2014-07-16 19:39:15 -04:00
|
|
|
// +build linux,cgo
|
2014-07-14 15:49:50 -04:00
|
|
|
|
2014-03-21 04:10:07 -04:00
|
|
|
package native
|
|
|
|
|
|
|
|
import (
|
|
|
|
"fmt"
|
2014-04-01 03:07:42 -04:00
|
|
|
"os"
|
2014-05-21 16:48:06 -04:00
|
|
|
"os/exec"
|
2014-04-30 18:46:56 -04:00
|
|
|
"path/filepath"
|
2014-04-01 03:07:42 -04:00
|
|
|
|
2014-07-24 18:25:29 -04:00
|
|
|
"github.com/docker/docker/daemon/execdriver"
|
|
|
|
"github.com/docker/docker/daemon/execdriver/native/configuration"
|
|
|
|
"github.com/docker/docker/daemon/execdriver/native/template"
|
2014-06-10 22:58:15 -04:00
|
|
|
"github.com/docker/libcontainer"
|
|
|
|
"github.com/docker/libcontainer/apparmor"
|
|
|
|
"github.com/docker/libcontainer/devices"
|
2014-06-23 19:43:43 -04:00
|
|
|
"github.com/docker/libcontainer/mount"
|
|
|
|
"github.com/docker/libcontainer/security/capabilities"
|
2014-03-21 04:10:07 -04:00
|
|
|
)
|
|
|
|
|
|
|
|
// createContainer populates and configures the container type with the
|
|
|
|
// data provided by the execdriver.Command
|
2014-06-24 14:22:25 -04:00
|
|
|
func (d *driver) createContainer(c *execdriver.Command) (*libcontainer.Config, error) {
|
2014-03-24 03:16:40 -04:00
|
|
|
container := template.New()
|
2014-03-21 04:10:07 -04:00
|
|
|
|
2014-08-26 18:05:37 -04:00
|
|
|
container.Hostname = getEnv("HOSTNAME", c.ProcessConfig.Env)
|
|
|
|
container.Tty = c.ProcessConfig.Tty
|
|
|
|
container.User = c.ProcessConfig.User
|
2014-03-21 04:10:07 -04:00
|
|
|
container.WorkingDir = c.WorkingDir
|
2014-08-26 18:05:37 -04:00
|
|
|
container.Env = c.ProcessConfig.Env
|
2014-03-24 03:16:40 -04:00
|
|
|
container.Cgroups.Name = c.ID
|
2014-02-17 18:14:30 -05:00
|
|
|
container.Cgroups.AllowedDevices = c.AllowedDevices
|
2014-06-23 19:43:43 -04:00
|
|
|
container.MountConfig.DeviceNodes = c.AutoCreatedDevices
|
|
|
|
|
2014-03-24 03:16:40 -04:00
|
|
|
// check to see if we are running in ramdisk to disable pivot root
|
2014-06-23 19:43:43 -04:00
|
|
|
container.MountConfig.NoPivotRoot = os.Getenv("DOCKER_RAMDISK") != ""
|
2014-06-26 15:23:53 -04:00
|
|
|
container.RestrictSys = true
|
2014-03-21 04:10:07 -04:00
|
|
|
|
2014-03-24 03:16:40 -04:00
|
|
|
if err := d.createNetwork(container, c); err != nil {
|
|
|
|
return nil, err
|
2014-03-21 04:10:07 -04:00
|
|
|
}
|
2014-06-23 19:43:43 -04:00
|
|
|
|
2014-08-26 18:05:37 -04:00
|
|
|
if c.ProcessConfig.Privileged {
|
2014-03-24 03:16:40 -04:00
|
|
|
if err := d.setPrivileged(container); err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
2014-07-10 14:41:11 -04:00
|
|
|
} else {
|
2014-07-10 19:38:11 -04:00
|
|
|
if err := d.setCapabilities(container, c); err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
2014-03-24 03:16:40 -04:00
|
|
|
}
|
2014-06-23 19:43:43 -04:00
|
|
|
|
2014-03-24 03:16:40 -04:00
|
|
|
if err := d.setupCgroups(container, c); err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
2014-06-23 19:43:43 -04:00
|
|
|
|
2014-03-24 03:16:40 -04:00
|
|
|
if err := d.setupMounts(container, c); err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
2014-06-23 19:43:43 -04:00
|
|
|
|
2014-03-27 05:04:54 -04:00
|
|
|
if err := d.setupLabels(container, c); err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
2014-06-23 19:43:43 -04:00
|
|
|
|
2014-05-21 16:48:06 -04:00
|
|
|
cmds := make(map[string]*exec.Cmd)
|
2014-05-29 08:40:42 -04:00
|
|
|
d.Lock()
|
2014-05-21 16:48:06 -04:00
|
|
|
for k, v := range d.activeContainers {
|
|
|
|
cmds[k] = v.cmd
|
|
|
|
}
|
2014-05-29 08:40:42 -04:00
|
|
|
d.Unlock()
|
2014-06-23 19:43:43 -04:00
|
|
|
|
2014-05-21 16:48:06 -04:00
|
|
|
if err := configuration.ParseConfiguration(container, cmds, c.Config["native"]); err != nil {
|
2014-03-24 03:16:40 -04:00
|
|
|
return nil, err
|
|
|
|
}
|
2014-06-23 19:43:43 -04:00
|
|
|
|
2014-03-24 03:16:40 -04:00
|
|
|
return container, nil
|
|
|
|
}
|
2014-03-21 04:10:07 -04:00
|
|
|
|
2014-06-24 14:22:25 -04:00
|
|
|
func (d *driver) createNetwork(container *libcontainer.Config, c *execdriver.Command) error {
|
2014-05-02 17:17:31 -04:00
|
|
|
if c.Network.HostNetworking {
|
2014-05-05 16:54:37 -04:00
|
|
|
container.Namespaces["NEWNET"] = false
|
2014-05-02 17:17:31 -04:00
|
|
|
return nil
|
|
|
|
}
|
2014-06-23 19:43:43 -04:00
|
|
|
|
2014-03-21 04:10:07 -04:00
|
|
|
container.Networks = []*libcontainer.Network{
|
2014-03-24 03:16:40 -04:00
|
|
|
{
|
|
|
|
Mtu: c.Network.Mtu,
|
|
|
|
Address: fmt.Sprintf("%s/%d", "127.0.0.1", 0),
|
|
|
|
Gateway: "localhost",
|
|
|
|
Type: "loopback",
|
|
|
|
},
|
2014-03-21 04:10:07 -04:00
|
|
|
}
|
|
|
|
|
|
|
|
if c.Network.Interface != nil {
|
|
|
|
vethNetwork := libcontainer.Network{
|
2014-06-23 19:43:43 -04:00
|
|
|
Mtu: c.Network.Mtu,
|
|
|
|
Address: fmt.Sprintf("%s/%d", c.Network.Interface.IPAddress, c.Network.Interface.IPPrefixLen),
|
|
|
|
Gateway: c.Network.Interface.Gateway,
|
|
|
|
Type: "veth",
|
|
|
|
Bridge: c.Network.Interface.Bridge,
|
|
|
|
VethPrefix: "veth",
|
2014-03-21 04:10:07 -04:00
|
|
|
}
|
|
|
|
container.Networks = append(container.Networks, &vethNetwork)
|
|
|
|
}
|
2014-04-30 18:46:56 -04:00
|
|
|
|
|
|
|
if c.Network.ContainerID != "" {
|
2014-05-29 08:40:42 -04:00
|
|
|
d.Lock()
|
2014-05-21 16:48:06 -04:00
|
|
|
active := d.activeContainers[c.Network.ContainerID]
|
2014-05-29 08:40:42 -04:00
|
|
|
d.Unlock()
|
2014-06-23 19:43:43 -04:00
|
|
|
|
2014-05-21 16:48:06 -04:00
|
|
|
if active == nil || active.cmd.Process == nil {
|
2014-04-30 18:46:56 -04:00
|
|
|
return fmt.Errorf("%s is not a valid running container to join", c.Network.ContainerID)
|
|
|
|
}
|
2014-05-21 16:48:06 -04:00
|
|
|
cmd := active.cmd
|
|
|
|
|
2014-04-30 18:46:56 -04:00
|
|
|
nspath := filepath.Join("/proc", fmt.Sprint(cmd.Process.Pid), "ns", "net")
|
|
|
|
container.Networks = append(container.Networks, &libcontainer.Network{
|
2014-06-23 19:43:43 -04:00
|
|
|
Type: "netns",
|
|
|
|
NsPath: nspath,
|
2014-04-30 18:46:56 -04:00
|
|
|
})
|
|
|
|
}
|
2014-06-23 19:43:43 -04:00
|
|
|
|
2014-03-24 03:16:40 -04:00
|
|
|
return nil
|
|
|
|
}
|
2014-03-21 04:10:07 -04:00
|
|
|
|
2014-06-24 14:22:25 -04:00
|
|
|
func (d *driver) setPrivileged(container *libcontainer.Config) (err error) {
|
2014-06-23 19:43:43 -04:00
|
|
|
container.Capabilities = capabilities.GetAllCapabilities()
|
2014-02-17 18:14:30 -05:00
|
|
|
container.Cgroups.AllowAllDevices = true
|
2014-04-11 07:45:39 -04:00
|
|
|
|
2014-05-30 21:30:27 -04:00
|
|
|
hostDeviceNodes, err := devices.GetHostDeviceNodes()
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
2014-06-23 19:43:43 -04:00
|
|
|
container.MountConfig.DeviceNodes = hostDeviceNodes
|
2014-05-30 21:30:27 -04:00
|
|
|
|
2014-06-26 15:23:53 -04:00
|
|
|
container.RestrictSys = false
|
2014-05-19 20:13:00 -04:00
|
|
|
|
2014-04-09 06:22:17 -04:00
|
|
|
if apparmor.IsEnabled() {
|
2014-06-26 15:23:53 -04:00
|
|
|
container.AppArmorProfile = "unconfined"
|
2014-04-09 06:22:17 -04:00
|
|
|
}
|
2014-06-23 19:43:43 -04:00
|
|
|
|
2014-03-24 03:16:40 -04:00
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2014-07-10 19:38:11 -04:00
|
|
|
func (d *driver) setCapabilities(container *libcontainer.Config, c *execdriver.Command) (err error) {
|
|
|
|
container.Capabilities, err = execdriver.TweakCapabilities(container.Capabilities, c.CapAdd, c.CapDrop)
|
|
|
|
return err
|
2014-07-10 14:41:11 -04:00
|
|
|
}
|
|
|
|
|
2014-06-24 14:22:25 -04:00
|
|
|
func (d *driver) setupCgroups(container *libcontainer.Config, c *execdriver.Command) error {
|
2014-03-21 04:10:07 -04:00
|
|
|
if c.Resources != nil {
|
|
|
|
container.Cgroups.CpuShares = c.Resources.CpuShares
|
|
|
|
container.Cgroups.Memory = c.Resources.Memory
|
2014-04-24 01:11:43 -04:00
|
|
|
container.Cgroups.MemoryReservation = c.Resources.Memory
|
2014-03-21 04:10:07 -04:00
|
|
|
container.Cgroups.MemorySwap = c.Resources.MemorySwap
|
2014-05-12 20:44:57 -04:00
|
|
|
container.Cgroups.CpusetCpus = c.Resources.Cpuset
|
2014-03-21 04:10:07 -04:00
|
|
|
}
|
2014-06-23 19:43:43 -04:00
|
|
|
|
2014-03-24 03:16:40 -04:00
|
|
|
return nil
|
|
|
|
}
|
2014-03-21 04:10:07 -04:00
|
|
|
|
2014-06-24 14:22:25 -04:00
|
|
|
func (d *driver) setupMounts(container *libcontainer.Config, c *execdriver.Command) error {
|
2014-03-21 04:10:07 -04:00
|
|
|
for _, m := range c.Mounts {
|
2014-09-01 18:18:30 -04:00
|
|
|
container.MountConfig.Mounts = append(container.MountConfig.Mounts, &mount.Mount{
|
2014-04-11 07:45:39 -04:00
|
|
|
Type: "bind",
|
|
|
|
Source: m.Source,
|
|
|
|
Destination: m.Destination,
|
|
|
|
Writable: m.Writable,
|
|
|
|
Private: m.Private,
|
|
|
|
})
|
2014-03-21 04:10:07 -04:00
|
|
|
}
|
2014-06-23 19:43:43 -04:00
|
|
|
|
2014-03-24 03:16:40 -04:00
|
|
|
return nil
|
2014-03-21 04:10:07 -04:00
|
|
|
}
|
2014-03-27 05:04:54 -04:00
|
|
|
|
2014-06-24 14:22:25 -04:00
|
|
|
func (d *driver) setupLabels(container *libcontainer.Config, c *execdriver.Command) error {
|
2014-06-26 15:23:53 -04:00
|
|
|
container.ProcessLabel = c.Config["process_label"][0]
|
|
|
|
container.MountConfig.MountLabel = c.Config["mount_label"][0]
|
2014-06-23 19:43:43 -04:00
|
|
|
|
2014-03-27 05:04:54 -04:00
|
|
|
return nil
|
|
|
|
}
|