fix(remount): ensure mountpoint is a file for files

[maxbrunet]

Fixes errors like:

error: temp remount: temp remount: bind mount /usr/bin/nvidia-smi => /.envbuilder/mnt/usr/bin/nvidia-smi: not a directory

Follow up to #183

[johnstcn]

Thanks for your contribution!

[maxbrunet]

Apparently that's not enough, maybe files need extra flags or something, I'll try to investigate:

error: temp remount: temp remount: bind mount /usr/bin/nvidia-smi => /.envbuilder/mnt/usr/bin/nvidia-smi: no such file or directory

research

[johnstcn]

Apparently that's not enough, maybe files need extra flags or something, I'll try to investigate:

error: temp remount: temp remount: bind mount /usr/bin/nvidia-smi => /.envbuilder/mnt/usr/bin/nvidia-smi: no such file or directory

What are you trying to accomplish exactly? Can you provide steps to reproduce?

[maxbrunet]

Fixed. The file mountpoint must exist

The main use case would probably usage of pod.spec.containers.volumeMounts.subPath where the subPath is a file and readOnly is also set.

But I'm experimenting with GPUs, the NVIDIA container runtime mounts a lot of things. Now I'm back to the known issue with Kaniko

pod.yaml

apiVersion: v1
kind: Pod
metadata:
  name: envbuilder 
spec:
  containers:
  - name: envbuilder
    image: ghcr.io/coder/envbuilder-preview
    env:
    - name: FALLBACK_IMAGE
      value: busybox
    - name: INIT_SCRIPT
      value: sh 
    resources:
      limits:
        nvidia.com/gpu: "1"
    securityContext:
      privileged: true

These paths need privileges to be remounted, I am thinking ignorePrefixes should be an extension of ignorePaths since there are ignored, it should not be needed to remount them. I can try that in a separate PR

envbuilder/envbuilder.go

Line 436 in b065656

ignorePrefixes := []string{tempRemountDest, "/proc", "/sys"}

Edit: I have a workaround for the Kaniko issue, I'll open a PR for that too

[johnstcn]

I added a couple of changes in a separate PR:

• Modified our existing integration test to correctly reproduce the issue you mention (we weren't mounting RO) 734cefc
• Added IgnorePaths when performing temp remount 20c0145

Let me know if this looks good to you! If you're happy, you can cherry-pick those commits into this PR or we can continue with the other one!

[johnstcn]

ah, nice catch 👍

[maxbrunet]

Hehe yes, it was ignoring everything 😅

[maxbrunet]

Thank you @johnstcn, this looks good to me. There is more to consider for NVIDIA and I am not sure ignorePaths will solve everything, but I'll get into the specifics on the related issue, I don't want to sidetrack this PR too much :)

[johnstcn]

Thanks for the collaboration @maxbrunet!

[guidogagl]

Apparently that's not enough, maybe files need extra flags or something, I'll try to investigate:

error: temp remount: temp remount: bind mount /usr/bin/nvidia-smi => /.envbuilder/mnt/usr/bin/nvidia-smi: no such file or directory

Hi, how did you solve this? I'm running into the same issue at the moment and I'm stuck :S