1
0
Fork 0
mirror of https://github.com/moby/moby.git synced 2022-11-09 12:21:53 -05:00

Add execin function to running a process in a namespace

Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
This commit is contained in:
Michael Crosby 2014-02-19 19:53:25 -08:00
parent 5d62916c48
commit 420b5eb211
4 changed files with 133 additions and 1 deletions

View file

@ -1,5 +1,5 @@
{
"id": "koye",
"hostname": "koye",
"command": {
"args": [
"/bin/bash"

View file

@ -0,0 +1,115 @@
package main
import (
"fmt"
"github.com/dotcloud/docker/pkg/libcontainer"
"github.com/dotcloud/docker/pkg/libcontainer/capabilities"
"github.com/dotcloud/docker/pkg/system"
"io/ioutil"
"os"
"path/filepath"
"strconv"
"syscall"
)
func execinCommand(container *libcontainer.Container) (int, error) {
nspid, err := readPid()
if err != nil {
return -1, err
}
for _, ns := range container.Namespaces {
if err := system.Unshare(namespaceMap[ns]); err != nil {
return -1, err
}
}
fds, err := getNsFds(nspid, container)
closeFds := func() {
for _, f := range fds {
system.Closefd(f)
}
}
if err != nil {
closeFds()
return -1, err
}
for _, fd := range fds {
if fd > 0 {
if err := system.Setns(fd, 0); err != nil {
closeFds()
return -1, fmt.Errorf("setns %s", err)
}
}
system.Closefd(fd)
}
// if the container has a new pid and mount namespace we need to
// remount proc and sys to pick up the changes
if container.Namespaces.Contains(libcontainer.CLONE_NEWNS) &&
container.Namespaces.Contains(libcontainer.CLONE_NEWPID) {
pid, err := system.Fork()
if err != nil {
return -1, err
}
if pid == 0 {
// TODO: make all raw syscalls to be fork safe
if err := system.Unshare(syscall.CLONE_NEWNS); err != nil {
return -1, err
}
if err := remountProc(); err != nil {
return -1, fmt.Errorf("remount proc %s", err)
}
if err := remountSys(); err != nil {
return -1, fmt.Errorf("remount sys %s", err)
}
if err := capabilities.DropCapabilities(container); err != nil {
return -1, fmt.Errorf("drop capabilities %s", err)
}
if err := system.Exec(container.Command.Args[0], container.Command.Args[0:], container.Command.Env); err != nil {
return -1, err
}
}
proc, err := os.FindProcess(pid)
if err != nil {
return -1, err
}
state, err := proc.Wait()
if err != nil {
return -1, err
}
os.Exit(state.Sys().(syscall.WaitStatus).ExitStatus())
}
if err := capabilities.DropCapabilities(container); err != nil {
return -1, fmt.Errorf("drop capabilities %s", err)
}
if err := system.Exec(container.Command.Args[0], container.Command.Args[0:], container.Command.Env); err != nil {
return -1, err
}
panic("unreachable")
}
func readPid() (int, error) {
data, err := ioutil.ReadFile(".nspid")
if err != nil {
return -1, err
}
pid, err := strconv.Atoi(string(data))
if err != nil {
return -1, err
}
return pid, nil
}
func getNsFds(pid int, container *libcontainer.Container) ([]uintptr, error) {
fds := make([]uintptr, len(container.Namespaces))
for i, ns := range container.Namespaces {
f, err := os.OpenFile(filepath.Join("/proc/", strconv.Itoa(pid), "ns", namespaceFileMap[ns]), os.O_RDONLY, 0)
if err != nil {
return fds, err
}
fds[i] = f.Fd()
}
return fds, nil
}

View file

@ -37,6 +37,14 @@ func main() {
if err := initCommand(container, os.Args[2]); err != nil {
log.Fatal(err)
}
case "execin":
exitCode, err := execinCommand(container)
if err != nil {
log.Fatal(err)
}
os.Exit(exitCode)
default:
log.Fatalf("command not supported for nsinit %s", os.Args[1])
}
}

View file

@ -14,6 +14,15 @@ var namespaceMap = map[libcontainer.Namespace]int{
libcontainer.CLONE_NEWNET: syscall.CLONE_NEWNET,
}
var namespaceFileMap = map[libcontainer.Namespace]string{
libcontainer.CLONE_NEWNS: "mnt",
libcontainer.CLONE_NEWUTS: "uts",
libcontainer.CLONE_NEWIPC: "ipc",
libcontainer.CLONE_NEWUSER: "user",
libcontainer.CLONE_NEWPID: "pid",
libcontainer.CLONE_NEWNET: "net",
}
// getNamespaceFlags parses the container's Namespaces options to set the correct
// flags on clone, unshare, and setns
func getNamespaceFlags(namespaces libcontainer.Namespaces) (flag int) {