forked from docker-archive/runc
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
The current implementation sets all the environment variables passed in Process.Env in the current process, one by one, then uses os.Environ to read those back. As pointed out in [1], this is slow, as runc calls os.Setenv for every variable, and there may be a few thousands of those. Looking into how os.Setenv is implemented, it is indeed slow, especially when cgo is enabled. Looking into why it was implemented, I found commit 9744d72 and traced it to [2], which discusses the actual reasons. At the time were: - HOME is not passed into container as it is set in setupUser by os.Setenv and has no effect on config.Env; - there is no deduplication of environment variables. Yet it was decided to not go ahead with this patch, but later [3] was merged with the carry of this patch. Now, from what I see: 1. Passing environment to exec is way faster than using os.Setenv and os.Environment() (tests show ~20x faster in simple Go test, and 2x faster in real-world test, see below). 2. Setting environment variables in the runc context can result is ugly side effects (think GODEBUG). 3. Nothing in runtime spec says that the environment needs to be deduplicated, or the order of preference (whether the first or the last value of a variable with the same name is to be used). In C (Linux/glibc), the first value is used. In Go, it's the last one. We should probably stick to what we have in order to maintain backward compatibility. This patch: - switches to passing env directly to exec; - adds deduplication mechanism to retain backward compatibility; - sets PATH from process.Env in the current process; - adds HOME to process.Env if not set; - removes os.Clearenv call as it's no longer needed. The benchmark added by the previous commit shows 2x improvement: name old time/op new time/op delta ExecInBigEnv-20 60.2ms ± 2% 27.4ms ±20% -54.42% (p=0.000 n=8+9) The remaining questions are: - are there any potential regressions (for example, from not setting values from process.Env to the current process); - should deduplication show warnings (maybe promoted to errors later); - whether a default for PATH (e.g "/bin:/usr/bin" should be added, when PATH is not set. [1]: opencontainers#1983 [2]: docker-archive/libcontainer#418 [3]: docker-archive/libcontainer#432 Signed-off-by: Kir Kolyshkin <[email protected]>
- Loading branch information
Showing
5 changed files
with
115 additions
and
47 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,53 @@ | ||
| package libcontainer | ||
|
|
||
| import ( | ||
| "errors" | ||
| "fmt" | ||
| "os" | ||
| "slices" | ||
| "strings" | ||
| ) | ||
|
|
||
| // prepareEnv checks supplied environment variables for validity, removes | ||
| // duplicates (leaving the last value only), and sets PATH from env, if found. | ||
| // Returns the deduplicated environment, and a flag telling if HOME is found. | ||
| func prepareEnv(env []string) ([]string, bool, error) { | ||
| if env == nil { | ||
| return nil, false, nil | ||
| } | ||
| // Deduplication code based on dedupEnv from Go 1.22 os/exec. | ||
|
|
||
| // Construct the output in reverse order, to preserve the | ||
| // last occurrence of each key. | ||
| out := make([]string, 0, len(env)) | ||
| saw := make(map[string]bool, len(env)) | ||
| for n := len(env); n > 0; n-- { | ||
| kv := env[n-1] | ||
| i := strings.IndexByte(kv, '=') | ||
| if i == -1 { | ||
| return nil, false, errors.New("invalid environment variable: missing '='") | ||
| } | ||
| if i == 0 { | ||
| return nil, false, errors.New("invalid environment variable: name cannot be empty") | ||
| } | ||
| key := kv[:i] | ||
| if saw[key] { // Duplicate. | ||
| continue | ||
| } | ||
| saw[key] = true | ||
| if strings.IndexByte(kv, 0) >= 0 { | ||
| return nil, false, fmt.Errorf("invalid environment variable %q: contains nul byte (\\x00)", key) | ||
| } | ||
| if key == "PATH" { | ||
| // Needs to be set as it is used for binary lookup. | ||
| if err := os.Setenv("PATH", kv[5:]); err != nil { | ||
| return nil, false, err | ||
| } | ||
| } | ||
| out = append(out, kv) | ||
| } | ||
| // Restore the original order. | ||
| slices.Reverse(out) | ||
|
|
||
| return out, saw["HOME"], nil | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,40 @@ | ||
| package libcontainer | ||
|
|
||
| import ( | ||
| "slices" | ||
| "testing" | ||
| ) | ||
|
|
||
| func TestPrepareEnvDedup(t *testing.T) { | ||
| tests := []struct { | ||
| env, wantEnv []string | ||
| }{ | ||
| { | ||
| env: []string{}, | ||
| wantEnv: []string{}, | ||
| }, | ||
| { | ||
| env: []string{"HOME=/root", "FOO=bar"}, | ||
| wantEnv: []string{"HOME=/root", "FOO=bar"}, | ||
| }, | ||
| { | ||
| env: []string{"A=a", "A=b", "A=c"}, | ||
| wantEnv: []string{"A=c"}, | ||
| }, | ||
| { | ||
| env: []string{"TERM=vt100", "HOME=/home/one", "HOME=/home/two", "TERM=xterm", "HOME=/home/three", "FOO=bar"}, | ||
| wantEnv: []string{"TERM=xterm", "HOME=/home/three", "FOO=bar"}, | ||
| }, | ||
| } | ||
|
|
||
| for _, tc := range tests { | ||
| env, _, err := prepareEnv(tc.env) | ||
| if err != nil { | ||
| t.Error(err) | ||
| continue | ||
| } | ||
| if !slices.Equal(env, tc.wantEnv) { | ||
| t.Errorf("want %v, got %v", tc.wantEnv, env) | ||
| } | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters