github.com/demonoid81/moby@v0.0.0-20200517203328-62dd8e17c460/daemon/graphdriver/aufs/aufs.go (about)

     1  // +build linux
     2  
     3  /*
     4  
     5  aufs driver directory structure
     6  
     7    .
     8    ├── layers // Metadata of layers
     9    │   ├── 1
    10    │   ├── 2
    11    │   └── 3
    12    ├── diff  // Content of the layer
    13    │   ├── 1  // Contains layers that need to be mounted for the id
    14    │   ├── 2
    15    │   └── 3
    16    └── mnt    // Mount points for the rw layers to be mounted
    17        ├── 1
    18        ├── 2
    19        └── 3
    20  
    21  */
    22  
    23  package aufs // import "github.com/demonoid81/moby/daemon/graphdriver/aufs"
    24  
    25  import (
    26  	"bufio"
    27  	"context"
    28  	"fmt"
    29  	"io"
    30  	"io/ioutil"
    31  	"os"
    32  	"os/exec"
    33  	"path"
    34  	"path/filepath"
    35  	"strings"
    36  	"sync"
    37  
    38  	"github.com/demonoid81/moby/daemon/graphdriver"
    39  	"github.com/demonoid81/moby/pkg/archive"
    40  	"github.com/demonoid81/moby/pkg/chrootarchive"
    41  	"github.com/demonoid81/moby/pkg/containerfs"
    42  	"github.com/demonoid81/moby/pkg/directory"
    43  	"github.com/demonoid81/moby/pkg/idtools"
    44  	"github.com/demonoid81/moby/pkg/locker"
    45  	"github.com/demonoid81/moby/pkg/system"
    46  	"github.com/moby/sys/mount"
    47  	rsystem "github.com/opencontainers/runc/libcontainer/system"
    48  	"github.com/opencontainers/selinux/go-selinux/label"
    49  	"github.com/pkg/errors"
    50  	"github.com/sirupsen/logrus"
    51  	"github.com/vbatts/tar-split/tar/storage"
    52  	"golang.org/x/sys/unix"
    53  )
    54  
    55  var (
    56  	// ErrAufsNotSupported is returned if aufs is not supported by the host.
    57  	ErrAufsNotSupported = fmt.Errorf("AUFS was not found in /proc/filesystems")
    58  	// ErrAufsNested means aufs cannot be used bc we are in a user namespace
    59  	ErrAufsNested = fmt.Errorf("AUFS cannot be used in non-init user namespace")
    60  	backingFs     = "<unknown>"
    61  
    62  	enableDirpermLock sync.Once
    63  	enableDirperm     bool
    64  
    65  	logger = logrus.WithField("storage-driver", "aufs")
    66  )
    67  
    68  func init() {
    69  	graphdriver.Register("aufs", Init)
    70  }
    71  
    72  // Driver contains information about the filesystem mounted.
    73  type Driver struct {
    74  	root          string
    75  	uidMaps       []idtools.IDMap
    76  	gidMaps       []idtools.IDMap
    77  	ctr           *graphdriver.RefCounter
    78  	pathCacheLock sync.Mutex
    79  	pathCache     map[string]string
    80  	naiveDiff     graphdriver.DiffDriver
    81  	locker        *locker.Locker
    82  	mntL          sync.Mutex
    83  }
    84  
    85  // Init returns a new AUFS driver.
    86  // An error is returned if AUFS is not supported.
    87  func Init(root string, options []string, uidMaps, gidMaps []idtools.IDMap) (graphdriver.Driver, error) {
    88  	// Try to load the aufs kernel module
    89  	if err := supportsAufs(); err != nil {
    90  		logger.Error(err)
    91  		return nil, graphdriver.ErrNotSupported
    92  	}
    93  
    94  	// Perform feature detection on /var/lib/docker/aufs if it's an existing directory.
    95  	// This covers situations where /var/lib/docker/aufs is a mount, and on a different
    96  	// filesystem than /var/lib/docker.
    97  	// If the path does not exist, fall back to using /var/lib/docker for feature detection.
    98  	testdir := root
    99  	if _, err := os.Stat(testdir); os.IsNotExist(err) {
   100  		testdir = filepath.Dir(testdir)
   101  	}
   102  
   103  	fsMagic, err := graphdriver.GetFSMagic(testdir)
   104  	if err != nil {
   105  		return nil, err
   106  	}
   107  	if fsName, ok := graphdriver.FsNames[fsMagic]; ok {
   108  		backingFs = fsName
   109  	}
   110  
   111  	switch fsMagic {
   112  	case graphdriver.FsMagicAufs, graphdriver.FsMagicBtrfs, graphdriver.FsMagicEcryptfs:
   113  		logger.Errorf("AUFS is not supported over %s", backingFs)
   114  		return nil, graphdriver.ErrIncompatibleFS
   115  	}
   116  
   117  	paths := []string{
   118  		"mnt",
   119  		"diff",
   120  		"layers",
   121  	}
   122  
   123  	a := &Driver{
   124  		root:      root,
   125  		uidMaps:   uidMaps,
   126  		gidMaps:   gidMaps,
   127  		pathCache: make(map[string]string),
   128  		ctr:       graphdriver.NewRefCounter(graphdriver.NewFsChecker(graphdriver.FsMagicAufs)),
   129  		locker:    locker.New(),
   130  	}
   131  
   132  	rootUID, rootGID, err := idtools.GetRootUIDGID(uidMaps, gidMaps)
   133  	if err != nil {
   134  		return nil, err
   135  	}
   136  	// Create the root aufs driver dir
   137  	if err := idtools.MkdirAllAndChown(root, 0700, idtools.Identity{UID: rootUID, GID: rootGID}); err != nil {
   138  		return nil, err
   139  	}
   140  
   141  	// Populate the dir structure
   142  	for _, p := range paths {
   143  		if err := idtools.MkdirAllAndChown(path.Join(root, p), 0700, idtools.Identity{UID: rootUID, GID: rootGID}); err != nil {
   144  			return nil, err
   145  		}
   146  	}
   147  
   148  	for _, path := range []string{"mnt", "diff"} {
   149  		p := filepath.Join(root, path)
   150  		entries, err := ioutil.ReadDir(p)
   151  		if err != nil {
   152  			logger.WithError(err).WithField("dir", p).Error("error reading dir entries")
   153  			continue
   154  		}
   155  		for _, entry := range entries {
   156  			if !entry.IsDir() {
   157  				continue
   158  			}
   159  			if strings.HasSuffix(entry.Name(), "-removing") {
   160  				logger.WithField("dir", entry.Name()).Debug("Cleaning up stale layer dir")
   161  				if err := system.EnsureRemoveAll(filepath.Join(p, entry.Name())); err != nil {
   162  					logger.WithField("dir", entry.Name()).WithError(err).Error("Error removing stale layer dir")
   163  				}
   164  			}
   165  		}
   166  	}
   167  
   168  	a.naiveDiff = graphdriver.NewNaiveDiffDriver(a, uidMaps, gidMaps)
   169  	return a, nil
   170  }
   171  
   172  // Return a nil error if the kernel supports aufs
   173  // We cannot modprobe because inside dind modprobe fails
   174  // to run
   175  func supportsAufs() error {
   176  	// We can try to modprobe aufs first before looking at
   177  	// proc/filesystems for when aufs is supported
   178  	exec.Command("modprobe", "aufs").Run()
   179  
   180  	if rsystem.RunningInUserNS() {
   181  		return ErrAufsNested
   182  	}
   183  
   184  	f, err := os.Open("/proc/filesystems")
   185  	if err != nil {
   186  		return err
   187  	}
   188  	defer f.Close()
   189  
   190  	s := bufio.NewScanner(f)
   191  	for s.Scan() {
   192  		if strings.Contains(s.Text(), "aufs") {
   193  			return nil
   194  		}
   195  	}
   196  	return ErrAufsNotSupported
   197  }
   198  
   199  func (a *Driver) rootPath() string {
   200  	return a.root
   201  }
   202  
   203  func (*Driver) String() string {
   204  	return "aufs"
   205  }
   206  
   207  // Status returns current information about the filesystem such as root directory, number of directories mounted, etc.
   208  func (a *Driver) Status() [][2]string {
   209  	ids, _ := loadIds(path.Join(a.rootPath(), "layers"))
   210  	return [][2]string{
   211  		{"Root Dir", a.rootPath()},
   212  		{"Backing Filesystem", backingFs},
   213  		{"Dirs", fmt.Sprintf("%d", len(ids))},
   214  		{"Dirperm1 Supported", fmt.Sprintf("%v", useDirperm())},
   215  	}
   216  }
   217  
   218  // GetMetadata not implemented
   219  func (a *Driver) GetMetadata(id string) (map[string]string, error) {
   220  	return nil, nil
   221  }
   222  
   223  // Exists returns true if the given id is registered with
   224  // this driver
   225  func (a *Driver) Exists(id string) bool {
   226  	if _, err := os.Lstat(path.Join(a.rootPath(), "layers", id)); err != nil {
   227  		return false
   228  	}
   229  	return true
   230  }
   231  
   232  // CreateReadWrite creates a layer that is writable for use as a container
   233  // file system.
   234  func (a *Driver) CreateReadWrite(id, parent string, opts *graphdriver.CreateOpts) error {
   235  	return a.Create(id, parent, opts)
   236  }
   237  
   238  // Create three folders for each id
   239  // mnt, layers, and diff
   240  func (a *Driver) Create(id, parent string, opts *graphdriver.CreateOpts) error {
   241  
   242  	if opts != nil && len(opts.StorageOpt) != 0 {
   243  		return fmt.Errorf("--storage-opt is not supported for aufs")
   244  	}
   245  
   246  	if err := a.createDirsFor(id); err != nil {
   247  		return err
   248  	}
   249  	// Write the layers metadata
   250  	f, err := os.Create(path.Join(a.rootPath(), "layers", id))
   251  	if err != nil {
   252  		return err
   253  	}
   254  	defer f.Close()
   255  
   256  	if parent != "" {
   257  		ids, err := getParentIDs(a.rootPath(), parent)
   258  		if err != nil {
   259  			return err
   260  		}
   261  
   262  		if _, err := fmt.Fprintln(f, parent); err != nil {
   263  			return err
   264  		}
   265  		for _, i := range ids {
   266  			if _, err := fmt.Fprintln(f, i); err != nil {
   267  				return err
   268  			}
   269  		}
   270  	}
   271  
   272  	return nil
   273  }
   274  
   275  // createDirsFor creates two directories for the given id.
   276  // mnt and diff
   277  func (a *Driver) createDirsFor(id string) error {
   278  	paths := []string{
   279  		"mnt",
   280  		"diff",
   281  	}
   282  
   283  	rootUID, rootGID, err := idtools.GetRootUIDGID(a.uidMaps, a.gidMaps)
   284  	if err != nil {
   285  		return err
   286  	}
   287  	// Directory permission is 0755.
   288  	// The path of directories are <aufs_root_path>/mnt/<image_id>
   289  	// and <aufs_root_path>/diff/<image_id>
   290  	for _, p := range paths {
   291  		if err := idtools.MkdirAllAndChown(path.Join(a.rootPath(), p, id), 0755, idtools.Identity{UID: rootUID, GID: rootGID}); err != nil {
   292  			return err
   293  		}
   294  	}
   295  	return nil
   296  }
   297  
   298  // Remove will unmount and remove the given id.
   299  func (a *Driver) Remove(id string) error {
   300  	a.locker.Lock(id)
   301  	defer a.locker.Unlock(id)
   302  	a.pathCacheLock.Lock()
   303  	mountpoint, exists := a.pathCache[id]
   304  	a.pathCacheLock.Unlock()
   305  	if !exists {
   306  		mountpoint = a.getMountpoint(id)
   307  	}
   308  
   309  	if err := a.unmount(mountpoint); err != nil {
   310  		logger.WithError(err).WithField("method", "Remove()").Warn()
   311  		return err
   312  	}
   313  
   314  	// Remove the layers file for the id
   315  	if err := os.Remove(path.Join(a.rootPath(), "layers", id)); err != nil && !os.IsNotExist(err) {
   316  		return errors.Wrapf(err, "error removing layers dir for %s", id)
   317  	}
   318  
   319  	if err := atomicRemove(a.getDiffPath(id)); err != nil {
   320  		return errors.Wrapf(err, "could not remove diff path for id %s", id)
   321  	}
   322  
   323  	// Atomically remove each directory in turn by first moving it out of the
   324  	// way (so that docker doesn't find it anymore) before doing removal of
   325  	// the whole tree.
   326  	if err := atomicRemove(mountpoint); err != nil {
   327  		if errors.Is(err, unix.EBUSY) {
   328  			logger.WithField("dir", mountpoint).WithError(err).Warn("error performing atomic remove due to EBUSY")
   329  		}
   330  		return errors.Wrapf(err, "could not remove mountpoint for id %s", id)
   331  	}
   332  
   333  	a.pathCacheLock.Lock()
   334  	delete(a.pathCache, id)
   335  	a.pathCacheLock.Unlock()
   336  	return nil
   337  }
   338  
   339  func atomicRemove(source string) error {
   340  	target := source + "-removing"
   341  
   342  	err := os.Rename(source, target)
   343  	switch {
   344  	case err == nil, os.IsNotExist(err):
   345  	case os.IsExist(err):
   346  		// Got error saying the target dir already exists, maybe the source doesn't exist due to a previous (failed) remove
   347  		if _, e := os.Stat(source); !os.IsNotExist(e) {
   348  			return errors.Wrapf(err, "target rename dir %q exists but should not, this needs to be manually cleaned up", target)
   349  		}
   350  	default:
   351  		return errors.Wrapf(err, "error preparing atomic delete")
   352  	}
   353  
   354  	return system.EnsureRemoveAll(target)
   355  }
   356  
   357  // Get returns the rootfs path for the id.
   358  // This will mount the dir at its given path
   359  func (a *Driver) Get(id, mountLabel string) (containerfs.ContainerFS, error) {
   360  	a.locker.Lock(id)
   361  	defer a.locker.Unlock(id)
   362  	parents, err := a.getParentLayerPaths(id)
   363  	if err != nil && !os.IsNotExist(err) {
   364  		return nil, err
   365  	}
   366  
   367  	a.pathCacheLock.Lock()
   368  	m, exists := a.pathCache[id]
   369  	a.pathCacheLock.Unlock()
   370  
   371  	if !exists {
   372  		m = a.getDiffPath(id)
   373  		if len(parents) > 0 {
   374  			m = a.getMountpoint(id)
   375  		}
   376  	}
   377  	if count := a.ctr.Increment(m); count > 1 {
   378  		return containerfs.NewLocalContainerFS(m), nil
   379  	}
   380  
   381  	// If a dir does not have a parent ( no layers )do not try to mount
   382  	// just return the diff path to the data
   383  	if len(parents) > 0 {
   384  		if err := a.mount(id, m, mountLabel, parents); err != nil {
   385  			return nil, err
   386  		}
   387  	}
   388  
   389  	a.pathCacheLock.Lock()
   390  	a.pathCache[id] = m
   391  	a.pathCacheLock.Unlock()
   392  	return containerfs.NewLocalContainerFS(m), nil
   393  }
   394  
   395  // Put unmounts and updates list of active mounts.
   396  func (a *Driver) Put(id string) error {
   397  	a.locker.Lock(id)
   398  	defer a.locker.Unlock(id)
   399  	a.pathCacheLock.Lock()
   400  	m, exists := a.pathCache[id]
   401  	if !exists {
   402  		m = a.getMountpoint(id)
   403  		a.pathCache[id] = m
   404  	}
   405  	a.pathCacheLock.Unlock()
   406  	if count := a.ctr.Decrement(m); count > 0 {
   407  		return nil
   408  	}
   409  
   410  	err := a.unmount(m)
   411  	if err != nil {
   412  		logger.WithError(err).WithField("method", "Put()").Warn()
   413  	}
   414  	return err
   415  }
   416  
   417  // isParent returns if the passed in parent is the direct parent of the passed in layer
   418  func (a *Driver) isParent(id, parent string) bool {
   419  	parents, _ := getParentIDs(a.rootPath(), id)
   420  	if parent == "" && len(parents) > 0 {
   421  		return false
   422  	}
   423  	return !(len(parents) > 0 && parent != parents[0])
   424  }
   425  
   426  // Diff produces an archive of the changes between the specified
   427  // layer and its parent layer which may be "".
   428  func (a *Driver) Diff(id, parent string) (io.ReadCloser, error) {
   429  	if !a.isParent(id, parent) {
   430  		return a.naiveDiff.Diff(id, parent)
   431  	}
   432  
   433  	// AUFS doesn't need the parent layer to produce a diff.
   434  	return archive.TarWithOptions(path.Join(a.rootPath(), "diff", id), &archive.TarOptions{
   435  		Compression:     archive.Uncompressed,
   436  		ExcludePatterns: []string{archive.WhiteoutMetaPrefix + "*", "!" + archive.WhiteoutOpaqueDir},
   437  		UIDMaps:         a.uidMaps,
   438  		GIDMaps:         a.gidMaps,
   439  	})
   440  }
   441  
   442  type fileGetNilCloser struct {
   443  	storage.FileGetter
   444  }
   445  
   446  func (f fileGetNilCloser) Close() error {
   447  	return nil
   448  }
   449  
   450  // DiffGetter returns a FileGetCloser that can read files from the directory that
   451  // contains files for the layer differences. Used for direct access for tar-split.
   452  func (a *Driver) DiffGetter(id string) (graphdriver.FileGetCloser, error) {
   453  	p := path.Join(a.rootPath(), "diff", id)
   454  	return fileGetNilCloser{storage.NewPathFileGetter(p)}, nil
   455  }
   456  
   457  func (a *Driver) applyDiff(id string, diff io.Reader) error {
   458  	return chrootarchive.UntarUncompressed(diff, path.Join(a.rootPath(), "diff", id), &archive.TarOptions{
   459  		UIDMaps: a.uidMaps,
   460  		GIDMaps: a.gidMaps,
   461  	})
   462  }
   463  
   464  // DiffSize calculates the changes between the specified id
   465  // and its parent and returns the size in bytes of the changes
   466  // relative to its base filesystem directory.
   467  func (a *Driver) DiffSize(id, parent string) (size int64, err error) {
   468  	if !a.isParent(id, parent) {
   469  		return a.naiveDiff.DiffSize(id, parent)
   470  	}
   471  	// AUFS doesn't need the parent layer to calculate the diff size.
   472  	return directory.Size(context.TODO(), path.Join(a.rootPath(), "diff", id))
   473  }
   474  
   475  // ApplyDiff extracts the changeset from the given diff into the
   476  // layer with the specified id and parent, returning the size of the
   477  // new layer in bytes.
   478  func (a *Driver) ApplyDiff(id, parent string, diff io.Reader) (size int64, err error) {
   479  	if !a.isParent(id, parent) {
   480  		return a.naiveDiff.ApplyDiff(id, parent, diff)
   481  	}
   482  
   483  	// AUFS doesn't need the parent id to apply the diff if it is the direct parent.
   484  	if err = a.applyDiff(id, diff); err != nil {
   485  		return
   486  	}
   487  
   488  	return a.DiffSize(id, parent)
   489  }
   490  
   491  // Changes produces a list of changes between the specified layer
   492  // and its parent layer. If parent is "", then all changes will be ADD changes.
   493  func (a *Driver) Changes(id, parent string) ([]archive.Change, error) {
   494  	if !a.isParent(id, parent) {
   495  		return a.naiveDiff.Changes(id, parent)
   496  	}
   497  
   498  	// AUFS doesn't have snapshots, so we need to get changes from all parent
   499  	// layers.
   500  	layers, err := a.getParentLayerPaths(id)
   501  	if err != nil {
   502  		return nil, err
   503  	}
   504  	return archive.Changes(layers, path.Join(a.rootPath(), "diff", id))
   505  }
   506  
   507  func (a *Driver) getParentLayerPaths(id string) ([]string, error) {
   508  	parentIds, err := getParentIDs(a.rootPath(), id)
   509  	if err != nil {
   510  		return nil, err
   511  	}
   512  	layers := make([]string, len(parentIds))
   513  
   514  	// Get the diff paths for all the parent ids
   515  	for i, p := range parentIds {
   516  		layers[i] = path.Join(a.rootPath(), "diff", p)
   517  	}
   518  	return layers, nil
   519  }
   520  
   521  func (a *Driver) mount(id string, target string, mountLabel string, layers []string) error {
   522  	// If the id is mounted or we get an error return
   523  	if mounted, err := a.mounted(target); err != nil || mounted {
   524  		return err
   525  	}
   526  
   527  	rw := a.getDiffPath(id)
   528  
   529  	if err := a.aufsMount(layers, rw, target, mountLabel); err != nil {
   530  		return fmt.Errorf("error creating aufs mount to %s: %v", target, err)
   531  	}
   532  	return nil
   533  }
   534  
   535  func (a *Driver) unmount(mountPath string) error {
   536  	if mounted, err := a.mounted(mountPath); err != nil || !mounted {
   537  		return err
   538  	}
   539  	return Unmount(mountPath)
   540  }
   541  
   542  func (a *Driver) mounted(mountpoint string) (bool, error) {
   543  	return graphdriver.Mounted(graphdriver.FsMagicAufs, mountpoint)
   544  }
   545  
   546  // Cleanup aufs and unmount all mountpoints
   547  func (a *Driver) Cleanup() error {
   548  	dir := a.mntPath()
   549  	files, err := ioutil.ReadDir(dir)
   550  	if err != nil {
   551  		return errors.Wrap(err, "aufs readdir error")
   552  	}
   553  	for _, f := range files {
   554  		if !f.IsDir() {
   555  			continue
   556  		}
   557  
   558  		m := path.Join(dir, f.Name())
   559  
   560  		if err := a.unmount(m); err != nil {
   561  			logger.WithError(err).WithField("method", "Cleanup()").Warn()
   562  		}
   563  	}
   564  	return mount.RecursiveUnmount(a.root)
   565  }
   566  
   567  func (a *Driver) aufsMount(ro []string, rw, target, mountLabel string) (err error) {
   568  	defer func() {
   569  		if err != nil {
   570  			mount.Unmount(target)
   571  		}
   572  	}()
   573  
   574  	// Mount options are clipped to page size(4096 bytes). If there are more
   575  	// layers then these are remounted individually using append.
   576  
   577  	offset := 54
   578  	if useDirperm() {
   579  		offset += len(",dirperm1")
   580  	}
   581  	b := make([]byte, unix.Getpagesize()-len(mountLabel)-offset) // room for xino & mountLabel
   582  	bp := copy(b, fmt.Sprintf("br:%s=rw", rw))
   583  
   584  	index := 0
   585  	for ; index < len(ro); index++ {
   586  		layer := fmt.Sprintf(":%s=ro+wh", ro[index])
   587  		if bp+len(layer) > len(b) {
   588  			break
   589  		}
   590  		bp += copy(b[bp:], layer)
   591  	}
   592  
   593  	opts := "dio,xino=/dev/shm/aufs.xino"
   594  	if useDirperm() {
   595  		opts += ",dirperm1"
   596  	}
   597  	data := label.FormatMountLabel(fmt.Sprintf("%s,%s", string(b[:bp]), opts), mountLabel)
   598  	a.mntL.Lock()
   599  	err = unix.Mount("none", target, "aufs", 0, data)
   600  	a.mntL.Unlock()
   601  	if err != nil {
   602  		err = errors.Wrap(err, "mount target="+target+" data="+data)
   603  		return
   604  	}
   605  
   606  	for index < len(ro) {
   607  		bp = 0
   608  		for ; index < len(ro); index++ {
   609  			layer := fmt.Sprintf("append:%s=ro+wh,", ro[index])
   610  			if bp+len(layer) > len(b) {
   611  				break
   612  			}
   613  			bp += copy(b[bp:], layer)
   614  		}
   615  		data := label.FormatMountLabel(string(b[:bp]), mountLabel)
   616  		a.mntL.Lock()
   617  		err = unix.Mount("none", target, "aufs", unix.MS_REMOUNT, data)
   618  		a.mntL.Unlock()
   619  		if err != nil {
   620  			err = errors.Wrap(err, "mount target="+target+" flags=MS_REMOUNT data="+data)
   621  			return
   622  		}
   623  	}
   624  
   625  	return
   626  }
   627  
   628  // useDirperm checks dirperm1 mount option can be used with the current
   629  // version of aufs.
   630  func useDirperm() bool {
   631  	enableDirpermLock.Do(func() {
   632  		base, err := ioutil.TempDir("", "docker-aufs-base")
   633  		if err != nil {
   634  			logger.Errorf("error checking dirperm1: %v", err)
   635  			return
   636  		}
   637  		defer os.RemoveAll(base)
   638  
   639  		union, err := ioutil.TempDir("", "docker-aufs-union")
   640  		if err != nil {
   641  			logger.Errorf("error checking dirperm1: %v", err)
   642  			return
   643  		}
   644  		defer os.RemoveAll(union)
   645  
   646  		opts := fmt.Sprintf("br:%s,dirperm1,xino=/dev/shm/aufs.xino", base)
   647  		if err := unix.Mount("none", union, "aufs", 0, opts); err != nil {
   648  			return
   649  		}
   650  		enableDirperm = true
   651  		if err := Unmount(union); err != nil {
   652  			logger.Errorf("error checking dirperm1: failed to unmount %v", err)
   653  		}
   654  	})
   655  	return enableDirperm
   656  }