs_test.go:80: export caused overlayfs kernel warning: <4>[520341.315250] overlayfs: workdir is in-use as upperdir/workdir of another mount, accessing files from both mounts will result in undefined behavior.=== RUN   TestOverlayfs/cp_to_container=== RUN   TestOverlayfs/cp_from_container--- FAIL: TestOverlayfs (1.02s)    --- FAIL: TestOverlayfs/diff (0.02s)    --- FAIL: TestOverlayfs/export (0.02s)    --- PASS: TestOverlayfs/cp_to_container (0.01s)    --- PASS: TestOverlayfs/cp_from_container (0.01s)FAIL

After this PR

INFO: Testing against a local daemon=== RUN   TestOverlayfs=== RUN   TestOverlayfs/diff=== RUN   TestOverlayfs/export=== RUN   TestOverlayfs/cp_to_container=== RUN   TestOverlayfs/cp_from_container--- PASS: TestOverlayfs (1.07s)    --- PASS: TestOverlayfs/diff (0.04s)    --- PASS: TestOverlayfs/export (0.02s)    --- PASS: TestOverlayfs/cp_to_container (0.01s)    --- PASS: TestOverlayfs/cp_from_container (0.01s)PASSDONE 5 tests in 3.427s

- Description for the changelog

- A picture of a cute animal (not mandatory but encouraged)

vvoland added3 commits

August 18, 2023 15:32

integration: Add test for not breaking overlayfs

54953f2

Check that operations that could potentially perform overlayfs mountsthat could cause undefined behaviors.Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>(cherry picked from commit303e2b1)Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>

c8d/export: Use ref counted mounter

b76a0c7

To prevent mounting the container rootfs in a rw mode if it's alreadymounted.  This can't use `mount.WithReadonlyTempMount` because thearchive code does a chroot with a pivot_root, which creates a newdirectory in the rootfs.Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>(cherry picked from commit051d51b)Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>

c8d/diff: Reuse mount, mount parent as read-only

74bf46a

The container rw layer may already be mounted, so it's not safe to useit in another overlay mount. Use the ref counted mounter (which willreuse the existing mount if it exists) to avoid that.Also, mount the parent mounts (layers of the base image) in a read-onlymode.Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>(cherry picked from commit6da42ca)Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>