Repository navigation
fix(volume): keep verity volumes out of the data disk search - #1459
Merged
Merged
Conversation
dstack-prepare finds the app data disk by its partition label, dstack-data. A verity volume built by `dstack verity` used the same label for its data partition, so on a fresh CVM, whose data disk has no partition yet, the guest picked the volume and ran luksFormat on it. That failed only because the VMM attaches volumes read-only, and the CVM did not boot. Label the volume's data partition dstack-volume-data; the guest opens volume partitions by number, so nothing else reads the label. Old volumes keep the old label, so dstack-prepare also skips any disk with a dstack-volume partition, and refuses more than one dstack-data partition instead of taking the first. Signed-off-by: Kevin Wang <wy721@qq.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A verity volume labelled its data partition
dstack-data, the labeldstack-prepareuses to find the app data disk. On a fresh CVM, whose data disk has no partition yet, the guest picked the volume's p2 and ranluksFormaton it; the boot failed withFailed to setup luks volume(it only did not destroy the volume because the VMM attaches volumes read-only). Seen on v0.6.0 with a 490 GiB model volume;nexthas the same code.dstack veritylabels the data partitiondstack-volume-data. The guest opens volume partitions by number, so nothing else reads the label, and the verity root is unchanged.dstack-prepare.shskips disks carrying adstack-volumepartition, so volumes built by released versions are safe too, and refuses more than onedstack-datapartition instead of taking the first.Tested:
cargo test -p dstack-volume; the new selection on a synthetic sysfs (data disk only; data disk + old volume; old volume only on a fresh VM -> falls back to/dev/vdb; two data partitions -> error; new-label volume); the same failure worked around on a TDX CVM by relabelling the volume's p2.