hanzoai/visor
2
0
Fork 0
mirror of https://github.com/hanzoai/visor.git synced 2026-09-24 17:04:14 +00:00
Code Issues Packages Projects Releases Wiki Activity

Enforce sidecar version matching.

Browse Source 
This ensures that users cannot accidentally pair a `runsc` binary from
one version and sidecar binaries from another.

PiperOrigin-RevId: 971780011
This commit is contained in:
Etienne Perot
2026-08-27 00:50:31 -07:00
committed by gVisor bot
parent 40aec290c1
commit cb0391d71f
2 changed files with 3 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
runsc/cmd/install.go
+2 -3
View File
@@ -66,9 +66,8 @@ func (i *Install) SetFlags(fs *flag.FlagSet) {
fs.BoolVar(&i.Experimental, "experimental", false, "enable/disable experimental features")
fs.BoolVar(&i.Clobber, "clobber", true, "clobber existing runtime configuration")
fs.StringVar(&i.CgroupDriver, "cgroupdriver", "", "docker cgroup driver")
// TODO(gvisor.dev/issue/13718): flip defaults to `IF_RELEASE_BUILD`.
i.DownloadSidecars = config.SidecarReleaseNever
i.RequireSidecars = config.SidecarReleaseNever
i.DownloadSidecars = config.SidecarReleaseIfReleaseBuild
i.RequireSidecars = config.SidecarReleaseIfReleaseBuild
fs.Var(&i.DownloadSidecars, "download-sidecars", "when to download missing sidecar binaries into gvisor-bin/ next to runsc: NEVER, ALWAYS, or IF_RELEASE_BUILD. This flag will go away in a few weeks! See gvisor.dev/issue/13718")
fs.Var(&i.RequireSidecars, "require-sidecars", "when missing sidecar binaries that cannot be installed are fatal: NEVER, ALWAYS, or IF_RELEASE_BUILD. This flag will go away in a few weeks! See gvisor.dev/issue/13718")
fs.StringVar(&i.SidecarURL, "sidecar-url", "", "download sidecar binaries from this gvisor.tar.bz2 URL instead of the release URL derived from the runsc version. This flag will go away in a few weeks! See gvisor.dev/issue/13718")
runsc/config/flags.go
+1 -2
View File
@@ -117,8 +117,7 @@ func RegisterFlags(flagSet *flag.FlagSet) {
flagSet.Bool("enable-core-tags", false, "enables core tagging. Requires host linux kernel >= 5.14.")
flagSet.String("pod-init-config", "", "path to configuration file with additional steps to take during pod creation.")
flagSet.Var(HostSettingsCheck.Ptr(), "host-settings", "how to handle non-optimal host kernel settings: check (default, advisory-only), ignore (do not check), adjust (best-effort auto-adjustment), or enforce (auto-adjustment must succeed).")
// TODO(gvisor.dev/issue/13718): flip default to `IF_RELEASE_BUILD`.
flagSet.Var(SidecarReleaseNever.Ptr(), "sidecar-release-enforcement-policy", "when spawned sidecar binaries must match runsc's release: NEVER, ALWAYS, or IF_RELEASE_BUILD. May be overridden by setting GVISOR_ENFORCE_RELEASE=SKIP as env var.")
flagSet.Var(SidecarReleaseIfReleaseBuild.Ptr(), "sidecar-release-enforcement-policy", "when spawned sidecar binaries must match runsc's release: NEVER, ALWAYS, or IF_RELEASE_BUILD. May be overridden by setting GVISOR_ENFORCE_RELEASE=SKIP as env var.")
flagSet.Var(SidecarUsageDefault.Ptr(), "sidecar-usage-policy", "policy for sidecar binaries: STRICT (sidecars must exist), LEGACY_DEPRECATED_SLOW_EMBEDDED_FALLBACK (use embedded fallbacks if sidecars are missing; will stop working after 2026-10). The DEFAULT policy will change to STRICT after 2026-09.")
flagSet.Var(RestoreSpecValidationEnforce.Ptr(), "restore-spec-validation", "how to handle spec validation during restore.")
flagSet.Bool("systrap-disable-syscall-patching", false, "disables syscall patching when using the Systrap platform. May be necessary to use in case the workload uses the GS register, or uses ptrace within gVisor. Has significant performance implications and is only recommended when the sandbox is known to run otherwise-incompatible workloads. Only relevant for x86.")