plugins: misc fixes
Rename variable to reflect manifest -> config renaming Populate Description fields when computing privileges. Refactor/reuse code from daemon/oci_linux.go Signed-off-by: Tibor Vass <tibor@docker.com>
This commit is contained in:
Tibor Vass
parent
53b9b99e5c
commit
6547609870
|
|
@ -221,18 +221,6 @@ func setCapabilities(s *specs.Spec, c *container.Container) error {
|
|||
return nil
|
||||
}
|
||||
|
||||
func delNamespace(s *specs.Spec, nsType specs.NamespaceType) {
|
||||
idx := -1
|
||||
for i, n := range s.Linux.Namespaces {
|
||||
if n.Type == nsType {
|
||||
idx = i
|
||||
}
|
||||
}
|
||||
if idx >= 0 {
|
||||
s.Linux.Namespaces = append(s.Linux.Namespaces[:idx], s.Linux.Namespaces[idx+1:]...)
|
||||
}
|
||||
}
|
||||
|
||||
func setNamespaces(daemon *Daemon, s *specs.Spec, c *container.Container) error {
|
||||
userNS := false
|
||||
// user
|
||||
|
|
@ -283,7 +271,7 @@ func setNamespaces(daemon *Daemon, s *specs.Spec, c *container.Container) error
|
|||
setNamespace(s, nsUser)
|
||||
}
|
||||
} else if c.HostConfig.IpcMode.IsHost() {
|
||||
delNamespace(s, specs.NamespaceType("ipc"))
|
||||
oci.RemoveNamespace(s, specs.NamespaceType("ipc"))
|
||||
} else {
|
||||
ns := specs.Namespace{Type: "ipc"}
|
||||
setNamespace(s, ns)
|
||||
|
|
@ -304,14 +292,14 @@ func setNamespaces(daemon *Daemon, s *specs.Spec, c *container.Container) error
|
|||
setNamespace(s, nsUser)
|
||||
}
|
||||
} else if c.HostConfig.PidMode.IsHost() {
|
||||
delNamespace(s, specs.NamespaceType("pid"))
|
||||
oci.RemoveNamespace(s, specs.NamespaceType("pid"))
|
||||
} else {
|
||||
ns := specs.Namespace{Type: "pid"}
|
||||
setNamespace(s, ns)
|
||||
}
|
||||
// uts
|
||||
if c.HostConfig.UTSMode.IsHost() {
|
||||
delNamespace(s, specs.NamespaceType("uts"))
|
||||
oci.RemoveNamespace(s, specs.NamespaceType("uts"))
|
||||
s.Hostname = ""
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -16,6 +16,7 @@ keywords: "API, Usage, plugins, documentation, developer"
|
|||
will be rejected.
|
||||
-->
|
||||
|
||||
|
||||
# Plugin Config Version 0 of Plugin V2
|
||||
|
||||
This document outlines the format of the V0 plugin configuration. The plugin
|
||||
|
|
@ -85,10 +86,6 @@ Config provides the base accessible fields for working with V0 plugin format
|
|||
- **host**
|
||||
- **none**
|
||||
|
||||
- **`capabilities`** *array*
|
||||
|
||||
capabilities of the plugin (*Linux only*), see list [`here`](https://github.com/opencontainers/runc/blob/master/libcontainer/SPEC.md#security)
|
||||
|
||||
- **`mounts`** *PluginMount array*
|
||||
|
||||
mount of the plugin, struct consisting of the following fields, see [`MOUNTS`](https://github.com/opencontainers/runtime-spec/blob/master/config.md#mounts)
|
||||
|
|
@ -117,22 +114,6 @@ Config provides the base accessible fields for working with V0 plugin format
|
|||
|
||||
options of the mount.
|
||||
|
||||
- **`devices`** *PluginDevice array*
|
||||
|
||||
device of the plugin, (*Linux only*), struct consisting of the following fields, see [`DEVICES`](https://github.com/opencontainers/runtime-spec/blob/master/config-linux.md#devices)
|
||||
|
||||
- **`name`** *string*
|
||||
|
||||
name of the device.
|
||||
|
||||
- **`description`** *string*
|
||||
|
||||
description of the device.
|
||||
|
||||
- **`path`** *string*
|
||||
|
||||
path of the device.
|
||||
|
||||
- **`env`** *PluginEnv array*
|
||||
|
||||
env of the plugin, struct consisting of the following fields
|
||||
|
|
@ -165,6 +146,27 @@ Config provides the base accessible fields for working with V0 plugin format
|
|||
|
||||
values of the args.
|
||||
|
||||
- **`linux`** *PluginLinux*
|
||||
|
||||
- **`capabilities`** *string array*
|
||||
|
||||
capabilities of the plugin (*Linux only*), see list [`here`](https://github.com/opencontainers/runc/blob/master/libcontainer/SPEC.md#security)
|
||||
|
||||
- **`devices`** *PluginDevice array*
|
||||
|
||||
device of the plugin, (*Linux only*), struct consisting of the following fields, see [`DEVICES`](https://github.com/opencontainers/runtime-spec/blob/master/config-linux.md#devices)
|
||||
|
||||
- **`name`** *string*
|
||||
|
||||
name of the device.
|
||||
|
||||
- **`description`** *string*
|
||||
|
||||
description of the device.
|
||||
|
||||
- **`path`** *string*
|
||||
|
||||
path of the device.
|
||||
|
||||
## Example Config
|
||||
|
||||
|
|
|
|||
|
|
@ -0,0 +1,16 @@
|
|||
package oci
|
||||
|
||||
import specs "github.com/opencontainers/runtime-spec/specs-go"
|
||||
|
||||
// RemoveNamespace removes the `nsType` namespace from OCI spec `s`
|
||||
func RemoveNamespace(s *specs.Spec, nsType specs.NamespaceType) {
|
||||
idx := -1
|
||||
for i, n := range s.Linux.Namespaces {
|
||||
if n.Type == nsType {
|
||||
idx = i
|
||||
}
|
||||
}
|
||||
if idx >= 0 {
|
||||
s.Linux.Namespaces = append(s.Linux.Namespaces[:idx], s.Linux.Namespaces[idx+1:]...)
|
||||
}
|
||||
}
|
||||
|
|
@ -218,45 +218,45 @@ next:
|
|||
// ComputePrivileges takes the config file and computes the list of access necessary
|
||||
// for the plugin on the host.
|
||||
func (p *Plugin) ComputePrivileges() types.PluginPrivileges {
|
||||
m := p.PluginObj.Config
|
||||
c := p.PluginObj.Config
|
||||
var privileges types.PluginPrivileges
|
||||
if m.Network.Type != "null" && m.Network.Type != "bridge" {
|
||||
if c.Network.Type != "null" && c.Network.Type != "bridge" {
|
||||
privileges = append(privileges, types.PluginPrivilege{
|
||||
Name: "network",
|
||||
Description: "",
|
||||
Value: []string{m.Network.Type},
|
||||
Description: "permissions to access a network",
|
||||
Value: []string{c.Network.Type},
|
||||
})
|
||||
}
|
||||
for _, mount := range m.Mounts {
|
||||
for _, mount := range c.Mounts {
|
||||
if mount.Source != nil {
|
||||
privileges = append(privileges, types.PluginPrivilege{
|
||||
Name: "mount",
|
||||
Description: "",
|
||||
Description: "host path to mount",
|
||||
Value: []string{*mount.Source},
|
||||
})
|
||||
}
|
||||
}
|
||||
for _, device := range m.Linux.Devices {
|
||||
for _, device := range c.Linux.Devices {
|
||||
if device.Path != nil {
|
||||
privileges = append(privileges, types.PluginPrivilege{
|
||||
Name: "device",
|
||||
Description: "",
|
||||
Description: "host device to access",
|
||||
Value: []string{*device.Path},
|
||||
})
|
||||
}
|
||||
}
|
||||
if m.Linux.DeviceCreation {
|
||||
if c.Linux.DeviceCreation {
|
||||
privileges = append(privileges, types.PluginPrivilege{
|
||||
Name: "device-creation",
|
||||
Description: "",
|
||||
Description: "allow creating devices inside plugin",
|
||||
Value: []string{"true"},
|
||||
})
|
||||
}
|
||||
if len(m.Linux.Capabilities) > 0 {
|
||||
if len(c.Linux.Capabilities) > 0 {
|
||||
privileges = append(privileges, types.PluginPrivilege{
|
||||
Name: "capabilities",
|
||||
Description: "",
|
||||
Value: m.Linux.Capabilities,
|
||||
Description: "list of additional capabilities required",
|
||||
Value: c.Linux.Capabilities,
|
||||
})
|
||||
}
|
||||
return privileges
|
||||
|
|
@ -317,12 +317,7 @@ func (p *Plugin) InitSpec(s specs.Spec, libRoot string) (*specs.Spec, error) {
|
|||
if p.PluginObj.Config.Network.Type != "" {
|
||||
// TODO: if net == bridge, use libnetwork controller to create a new plugin-specific bridge, bind mount /etc/hosts and /etc/resolv.conf look at the docker code (allocateNetwork, initialize)
|
||||
if p.PluginObj.Config.Network.Type == "host" {
|
||||
for i, n := range s.Linux.Namespaces {
|
||||
if n.Type == "network" {
|
||||
s.Linux.Namespaces = append(s.Linux.Namespaces[:i], s.Linux.Namespaces[i+1:]...)
|
||||
break
|
||||
}
|
||||
}
|
||||
oci.RemoveNamespace(&s, specs.NamespaceType("network"))
|
||||
}
|
||||
etcHosts := "/etc/hosts"
|
||||
resolvConf := "/etc/resolv.conf"
|
||||
|
|
@ -401,8 +396,6 @@ func (p *Plugin) InitSpec(s specs.Spec, libRoot string) (*specs.Spec, error) {
|
|||
s.Process.Cwd = cwd
|
||||
s.Process.Env = envs
|
||||
|
||||
// TODO: what about duplicates?
|
||||
// TODO: Should not need CAP_ prefix in manifest?
|
||||
s.Process.Capabilities = append(s.Process.Capabilities, p.PluginObj.Config.Linux.Capabilities...)
|
||||
|
||||
return &s, nil
|
||||
|
|
|
|||
Loading…
Reference in New Issue