Merge pull request #9563 from adrianreber/2025-11-03-passwd

openshift-merge-bot[bot] · web-flow · commit 93cc2c78f27b · 2025-12-10T01:45:30.000Z
OCPBUGS-62150: server: ignore /etc/passwd mount
diff --git a/server/container_restore.go b/server/container_restore.go
@@ -272,6 +272,8 @@ func (s *Server) CRImportCheckpoint(
 		"/dev/shm":           true,
 		"/etc/resolv.conf":   true,
 		"/etc/hostname":      true,
+		"/etc/passwd":        true,
+		"/etc/group":         true,
 		"/run/secrets":       true,
 		"/run/.containerenv": true,
 	}
diff --git a/test/checkpoint.bats b/test/checkpoint.bats
@@ -174,3 +174,44 @@ function teardown() {
 	[[ "$container_name" == "restored-sleep-container" ]]
 	[[ "$pod_name" == "restoresandbox2" ]]
 }
+
+@test "checkpoint and restore: /etc/passwd uses Kubernetes run_as_user on restore" {
+	CONTAINER_ENABLE_CRIU_SUPPORT=true start_crio
+	pod_id=$(crictl runp "$TESTDATA"/sandbox_config.json)
+	# Create container with run_as_user=1001
+	START_JSON=$(mktemp)
+	jq '.linux.security_context.run_as_user.value = 1001
+		| .command=["/bin/sh"]
+		| .args=["-c","sleep inf"]' \
+		"$TESTDATA"/container_sleep.json > "$START_JSON"
+	ctr_id=$(crictl create "$pod_id" "$START_JSON" "$TESTDATA"/sandbox_config.json)
+	crictl start "$ctr_id"
+	# Verify the UID of the running process
+	run crictl exec "$ctr_id" id
+	[[ "$output" == *"uid=1001"* ]]
+	# Verify /etc/passwd contains entry for UID 1001
+	run crictl exec "$ctr_id" cat /etc/passwd
+	[[ "$output" == *"1001"* ]]
+	# Checkpoint the container
+	crictl checkpoint --export="$TESTDIR"/cp.tar "$ctr_id"
+	crictl rm -f "$ctr_id"
+	crictl rmp -f "$pod_id"
+	pod_id=$(crictl runp "$TESTDATA"/sandbox_config.json)
+	RESTORE_JSON=$(mktemp)
+	jq '.image.image="'"$TESTDIR"'/cp.tar"
+		| .linux.security_context.run_as_user.value = 1001' \
+		"$TESTDATA"/container_sleep.json > "$RESTORE_JSON"
+	ctr_id=$(crictl create "$pod_id" "$RESTORE_JSON" "$TESTDATA"/sandbox_config.json)
+	crictl start "$ctr_id"
+	# Verify that the container was restored
+	restored=$(crictl inspect --output go-template --template "{{(index .info.restored)}}" "$ctr_id")
+	[[ "$restored" == "true" ]]
+	# Verify the UID is still 1001
+	run crictl exec "$ctr_id" id
+	[[ "$output" == *"uid=1001"* ]]
+	run crictl exec "$ctr_id" cat /etc/passwd
+	[[ "$output" == *"1001"* ]]
+	# Cleanup
+	rm -f "$START_JSON"
+	rm -f "$RESTORE_JSON"
+}

Original file line number	Diff line number	Diff line change
`@@ -272,6 +272,8 @@ func (s *Server) CRImportCheckpoint(`
`272`	`272`	`"/dev/shm": true,`
`273`	`273`	`"/etc/resolv.conf": true,`
`274`	`274`	`"/etc/hostname": true,`
	`275`	`+ "/etc/passwd": true,`
	`276`	`+ "/etc/group": true,`
`275`	`277`	`"/run/secrets": true,`
`276`	`278`	`"/run/.containerenv": true,`
`277`	`279`	`}`