Shorten the socket path on runcJailer

The max length of the Unix domain socket path is 108 bytes. We need to
use an relative path to workaround the limitation.

Signed-off-by: Kazuyoshi Kato <katokazu@amazon.com>

Author: Kazuyoshi Kato

runtime/runc_jailer.go

@@ -156,7 +156,7 @@ func (j *runcJailer) BuildJailedMachine(cfg *config.Config, machineConfig *firec
 func (j *runcJailer) BuildJailedRootHandler(cfg *config.Config, machineConfig *firecracker.Config, vmID string) firecracker.Handler {
 	ociBundlePath := j.OCIBundlePath()
 	rootPath := j.RootPath()
-	machineConfig.SocketPath = filepath.Join(rootPath, "api.socket")
+	machineConfig.SocketPath = filepath.Join(rootfsFolder, "api.socket")
 
 	return firecracker.Handler{
 		Name: jailerHandlerName,

runtime/service_integ_test.go

@@ -583,35 +583,69 @@ func TestLongUnixSocketPath_Isolated(t *testing.T) {
 	// default location we store state results in a path like
 	// "/run/firecracker-containerd/default/<vmID>" (with len 112).
 	const maxUnixSockLen = 108
-	vmID := strings.Repeat("x", 76)
+	vmID := strings.Repeat("x", 72)
 
 	ctx := namespaces.WithNamespace(context.Background(), "default")
 
 	pluginClient, err := ttrpcutil.NewClient(containerdSockPath + ".ttrpc")
 	require.NoError(t, err, "failed to create ttrpc client")
 
-	fcClient := fccontrol.NewFirecrackerClient(pluginClient.Client())
-	_, err = fcClient.CreateVM(ctx, &proto.CreateVMRequest{
-		VMID:              vmID,
-		NetworkInterfaces: []*proto.FirecrackerNetworkInterface{},
-	})
-	require.NoError(t, err, "failed to create VM")
+	subtests := []struct {
+		name    string
+		request proto.CreateVMRequest
+	}{
+		{
+			name: "Without Jailer",
+			request: proto.CreateVMRequest{
+				VMID:              vmID + "noop",
+				NetworkInterfaces: []*proto.FirecrackerNetworkInterface{},
+			},
+		},
+		{
+			name: "With Jailer",
+			request: proto.CreateVMRequest{
+				// We somehow cannot use the same VM ID here.
+				// https://github.com/firecracker-microvm/firecracker-containerd/issues/409
+				VMID:              vmID + "jail",
+				NetworkInterfaces: []*proto.FirecrackerNetworkInterface{},
+				JailerConfig: &proto.JailerConfig{
+					UID: 30000,
+					GID: 30000,
+				},
+			},
+		},
+	}
 
-	// double-check that the sockets are at the expected path and that their absolute
-	// length exceeds 108 bytes
-	shimDir, err := vm.ShimDir(cfg.ShimBaseDir, "default", vmID)
-	require.NoError(t, err, "failed to get shim dir")
+	fcClient := fccontrol.NewFirecrackerClient(pluginClient.Client())
+	for _, subtest := range subtests {
+		request := subtest.request
+		vmID := request.VMID
+		t.Run(subtest.name, func(t *testing.T) {
+			_, err = fcClient.CreateVM(ctx, &request)
+			require.NoError(t, err, "failed to create VM")
+
+			// double-check that the sockets are at the expected path and that their absolute
+			// length exceeds 108 bytes
+			shimDir, err := vm.ShimDir(cfg.ShimBaseDir, "default", vmID)
+			require.NoError(t, err, "failed to get shim dir")
+
+			if request.JailerConfig == nil {
+				_, err = os.Stat(shimDir.FirecrackerSockPath())
+				require.NoError(t, err, "failed to stat firecracker socket path")
+				if len(shimDir.FirecrackerSockPath()) <= maxUnixSockLen {
+					assert.Failf(t, "firecracker sock absolute path %q is not greater than max unix socket path length", shimDir.FirecrackerSockPath())
+				}
 
-	_, err = os.Stat(shimDir.FirecrackerSockPath())
-	require.NoError(t, err, "failed to stat firecracker socket path")
-	if len(shimDir.FirecrackerSockPath()) <= maxUnixSockLen {
-		assert.Failf(t, "firecracker sock absolute path %q is not greater than max unix socket path length", shimDir.FirecrackerSockPath())
-	}
+				_, err = os.Stat(shimDir.FirecrackerVSockPath())
+				require.NoError(t, err, "failed to stat firecracker vsock path")
+				if len(shimDir.FirecrackerVSockPath()) <= maxUnixSockLen {
+					assert.Failf(t, "firecracker vsock absolute path %q is not greater than max unix socket path length", shimDir.FirecrackerVSockPath())
+				}
+			}
 
-	_, err = os.Stat(shimDir.FirecrackerVSockPath())
-	require.NoError(t, err, "failed to stat firecracker vsock path")
-	if len(shimDir.FirecrackerVSockPath()) <= maxUnixSockLen {
-		assert.Failf(t, "firecracker vsock absolute path %q is not greater than max unix socket path length", shimDir.FirecrackerVSockPath())
+			_, err = fcClient.StopVM(ctx, &proto.StopVMRequest{VMID: vmID})
+			require.NoError(t, err)
+		})
 	}
 }