1
0
Fork 0
mirror of https://github.com/moby/moby.git synced 2022-11-09 12:21:53 -05:00
moby--moby/daemon/config
Kir Kolyshkin 596ca142e0 daemon: use 'private' ipc mode by default
This changes the default ipc mode of daemon/engine to be private,
meaning the containers will not have their /dev/shm bind-mounted
from the host by default. The benefits of doing this are:

 1. No leaked mounts. Eliminate a possibility to leak mounts into
    other namespaces (and therefore unfortunate errors like "Unable to
    remove filesystem for <ID>: remove /var/lib/docker/containers/<ID>/shm:
    device or resource busy").

 2. Working checkpoint/restore. Make `docker checkpoint`
    not lose the contents of `/dev/shm`, but save it to
    the dump, and be restored back upon `docker start --checkpoint`
    (currently it is lost -- while CRIU handles tmpfs mounts,
    the "shareable" mount is seen as external to container,
    and thus rightfully ignored).

3. Better security. Currently any container is opened to share
   its /dev/shm with any other container.

Obviously, this change will break the following usage scenario:

 $ docker run -d --name donor busybox top
 $ docker run --rm -it --ipc container:donor busybox sh
 Error response from daemon: linux spec namespaces: can't join IPC
 of container <ID>: non-shareable IPC (hint: use IpcMode:shareable
 for the donor container)

The soution, as hinted by the (amended) error message, is to
explicitly enable donor sharing by using --ipc shareable:

 $ docker run -d --name donor --ipc shareable busybox top

Compatibility notes:

1. This only applies to containers created _after_ this change.
   Existing containers are not affected and will work fine
   as their ipc mode is stored in HostConfig.

2. Old backward compatible behavior ("shareable" containers
   by default) can be enabled by either using
   `--default-ipc-mode shareable` daemon command line option,
   or by adding a `"default-ipc-mode": "shareable"`
   line in `/etc/docker/daemon.json` configuration file.

3. If an older client (API < 1.40) is used, a "shareable" container
   is created. A test to check that is added.

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
2019-03-09 18:57:42 -08:00
..
builder.go builder: use buildkit's GC for build cache 2018-09-21 22:06:00 +00:00
config.go Remove the rest of v1 manifest support 2019-03-02 10:46:37 -08:00
config_common_unix.go Fixes for resolv.conf 2018-07-26 11:17:56 -07:00
config_common_unix_test.go Add canonical import comment 2018-02-05 16:51:57 -05:00
config_test.go Update tests to use gotest.tools 👼 2018-06-13 09:04:30 +02:00
config_unix.go daemon: use 'private' ipc mode by default 2019-03-09 18:57:42 -08:00
config_unix_test.go Update tests to use gotest.tools 👼 2018-06-13 09:04:30 +02:00
config_windows.go allow running dockerd in an unprivileged user namespace (rootless mode) 2019-02-04 00:24:27 +09:00
config_windows_test.go Update tests to use gotest.tools 👼 2018-06-13 09:04:30 +02:00
opts.go Add canonical import comment 2018-02-05 16:51:57 -05:00