From ce5bc0079b8b2f08535960cc29602f2df8d4aeed Mon Sep 17 00:00:00 2001
From: Akihiro Suda <suda.akihiro@lab.ntt.co.jp>
Date: Sat, 11 Aug 2018 21:26:40 +0900
Subject: [PATCH] allow propagating custom exec-root (e.g. "/run/docker") to
 libnetwork-setkey

The docker daemon needs to be modified as follows:

    diff --git a/daemon/oci_linux.go b/daemon/oci_linux.go
    index 00ace320df..ea7daa72df 100644
    --- a/daemon/oci_linux.go
    +++ b/daemon/oci_linux.go
    @@ -809,7 +809,7 @@ func (daemon *Daemon) createSpec(c *container.Container) (retSpec *specs.Spec, e
                        s.Hooks = &specs.Hooks{
                                Prestart: []specs.Hook{{
                                        Path: target,
    -                                   Args: []string{"libnetwork-setkey", c.ID, daemon.netController.ID()},
    +                                   Args: []string{"libnetwork-setkey", c.ID, daemon.netController.ID(), "-exec-root="+daemon.configStore.GetExecRoot()},
                                }},
                        }
                }

Signed-off-by: Akihiro Suda <suda.akihiro@lab.ntt.co.jp>
---
 libnetwork/config/config.go            |  2 ++
 libnetwork/sandbox_externalkey_unix.go | 39 ++++++++++++++++++--------
 2 files changed, 29 insertions(+), 12 deletions(-)

diff --git a/libnetwork/config/config.go b/libnetwork/config/config.go
index 4ba85a9c61..b7c66e9884 100644
--- a/libnetwork/config/config.go
+++ b/libnetwork/config/config.go
@@ -35,6 +35,7 @@ type DaemonCfg struct {
 	Debug                  bool
 	Experimental           bool
 	DataDir                string
+	ExecRoot               string
 	DefaultNetwork         string
 	DefaultDriver          string
 	Labels                 []string
@@ -217,6 +218,7 @@ func OptionDataDir(dataDir string) Option {
 // OptionExecRoot function returns an option setter for exec root folder
 func OptionExecRoot(execRoot string) Option {
 	return func(c *Config) {
+		c.Daemon.ExecRoot = execRoot
 		osl.SetBasePath(execRoot)
 	}
 }
diff --git a/libnetwork/sandbox_externalkey_unix.go b/libnetwork/sandbox_externalkey_unix.go
index f4c4276848..7601db9049 100644
--- a/libnetwork/sandbox_externalkey_unix.go
+++ b/libnetwork/sandbox_externalkey_unix.go
@@ -4,24 +4,30 @@ package libnetwork
 
 import (
 	"encoding/json"
+	"flag"
 	"fmt"
 	"io"
 	"io/ioutil"
 	"net"
 	"os"
+	"path/filepath"
 
 	"github.com/docker/libnetwork/types"
 	"github.com/opencontainers/runc/libcontainer/configs"
 	"github.com/sirupsen/logrus"
 )
 
-const udsBase = "/run/docker/libnetwork/"
-const success = "success"
+const (
+	execSubdir      = "libnetwork"
+	defaultExecRoot = "/run/docker"
+	success         = "success"
+)
 
 // processSetKeyReexec is a private function that must be called only on an reexec path
 // It expects 3 args { [0] = "libnetwork-setkey", [1] = <container-id>, [2] = <controller-id> }
 // It also expects configs.HookState as a json string in <stdin>
 // Refer to https://github.com/opencontainers/runc/pull/160/ for more information
+// The docker exec-root can be specified as "-exec-root" flag. The default value is "/run/docker".
 func processSetKeyReexec() {
 	var err error
 
@@ -32,12 +38,17 @@ func processSetKeyReexec() {
 		}
 	}()
 
-	// expecting 3 args {[0]="libnetwork-setkey", [1]=<container-id>, [2]=<controller-id> }
-	if len(os.Args) < 3 {
-		err = fmt.Errorf("Re-exec expects 3 args, received : %d", len(os.Args))
+	execRoot := flag.String("exec-root", defaultExecRoot, "docker exec root")
+	flag.Parse()
+
+	// expecting 3 os.Args {[0]="libnetwork-setkey", [1]=<container-id>, [2]=<controller-id> }
+	// (i.e. expecting 2 flag.Args())
+	args := flag.Args()
+	if len(args) < 2 {
+		err = fmt.Errorf("Re-exec expects 2 args (after parsing flags), received : %d", len(args))
 		return
 	}
-	containerID := os.Args[1]
+	containerID, controllerID := args[0], args[1]
 
 	// We expect configs.HookState as a json string in <stdin>
 	stateBuf, err := ioutil.ReadAll(os.Stdin)
@@ -49,18 +60,17 @@ func processSetKeyReexec() {
 		return
 	}
 
-	controllerID := os.Args[2]
-
-	err = SetExternalKey(controllerID, containerID, fmt.Sprintf("/proc/%d/ns/net", state.Pid))
+	err = SetExternalKey(controllerID, containerID, fmt.Sprintf("/proc/%d/ns/net", state.Pid), *execRoot)
 }
 
 // SetExternalKey provides a convenient way to set an External key to a sandbox
-func SetExternalKey(controllerID string, containerID string, key string) error {
+func SetExternalKey(controllerID string, containerID string, key string, execRoot string) error {
 	keyData := setKeyData{
 		ContainerID: containerID,
 		Key:         key}
 
-	c, err := net.Dial("unix", udsBase+controllerID+".sock")
+	uds := filepath.Join(execRoot, execSubdir, controllerID+".sock")
+	c, err := net.Dial("unix", uds)
 	if err != nil {
 		return err
 	}
@@ -102,10 +112,15 @@ func processReturn(r io.Reader) error {
 }
 
 func (c *controller) startExternalKeyListener() error {
+	execRoot := defaultExecRoot
+	if v := c.Config().Daemon.ExecRoot; v != "" {
+		execRoot = v
+	}
+	udsBase := filepath.Join(execRoot, execSubdir)
 	if err := os.MkdirAll(udsBase, 0600); err != nil {
 		return err
 	}
-	uds := udsBase + c.id + ".sock"
+	uds := filepath.Join(udsBase, c.id+".sock")
 	l, err := net.Listen("unix", uds)
 	if err != nil {
 		return err