diff --git a/daemon/oci_linux.go b/daemon/oci_linux.go index b3abd8c6cb..bf21df86c4 100644 --- a/daemon/oci_linux.go +++ b/daemon/oci_linux.go @@ -221,18 +221,6 @@ func setCapabilities(s *specs.Spec, c *container.Container) error { return nil } -func delNamespace(s *specs.Spec, nsType specs.NamespaceType) { - idx := -1 - for i, n := range s.Linux.Namespaces { - if n.Type == nsType { - idx = i - } - } - if idx >= 0 { - s.Linux.Namespaces = append(s.Linux.Namespaces[:idx], s.Linux.Namespaces[idx+1:]...) - } -} - func setNamespaces(daemon *Daemon, s *specs.Spec, c *container.Container) error { userNS := false // user @@ -283,7 +271,7 @@ func setNamespaces(daemon *Daemon, s *specs.Spec, c *container.Container) error setNamespace(s, nsUser) } } else if c.HostConfig.IpcMode.IsHost() { - delNamespace(s, specs.NamespaceType("ipc")) + oci.RemoveNamespace(s, specs.NamespaceType("ipc")) } else { ns := specs.Namespace{Type: "ipc"} setNamespace(s, ns) @@ -304,14 +292,14 @@ func setNamespaces(daemon *Daemon, s *specs.Spec, c *container.Container) error setNamespace(s, nsUser) } } else if c.HostConfig.PidMode.IsHost() { - delNamespace(s, specs.NamespaceType("pid")) + oci.RemoveNamespace(s, specs.NamespaceType("pid")) } else { ns := specs.Namespace{Type: "pid"} setNamespace(s, ns) } // uts if c.HostConfig.UTSMode.IsHost() { - delNamespace(s, specs.NamespaceType("uts")) + oci.RemoveNamespace(s, specs.NamespaceType("uts")) s.Hostname = "" } diff --git a/docs/extend/config.md b/docs/extend/config.md index 329af250eb..53f52f7b66 100644 --- a/docs/extend/config.md +++ b/docs/extend/config.md @@ -16,6 +16,7 @@ keywords: "API, Usage, plugins, documentation, developer" will be rejected. --> + # Plugin Config Version 0 of Plugin V2 This document outlines the format of the V0 plugin configuration. The plugin @@ -85,10 +86,6 @@ Config provides the base accessible fields for working with V0 plugin format - **host** - **none** -- **`capabilities`** *array* - - capabilities of the plugin (*Linux only*), see list [`here`](https://github.com/opencontainers/runc/blob/master/libcontainer/SPEC.md#security) - - **`mounts`** *PluginMount array* mount of the plugin, struct consisting of the following fields, see [`MOUNTS`](https://github.com/opencontainers/runtime-spec/blob/master/config.md#mounts) @@ -117,22 +114,6 @@ Config provides the base accessible fields for working with V0 plugin format options of the mount. -- **`devices`** *PluginDevice array* - - device of the plugin, (*Linux only*), struct consisting of the following fields, see [`DEVICES`](https://github.com/opencontainers/runtime-spec/blob/master/config-linux.md#devices) - - - **`name`** *string* - - name of the device. - - - **`description`** *string* - - description of the device. - - - **`path`** *string* - - path of the device. - - **`env`** *PluginEnv array* env of the plugin, struct consisting of the following fields @@ -165,6 +146,27 @@ Config provides the base accessible fields for working with V0 plugin format values of the args. +- **`linux`** *PluginLinux* + + - **`capabilities`** *string array* + + capabilities of the plugin (*Linux only*), see list [`here`](https://github.com/opencontainers/runc/blob/master/libcontainer/SPEC.md#security) + + - **`devices`** *PluginDevice array* + + device of the plugin, (*Linux only*), struct consisting of the following fields, see [`DEVICES`](https://github.com/opencontainers/runtime-spec/blob/master/config-linux.md#devices) + + - **`name`** *string* + + name of the device. + + - **`description`** *string* + + description of the device. + + - **`path`** *string* + + path of the device. ## Example Config diff --git a/oci/namespaces.go b/oci/namespaces.go new file mode 100644 index 0000000000..4902482498 --- /dev/null +++ b/oci/namespaces.go @@ -0,0 +1,16 @@ +package oci + +import specs "github.com/opencontainers/runtime-spec/specs-go" + +// RemoveNamespace removes the `nsType` namespace from OCI spec `s` +func RemoveNamespace(s *specs.Spec, nsType specs.NamespaceType) { + idx := -1 + for i, n := range s.Linux.Namespaces { + if n.Type == nsType { + idx = i + } + } + if idx >= 0 { + s.Linux.Namespaces = append(s.Linux.Namespaces[:idx], s.Linux.Namespaces[idx+1:]...) + } +} diff --git a/plugin/v2/plugin.go b/plugin/v2/plugin.go index ca1b5f1962..38b74721e7 100644 --- a/plugin/v2/plugin.go +++ b/plugin/v2/plugin.go @@ -218,45 +218,45 @@ next: // ComputePrivileges takes the config file and computes the list of access necessary // for the plugin on the host. func (p *Plugin) ComputePrivileges() types.PluginPrivileges { - m := p.PluginObj.Config + c := p.PluginObj.Config var privileges types.PluginPrivileges - if m.Network.Type != "null" && m.Network.Type != "bridge" { + if c.Network.Type != "null" && c.Network.Type != "bridge" { privileges = append(privileges, types.PluginPrivilege{ Name: "network", - Description: "", - Value: []string{m.Network.Type}, + Description: "permissions to access a network", + Value: []string{c.Network.Type}, }) } - for _, mount := range m.Mounts { + for _, mount := range c.Mounts { if mount.Source != nil { privileges = append(privileges, types.PluginPrivilege{ Name: "mount", - Description: "", + Description: "host path to mount", Value: []string{*mount.Source}, }) } } - for _, device := range m.Linux.Devices { + for _, device := range c.Linux.Devices { if device.Path != nil { privileges = append(privileges, types.PluginPrivilege{ Name: "device", - Description: "", + Description: "host device to access", Value: []string{*device.Path}, }) } } - if m.Linux.DeviceCreation { + if c.Linux.DeviceCreation { privileges = append(privileges, types.PluginPrivilege{ Name: "device-creation", - Description: "", + Description: "allow creating devices inside plugin", Value: []string{"true"}, }) } - if len(m.Linux.Capabilities) > 0 { + if len(c.Linux.Capabilities) > 0 { privileges = append(privileges, types.PluginPrivilege{ Name: "capabilities", - Description: "", - Value: m.Linux.Capabilities, + Description: "list of additional capabilities required", + Value: c.Linux.Capabilities, }) } return privileges @@ -317,12 +317,7 @@ func (p *Plugin) InitSpec(s specs.Spec, libRoot string) (*specs.Spec, error) { if p.PluginObj.Config.Network.Type != "" { // TODO: if net == bridge, use libnetwork controller to create a new plugin-specific bridge, bind mount /etc/hosts and /etc/resolv.conf look at the docker code (allocateNetwork, initialize) if p.PluginObj.Config.Network.Type == "host" { - for i, n := range s.Linux.Namespaces { - if n.Type == "network" { - s.Linux.Namespaces = append(s.Linux.Namespaces[:i], s.Linux.Namespaces[i+1:]...) - break - } - } + oci.RemoveNamespace(&s, specs.NamespaceType("network")) } etcHosts := "/etc/hosts" resolvConf := "/etc/resolv.conf" @@ -401,8 +396,6 @@ func (p *Plugin) InitSpec(s specs.Spec, libRoot string) (*specs.Spec, error) { s.Process.Cwd = cwd s.Process.Env = envs - // TODO: what about duplicates? - // TODO: Should not need CAP_ prefix in manifest? s.Process.Capabilities = append(s.Process.Capabilities, p.PluginObj.Config.Linux.Capabilities...) return &s, nil