Skip to content

Conversation

@HirazawaUi
Copy link
Contributor

@HirazawaUi HirazawaUi commented Dec 13, 2025

What type of PR is this?

/kind cleanup

What this PR does / why we need it:

Follow up on PR #9634 to clean up redundant code

Which issue(s) this PR fixes:

Special notes for your reviewer:

Does this PR introduce a user-facing change?

None

Summary by CodeRabbit

  • Refactor
    • Simplified how container user-namespace settings are determined and passed to system filesystem mounting logic, reducing internal complexity.
    • Streamlined sysfs/cgroup mount decision paths so mounts depend on network and user-namespace mode more directly, while preserving existing privileged-container behavior.

✏️ Tip: You can customize this high-level summary in your review settings.

@HirazawaUi HirazawaUi requested a review from mrunalp as a code owner December 13, 2025 16:28
@openshift-ci openshift-ci bot added release-note-none Denotes a PR that doesn't merit a release note. kind/cleanup Categorizes issue or PR as related to cleaning up code, process, or technical debt. dco-signoff: yes Indicates the PR's author has DCO signed all their commits. labels Dec 13, 2025
@openshift-ci openshift-ci bot added the needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. label Dec 13, 2025
@openshift-ci
Copy link
Contributor

openshift-ci bot commented Dec 13, 2025

Hi @HirazawaUi. Thanks for your PR.

I'm waiting for a github.com member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@coderabbitai
Copy link

coderabbitai bot commented Dec 13, 2025

Walkthrough

Refactors addSysfsMounts usage and signatures: callers derive a boolean usernsEnabled from container ID mappings instead of passing mapping objects and sandbox; platform-specific implementations updated to accept (hostNet, usernsEnabled) and Linux logic now branches on that flag for /sys and cgroup mounts.

Changes

Cohort / File(s) Summary
Calling code refactor
server/container_create.go
Removes call to getSandboxIDMappings(...) and its error handling; computes usernsEnabled = containerIDMappings != nil and updates addSysfsMounts(...) invocation to pass booleans instead of sandbox and mapping objects.
Signature updates (cross-platform)
server/container_create_freebsd.go, server/container_create_linux.go
Changes addSysfsMounts signature to accept hostNet, usernsEnabled bool instead of sb *sandbox.Sandbox and containerIDMappings *idtools.IDMappings. FreeBSD implementation body kept empty; signature adjusted.
Linux-specific mount logic
server/container_create_linux.go
Removes internal mapping-derived userns detection; uses usernsEnabled parameter. When hostNet is true, branches on usernsEnabled to choose bind vs. sysfs mounts for /sys and whether /sys/fs/cgroup is mounted as cgroup; preserves privileged-container handling.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

  • Areas requiring attention:
    • Confirm usernsEnabled = containerIDMappings != nil preserves original semantics in all paths.
    • Validate Linux mount branching (bind vs sysfs and cgroup mounts) matches prior behavior for hostNet/userns/privileged combinations.
    • Ensure removal of getSandboxIDMappings() error handling doesn't hide important error cases.

Possibly related PRs

Suggested labels

ok-to-test

Suggested reviewers

  • mrunalp
  • QiWang19

Poem

🐰 I hopped through mounts and flags today,
Mappings folded into a boolean way.
/sys now listens to hostNet and userns true,
Simpler calls — a cleaner view! 🥕

Pre-merge checks and finishing touches

❌ Failed checks (1 warning)
Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. You can run @coderabbitai generate docstrings to improve docstring coverage.
✅ Passed checks (2 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title accurately reflects the main change: refactoring to eliminate redundant code by replacing sandbox and mapping parameter passing with a derived boolean.
✨ Finishing touches
  • 📝 Generate docstrings
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Post copyable unit tests in a comment

📜 Recent review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between e862125 and 01b2c74.

📒 Files selected for processing (3)
  • server/container_create.go (1 hunks)
  • server/container_create_freebsd.go (1 hunks)
  • server/container_create_linux.go (1 hunks)
🚧 Files skipped from review as they are similar to previous changes (1)
  • server/container_create_freebsd.go
🧰 Additional context used
📓 Path-based instructions (1)
**/*.go

📄 CodeRabbit inference engine (AGENTS.md)

**/*.go: Use interface-based design and dependency injection patterns in Go code
Propagate context.Context through function calls in Go code
Use fmt.Errorf with %w for error wrapping in Go code
Use logrus with structured fields for logging in Go code
Add comments explaining 'why' not 'what' in Go code
Use platform-specific file naming: *_{linux,freebsd}.go for platform-dependent code

Files:

  • server/container_create.go
  • server/container_create_linux.go
🧬 Code graph analysis (1)
server/container_create_linux.go (1)
internal/oci/container.go (1)
  • Container (44-92)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (44)
  • GitHub Check: rpm-build:centos-stream-9-x86_64:fedora-rawhide
  • GitHub Check: rpm-build:fedora-43-aarch64:fedora-rawhide
  • GitHub Check: rpm-build:fedora-43-x86_64:fedora-rawhide
  • GitHub Check: rpm-build:fedora-rawhide-aarch64:fedora-rawhide
  • GitHub Check: rpm-build:fedora-rawhide-x86_64:fedora-rawhide
  • GitHub Check: rpm-build:centos-stream-9-aarch64:fedora-rawhide
  • GitHub Check: integration / userns / crun / amd64
  • GitHub Check: critest / conmon-rs / crun / amd64
  • GitHub Check: critest / conmon-rs / crun / arm64
  • GitHub Check: integration / conmon-rs / crun / amd64
  • GitHub Check: critest / conmon / crun / arm64
  • GitHub Check: integration / conmon / crun / amd64
  • GitHub Check: critest / conmon / crun / amd64
  • GitHub Check: integration / conmon / crun / arm64
  • GitHub Check: rpm-build:fedora-rawhide-x86_64:fedora-rawhide
  • GitHub Check: rpm-build:centos-stream-9-aarch64:fedora-rawhide
  • GitHub Check: rpm-build:fedora-43-x86_64:fedora-rawhide
  • GitHub Check: rpm-build:fedora-rawhide-aarch64:fedora-rawhide
  • GitHub Check: rpm-build:centos-stream-9-x86_64:fedora-rawhide
  • GitHub Check: rpm-build:fedora-43-aarch64:fedora-rawhide
  • GitHub Check: rpm-build:fedora-rawhide-x86_64:fedora-rawhide
  • GitHub Check: rpm-build:fedora-43-x86_64:fedora-rawhide
  • GitHub Check: rpm-build:centos-stream-9-x86_64:fedora-rawhide
  • GitHub Check: rpm-build:fedora-rawhide-aarch64:fedora-rawhide
  • GitHub Check: rpm-build:fedora-43-aarch64:fedora-rawhide
  • GitHub Check: rpm-build:centos-stream-9-aarch64:fedora-rawhide
  • GitHub Check: rpm-build:fedora-43-x86_64:fedora-rawhide
  • GitHub Check: rpm-build:centos-stream-9-aarch64:fedora-rawhide
  • GitHub Check: build static / ppc64le
  • GitHub Check: build static / s390x
  • GitHub Check: unit / amd64 / root
  • GitHub Check: build static / amd64
  • GitHub Check: codeql-build
  • GitHub Check: unit / amd64 / rootless
  • GitHub Check: unit / arm64 / root
  • GitHub Check: build
  • GitHub Check: build static / arm64
  • GitHub Check: security-checks
  • GitHub Check: rpm-build:fedora-rawhide-aarch64:fedora-rawhide
  • GitHub Check: rpm-build:fedora-rawhide-x86_64:fedora-rawhide
  • GitHub Check: rpm-build:centos-stream-9-x86_64:fedora-rawhide
  • GitHub Check: rpm-build:fedora-43-aarch64:fedora-rawhide
  • GitHub Check: docs
  • GitHub Check: lint
🔇 Additional comments (3)
server/container_create.go (1)

796-797: LGTM! Clean refactoring that reduces coupling.

The derivation of usernsEnabled from containerIDMappings != nil is correct and simplifies the addSysfsMounts interface by passing a boolean instead of the full mappings object and sandbox reference.

server/container_create_linux.go (2)

872-872: Signature change improves the interface.

The updated signature accepting hostNet and usernsEnabled booleans instead of deriving usernsEnabled internally reduces coupling and makes the function's dependencies explicit.


874-916: Verify whether duplicate mount destinations are handled safely by the OCI runtime.

Both conditional branches execute independently: the first (lines 874-900) adds a /sys mount when hostNet is true, and the second (lines 902-916) unconditionally adds /sys and cgroup mounts when ctr.Privileged() is true. For containers that are both host-networked and privileged, /sys would be added twice with different mount options (bind mount with ro vs sysfs with rw).

Clarify whether:

  • The OCI runtime accepts and handles duplicate mount destinations gracefully, or
  • The last mount definition overrides earlier ones, or
  • This scenario should be prevented with an early return or mutual exclusivity check

Comment @coderabbitai help to get the list of available commands and usage tips.

@codecov
Copy link

codecov bot commented Dec 13, 2025

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 67.13%. Comparing base (2e590ab) to head (01b2c74).
⚠️ Report is 27 commits behind head on main.

Additional details and impacted files
@@            Coverage Diff             @@
##             main    #9660      +/-   ##
==========================================
- Coverage   67.28%   67.13%   -0.15%     
==========================================
  Files         208      208              
  Lines       28983    28978       -5     
==========================================
- Hits        19500    19454      -46     
- Misses       7819     7863      +44     
+ Partials     1664     1661       -3     
🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

}
}()

containerMappings, err := s.getSandboxIDMappings(ctx, sb)
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I noticed that the variable containerIDMappings has already been created in this function, so I cleaned it up :)

@HirazawaUi
Copy link
Contributor Author

/assign @haircommander

@HirazawaUi
Copy link
Contributor Author

/ok-to-test

@openshift-ci
Copy link
Contributor

openshift-ci bot commented Dec 13, 2025

@HirazawaUi: Cannot trigger testing until a trusted user reviews the PR and leaves an /ok-to-test message.

Details

In response to this:

/ok-to-test

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@bitoku
Copy link
Contributor

bitoku commented Dec 15, 2025

/ok-to-test

@openshift-ci openshift-ci bot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Dec 15, 2025
@HirazawaUi
Copy link
Contributor Author

/retest

@bitoku
Copy link
Contributor

bitoku commented Dec 16, 2025

/lgtm
/retest

@openshift-ci openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Dec 16, 2025
@HirazawaUi
Copy link
Contributor Author

/retest

@bitoku
Copy link
Contributor

bitoku commented Dec 22, 2025

@cri-o/cri-o-maintainers PTAL

@haircommander
Copy link
Member

/approve

thank you!

@openshift-ci
Copy link
Contributor

openshift-ci bot commented Dec 22, 2025

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: haircommander, HirazawaUi

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Dec 22, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. dco-signoff: yes Indicates the PR's author has DCO signed all their commits. kind/cleanup Categorizes issue or PR as related to cleaning up code, process, or technical debt. lgtm Indicates that a PR is ready to be merged. ok-to-test Indicates a non-member PR verified by an org member that is safe to test. release-note-none Denotes a PR that doesn't merit a release note.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants