2018-02-05 16:05:59 -05:00
|
|
|
package plugin // import "github.com/docker/docker/plugin"
|
2016-05-16 11:50:55 -04:00
|
|
|
|
|
|
|
import (
|
2020-02-10 19:31:04 -05:00
|
|
|
"context"
|
2016-05-16 11:50:55 -04:00
|
|
|
"encoding/json"
|
|
|
|
"io"
|
2016-12-12 18:05:53 -05:00
|
|
|
"io/ioutil"
|
2016-05-16 11:50:55 -04:00
|
|
|
"os"
|
|
|
|
"path/filepath"
|
2016-12-12 18:05:53 -05:00
|
|
|
"reflect"
|
|
|
|
"regexp"
|
2016-12-27 22:38:13 -05:00
|
|
|
"sort"
|
2016-11-22 14:21:34 -05:00
|
|
|
"strings"
|
2016-05-16 11:50:55 -04:00
|
|
|
"sync"
|
|
|
|
|
2020-02-10 19:31:04 -05:00
|
|
|
"github.com/containerd/containerd/content"
|
|
|
|
"github.com/containerd/containerd/content/local"
|
2017-01-11 16:54:52 -05:00
|
|
|
"github.com/docker/distribution/reference"
|
2016-12-12 18:05:53 -05:00
|
|
|
"github.com/docker/docker/api/types"
|
2017-03-17 17:57:23 -04:00
|
|
|
"github.com/docker/docker/pkg/authorization"
|
2016-12-12 18:05:53 -05:00
|
|
|
"github.com/docker/docker/pkg/ioutils"
|
2017-06-07 13:07:01 -04:00
|
|
|
"github.com/docker/docker/pkg/pubsub"
|
2017-04-25 19:45:42 -04:00
|
|
|
"github.com/docker/docker/pkg/system"
|
2019-08-05 10:37:47 -04:00
|
|
|
v2 "github.com/docker/docker/plugin/v2"
|
2016-05-16 11:50:55 -04:00
|
|
|
"github.com/docker/docker/registry"
|
2020-03-13 19:38:24 -04:00
|
|
|
"github.com/moby/sys/mount"
|
2019-08-05 10:37:47 -04:00
|
|
|
digest "github.com/opencontainers/go-digest"
|
|
|
|
specs "github.com/opencontainers/runtime-spec/specs-go"
|
2016-12-12 18:05:53 -05:00
|
|
|
"github.com/pkg/errors"
|
2017-07-26 17:42:13 -04:00
|
|
|
"github.com/sirupsen/logrus"
|
2016-05-16 11:50:55 -04:00
|
|
|
)
|
|
|
|
|
2016-12-12 18:05:53 -05:00
|
|
|
const configFileName = "config.json"
|
|
|
|
const rootFSFileName = "rootfs"
|
|
|
|
|
|
|
|
var validFullID = regexp.MustCompile(`^([a-f0-9]{64})$`)
|
2016-05-16 11:50:55 -04:00
|
|
|
|
2017-07-14 16:45:32 -04:00
|
|
|
// Executor is the interface that the plugin manager uses to interact with for starting/stopping plugins
|
|
|
|
type Executor interface {
|
|
|
|
Create(id string, spec specs.Spec, stdout, stderr io.WriteCloser) error
|
|
|
|
IsRunning(id string) (bool, error)
|
2018-04-20 10:48:54 -04:00
|
|
|
Restore(id string, stdout, stderr io.WriteCloser) (alive bool, err error)
|
2017-07-14 16:45:32 -04:00
|
|
|
Signal(id string, signal int) error
|
|
|
|
}
|
|
|
|
|
2018-04-20 10:48:54 -04:00
|
|
|
func (pm *Manager) restorePlugin(p *v2.Plugin, c *controller) error {
|
2016-08-26 13:02:38 -04:00
|
|
|
if p.IsEnabled() {
|
2018-04-20 10:48:54 -04:00
|
|
|
return pm.restore(p, c)
|
2016-06-15 13:39:33 -04:00
|
|
|
}
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2016-07-18 11:02:12 -04:00
|
|
|
type eventLogger func(id, name, action string)
|
2016-05-16 11:50:55 -04:00
|
|
|
|
2016-12-12 18:05:53 -05:00
|
|
|
// ManagerConfig defines configuration needed to start new manager.
|
|
|
|
type ManagerConfig struct {
|
|
|
|
Store *Store // remove
|
|
|
|
RegistryService registry.Service
|
|
|
|
LiveRestoreEnabled bool // TODO: remove
|
|
|
|
LogPluginEvent eventLogger
|
|
|
|
Root string
|
|
|
|
ExecRoot string
|
2017-07-14 16:45:32 -04:00
|
|
|
CreateExecutor ExecutorCreator
|
2017-03-17 17:57:23 -04:00
|
|
|
AuthzMiddleware *authorization.Middleware
|
2016-12-12 18:05:53 -05:00
|
|
|
}
|
|
|
|
|
2017-07-14 16:45:32 -04:00
|
|
|
// ExecutorCreator is used in the manager config to pass in an `Executor`
|
|
|
|
type ExecutorCreator func(*Manager) (Executor, error)
|
|
|
|
|
2016-05-16 11:50:55 -04:00
|
|
|
// Manager controls the plugin subsystem.
|
|
|
|
type Manager struct {
|
2017-07-14 16:45:32 -04:00
|
|
|
config ManagerConfig
|
|
|
|
mu sync.RWMutex // protects cMap
|
|
|
|
muGC sync.RWMutex // protects blobstore deletions
|
|
|
|
cMap map[*v2.Plugin]*controller
|
2020-02-10 19:31:04 -05:00
|
|
|
blobStore content.Store
|
2017-07-14 16:45:32 -04:00
|
|
|
publisher *pubsub.Publisher
|
|
|
|
executor Executor
|
2016-12-01 14:36:56 -05:00
|
|
|
}
|
|
|
|
|
|
|
|
// controller represents the manager's control on a plugin.
|
|
|
|
type controller struct {
|
|
|
|
restart bool
|
|
|
|
exitChan chan bool
|
|
|
|
timeoutInSecs int
|
2016-05-16 11:50:55 -04:00
|
|
|
}
|
|
|
|
|
2016-12-12 18:05:53 -05:00
|
|
|
// pluginRegistryService ensures that all resolved repositories
|
|
|
|
// are of the plugin class.
|
|
|
|
type pluginRegistryService struct {
|
|
|
|
registry.Service
|
2016-05-16 11:50:55 -04:00
|
|
|
}
|
|
|
|
|
2016-12-12 18:05:53 -05:00
|
|
|
func (s pluginRegistryService) ResolveRepository(name reference.Named) (repoInfo *registry.RepositoryInfo, err error) {
|
|
|
|
repoInfo, err = s.Service.ResolveRepository(name)
|
|
|
|
if repoInfo != nil {
|
|
|
|
repoInfo.Class = "plugin"
|
2016-05-16 11:50:55 -04:00
|
|
|
}
|
2016-12-12 18:05:53 -05:00
|
|
|
return
|
|
|
|
}
|
2016-05-16 11:50:55 -04:00
|
|
|
|
2016-12-12 18:05:53 -05:00
|
|
|
// NewManager returns a new plugin manager.
|
|
|
|
func NewManager(config ManagerConfig) (*Manager, error) {
|
|
|
|
if config.RegistryService != nil {
|
|
|
|
config.RegistryService = pluginRegistryService{config.RegistryService}
|
2016-05-16 11:50:55 -04:00
|
|
|
}
|
2016-12-12 18:05:53 -05:00
|
|
|
manager := &Manager{
|
|
|
|
config: config,
|
2016-05-16 11:50:55 -04:00
|
|
|
}
|
2017-11-01 05:29:37 -04:00
|
|
|
for _, dirName := range []string{manager.config.Root, manager.config.ExecRoot, manager.tmpDir()} {
|
|
|
|
if err := os.MkdirAll(dirName, 0700); err != nil {
|
|
|
|
return nil, errors.Wrapf(err, "failed to mkdir %v", dirName)
|
|
|
|
}
|
2016-12-12 18:05:53 -05:00
|
|
|
}
|
|
|
|
var err error
|
2017-07-14 16:45:32 -04:00
|
|
|
manager.executor, err = config.CreateExecutor(manager)
|
2016-05-16 11:50:55 -04:00
|
|
|
if err != nil {
|
2017-07-14 16:45:32 -04:00
|
|
|
return nil, err
|
2016-05-16 11:50:55 -04:00
|
|
|
}
|
2017-07-14 16:45:32 -04:00
|
|
|
|
2020-02-10 19:31:04 -05:00
|
|
|
manager.blobStore, err = local.NewStore(filepath.Join(manager.config.Root, "storage"))
|
2016-12-12 18:05:53 -05:00
|
|
|
if err != nil {
|
2020-02-10 19:31:04 -05:00
|
|
|
return nil, errors.Wrap(err, "error creating plugin blob store")
|
2016-12-12 18:05:53 -05:00
|
|
|
}
|
|
|
|
|
2016-12-01 14:36:56 -05:00
|
|
|
manager.cMap = make(map[*v2.Plugin]*controller)
|
2016-12-12 18:05:53 -05:00
|
|
|
if err := manager.reload(); err != nil {
|
|
|
|
return nil, errors.Wrap(err, "failed to restore plugins")
|
|
|
|
}
|
2017-06-07 13:07:01 -04:00
|
|
|
|
|
|
|
manager.publisher = pubsub.NewPublisher(0, 0)
|
2016-12-12 18:05:53 -05:00
|
|
|
return manager, nil
|
|
|
|
}
|
|
|
|
|
|
|
|
func (pm *Manager) tmpDir() string {
|
|
|
|
return filepath.Join(pm.config.Root, "tmp")
|
2016-05-16 11:50:55 -04:00
|
|
|
}
|
|
|
|
|
2017-07-14 16:45:32 -04:00
|
|
|
// HandleExitEvent is called when the executor receives the exit event
|
|
|
|
// In the future we may change this, but for now all we care about is the exit event.
|
|
|
|
func (pm *Manager) HandleExitEvent(id string) error {
|
|
|
|
p, err := pm.config.Store.GetV2Plugin(id)
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
2016-12-01 14:36:56 -05:00
|
|
|
|
2018-04-20 10:48:54 -04:00
|
|
|
if err := os.RemoveAll(filepath.Join(pm.config.ExecRoot, id)); err != nil && !os.IsNotExist(err) {
|
|
|
|
logrus.WithError(err).WithField("id", id).Error("Could not remove plugin bundle dir")
|
|
|
|
}
|
2016-11-22 14:21:34 -05:00
|
|
|
|
2017-07-14 16:45:32 -04:00
|
|
|
pm.mu.RLock()
|
|
|
|
c := pm.cMap[p]
|
|
|
|
if c.exitChan != nil {
|
|
|
|
close(c.exitChan)
|
2018-04-20 10:48:54 -04:00
|
|
|
c.exitChan = nil // ignore duplicate events (containerd issue #2299)
|
2016-07-01 14:36:11 -04:00
|
|
|
}
|
2017-07-14 16:45:32 -04:00
|
|
|
restart := c.restart
|
|
|
|
pm.mu.RUnlock()
|
2016-07-01 14:36:11 -04:00
|
|
|
|
2017-07-14 16:45:32 -04:00
|
|
|
if restart {
|
|
|
|
pm.enable(p, c, true)
|
2017-12-18 21:28:16 -05:00
|
|
|
} else {
|
|
|
|
if err := mount.RecursiveUnmount(filepath.Join(pm.config.Root, id)); err != nil {
|
|
|
|
return errors.Wrap(err, "error cleaning up plugin mounts")
|
|
|
|
}
|
2017-07-14 16:45:32 -04:00
|
|
|
}
|
2016-05-16 11:50:55 -04:00
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2017-06-26 14:54:14 -04:00
|
|
|
func handleLoadError(err error, id string) {
|
|
|
|
if err == nil {
|
|
|
|
return
|
|
|
|
}
|
|
|
|
logger := logrus.WithError(err).WithField("id", id)
|
2020-04-17 06:01:01 -04:00
|
|
|
if errors.Is(err, os.ErrNotExist) {
|
2017-06-26 14:54:14 -04:00
|
|
|
// Likely some error while removing on an older version of docker
|
|
|
|
logger.Warn("missing plugin config, skipping: this may be caused due to a failed remove and requires manual cleanup.")
|
|
|
|
return
|
|
|
|
}
|
|
|
|
logger.Error("error loading plugin, skipping")
|
|
|
|
}
|
|
|
|
|
2016-12-12 18:05:53 -05:00
|
|
|
func (pm *Manager) reload() error { // todo: restore
|
|
|
|
dir, err := ioutil.ReadDir(pm.config.Root)
|
2016-05-16 11:50:55 -04:00
|
|
|
if err != nil {
|
2016-12-12 18:05:53 -05:00
|
|
|
return errors.Wrapf(err, "failed to read %v", pm.config.Root)
|
2016-05-16 11:50:55 -04:00
|
|
|
}
|
2016-08-26 13:02:38 -04:00
|
|
|
plugins := make(map[string]*v2.Plugin)
|
2016-12-12 18:05:53 -05:00
|
|
|
for _, v := range dir {
|
|
|
|
if validFullID.MatchString(v.Name()) {
|
|
|
|
p, err := pm.loadPlugin(v.Name())
|
|
|
|
if err != nil {
|
2017-06-26 14:54:14 -04:00
|
|
|
handleLoadError(err, v.Name())
|
|
|
|
continue
|
2016-12-12 18:05:53 -05:00
|
|
|
}
|
|
|
|
plugins[p.GetID()] = p
|
2017-06-26 14:54:14 -04:00
|
|
|
} else {
|
|
|
|
if validFullID.MatchString(strings.TrimSuffix(v.Name(), "-removing")) {
|
|
|
|
// There was likely some error while removing this plugin, let's try to remove again here
|
|
|
|
if err := system.EnsureRemoveAll(v.Name()); err != nil {
|
|
|
|
logrus.WithError(err).WithField("id", v.Name()).Warn("error while attempting to clean up previously removed plugin")
|
|
|
|
}
|
|
|
|
}
|
2016-12-12 18:05:53 -05:00
|
|
|
}
|
2016-05-16 11:50:55 -04:00
|
|
|
}
|
|
|
|
|
2016-12-12 18:05:53 -05:00
|
|
|
pm.config.Store.SetAll(plugins)
|
|
|
|
|
|
|
|
var wg sync.WaitGroup
|
|
|
|
wg.Add(len(plugins))
|
2016-08-26 13:02:38 -04:00
|
|
|
for _, p := range plugins {
|
2018-04-20 10:48:54 -04:00
|
|
|
c := &controller{exitChan: make(chan bool)}
|
|
|
|
pm.mu.Lock()
|
2016-12-01 14:36:56 -05:00
|
|
|
pm.cMap[p] = c
|
2018-04-20 10:48:54 -04:00
|
|
|
pm.mu.Unlock()
|
|
|
|
|
2016-08-26 13:02:38 -04:00
|
|
|
go func(p *v2.Plugin) {
|
2016-12-12 18:05:53 -05:00
|
|
|
defer wg.Done()
|
2018-04-20 10:48:54 -04:00
|
|
|
if err := pm.restorePlugin(p, c); err != nil {
|
|
|
|
logrus.WithError(err).WithField("id", p.GetID()).Error("Failed to restore plugin")
|
2016-06-15 13:39:33 -04:00
|
|
|
return
|
|
|
|
}
|
|
|
|
|
2016-11-22 14:21:34 -05:00
|
|
|
if p.Rootfs != "" {
|
2016-12-12 18:05:53 -05:00
|
|
|
p.Rootfs = filepath.Join(pm.config.Root, p.PluginObj.ID, "rootfs")
|
2016-11-22 14:21:34 -05:00
|
|
|
}
|
|
|
|
|
|
|
|
// We should only enable rootfs propagation for certain plugin types that need it.
|
|
|
|
for _, typ := range p.PluginObj.Config.Interface.Types {
|
2016-12-10 11:40:01 -05:00
|
|
|
if (typ.Capability == "volumedriver" || typ.Capability == "graphdriver") && typ.Prefix == "docker" && strings.HasPrefix(typ.Version, "1.") {
|
2016-11-22 14:21:34 -05:00
|
|
|
if p.PluginObj.Config.PropagatedMount != "" {
|
2017-02-02 23:08:35 -05:00
|
|
|
propRoot := filepath.Join(filepath.Dir(p.Rootfs), "propagated-mount")
|
|
|
|
|
|
|
|
// check if we need to migrate an older propagated mount from before
|
|
|
|
// these mounts were stored outside the plugin rootfs
|
|
|
|
if _, err := os.Stat(propRoot); os.IsNotExist(err) {
|
2017-12-14 09:29:11 -05:00
|
|
|
rootfsProp := filepath.Join(p.Rootfs, p.PluginObj.Config.PropagatedMount)
|
|
|
|
if _, err := os.Stat(rootfsProp); err == nil {
|
|
|
|
if err := os.Rename(rootfsProp, propRoot); err != nil {
|
2017-02-02 23:08:35 -05:00
|
|
|
logrus.WithError(err).WithField("dir", propRoot).Error("error migrating propagated mount storage")
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
if err := os.MkdirAll(propRoot, 0755); err != nil {
|
|
|
|
logrus.Errorf("failed to create PropagatedMount directory at %s: %v", propRoot, err)
|
|
|
|
}
|
2016-11-22 14:21:34 -05:00
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2016-12-12 18:05:53 -05:00
|
|
|
pm.save(p)
|
|
|
|
requiresManualRestore := !pm.config.LiveRestoreEnabled && p.IsEnabled()
|
2016-06-15 13:39:33 -04:00
|
|
|
|
|
|
|
if requiresManualRestore {
|
|
|
|
// if liveRestore is not enabled, the plugin will be stopped now so we should enable it
|
2016-12-01 14:36:56 -05:00
|
|
|
if err := pm.enable(p, c, true); err != nil {
|
2018-04-20 10:48:54 -04:00
|
|
|
logrus.WithError(err).WithField("id", p.GetID()).Error("failed to enable plugin")
|
2016-06-15 13:39:33 -04:00
|
|
|
}
|
|
|
|
}
|
|
|
|
}(p)
|
|
|
|
}
|
2016-12-12 18:05:53 -05:00
|
|
|
wg.Wait()
|
2016-05-16 11:50:55 -04:00
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2017-06-07 13:07:01 -04:00
|
|
|
// Get looks up the requested plugin in the store.
|
|
|
|
func (pm *Manager) Get(idOrName string) (*v2.Plugin, error) {
|
|
|
|
return pm.config.Store.GetV2Plugin(idOrName)
|
|
|
|
}
|
|
|
|
|
2016-12-12 18:05:53 -05:00
|
|
|
func (pm *Manager) loadPlugin(id string) (*v2.Plugin, error) {
|
|
|
|
p := filepath.Join(pm.config.Root, id, configFileName)
|
|
|
|
dt, err := ioutil.ReadFile(p)
|
|
|
|
if err != nil {
|
|
|
|
return nil, errors.Wrapf(err, "error reading %v", p)
|
|
|
|
}
|
|
|
|
var plugin v2.Plugin
|
|
|
|
if err := json.Unmarshal(dt, &plugin); err != nil {
|
|
|
|
return nil, errors.Wrapf(err, "error decoding %v", p)
|
|
|
|
}
|
|
|
|
return &plugin, nil
|
|
|
|
}
|
|
|
|
|
|
|
|
func (pm *Manager) save(p *v2.Plugin) error {
|
|
|
|
pluginJSON, err := json.Marshal(p)
|
|
|
|
if err != nil {
|
|
|
|
return errors.Wrap(err, "failed to marshal plugin json")
|
|
|
|
}
|
|
|
|
if err := ioutils.AtomicWriteFile(filepath.Join(pm.config.Root, p.GetID(), configFileName), pluginJSON, 0600); err != nil {
|
2017-01-17 13:27:01 -05:00
|
|
|
return errors.Wrap(err, "failed to write atomically plugin json")
|
2016-12-12 18:05:53 -05:00
|
|
|
}
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2017-05-21 19:24:07 -04:00
|
|
|
// GC cleans up unreferenced blobs. This is recommended to run in a goroutine
|
2016-12-12 18:05:53 -05:00
|
|
|
func (pm *Manager) GC() {
|
|
|
|
pm.muGC.Lock()
|
|
|
|
defer pm.muGC.Unlock()
|
|
|
|
|
2020-07-14 04:41:34 -04:00
|
|
|
used := make(map[digest.Digest]struct{})
|
2016-12-12 18:05:53 -05:00
|
|
|
for _, p := range pm.config.Store.GetAll() {
|
2020-07-14 04:41:34 -04:00
|
|
|
used[p.Config] = struct{}{}
|
2016-12-12 18:05:53 -05:00
|
|
|
for _, b := range p.Blobsums {
|
2020-07-14 04:41:34 -04:00
|
|
|
used[b] = struct{}{}
|
2016-12-12 18:05:53 -05:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2020-02-10 19:31:04 -05:00
|
|
|
ctx := context.TODO()
|
|
|
|
pm.blobStore.Walk(ctx, func(info content.Info) error {
|
2020-07-14 04:41:34 -04:00
|
|
|
_, ok := used[info.Digest]
|
2020-02-10 19:31:04 -05:00
|
|
|
if ok {
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
|
|
|
return pm.blobStore.Delete(ctx, info.Digest)
|
|
|
|
})
|
2016-12-12 18:05:53 -05:00
|
|
|
}
|
|
|
|
|
2016-05-16 11:50:55 -04:00
|
|
|
type logHook struct{ id string }
|
|
|
|
|
|
|
|
func (logHook) Levels() []logrus.Level {
|
|
|
|
return logrus.AllLevels
|
|
|
|
}
|
|
|
|
|
|
|
|
func (l logHook) Fire(entry *logrus.Entry) error {
|
|
|
|
entry.Data = logrus.Fields{"plugin": l.id}
|
|
|
|
return nil
|
|
|
|
}
|
2016-10-17 17:39:52 -04:00
|
|
|
|
2017-07-14 16:45:32 -04:00
|
|
|
func makeLoggerStreams(id string) (stdout, stderr io.WriteCloser) {
|
|
|
|
logger := logrus.New()
|
|
|
|
logger.Hooks.Add(logHook{id})
|
|
|
|
return logger.WriterLevel(logrus.InfoLevel), logger.WriterLevel(logrus.ErrorLevel)
|
2016-10-17 17:39:52 -04:00
|
|
|
}
|
2016-12-12 18:05:53 -05:00
|
|
|
|
|
|
|
func validatePrivileges(requiredPrivileges, privileges types.PluginPrivileges) error {
|
2016-12-27 22:38:13 -05:00
|
|
|
if !isEqual(requiredPrivileges, privileges, isEqualPrivilege) {
|
2016-12-12 18:05:53 -05:00
|
|
|
return errors.New("incorrect privileges")
|
|
|
|
}
|
2016-12-27 22:38:13 -05:00
|
|
|
|
2016-12-12 18:05:53 -05:00
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2016-12-27 22:38:13 -05:00
|
|
|
func isEqual(arrOne, arrOther types.PluginPrivileges, compare func(x, y types.PluginPrivilege) bool) bool {
|
|
|
|
if len(arrOne) != len(arrOther) {
|
|
|
|
return false
|
|
|
|
}
|
|
|
|
|
|
|
|
sort.Sort(arrOne)
|
|
|
|
sort.Sort(arrOther)
|
|
|
|
|
|
|
|
for i := 1; i < arrOne.Len(); i++ {
|
|
|
|
if !compare(arrOne[i], arrOther[i]) {
|
|
|
|
return false
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
return true
|
|
|
|
}
|
|
|
|
|
|
|
|
func isEqualPrivilege(a, b types.PluginPrivilege) bool {
|
|
|
|
if a.Name != b.Name {
|
|
|
|
return false
|
|
|
|
}
|
|
|
|
|
|
|
|
return reflect.DeepEqual(a.Value, b.Value)
|
|
|
|
}
|