Merge d59830330f into 4cb5af00f6

cmd/server/config.go

@@ -5,7 +5,7 @@ import (
 	"path/filepath"
 	"text/template"
 
-	"github.com/kubernetes-incubator/cri-o/server"
+	"github.com/kubernetes-incubator/cri-o/manager"
 	"github.com/opencontainers/runc/libcontainer/selinux"
 	"github.com/urfave/cli"
 )
@@ -82,18 +82,18 @@ pause = "{{ .Pause }}"
 //       template. Add it once the storage code has been merged.
 
 // DefaultConfig returns the default configuration for ocid.
-func DefaultConfig() *server.Config {
+func DefaultConfig() *manager.Config {
-	return &server.Config{
+	return &manager.Config{
-		RootConfig: server.RootConfig{
+		RootConfig: manager.RootConfig{
 			Root:         ocidRoot,
 			SandboxDir:   filepath.Join(ocidRoot, "sandboxes"),
 			ContainerDir: filepath.Join(ocidRoot, "containers"),
 			LogDir:       "/var/log/ocid/pods",
 		},
-		APIConfig: server.APIConfig{
+		APIConfig: manager.APIConfig{
 			Listen: "/var/run/ocid.sock",
 		},
-		RuntimeConfig: server.RuntimeConfig{
+		RuntimeConfig: manager.RuntimeConfig{
 			Runtime: "/usr/bin/runc",
 			Conmon:  conmonPath,
 			ConmonEnv: []string{
@@ -103,7 +103,7 @@ func DefaultConfig() *server.Config {
 			SeccompProfile:  seccompProfilePath,
 			ApparmorProfile: apparmorProfileName,
 		},
-		ImageConfig: server.ImageConfig{
+		ImageConfig: manager.ImageConfig{
 			Pause:    pausePath,
 			ImageDir: filepath.Join(ocidRoot, "store"),
 		},
@@ -122,7 +122,7 @@ var configCommand = cli.Command{
 	Action: func(c *cli.Context) error {
 		// At this point, app.Before has already parsed the user's chosen
 		// config file. So no need to handle that here.
-		config := c.App.Metadata["config"].(*server.Config)
+		config := c.App.Metadata["config"].(*manager.Config)
 		if c.Bool("default") {
 			config = DefaultConfig()
 		}

cmd/server/main.go

@@ -7,6 +7,7 @@ import (
 	"sort"
 
 	"github.com/Sirupsen/logrus"
+	"github.com/kubernetes-incubator/cri-o/manager"
 	"github.com/kubernetes-incubator/cri-o/server"
 	"github.com/opencontainers/runc/libcontainer/selinux"
 	"github.com/urfave/cli"
@@ -16,7 +17,7 @@ import (
 
 const ociConfigPath = "/etc/ocid/ocid.conf"
 
-func mergeConfig(config *server.Config, ctx *cli.Context) error {
+func mergeConfig(config *manager.Config, ctx *cli.Context) error {
 	// Don't parse the config if the user explicitly set it to "".
 	if path := ctx.GlobalString("config"); path != "" {
 		if err := config.FromFile(path); err != nil {
@@ -158,7 +159,7 @@ func main() {
 
 	app.Before = func(c *cli.Context) error {
 		// Load the configuration file.
-		config := c.App.Metadata["config"].(*server.Config)
+		config := c.App.Metadata["config"].(*manager.Config)
 		if err := mergeConfig(config, c); err != nil {
 			return err
 		}
@@ -195,7 +196,7 @@ func main() {
 	}
 
 	app.Action = func(c *cli.Context) error {
-		config := c.App.Metadata["config"].(*server.Config)
+		config := c.App.Metadata["config"].(*manager.Config)
 
 		if !config.SELinux {
 			selinux.SetDisabled()

manager/config.go

@@ -1,4 +1,4 @@
-package server
+package manager
 
 import (
 	"bytes"

manager/container.go

@@ -0,0 +1,31 @@
+package manager
+
+import (
+	"fmt"
+
+	"github.com/kubernetes-incubator/cri-o/oci"
+)
+
+const (
+	// containerTypeSandbox represents a pod sandbox container
+	containerTypeSandbox = "sandbox"
+	// containerTypeContainer represents a container running within a pod
+	containerTypeContainer = "container"
+)
+
+func (m *Manager) getContainerWithPartialID(ctrID string) (*oci.Container, error) {
+	if ctrID == "" {
+		return nil, fmt.Errorf("container ID should not be empty")
+	}
+
+	containerID, err := m.ctrIDIndex.Get(ctrID)
+	if err != nil {
+		return nil, fmt.Errorf("container with ID starting with %s not found: %v", ctrID, err)
+	}
+
+	c := m.state.containers.Get(containerID)
+	if c == nil {
+		return nil, fmt.Errorf("specified container not found: %s", containerID)
+	}
+	return c, nil
+}

manager/container_create.go

@@ -1,4 +1,4 @@
-package server
+package manager
 
 import (
 	"encoding/json"
@@ -11,13 +11,12 @@ import (
 
 	"github.com/Sirupsen/logrus"
 	"github.com/docker/docker/pkg/stringid"
+	"github.com/kubernetes-incubator/cri-o/manager/apparmor"
+	"github.com/kubernetes-incubator/cri-o/manager/seccomp"
 	"github.com/kubernetes-incubator/cri-o/oci"
-	"github.com/kubernetes-incubator/cri-o/server/apparmor"
-	"github.com/kubernetes-incubator/cri-o/server/seccomp"
 	"github.com/kubernetes-incubator/cri-o/utils"
 	"github.com/opencontainers/runc/libcontainer/label"
 	"github.com/opencontainers/runtime-tools/generate"
-	"golang.org/x/net/context"
 	pb "k8s.io/kubernetes/pkg/kubelet/api/v1alpha1/runtime"
 )
 
@@ -28,45 +27,42 @@ const (
 )
 
 // CreateContainer creates a new container in specified PodSandbox
-func (s *Server) CreateContainer(ctx context.Context, req *pb.CreateContainerRequest) (res *pb.CreateContainerResponse, err error) {
+func (m *Manager) CreateContainer(sbID string, containerConfig *pb.ContainerConfig, sandboxConfig *pb.PodSandboxConfig) (string, error) {
-	logrus.Debugf("CreateContainerRequest %+v", req)
-	sbID := req.GetPodSandboxId()
 	if sbID == "" {
-		return nil, fmt.Errorf("PodSandboxId should not be empty")
+		return "", fmt.Errorf("PodSandboxId should not be empty")
 	}
 
-	sandboxID, err := s.podIDIndex.Get(sbID)
+	sandboxID, err := m.podIDIndex.Get(sbID)
 	if err != nil {
-		return nil, fmt.Errorf("PodSandbox with ID starting with %s not found: %v", sbID, err)
+		return "", fmt.Errorf("PodSandbox with ID starting with %s not found: %v", sbID, err)
 	}
 
-	sb := s.getSandbox(sandboxID)
+	sb := m.getSandbox(sandboxID)
 	if sb == nil {
-		return nil, fmt.Errorf("specified sandbox not found: %s", sandboxID)
+		return "", fmt.Errorf("specified sandbox not found: %s", sandboxID)
 	}
 
 	// The config of the container
-	containerConfig := req.GetConfig()
 	if containerConfig == nil {
-		return nil, fmt.Errorf("CreateContainerRequest.ContainerConfig is nil")
+		return "", fmt.Errorf("CreateContainerRequest.ContainerConfig is nil")
 	}
 
 	name := containerConfig.GetMetadata().GetName()
 	if name == "" {
-		return nil, fmt.Errorf("CreateContainerRequest.ContainerConfig.Name is empty")
+		return "", fmt.Errorf("CreateContainerRequest.ContainerConfig.Name is empty")
 	}
 
 	attempt := containerConfig.GetMetadata().GetAttempt()
-	containerID, containerName, err := s.generateContainerIDandName(sb.name, name, attempt)
+	containerID, containerName, err := m.generateContainerIDandName(sb.name, name, attempt)
 	if err != nil {
-		return nil, err
+		return "", err
 	}
 
 	// containerDir is the dir for the container bundle.
-	containerDir := filepath.Join(s.runtime.ContainerDir(), containerID)
+	containerDir := filepath.Join(m.runtime.ContainerDir(), containerID)
 	defer func() {
 		if err != nil {
-			s.releaseContainerName(containerName)
+			m.releaseContainerName(containerName)
 			err1 := os.RemoveAll(containerDir)
 			if err1 != nil {
 				logrus.Warnf("Failed to cleanup container directory: %v", err1)
@@ -75,42 +71,37 @@ func (s *Server) CreateContainer(ctx context.Context, req *pb.CreateContainerReq
 	}()
 
 	if _, err = os.Stat(containerDir); err == nil {
-		return nil, fmt.Errorf("container (%s) already exists", containerDir)
+		return "", fmt.Errorf("container (%s) already exists", containerDir)
 	}
 
 	if err = os.MkdirAll(containerDir, 0755); err != nil {
-		return nil, err
+		return "", err
 	}
 
-	container, err := s.createSandboxContainer(containerID, containerName, sb, containerDir, containerConfig)
+	container, err := m.createSandboxContainer(containerID, containerName, sb, containerDir, containerConfig)
 	if err != nil {
-		return nil, err
+		return "", err
 	}
 
-	if err = s.runtime.CreateContainer(container); err != nil {
+	if err = m.runtime.CreateContainer(container); err != nil {
-		return nil, err
+		return "", err
 	}
 
-	if err = s.runtime.UpdateStatus(container); err != nil {
+	if err = m.runtime.UpdateStatus(container); err != nil {
-		return nil, err
+		return "", err
 	}
 
-	s.addContainer(container)
+	m.addContainer(container)
 
-	if err = s.ctrIDIndex.Add(containerID); err != nil {
+	if err = m.ctrIDIndex.Add(containerID); err != nil {
-		s.removeContainer(container)
+		m.removeContainer(container)
-		return nil, err
+		return "", err
 	}
 
-	resp := &pb.CreateContainerResponse{
+	return containerID, nil
-		ContainerId: &containerID,
-	}
-
-	logrus.Debugf("CreateContainerResponse: %+v", resp)
-	return resp, nil
 }
 
-func (s *Server) createSandboxContainer(containerID string, containerName string, sb *sandbox, containerDir string, containerConfig *pb.ContainerConfig) (*oci.Container, error) {
+func (m *Manager) createSandboxContainer(containerID string, containerName string, sb *sandbox, containerDir string, containerConfig *pb.ContainerConfig) (*oci.Container, error) {
 	if sb == nil {
 		return nil, errors.New("createSandboxContainer needs a sandbox")
 	}
@@ -195,11 +186,11 @@ func (s *Server) createSandboxContainer(containerID string, containerName string
 	}
 
 	// set this container's apparmor profile if it is set by sandbox
-	if s.appArmorEnabled {
+	if m.appArmorEnabled {
-		appArmorProfileName := s.getAppArmorProfileName(sb.annotations, metadata.GetName())
+		appArmorProfileName := m.getAppArmorProfileName(sb.annotations, metadata.GetName())
 		if appArmorProfileName != "" {
 			// reload default apparmor profile if it is unloaded.
-			if s.appArmorProfile == apparmor.DefaultApparmorProfile {
+			if m.appArmorProfile == apparmor.DefaultApparmorProfile {
 				if err := apparmor.EnsureDefaultApparmorProfile(); err != nil {
 					return nil, err
 				}
@@ -286,7 +277,7 @@ func (s *Server) createSandboxContainer(containerID string, containerName string
 		}
 	}
 	// Join the namespace paths for the pod sandbox container.
-	podInfraState := s.runtime.ContainerStatus(sb.infraContainer)
+	podInfraState := m.runtime.ContainerStatus(sb.infraContainer)
 
 	logrus.Debugf("pod container state %+v", podInfraState)
 
@@ -345,7 +336,7 @@ func (s *Server) createSandboxContainer(containerID string, containerName string
 	}
 	specgen.AddAnnotation("ocid/annotations", string(annotationsJSON))
 
-	if err = s.setupSeccomp(&specgen, containerName, sb.annotations); err != nil {
+	if err = m.setupSeccomp(&specgen, containerName, sb.annotations); err != nil {
 		return nil, err
 	}
 
@@ -367,7 +358,7 @@ func (s *Server) createSandboxContainer(containerID string, containerName string
 	return container, nil
 }
 
-func (s *Server) setupSeccomp(specgen *generate.Generator, cname string, sbAnnotations map[string]string) error {
+func (m *Manager) setupSeccomp(specgen *generate.Generator, cname string, sbAnnotations map[string]string) error {
 	profile, ok := sbAnnotations["security.alpha.kubernetes.io/seccomp/container/"+cname]
 	if !ok {
 		profile, ok = sbAnnotations["security.alpha.kubernetes.io/seccomp/pod"]
@@ -376,7 +367,7 @@ func (s *Server) setupSeccomp(specgen *generate.Generator, cname string, sbAnnot
 			profile = seccompUnconfined
 		}
 	}
-	if !s.seccompEnabled {
+	if !m.seccompEnabled {
 		if profile != seccompUnconfined {
 			return fmt.Errorf("seccomp is not enabled in your kernel, cannot run with a profile")
 		}
@@ -388,7 +379,7 @@ func (s *Server) setupSeccomp(specgen *generate.Generator, cname string, sbAnnot
 		return nil
 	}
 	if profile == seccompRuntimeDefault {
-		return seccomp.LoadProfileFromStruct(s.seccompProfile, specgen)
+		return seccomp.LoadProfileFromStruct(m.seccompProfile, specgen)
 	}
 	if !strings.HasPrefix(profile, seccompLocalhostPrefix) {
 		return fmt.Errorf("unknown seccomp profile option: %q", profile)
@@ -402,7 +393,7 @@ func (s *Server) setupSeccomp(specgen *generate.Generator, cname string, sbAnnot
 	return nil
 }
 
-func (s *Server) generateContainerIDandName(podName string, name string, attempt uint32) (string, string, error) {
+func (m *Manager) generateContainerIDandName(podName string, name string, attempt uint32) (string, string, error) {
 	var (
 		err error
 		id  = stringid.GenerateNonCryptoID()
@@ -411,14 +402,14 @@ func (s *Server) generateContainerIDandName(podName string, name string, attempt
 	if name == "infra" {
 		nameStr = fmt.Sprintf("%s-%s", podName, name)
 	}
-	if name, err = s.reserveContainerName(id, nameStr); err != nil {
+	if name, err = m.reserveContainerName(id, nameStr); err != nil {
 		return "", "", err
 	}
 	return id, name, err
 }
 
 // getAppArmorProfileName gets the profile name for the given container.
-func (s *Server) getAppArmorProfileName(annotations map[string]string, ctrName string) string {
+func (m *Manager) getAppArmorProfileName(annotations map[string]string, ctrName string) string {
 	profile := apparmor.GetProfileNameFromPodAnnotations(annotations, ctrName)
 
 	if profile == "" {
@@ -427,7 +418,7 @@ func (s *Server) getAppArmorProfileName(annotations map[string]string, ctrName s
 
 	if profile == apparmor.ProfileRuntimeDefault {
 		// If the value is runtime/default, then return default profile.
-		return s.appArmorProfile
+		return m.appArmorProfile
 	}
 
 	return strings.TrimPrefix(profile, apparmor.ProfileNamePrefix)

manager/container_execsync.go

@@ -0,0 +1,35 @@
+package manager
+
+import (
+	"fmt"
+
+	"github.com/kubernetes-incubator/cri-o/oci"
+)
+
+// ExecSync runs a command in a container synchronously.
+func (m *Manager) ExecSync(ctrID string, cmd []string, timeout int64) (*oci.ExecSyncResponse, error) {
+	c, err := m.getContainerWithPartialID(ctrID)
+	if err != nil {
+		return nil, err
+	}
+
+	if err = m.runtime.UpdateStatus(c); err != nil {
+		return nil, err
+	}
+
+	cState := m.runtime.ContainerStatus(c)
+	if !(cState.Status == oci.ContainerStateRunning || cState.Status == oci.ContainerStateCreated) {
+		return nil, fmt.Errorf("container is not created or running")
+	}
+
+	if cmd == nil {
+		return nil, fmt.Errorf("exec command cannot be empty")
+	}
+
+	execResp, err := m.runtime.ExecSync(c, cmd, timeout)
+	if err != nil {
+		return nil, err
+	}
+
+	return execResp, nil
+}

manager/container_list.go

@@ -1,9 +1,7 @@
-package server
+package manager
 
 import (
-	"github.com/Sirupsen/logrus"
 	"github.com/kubernetes-incubator/cri-o/oci"
-	"golang.org/x/net/context"
 	"k8s.io/kubernetes/pkg/fields"
 	pb "k8s.io/kubernetes/pkg/kubelet/api/v1alpha1/runtime"
 )
@@ -27,20 +25,18 @@ func filterContainer(c *pb.Container, filter *pb.ContainerFilter) bool {
 }
 
 // ListContainers lists all containers by filters.
-func (s *Server) ListContainers(ctx context.Context, req *pb.ListContainersRequest) (*pb.ListContainersResponse, error) {
+func (m *Manager) ListContainers(filter *pb.ContainerFilter) ([]*pb.Container, error) {
-	logrus.Debugf("ListContainersRequest %+v", req)
 	var ctrs []*pb.Container
-	filter := req.Filter
+	ctrList := m.state.containers.List()
-	ctrList := s.state.containers.List()
 
 	// Filter using container id and pod id first.
 	if filter != nil {
 		if filter.Id != nil {
-			id, err := s.ctrIDIndex.Get(*filter.Id)
+			id, err := m.ctrIDIndex.Get(*filter.Id)
 			if err != nil {
 				return nil, err
 			}
-			c := s.state.containers.Get(id)
+			c := m.state.containers.Get(id)
 			if c != nil {
 				if filter.PodSandboxId != nil {
 					if c.Sandbox() == *filter.PodSandboxId {
@@ -55,7 +51,7 @@ func (s *Server) ListContainers(ctx context.Context, req *pb.ListContainersReque
 			}
 		} else {
 			if filter.PodSandboxId != nil {
-				pod := s.state.sandboxes[*filter.PodSandboxId]
+				pod := m.state.sandboxes[*filter.PodSandboxId]
 				if pod == nil {
 					ctrList = []*oci.Container{}
 				} else {
@@ -66,12 +62,12 @@ func (s *Server) ListContainers(ctx context.Context, req *pb.ListContainersReque
 	}
 
 	for _, ctr := range ctrList {
-		if err := s.runtime.UpdateStatus(ctr); err != nil {
+		if err := m.runtime.UpdateStatus(ctr); err != nil {
 			return nil, err
 		}
 
 		podSandboxID := ctr.Sandbox()
-		cState := s.runtime.ContainerStatus(ctr)
+		cState := m.runtime.ContainerStatus(ctr)
 		created := cState.Created.UnixNano()
 		rState := pb.ContainerState_CONTAINER_UNKNOWN
 		cID := ctr.ID()
@@ -97,14 +93,10 @@ func (s *Server) ListContainers(ctx context.Context, req *pb.ListContainersReque
 		c.State = &rState
 
 		// Filter by other criteria such as state and labels.
-		if filterContainer(c, req.Filter) {
+		if filterContainer(c, filter) {
 			ctrs = append(ctrs, c)
 		}
 	}
 
-	resp := &pb.ListContainersResponse{
+	return ctrs, nil
-		Containers: ctrs,
-	}
-	logrus.Debugf("ListContainersResponse: %+v", resp)
-	return resp, nil
 }

manager/container_remove.go

@@ -0,0 +1,47 @@
+package manager
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+
+	"github.com/kubernetes-incubator/cri-o/oci"
+)
+
+// RemoveContainer removes the container. If the container is running, the container
+// should be force removed.
+func (m *Manager) RemoveContainer(ctrID string) error {
+	c, err := m.getContainerWithPartialID(ctrID)
+	if err != nil {
+		return err
+	}
+
+	if err := m.runtime.UpdateStatus(c); err != nil {
+		return fmt.Errorf("failed to update container state: %v", err)
+	}
+
+	cState := m.runtime.ContainerStatus(c)
+	if cState.Status == oci.ContainerStateCreated || cState.Status == oci.ContainerStateRunning {
+		if err := m.runtime.StopContainer(c); err != nil {
+			return fmt.Errorf("failed to stop container %s: %v", c.ID(), err)
+		}
+	}
+
+	if err := m.runtime.DeleteContainer(c); err != nil {
+		return fmt.Errorf("failed to delete container %s: %v", c.ID(), err)
+	}
+
+	containerDir := filepath.Join(m.runtime.ContainerDir(), c.ID())
+	if err := os.RemoveAll(containerDir); err != nil {
+		return fmt.Errorf("failed to remove container %s directory: %v", c.ID(), err)
+	}
+
+	m.releaseContainerName(c.Name())
+	m.removeContainer(c)
+
+	if err := m.ctrIDIndex.Delete(c.ID()); err != nil {
+		return err
+	}
+
+	return nil
+}

manager/container_start.go

@@ -0,0 +1,17 @@
+package manager
+
+import "fmt"
+
+// StartContainer starts the container.
+func (m *Manager) StartContainer(cID string) error {
+	c, err := m.getContainerWithPartialID(cID)
+	if err != nil {
+		return err
+	}
+
+	if err := m.runtime.StartContainer(c); err != nil {
+		return fmt.Errorf("failed to start container %s: %v", c.ID(), err)
+	}
+
+	return nil
+}

manager/container_status.go

@@ -0,0 +1,53 @@
+package manager
+
+import (
+	"github.com/kubernetes-incubator/cri-o/oci"
+	pb "k8s.io/kubernetes/pkg/kubelet/api/v1alpha1/runtime"
+)
+
+// ContainerStatus returns status of the container.
+func (m *Manager) ContainerStatus(ctrID string) (*pb.ContainerStatus, error) {
+	c, err := m.getContainerWithPartialID(ctrID)
+	if err != nil {
+		return nil, err
+	}
+
+	if err := m.runtime.UpdateStatus(c); err != nil {
+		return nil, err
+	}
+
+	containerID := c.ID()
+	status := &pb.ContainerStatus{
+		Id:       &containerID,
+		Metadata: c.Metadata(),
+	}
+
+	cState := m.runtime.ContainerStatus(c)
+	rStatus := pb.ContainerState_CONTAINER_UNKNOWN
+
+	switch cState.Status {
+	case oci.ContainerStateCreated:
+		rStatus = pb.ContainerState_CONTAINER_CREATED
+		created := cState.Created.UnixNano()
+		status.CreatedAt = int64Ptr(created)
+	case oci.ContainerStateRunning:
+		rStatus = pb.ContainerState_CONTAINER_RUNNING
+		created := cState.Created.UnixNano()
+		status.CreatedAt = int64Ptr(created)
+		started := cState.Started.UnixNano()
+		status.StartedAt = int64Ptr(started)
+	case oci.ContainerStateStopped:
+		rStatus = pb.ContainerState_CONTAINER_EXITED
+		created := cState.Created.UnixNano()
+		status.CreatedAt = int64Ptr(created)
+		started := cState.Started.UnixNano()
+		status.StartedAt = int64Ptr(started)
+		finished := cState.Finished.UnixNano()
+		status.FinishedAt = int64Ptr(finished)
+		status.ExitCode = int32Ptr(cState.ExitCode)
+	}
+
+	status.State = &rStatus
+
+	return status, nil
+}

manager/container_stop.go

@@ -0,0 +1,27 @@
+package manager
+
+import (
+	"fmt"
+
+	"github.com/kubernetes-incubator/cri-o/oci"
+)
+
+// StopContainer stops a running container with a grace period (i.e., timeout).
+func (m *Manager) StopContainer(ctrID string, timeout int64) error {
+	c, err := m.getContainerWithPartialID(ctrID)
+	if err != nil {
+		return err
+	}
+
+	if err := m.runtime.UpdateStatus(c); err != nil {
+		return err
+	}
+	cStatus := m.runtime.ContainerStatus(c)
+	if cStatus.Status != oci.ContainerStateStopped {
+		if err := m.runtime.StopContainer(c); err != nil {
+			return fmt.Errorf("failed to stop container %s: %v", c.ID(), err)
+		}
+	}
+
+	return nil
+}

manager/image_list.go

@@ -0,0 +1,11 @@
+package manager
+
+import pb "k8s.io/kubernetes/pkg/kubelet/api/v1alpha1/runtime"
+
+// ListImages lists existing images.
+func (m *Manager) ListImages(filter *pb.ImageFilter) ([]*pb.Image, error) {
+	// TODO
+	// containers/storage will take care of this by looking inside /var/lib/ocid/images
+	// and listing images.
+	return nil, nil
+}

manager/image_pull.go

@@ -1,4 +1,4 @@
-package server
+package manager
 
 import (
 	"errors"
@@ -6,20 +6,17 @@ import (
 	"os"
 	"path/filepath"
 
-	"github.com/Sirupsen/logrus"
 	"github.com/containers/image/directory"
 	"github.com/containers/image/image"
 	"github.com/containers/image/transports"
-	"golang.org/x/net/context"
 	pb "k8s.io/kubernetes/pkg/kubelet/api/v1alpha1/runtime"
 )
 
 // PullImage pulls a image with authentication config.
-func (s *Server) PullImage(ctx context.Context, req *pb.PullImageRequest) (*pb.PullImageResponse, error) {
+func (m *Manager) PullImage(imageSpec *pb.ImageSpec, auth *pb.AuthConfig, sandboxConfig *pb.PodSandboxConfig) error {
-	logrus.Debugf("PullImage: %+v", req)
+	img := imageSpec.GetImage()
-	img := req.GetImage().GetImage()
 	if img == "" {
-		return nil, errors.New("got empty imagespec name")
+		return errors.New("got empty imagespec name")
 	}
 
 	// TODO(runcom): deal with AuthConfig in req.GetAuth()
@@ -28,30 +25,30 @@ func (s *Server) PullImage(ctx context.Context, req *pb.PullImageRequest) (*pb.P
 	// how do we pull in a specified sandbox?
 	tr, err := transports.ParseImageName(img)
 	if err != nil {
-		return nil, err
+		return err
 	}
 	// TODO(runcom): figure out the ImageContext story in containers/image instead of passing ("", true)
 	src, err := tr.NewImageSource(nil, nil)
 	if err != nil {
-		return nil, err
+		return err
 	}
 	i := image.FromSource(src)
 	blobs, err := i.BlobDigests()
 	if err != nil {
-		return nil, err
+		return err
 	}
 
-	if err = os.Mkdir(filepath.Join(s.config.ImageDir, tr.StringWithinTransport()), 0755); err != nil {
+	if err = os.Mkdir(filepath.Join(m.config.ImageDir, tr.StringWithinTransport()), 0755); err != nil {
-		return nil, err
+		return err
 	}
-	dir, err := directory.NewReference(filepath.Join(s.config.ImageDir, tr.StringWithinTransport()))
+	dir, err := directory.NewReference(filepath.Join(m.config.ImageDir, tr.StringWithinTransport()))
 	if err != nil {
-		return nil, err
+		return err
 	}
 	// TODO(runcom): figure out the ImageContext story in containers/image instead of passing ("", true)
 	dest, err := dir.NewImageDestination(nil)
 	if err != nil {
-		return nil, err
+		return err
 	}
 	// save blobs (layer + config for docker v2s2, layers only for docker v2s1 [the config is in the manifest])
 	for _, b := range blobs {
@@ -59,24 +56,24 @@ func (s *Server) PullImage(ctx context.Context, req *pb.PullImageRequest) (*pb.P
 		var r io.ReadCloser
 		r, _, err = src.GetBlob(b)
 		if err != nil {
-			return nil, err
+			return err
 		}
 		if _, _, err = dest.PutBlob(r, b, -1); err != nil {
 			r.Close()
-			return nil, err
+			return err
 		}
 		r.Close()
 	}
 	// save manifest
-	m, _, err := i.Manifest()
+	mf, _, err := i.Manifest()
 	if err != nil {
-		return nil, err
+		return err
 	}
-	if err := dest.PutManifest(m); err != nil {
+	if err := dest.PutManifest(mf); err != nil {
-		return nil, err
+		return err
 	}
 
 	// TODO: what else do we need here? (Signatures when the story isn't just pulling from docker://)
 
-	return &pb.PullImageResponse{}, nil
+	return nil
 }

manager/image_remove.go

@@ -0,0 +1,9 @@
+package manager
+
+import pb "k8s.io/kubernetes/pkg/kubelet/api/v1alpha1/runtime"
+
+// RemoveImage removes the image.
+func (m *Manager) RemoveImage(imageSpec *pb.ImageSpec) error {
+	// TODO: implement this
+	return nil
+}

manager/image_status.go

@@ -0,0 +1,11 @@
+package manager
+
+import pb "k8s.io/kubernetes/pkg/kubelet/api/v1alpha1/runtime"
+
+// ImageStatus returns the status of the image.
+func (m *Manager) ImageStatus(imageSpec *pb.ImageSpec) (*pb.Image, error) {
+	// TODO
+	// containers/storage will take care of this by looking inside /var/lib/ocid/images
+	// and getting the image status
+	return nil, nil
+}

manager/manager.go

@@ -0,0 +1,406 @@
+package manager
+
+import (
+	"encoding/json"
+	"fmt"
+	"io/ioutil"
+	"os"
+	"path/filepath"
+	"sync"
+	"syscall"
+
+	"github.com/Sirupsen/logrus"
+	"github.com/docker/docker/pkg/registrar"
+	"github.com/docker/docker/pkg/truncindex"
+	"github.com/kubernetes-incubator/cri-o/manager/apparmor"
+	"github.com/kubernetes-incubator/cri-o/manager/seccomp"
+	"github.com/kubernetes-incubator/cri-o/oci"
+	"github.com/opencontainers/runc/libcontainer/label"
+	rspec "github.com/opencontainers/runtime-spec/specs-go"
+	"github.com/rajatchopra/ocicni"
+	pb "k8s.io/kubernetes/pkg/kubelet/api/v1alpha1/runtime"
+)
+
+// Manager implements the RuntimeService and ImageService
+type Manager struct {
+	config       Config
+	runtime      *oci.Runtime
+	stateLock    sync.Mutex
+	state        *managerState
+	netPlugin    ocicni.CNIPlugin
+	podNameIndex *registrar.Registrar
+	podIDIndex   *truncindex.TruncIndex
+	ctrNameIndex *registrar.Registrar
+	ctrIDIndex   *truncindex.TruncIndex
+
+	seccompEnabled bool
+	seccompProfile seccomp.Seccomp
+
+	appArmorEnabled bool
+	appArmorProfile string
+}
+
+func (m *Manager) loadContainer(id string) error {
+	config, err := ioutil.ReadFile(filepath.Join(m.runtime.ContainerDir(), id, "config.json"))
+	if err != nil {
+		return err
+	}
+	var s rspec.Spec
+	if err = json.Unmarshal(config, &s); err != nil {
+		return err
+	}
+	labels := make(map[string]string)
+	if err = json.Unmarshal([]byte(s.Annotations["ocid/labels"]), &labels); err != nil {
+		return err
+	}
+	name := s.Annotations["ocid/name"]
+	name, err = m.reserveContainerName(id, name)
+	if err != nil {
+		return err
+	}
+	var metadata pb.ContainerMetadata
+	if err = json.Unmarshal([]byte(s.Annotations["ocid/metadata"]), &metadata); err != nil {
+		return err
+	}
+	sb := m.getSandbox(s.Annotations["ocid/sandbox_id"])
+	if sb == nil {
+		logrus.Warnf("could not get sandbox with id %s, skipping", s.Annotations["ocid/sandbox_id"])
+		return nil
+	}
+
+	var tty bool
+	if v := s.Annotations["ocid/tty"]; v == "true" {
+		tty = true
+	}
+	containerPath := filepath.Join(m.runtime.ContainerDir(), id)
+
+	var img *pb.ImageSpec
+	image, ok := s.Annotations["ocid/image"]
+	if ok {
+		img = &pb.ImageSpec{
+			Image: &image,
+		}
+	}
+
+	annotations := make(map[string]string)
+	if err = json.Unmarshal([]byte(s.Annotations["ocid/annotations"]), &annotations); err != nil {
+		return err
+	}
+
+	ctr, err := oci.NewContainer(id, name, containerPath, s.Annotations["ocid/log_path"], sb.netNs(), labels, annotations, img, &metadata, sb.id, tty)
+	if err != nil {
+		return err
+	}
+	m.addContainer(ctr)
+	if err = m.runtime.UpdateStatus(ctr); err != nil {
+		logrus.Warnf("error updating status for container %s: %v", ctr.ID(), err)
+	}
+	if err = m.ctrIDIndex.Add(id); err != nil {
+		return err
+	}
+	return nil
+}
+
+func configNetNsPath(spec rspec.Spec) (string, error) {
+	for _, ns := range spec.Linux.Namespaces {
+		if ns.Type != rspec.NetworkNamespace {
+			continue
+		}
+
+		if ns.Path == "" {
+			return "", fmt.Errorf("empty networking namespace")
+		}
+
+		return ns.Path, nil
+	}
+
+	return "", fmt.Errorf("missing networking namespace")
+}
+
+func (m *Manager) loadSandbox(id string) error {
+	config, err := ioutil.ReadFile(filepath.Join(m.config.SandboxDir, id, "config.json"))
+	if err != nil {
+		return err
+	}
+	var s rspec.Spec
+	if err = json.Unmarshal(config, &s); err != nil {
+		return err
+	}
+	labels := make(map[string]string)
+	if err = json.Unmarshal([]byte(s.Annotations["ocid/labels"]), &labels); err != nil {
+		return err
+	}
+	name := s.Annotations["ocid/name"]
+	name, err = m.reservePodName(id, name)
+	if err != nil {
+		return err
+	}
+	var metadata pb.PodSandboxMetadata
+	if err = json.Unmarshal([]byte(s.Annotations["ocid/metadata"]), &metadata); err != nil {
+		return err
+	}
+
+	processLabel, mountLabel, err := label.InitLabels(label.DupSecOpt(s.Process.SelinuxLabel))
+	if err != nil {
+		return err
+	}
+
+	annotations := make(map[string]string)
+	if err = json.Unmarshal([]byte(s.Annotations["ocid/annotations"]), &annotations); err != nil {
+		return err
+	}
+
+	sb := &sandbox{
+		id:           id,
+		name:         name,
+		logDir:       s.Annotations["ocid/log_path"],
+		labels:       labels,
+		containers:   oci.NewMemoryStore(),
+		processLabel: processLabel,
+		mountLabel:   mountLabel,
+		annotations:  annotations,
+		metadata:     &metadata,
+		shmPath:      s.Annotations["ocid/shm_path"],
+	}
+
+	// We add a netNS only if we can load a permanent one.
+	// Otherwise, the sandbox will live in the host namespace.
+	netNsPath, err := configNetNsPath(s)
+	if err == nil {
+		netNS, nsErr := netNsGet(netNsPath, sb.name)
+		// If we can't load the networking namespace
+		// because it's closed, we just set the sb netns
+		// pointer to nil. Otherwise we return an error.
+		if nsErr != nil && nsErr != errSandboxClosedNetNS {
+			return nsErr
+		}
+
+		sb.netns = netNS
+	}
+
+	m.addSandbox(sb)
+
+	sandboxPath := filepath.Join(m.config.SandboxDir, id)
+
+	if err = label.ReserveLabel(processLabel); err != nil {
+		return err
+	}
+
+	cname, err := m.reserveContainerName(s.Annotations["ocid/container_id"], s.Annotations["ocid/container_name"])
+	if err != nil {
+		return err
+	}
+	scontainer, err := oci.NewContainer(s.Annotations["ocid/container_id"], cname, sandboxPath, sandboxPath, sb.netNs(), labels, annotations, nil, nil, id, false)
+	if err != nil {
+		return err
+	}
+	sb.infraContainer = scontainer
+	if err = m.runtime.UpdateStatus(scontainer); err != nil {
+		logrus.Warnf("error updating status for container %s: %v", scontainer.ID(), err)
+	}
+	if err = m.ctrIDIndex.Add(scontainer.ID()); err != nil {
+		return err
+	}
+	if err = m.podIDIndex.Add(id); err != nil {
+		return err
+	}
+	return nil
+}
+
+func (m *Manager) restore() {
+	sandboxDir, err := ioutil.ReadDir(m.config.SandboxDir)
+	if err != nil && !os.IsNotExist(err) {
+		logrus.Warnf("could not read sandbox directory %s: %v", sandboxDir, err)
+	}
+	for _, v := range sandboxDir {
+		if !v.IsDir() {
+			continue
+		}
+		if err = m.loadSandbox(v.Name()); err != nil {
+			logrus.Warnf("could not restore sandbox %s: %v", v.Name(), err)
+		}
+	}
+	containerDir, err := ioutil.ReadDir(m.runtime.ContainerDir())
+	if err != nil && !os.IsNotExist(err) {
+		logrus.Warnf("could not read container directory %s: %v", m.runtime.ContainerDir(), err)
+	}
+	for _, v := range containerDir {
+		if !v.IsDir() {
+			continue
+		}
+		if err := m.loadContainer(v.Name()); err != nil {
+			logrus.Warnf("could not restore container %s: %v", v.Name(), err)
+
+		}
+	}
+}
+
+func (m *Manager) reservePodName(id, name string) (string, error) {
+	if err := m.podNameIndex.Reserve(name, id); err != nil {
+		if err == registrar.ErrNameReserved {
+			id, err := m.podNameIndex.Get(name)
+			if err != nil {
+				logrus.Warnf("conflict, pod name %q already reserved", name)
+				return "", err
+			}
+			return "", fmt.Errorf("conflict, name %q already reserved for pod %q", name, id)
+		}
+		return "", fmt.Errorf("error reserving pod name %q", name)
+	}
+	return name, nil
+}
+
+func (m *Manager) releasePodName(name string) {
+	m.podNameIndex.Release(name)
+}
+
+func (m *Manager) reserveContainerName(id, name string) (string, error) {
+	if err := m.ctrNameIndex.Reserve(name, id); err != nil {
+		if err == registrar.ErrNameReserved {
+			id, err := m.ctrNameIndex.Get(name)
+			if err != nil {
+				logrus.Warnf("conflict, ctr name %q already reserved", name)
+				return "", err
+			}
+			return "", fmt.Errorf("conflict, name %q already reserved for ctr %q", name, id)
+		}
+		return "", fmt.Errorf("error reserving ctr name %s", name)
+	}
+	return name, nil
+}
+
+func (m *Manager) releaseContainerName(name string) {
+	m.ctrNameIndex.Release(name)
+}
+
+const (
+	// SeccompModeFilter refers to the syscall argument SECCOMP_MODE_FILTER.
+	SeccompModeFilter = uintptr(2)
+)
+
+func seccompEnabled() bool {
+	var enabled bool
+	// Check if Seccomp is supported, via CONFIG_SECCOMP.
+	if _, _, err := syscall.RawSyscall(syscall.SYS_PRCTL, syscall.PR_GET_SECCOMP, 0, 0); err != syscall.EINVAL {
+		// Make sure the kernel has CONFIG_SECCOMP_FILTER.
+		if _, _, err := syscall.RawSyscall(syscall.SYS_PRCTL, syscall.PR_SET_SECCOMP, SeccompModeFilter, 0); err != syscall.EINVAL {
+			enabled = true
+		}
+	}
+	return enabled
+}
+
+// New creates a new Manager with options provided
+func New(config *Config) (*Manager, error) {
+	if err := os.MkdirAll(config.ImageDir, 0755); err != nil {
+		return nil, err
+	}
+
+	if err := os.MkdirAll(config.SandboxDir, 0755); err != nil {
+		return nil, err
+	}
+
+	r, err := oci.New(config.Runtime, config.ContainerDir, config.Conmon, config.ConmonEnv)
+	if err != nil {
+		return nil, err
+	}
+	sandboxes := make(map[string]*sandbox)
+	containers := oci.NewMemoryStore()
+	netPlugin, err := ocicni.InitCNI("")
+	if err != nil {
+		return nil, err
+	}
+	m := &Manager{
+		runtime:   r,
+		netPlugin: netPlugin,
+		config:    *config,
+		state: &managerState{
+			sandboxes:  sandboxes,
+			containers: containers,
+		},
+		seccompEnabled:  seccompEnabled(),
+		appArmorEnabled: apparmor.IsEnabled(),
+		appArmorProfile: config.ApparmorProfile,
+	}
+	seccompProfile, err := ioutil.ReadFile(config.SeccompProfile)
+	if err != nil {
+		return nil, fmt.Errorf("opening seccomp profile (%s) failed: %v", config.SeccompProfile, err)
+	}
+	var seccompConfig seccomp.Seccomp
+	if err := json.Unmarshal(seccompProfile, &seccompConfig); err != nil {
+		return nil, fmt.Errorf("decoding seccomp profile failed: %v", err)
+	}
+	m.seccompProfile = seccompConfig
+
+	if m.appArmorEnabled && m.appArmorProfile == apparmor.DefaultApparmorProfile {
+		if err := apparmor.EnsureDefaultApparmorProfile(); err != nil {
+			return nil, fmt.Errorf("ensuring the default apparmor profile is installed failed: %v", err)
+		}
+	}
+
+	m.podIDIndex = truncindex.NewTruncIndex([]string{})
+	m.podNameIndex = registrar.NewRegistrar()
+	m.ctrIDIndex = truncindex.NewTruncIndex([]string{})
+	m.ctrNameIndex = registrar.NewRegistrar()
+
+	m.restore()
+
+	logrus.Debugf("sandboxes: %v", m.state.sandboxes)
+	logrus.Debugf("containers: %v", m.state.containers)
+	return m, nil
+}
+
+type managerState struct {
+	sandboxes  map[string]*sandbox
+	containers oci.Store
+}
+
+func (m *Manager) addSandbox(sb *sandbox) {
+	m.stateLock.Lock()
+	m.state.sandboxes[sb.id] = sb
+	m.stateLock.Unlock()
+}
+
+func (m *Manager) getSandbox(id string) *sandbox {
+	m.stateLock.Lock()
+	sb := m.state.sandboxes[id]
+	m.stateLock.Unlock()
+	return sb
+}
+
+func (m *Manager) hasSandbox(id string) bool {
+	m.stateLock.Lock()
+	_, ok := m.state.sandboxes[id]
+	m.stateLock.Unlock()
+	return ok
+}
+
+func (m *Manager) removeSandbox(id string) {
+	m.stateLock.Lock()
+	delete(m.state.sandboxes, id)
+	m.stateLock.Unlock()
+}
+
+func (m *Manager) addContainer(c *oci.Container) {
+	m.stateLock.Lock()
+	sandbox := m.state.sandboxes[c.Sandbox()]
+	// TODO(runcom): handle !ok above!!! otherwise it panics!
+	sandbox.addContainer(c)
+	m.state.containers.Add(c.ID(), c)
+	m.stateLock.Unlock()
+}
+
+func (m *Manager) getContainer(id string) *oci.Container {
+	m.stateLock.Lock()
+	c := m.state.containers.Get(id)
+	m.stateLock.Unlock()
+	return c
+}
+
+func (m *Manager) removeContainer(c *oci.Container) {
+	m.stateLock.Lock()
+	sandbox := m.state.sandboxes[c.Sandbox()]
+	sandbox.removeContainer(c)
+	m.state.containers.Delete(c.ID())
+	m.stateLock.Unlock()
+}

manager/runtime_status.go

@@ -0,0 +1,36 @@
+package manager
+
+import pb "k8s.io/kubernetes/pkg/kubelet/api/v1alpha1/runtime"
+
+// Status returns the status of the runtime
+func (m *Manager) Status() (*pb.RuntimeStatus, error) {
+
+	// Deal with Runtime conditions
+	runtimeReady, err := m.runtime.RuntimeReady()
+	if err != nil {
+		return nil, err
+	}
+	networkReady, err := m.runtime.NetworkReady()
+	if err != nil {
+		return nil, err
+	}
+
+	// Use vendored strings
+	runtimeReadyConditionString := pb.RuntimeReady
+	networkReadyConditionString := pb.NetworkReady
+
+	status := &pb.RuntimeStatus{
+		Conditions: []*pb.RuntimeCondition{
+			&pb.RuntimeCondition{
+				Type:   &runtimeReadyConditionString,
+				Status: &runtimeReady,
+			},
+			&pb.RuntimeCondition{
+				Type:   &networkReadyConditionString,
+				Status: &networkReady,
+			},
+		},
+	}
+
+	return status, nil
+}

manager/sandbox.go

@@ -0,0 +1,265 @@
+package manager
+
+import (
+	"crypto/rand"
+	"errors"
+	"fmt"
+	"os"
+	"path/filepath"
+	"sync"
+
+	"github.com/Sirupsen/logrus"
+	"github.com/containernetworking/cni/pkg/ns"
+	"github.com/docker/docker/pkg/stringid"
+	"github.com/kubernetes-incubator/cri-o/oci"
+	"k8s.io/kubernetes/pkg/fields"
+	pb "k8s.io/kubernetes/pkg/kubelet/api/v1alpha1/runtime"
+)
+
+type sandboxNetNs struct {
+	sync.Mutex
+	ns      ns.NetNS
+	symlink *os.File
+	closed  bool
+}
+
+func (ns *sandboxNetNs) symlinkCreate(name string) error {
+	b := make([]byte, 4)
+	_, randErr := rand.Reader.Read(b)
+	if randErr != nil {
+		return randErr
+	}
+
+	nsName := fmt.Sprintf("%s-%x", name, b)
+	symlinkPath := filepath.Join(nsRunDir, nsName)
+
+	if err := os.Symlink(ns.ns.Path(), symlinkPath); err != nil {
+		return err
+	}
+
+	fd, err := os.Open(symlinkPath)
+	if err != nil {
+		if removeErr := os.RemoveAll(symlinkPath); removeErr != nil {
+			return removeErr
+		}
+
+		return err
+	}
+
+	ns.symlink = fd
+
+	return nil
+}
+
+func (ns *sandboxNetNs) symlinkRemove() error {
+	if err := ns.symlink.Close(); err != nil {
+		return err
+	}
+
+	return os.RemoveAll(ns.symlink.Name())
+}
+
+func isSymbolicLink(path string) (bool, error) {
+	fi, err := os.Lstat(path)
+	if err != nil {
+		return false, err
+	}
+
+	return fi.Mode()&os.ModeSymlink == os.ModeSymlink, nil
+}
+
+func netNsGet(nspath, name string) (*sandboxNetNs, error) {
+	if err := ns.IsNSorErr(nspath); err != nil {
+		return nil, errSandboxClosedNetNS
+	}
+
+	symlink, symlinkErr := isSymbolicLink(nspath)
+	if symlinkErr != nil {
+		return nil, symlinkErr
+	}
+
+	var resolvedNsPath string
+	if symlink {
+		path, err := os.Readlink(nspath)
+		if err != nil {
+			return nil, err
+		}
+		resolvedNsPath = path
+	} else {
+		resolvedNsPath = nspath
+	}
+
+	netNS, err := ns.GetNS(resolvedNsPath)
+	if err != nil {
+		return nil, err
+	}
+
+	netNs := &sandboxNetNs{ns: netNS, closed: false}
+
+	if symlink {
+		fd, err := os.Open(nspath)
+		if err != nil {
+			return nil, err
+		}
+
+		netNs.symlink = fd
+	} else {
+		if err := netNs.symlinkCreate(name); err != nil {
+			return nil, err
+		}
+	}
+
+	return netNs, nil
+}
+
+func hostNetNsPath() (string, error) {
+	netNS, err := ns.GetCurrentNS()
+	if err != nil {
+		return "", err
+	}
+
+	defer netNS.Close()
+
+	return netNS.Path(), nil
+}
+
+type sandbox struct {
+	id             string
+	name           string
+	logDir         string
+	labels         fields.Set
+	annotations    map[string]string
+	infraContainer *oci.Container
+	containers     oci.Store
+	processLabel   string
+	mountLabel     string
+	netns          *sandboxNetNs
+	metadata       *pb.PodSandboxMetadata
+	shmPath        string
+}
+
+const (
+	podDefaultNamespace = "default"
+	defaultShmSize      = 64 * 1024 * 1024
+	nsRunDir            = "/var/run/netns"
+)
+
+var (
+	errSandboxIDEmpty     = errors.New("PodSandboxId should not be empty")
+	errSandboxClosedNetNS = errors.New("PodSandbox networking namespace is closed")
+)
+
+func (s *sandbox) addContainer(c *oci.Container) {
+	s.containers.Add(c.Name(), c)
+}
+
+func (s *sandbox) getContainer(name string) *oci.Container {
+	return s.containers.Get(name)
+}
+
+func (s *sandbox) removeContainer(c *oci.Container) {
+	s.containers.Delete(c.Name())
+}
+
+func (s *sandbox) netNs() ns.NetNS {
+	if s.netns == nil {
+		return nil
+	}
+
+	return s.netns.ns
+}
+
+func (s *sandbox) netNsPath() string {
+	if s.netns == nil {
+		return ""
+	}
+
+	return s.netns.symlink.Name()
+}
+
+func (s *sandbox) netNsCreate() error {
+	if s.netns != nil {
+		return fmt.Errorf("net NS already created")
+	}
+
+	netNS, err := ns.NewNS()
+	if err != nil {
+		return err
+	}
+
+	s.netns = &sandboxNetNs{
+		ns:     netNS,
+		closed: false,
+	}
+
+	if err := s.netns.symlinkCreate(s.name); err != nil {
+		logrus.Warnf("Could not create nentns symlink %v", err)
+
+		if err := s.netns.ns.Close(); err != nil {
+			return err
+		}
+
+		return err
+	}
+
+	return nil
+}
+
+func (s *sandbox) netNsRemove() error {
+	if s.netns == nil {
+		logrus.Warn("no networking namespace")
+		return nil
+	}
+
+	s.netns.Lock()
+	defer s.netns.Unlock()
+
+	if s.netns.closed {
+		// netNsRemove() can be called multiple
+		// times without returning an error.
+		return nil
+	}
+
+	if err := s.netns.symlinkRemove(); err != nil {
+		return err
+	}
+
+	if err := s.netns.ns.Close(); err != nil {
+		return err
+	}
+
+	s.netns.closed = true
+	return nil
+}
+
+func (m *Manager) generatePodIDandName(name string, namespace string, attempt uint32) (string, string, error) {
+	var (
+		err error
+		id  = stringid.GenerateNonCryptoID()
+	)
+	if namespace == "" {
+		namespace = podDefaultNamespace
+	}
+
+	if name, err = m.reservePodName(id, fmt.Sprintf("%s-%s-%v", namespace, name, attempt)); err != nil {
+		return "", "", err
+	}
+	return id, name, err
+}
+
+func (m *Manager) getPodSandboxWithPartialID(sbID string) (*sandbox, error) {
+	if sbID == "" {
+		return nil, errSandboxIDEmpty
+	}
+
+	sandboxID, err := m.podIDIndex.Get(sbID)
+	if err != nil {
+		return nil, fmt.Errorf("PodSandbox with ID starting with %s not found: %v", sbID, err)
+	}
+
+	sb := m.getSandbox(sandboxID)
+	if sb == nil {
+		return nil, fmt.Errorf("specified sandbox not found: %s", sandboxID)
+	}
+	return sb, nil
+}

manager/sandbox_list.go

@@ -1,9 +1,7 @@
-package server
+package manager
 
 import (
-	"github.com/Sirupsen/logrus"
 	"github.com/kubernetes-incubator/cri-o/oci"
-	"golang.org/x/net/context"
 	"k8s.io/kubernetes/pkg/fields"
 	pb "k8s.io/kubernetes/pkg/kubelet/api/v1alpha1/runtime"
 )
@@ -27,23 +25,21 @@ func filterSandbox(p *pb.PodSandbox, filter *pb.PodSandboxFilter) bool {
 }
 
 // ListPodSandbox returns a list of SandBoxes.
-func (s *Server) ListPodSandbox(ctx context.Context, req *pb.ListPodSandboxRequest) (*pb.ListPodSandboxResponse, error) {
+func (m *Manager) ListPodSandbox(filter *pb.PodSandboxFilter) ([]*pb.PodSandbox, error) {
-	logrus.Debugf("ListPodSandboxRequest %+v", req)
 	var pods []*pb.PodSandbox
 	var podList []*sandbox
-	for _, sb := range s.state.sandboxes {
+	for _, sb := range m.state.sandboxes {
 		podList = append(podList, sb)
 	}
 
-	filter := req.Filter
 	// Filter by pod id first.
 	if filter != nil {
 		if filter.Id != nil {
-			id, err := s.podIDIndex.Get(*filter.Id)
+			id, err := m.podIDIndex.Get(*filter.Id)
 			if err != nil {
 				return nil, err
 			}
-			sb := s.getSandbox(id)
+			sb := m.getSandbox(id)
 			if sb == nil {
 				podList = []*sandbox{}
 			} else {
@@ -59,10 +55,10 @@ func (s *Server) ListPodSandbox(ctx context.Context, req *pb.ListPodSandboxReque
 			// it's better not to panic
 			continue
 		}
-		if err := s.runtime.UpdateStatus(podInfraContainer); err != nil {
+		if err := m.runtime.UpdateStatus(podInfraContainer); err != nil {
 			return nil, err
 		}
-		cState := s.runtime.ContainerStatus(podInfraContainer)
+		cState := m.runtime.ContainerStatus(podInfraContainer)
 		created := cState.Created.UnixNano()
 		rStatus := pb.PodSandboxState_SANDBOX_NOTREADY
 		if cState.Status == oci.ContainerStateRunning {
@@ -79,14 +75,10 @@ func (s *Server) ListPodSandbox(ctx context.Context, req *pb.ListPodSandboxReque
 		}
 
 		// Filter by other criteria such as state and labels.
-		if filterSandbox(pod, req.Filter) {
+		if filterSandbox(pod, filter) {
 			pods = append(pods, pod)
 		}
 	}
 
-	resp := &pb.ListPodSandboxResponse{
+	return pods, nil
-		Items: pods,
-	}
-	logrus.Debugf("ListPodSandboxResponse %+v", resp)
-	return resp, nil
 }

manager/sandbox_remove.go

@@ -0,0 +1,89 @@
+package manager
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+	"syscall"
+
+	"github.com/Sirupsen/logrus"
+	"github.com/kubernetes-incubator/cri-o/oci"
+	"github.com/opencontainers/runc/libcontainer/label"
+)
+
+// RemovePodSandbox deletes the sandbox. If there are any running containers in the
+// sandbox, they should be force deleted.
+func (m *Manager) RemovePodSandbox(sbID string) error {
+	sb, err := m.getPodSandboxWithPartialID(sbID)
+	if err != nil {
+		if err == errSandboxIDEmpty {
+			return err
+		}
+
+		logrus.Warnf("could not get sandbox %s, it's probably been removed already: %v", sbID, err)
+		return nil
+	}
+
+	podInfraContainer := sb.infraContainer
+	containers := sb.containers.List()
+	containers = append(containers, podInfraContainer)
+
+	// Delete all the containers in the sandbox
+	for _, c := range containers {
+		if err := m.runtime.UpdateStatus(c); err != nil {
+			return fmt.Errorf("failed to update container state: %v", err)
+		}
+
+		cState := m.runtime.ContainerStatus(c)
+		if cState.Status == oci.ContainerStateCreated || cState.Status == oci.ContainerStateRunning {
+			if err := m.runtime.StopContainer(c); err != nil {
+				return fmt.Errorf("failed to stop container %s: %v", c.Name(), err)
+			}
+		}
+
+		if err := m.runtime.DeleteContainer(c); err != nil {
+			return fmt.Errorf("failed to delete container %s in sandbox %s: %v", c.Name(), sb.id, err)
+		}
+
+		if c == podInfraContainer {
+			continue
+		}
+
+		containerDir := filepath.Join(m.runtime.ContainerDir(), c.ID())
+		if err := os.RemoveAll(containerDir); err != nil {
+			return fmt.Errorf("failed to remove container %s directory: %v", c.Name(), err)
+		}
+
+		m.releaseContainerName(c.Name())
+		m.removeContainer(c)
+	}
+
+	if err := label.UnreserveLabel(sb.processLabel); err != nil {
+		return err
+	}
+
+	// unmount the shm for the pod
+	if sb.shmPath != "/dev/shm" {
+		if err := syscall.Unmount(sb.shmPath, syscall.MNT_DETACH); err != nil {
+			return err
+		}
+	}
+
+	if err := sb.netNsRemove(); err != nil {
+		return fmt.Errorf("failed to remove networking namespace for sandbox %s: %v", sb.id, err)
+	}
+
+	// Remove the files related to the sandbox
+	podSandboxDir := filepath.Join(m.config.SandboxDir, sb.id)
+	if err := os.RemoveAll(podSandboxDir); err != nil {
+		return fmt.Errorf("failed to remove sandbox %s directory: %v", sb.id, err)
+	}
+	m.releaseContainerName(podInfraContainer.Name())
+	m.removeContainer(podInfraContainer)
+	sb.infraContainer = nil
+
+	m.releasePodName(sb.name)
+	m.removeSandbox(sb.id)
+
+	return nil
+}

manager/sandbox_run.go

@@ -1,4 +1,4 @@
-package server
+package manager
 
 import (
 	"encoding/json"
@@ -13,24 +13,23 @@ import (
 	"github.com/kubernetes-incubator/cri-o/utils"
 	"github.com/opencontainers/runc/libcontainer/label"
 	"github.com/opencontainers/runtime-tools/generate"
-	"golang.org/x/net/context"
 	pb "k8s.io/kubernetes/pkg/kubelet/api/v1alpha1/runtime"
 )
 
-func (s *Server) runContainer(container *oci.Container) error {
+func (m *Manager) runContainer(container *oci.Container) error {
-	if err := s.runtime.CreateContainer(container); err != nil {
+	if err := m.runtime.CreateContainer(container); err != nil {
 		return err
 	}
 
-	if err := s.runtime.UpdateStatus(container); err != nil {
+	if err := m.runtime.UpdateStatus(container); err != nil {
 		return err
 	}
 
-	if err := s.runtime.StartContainer(container); err != nil {
+	if err := m.runtime.StartContainer(container); err != nil {
 		return err
 	}
 
-	if err := s.runtime.UpdateStatus(container); err != nil {
+	if err := m.runtime.UpdateStatus(container); err != nil {
 		return err
 	}
 
@@ -38,44 +37,46 @@ func (s *Server) runContainer(container *oci.Container) error {
 }
 
 // RunPodSandbox creates and runs a pod-level sandbox.
-func (s *Server) RunPodSandbox(ctx context.Context, req *pb.RunPodSandboxRequest) (resp *pb.RunPodSandboxResponse, err error) {
+func (m *Manager) RunPodSandbox(config *pb.PodSandboxConfig) (string, error) {
-	logrus.Debugf("RunPodSandboxRequest %+v", req)
 	var processLabel, mountLabel, netNsPath string
+	if config == nil {
+		return "", fmt.Errorf("PodSandboxConfig should not be nil")
+	}
 	// process req.Name
-	name := req.GetConfig().GetMetadata().GetName()
+	name := config.GetMetadata().GetName()
 	if name == "" {
-		return nil, fmt.Errorf("PodSandboxConfig.Name should not be empty")
+		return "", fmt.Errorf("PodSandboxConfig.Name should not be empty")
 	}
 
-	namespace := req.GetConfig().GetMetadata().GetNamespace()
+	namespace := config.GetMetadata().GetNamespace()
-	attempt := req.GetConfig().GetMetadata().GetAttempt()
+	attempt := config.GetMetadata().GetAttempt()
 
-	id, name, err := s.generatePodIDandName(name, namespace, attempt)
+	id, name, err := m.generatePodIDandName(name, namespace, attempt)
 	if err != nil {
-		return nil, err
+		return "", err
 	}
 
 	defer func() {
 		if err != nil {
-			s.releasePodName(name)
+			m.releasePodName(name)
 		}
 	}()
 
-	if err = s.podIDIndex.Add(id); err != nil {
+	if err = m.podIDIndex.Add(id); err != nil {
-		return nil, err
+		return "", err
 	}
 
 	defer func() {
 		if err != nil {
-			if err = s.podIDIndex.Delete(id); err != nil {
+			if err = m.podIDIndex.Delete(id); err != nil {
 				logrus.Warnf("couldn't delete pod id %s from idIndex", id)
 			}
 		}
 	}()
 
-	podSandboxDir := filepath.Join(s.config.SandboxDir, id)
+	podSandboxDir := filepath.Join(m.config.SandboxDir, id)
 	if _, err = os.Stat(podSandboxDir); err == nil {
-		return nil, fmt.Errorf("pod sandbox (%s) already exists", podSandboxDir)
+		return "", fmt.Errorf("pod sandbox (%s) already exists", podSandboxDir)
 	}
 
 	defer func() {
@@ -87,7 +88,7 @@ func (s *Server) RunPodSandbox(ctx context.Context, req *pb.RunPodSandboxRequest
 	}()
 
 	if err = os.MkdirAll(podSandboxDir, 0755); err != nil {
-		return nil, err
+		return "", err
 	}
 
 	// creates a spec Generator with the default spec.
@@ -95,79 +96,79 @@ func (s *Server) RunPodSandbox(ctx context.Context, req *pb.RunPodSandboxRequest
 
 	// TODO: Make the `graph/vfs` part of this configurable once the storage
 	//       integration has been merged.
-	podInfraRootfs := filepath.Join(s.config.Root, "graph/vfs/pause")
+	podInfraRootfs := filepath.Join(m.config.Root, "graph/vfs/pause")
 	// setup defaults for the pod sandbox
 	g.SetRootPath(filepath.Join(podInfraRootfs, "rootfs"))
 	g.SetRootReadonly(true)
 	g.SetProcessArgs([]string{"/pause"})
 
 	// set hostname
-	hostname := req.GetConfig().GetHostname()
+	hostname := config.GetHostname()
 	if hostname != "" {
 		g.SetHostname(hostname)
 	}
 
 	// set log directory
-	logDir := req.GetConfig().GetLogDirectory()
+	logDir := config.GetLogDirectory()
 	if logDir == "" {
-		logDir = filepath.Join(s.config.LogDir, id)
+		logDir = filepath.Join(m.config.LogDir, id)
 	}
 
 	// set DNS options
-	dnsServers := req.GetConfig().GetDnsConfig().GetServers()
+	dnsServers := config.GetDnsConfig().GetServers()
-	dnsSearches := req.GetConfig().GetDnsConfig().GetSearches()
+	dnsSearches := config.GetDnsConfig().GetSearches()
-	dnsOptions := req.GetConfig().GetDnsConfig().GetOptions()
+	dnsOptions := config.GetDnsConfig().GetOptions()
 	resolvPath := fmt.Sprintf("%s/resolv.conf", podSandboxDir)
 	err = parseDNSOptions(dnsServers, dnsSearches, dnsOptions, resolvPath)
 	if err != nil {
 		err1 := removeFile(resolvPath)
 		if err1 != nil {
 			err = err1
-			return nil, fmt.Errorf("%v; failed to remove %s: %v", err, resolvPath, err1)
+			return "", fmt.Errorf("%v; failed to remove %s: %v", err, resolvPath, err1)
 		}
-		return nil, err
+		return "", err
 	}
 
 	g.AddBindMount(resolvPath, "/etc/resolv.conf", []string{"ro"})
 
 	// add metadata
-	metadata := req.GetConfig().GetMetadata()
+	metadata := config.GetMetadata()
 	metadataJSON, err := json.Marshal(metadata)
 	if err != nil {
-		return nil, err
+		return "", err
 	}
 
 	// add labels
-	labels := req.GetConfig().GetLabels()
+	labels := config.GetLabels()
 	labelsJSON, err := json.Marshal(labels)
 	if err != nil {
-		return nil, err
+		return "", err
 	}
 
 	// add annotations
-	annotations := req.GetConfig().GetAnnotations()
+	annotations := config.GetAnnotations()
 	annotationsJSON, err := json.Marshal(annotations)
 	if err != nil {
-		return nil, err
+		return "", err
 	}
 
 	// Don't use SELinux separation with Host Pid or IPC Namespace,
-	if !req.GetConfig().GetLinux().GetSecurityContext().GetNamespaceOptions().GetHostPid() && !req.GetConfig().GetLinux().GetSecurityContext().GetNamespaceOptions().GetHostIpc() {
+	if !config.GetLinux().GetSecurityContext().GetNamespaceOptions().GetHostPid() && !config.GetLinux().GetSecurityContext().GetNamespaceOptions().GetHostIpc() {
 		processLabel, mountLabel, err = getSELinuxLabels(nil)
 		if err != nil {
-			return nil, err
+			return "", err
 		}
 		g.SetProcessSelinuxLabel(processLabel)
 	}
 
 	// create shm mount for the pod containers.
 	var shmPath string
-	if req.GetConfig().GetLinux().GetSecurityContext().GetNamespaceOptions().GetHostIpc() {
+	if config.GetLinux().GetSecurityContext().GetNamespaceOptions().GetHostIpc() {
 		shmPath = "/dev/shm"
 	} else {
 		shmPath, err = setupShm(podSandboxDir, mountLabel)
 		if err != nil {
-			return nil, err
+			return "", err
 		}
 		defer func() {
 			if err != nil {
@@ -178,24 +179,24 @@ func (s *Server) RunPodSandbox(ctx context.Context, req *pb.RunPodSandboxRequest
 		}()
 	}
 
-	containerID, containerName, err := s.generateContainerIDandName(name, "infra", 0)
+	containerID, containerName, err := m.generateContainerIDandName(name, "infra", 0)
 	if err != nil {
-		return nil, err
+		return "", err
 	}
 
 	defer func() {
 		if err != nil {
-			s.releaseContainerName(containerName)
+			m.releaseContainerName(containerName)
 		}
 	}()
 
-	if err = s.ctrIDIndex.Add(containerID); err != nil {
+	if err = m.ctrIDIndex.Add(containerID); err != nil {
-		return nil, err
+		return "", err
 	}
 
 	defer func() {
 		if err != nil {
-			if err = s.ctrIDIndex.Delete(containerID); err != nil {
+			if err = m.ctrIDIndex.Delete(containerID); err != nil {
 				logrus.Warnf("couldn't delete ctr id %s from idIndex", containerID)
 			}
 		}
@@ -224,7 +225,7 @@ func (s *Server) RunPodSandbox(ctx context.Context, req *pb.RunPodSandboxRequest
 		shmPath:      shmPath,
 	}
 
-	s.addSandbox(sb)
+	m.addSandbox(sb)
 
 	for k, v := range annotations {
 		g.AddAnnotation(k, v)
@@ -233,7 +234,7 @@ func (s *Server) RunPodSandbox(ctx context.Context, req *pb.RunPodSandboxRequest
 	// extract linux sysctls from annotations and pass down to oci runtime
 	safe, unsafe, err := SysctlsFromPodAnnotations(annotations)
 	if err != nil {
-		return nil, err
+		return "", err
 	}
 	for _, sysctl := range safe {
 		g.AddLinuxSysctl(sysctl.Name, sysctl.Value)
@@ -243,26 +244,26 @@ func (s *Server) RunPodSandbox(ctx context.Context, req *pb.RunPodSandboxRequest
 	}
 
 	// setup cgroup settings
-	cgroupParent := req.GetConfig().GetLinux().GetCgroupParent()
+	cgroupParent := config.GetLinux().GetCgroupParent()
 	if cgroupParent != "" {
 		g.SetLinuxCgroupsPath(cgroupParent)
 	}
 
 	// set up namespaces
-	if req.GetConfig().GetLinux().GetSecurityContext().GetNamespaceOptions().GetHostNetwork() {
+	if config.GetLinux().GetSecurityContext().GetNamespaceOptions().GetHostNetwork() {
 		err = g.RemoveLinuxNamespace("network")
 		if err != nil {
-			return nil, err
+			return "", err
 		}
 
 		netNsPath, err = hostNetNsPath()
 		if err != nil {
-			return nil, err
+			return "", err
 		}
 	} else {
 		// Create the sandbox network namespace
 		if err = sb.netNsCreate(); err != nil {
-			return nil, err
+			return "", err
 		}
 
 		defer func() {
@@ -273,67 +274,65 @@ func (s *Server) RunPodSandbox(ctx context.Context, req *pb.RunPodSandboxRequest
 			if netnsErr := sb.netNsRemove(); netnsErr != nil {
 				logrus.Warnf("Failed to remove networking namespace: %v", netnsErr)
 			}
-		} ()
+		}()
 
 		// Pass the created namespace path to the runtime
 		err = g.AddOrReplaceLinuxNamespace("network", sb.netNsPath())
 		if err != nil {
-			return nil, err
+			return "", err
 		}
 
 		netNsPath = sb.netNsPath()
 	}
 
-	if req.GetConfig().GetLinux().GetSecurityContext().GetNamespaceOptions().GetHostPid() {
+	if config.GetLinux().GetSecurityContext().GetNamespaceOptions().GetHostPid() {
 		err = g.RemoveLinuxNamespace("pid")
 		if err != nil {
-			return nil, err
+			return "", err
 		}
 	}
 
-	if req.GetConfig().GetLinux().GetSecurityContext().GetNamespaceOptions().GetHostIpc() {
+	if config.GetLinux().GetSecurityContext().GetNamespaceOptions().GetHostIpc() {
 		err = g.RemoveLinuxNamespace("ipc")
 		if err != nil {
-			return nil, err
+			return "", err
 		}
 	}
 
 	err = g.SaveToFile(filepath.Join(podSandboxDir, "config.json"), generate.ExportOptions{})
 	if err != nil {
-		return nil, err
+		return "", err
 	}
 
 	if _, err = os.Stat(podInfraRootfs); err != nil {
 		if os.IsNotExist(err) {
 			// TODO: Replace by rootfs creation API when it is ready
-			if err = utils.CreateInfraRootfs(podInfraRootfs, s.config.Pause); err != nil {
+			if err = utils.CreateInfraRootfs(podInfraRootfs, m.config.Pause); err != nil {
-				return nil, err
+				return "", err
 			}
 		} else {
-			return nil, err
+			return "", err
 		}
 	}
 
 	container, err := oci.NewContainer(containerID, containerName, podSandboxDir, podSandboxDir, sb.netNs(), labels, annotations, nil, nil, id, false)
 	if err != nil {
-		return nil, err
+		return "", err
 	}
 
 	sb.infraContainer = container
 
 	// setup the network
 	podNamespace := ""
-	if err = s.netPlugin.SetUpPod(netNsPath, podNamespace, id, containerName); err != nil {
+	if err = m.netPlugin.SetUpPod(netNsPath, podNamespace, id, containerName); err != nil {
-		return nil, fmt.Errorf("failed to create network for container %s in sandbox %s: %v", containerName, id, err)
+		return "", fmt.Errorf("failed to create network for container %s in sandbox %s: %v", containerName, id, err)
 	}
 
-	if err = s.runContainer(container); err != nil {
+	if err = m.runContainer(container); err != nil {
-		return nil, err
+		return "", err
 	}
 
-	resp = &pb.RunPodSandboxResponse{PodSandboxId: &id}
+	return id, nil
-	logrus.Debugf("RunPodSandboxResponse: %+v", resp)
-	return resp, nil
 }
 
 func getSELinuxLabels(selinuxOptions *pb.SELinuxOption) (processLabel string, mountLabel string, err error) {

manager/sandbox_status.go

@@ -0,0 +1,56 @@
+package manager
+
+import (
+	"github.com/kubernetes-incubator/cri-o/oci"
+	pb "k8s.io/kubernetes/pkg/kubelet/api/v1alpha1/runtime"
+)
+
+// PodSandboxStatus returns the Status of the PodSandbox.
+func (m *Manager) PodSandboxStatus(sbID string) (*pb.PodSandboxStatus, error) {
+	sb, err := m.getPodSandboxWithPartialID(sbID)
+	if err != nil {
+		return nil, err
+	}
+
+	podInfraContainer := sb.infraContainer
+	if err = m.runtime.UpdateStatus(podInfraContainer); err != nil {
+		return nil, err
+	}
+
+	cState := m.runtime.ContainerStatus(podInfraContainer)
+	created := cState.Created.UnixNano()
+
+	netNsPath, err := podInfraContainer.NetNsPath()
+	if err != nil {
+		return nil, err
+	}
+	podNamespace := ""
+	ip, err := m.netPlugin.GetContainerNetworkStatus(netNsPath, podNamespace, sb.id, podInfraContainer.Name())
+	if err != nil {
+		// ignore the error on network status
+		ip = ""
+	}
+
+	rStatus := pb.PodSandboxState_SANDBOX_NOTREADY
+	if cState.Status == oci.ContainerStateRunning {
+		rStatus = pb.PodSandboxState_SANDBOX_READY
+	}
+
+	sandboxID := sb.id
+	status := &pb.PodSandboxStatus{
+		Id:        &sandboxID,
+		CreatedAt: int64Ptr(created),
+		Linux: &pb.LinuxPodSandboxStatus{
+			Namespaces: &pb.Namespace{
+				Network: sPtr(netNsPath),
+			},
+		},
+		Network:     &pb.PodSandboxNetworkStatus{Ip: &ip},
+		State:       &rStatus,
+		Labels:      sb.labels,
+		Annotations: sb.annotations,
+		Metadata:    sb.metadata,
+	}
+
+	return status, nil
+}

manager/sandbox_stop.go

@@ -0,0 +1,55 @@
+package manager
+
+import (
+	"fmt"
+	"os"
+
+	"github.com/kubernetes-incubator/cri-o/oci"
+)
+
+// StopPodSandbox stops the sandbox. If there are any running containers in the
+// sandbox, they should be force terminated.
+func (m *Manager) StopPodSandbox(sbID string) error {
+	sb, err := m.getPodSandboxWithPartialID(sbID)
+	if err != nil {
+		return err
+	}
+
+	podNamespace := ""
+	podInfraContainer := sb.infraContainer
+	netnsPath, err := podInfraContainer.NetNsPath()
+	if err != nil {
+		return err
+	}
+	if _, err := os.Stat(netnsPath); err == nil {
+		if err2 := m.netPlugin.TearDownPod(netnsPath, podNamespace, sb.id, podInfraContainer.Name()); err2 != nil {
+			return fmt.Errorf("failed to destroy network for container %s in sandbox %s: %v",
+				podInfraContainer.Name(), sb.id, err2)
+		}
+	} else if !os.IsNotExist(err) { // it's ok for netnsPath to *not* exist
+		return fmt.Errorf("failed to stat netns path for container %s in sandbox %s before tearing down the network: %v",
+			podInfraContainer.Name(), sb.id, err)
+	}
+
+	// Close the sandbox networking namespace.
+	if err := sb.netNsRemove(); err != nil {
+		return err
+	}
+
+	containers := sb.containers.List()
+	containers = append(containers, podInfraContainer)
+
+	for _, c := range containers {
+		if err := m.runtime.UpdateStatus(c); err != nil {
+			return err
+		}
+		cStatus := m.runtime.ContainerStatus(c)
+		if cStatus.Status != oci.ContainerStateStopped {
+			if err := m.runtime.StopContainer(c); err != nil {
+				return fmt.Errorf("failed to stop container %s in sandbox %s: %v", c.Name(), sb.id, err)
+			}
+		}
+	}
+
+	return nil
+}

manager/utils.go

@@ -1,4 +1,4 @@
-package server
+package manager
 
 import (
 	"fmt"

manager/version.go

@@ -0,0 +1,23 @@
+package manager
+
+// Version returns the runtime name and runtime version
+func (m *Manager) Version() (*VersionResponse, error) {
+
+	runtimeVersion, err := m.runtime.Version()
+	if err != nil {
+		return nil, err
+	}
+
+	runtimeName := m.runtime.Name()
+
+	return &VersionResponse{
+		RuntimeName:    runtimeName,
+		RuntimeVersion: runtimeVersion,
+	}, nil
+}
+
+// VersionResponse is returned from Version.
+type VersionResponse struct {
+	RuntimeVersion string
+	RuntimeName    string
+}

server/container.go

@@ -1,36 +1,106 @@
 package server
 
 import (
-	"fmt"
+	"golang.org/x/net/context"
 
-	"github.com/kubernetes-incubator/cri-o/oci"
+	"github.com/Sirupsen/logrus"
+	pb "k8s.io/kubernetes/pkg/kubelet/api/v1alpha1/runtime"
 )
 
-const (
+// CreateContainer creates a new container in specified PodSandbox
-	// containerTypeSandbox represents a pod sandbox container
+func (s *Server) CreateContainer(ctx context.Context, req *pb.CreateContainerRequest) (res *pb.CreateContainerResponse, err error) {
-	containerTypeSandbox = "sandbox"
+	logrus.Debugf("CreateContainerRequest %+v", req)
-	// containerTypeContainer represents a container running within a pod
-	containerTypeContainer = "container"
-)
 
-type containerRequest interface {
+	containerID, err := s.manager.CreateContainer(req.GetPodSandboxId(), req.GetConfig(), req.GetSandboxConfig())
-	GetContainerId() string
-}
-
-func (s *Server) getContainerFromRequest(req containerRequest) (*oci.Container, error) {
-	ctrID := req.GetContainerId()
-	if ctrID == "" {
-		return nil, fmt.Errorf("container ID should not be empty")
-	}
-
-	containerID, err := s.ctrIDIndex.Get(ctrID)
 	if err != nil {
-		return nil, fmt.Errorf("container with ID starting with %s not found: %v", ctrID, err)
+		return nil, err
 	}
 
-	c := s.state.containers.Get(containerID)
+	resp := &pb.CreateContainerResponse{
-	if c == nil {
+		ContainerId: &containerID,
-		return nil, fmt.Errorf("specified container not found: %s", containerID)
 	}
-	return c, nil
+	logrus.Debugf("CreateContainerResponse: %+v", resp)
+
+	return resp, nil
+}
+
+// ListContainers lists all containers by filters.
+func (s *Server) ListContainers(ctx context.Context, req *pb.ListContainersRequest) (*pb.ListContainersResponse, error) {
+	logrus.Debugf("ListContainersRequest %+v", req)
+
+	ctrs, err := s.manager.ListContainers(req.GetFilter())
+	if err != nil {
+		return nil, err
+	}
+
+	resp := &pb.ListContainersResponse{
+		Containers: ctrs,
+	}
+	logrus.Debugf("ListContainersResponse: %+v", resp)
+
+	return resp, nil
+}
+
+// RemoveContainer removes the container. If the container is running, the container
+// should be force removed.
+func (s *Server) RemoveContainer(ctx context.Context, req *pb.RemoveContainerRequest) (*pb.RemoveContainerResponse, error) {
+	logrus.Debugf("RemoveContainerRequest %+v", req)
+
+	if err := s.manager.RemoveContainer(req.GetContainerId()); err != nil {
+		return nil, err
+	}
+
+	resp := &pb.RemoveContainerResponse{}
+	logrus.Debugf("RemoveContainerResponse: %+v", resp)
+
+	return resp, nil
+}
+
+// StartContainer starts the container.
+func (s *Server) StartContainer(ctx context.Context, req *pb.StartContainerRequest) (*pb.StartContainerResponse, error) {
+	logrus.Debugf("StartContainerRequest %+v", req)
+
+	if err := s.manager.StartContainer(req.GetContainerId()); err != nil {
+		return nil, err
+	}
+
+	resp := &pb.StartContainerResponse{}
+	logrus.Debugf("StartContainerResponse %+v", resp)
+
+	return resp, nil
+}
+
+// ContainerStatus returns status of the container.
+func (s *Server) ContainerStatus(ctx context.Context, req *pb.ContainerStatusRequest) (*pb.ContainerStatusResponse, error) {
+	logrus.Debugf("ContainerStatusRequest %+v", req)
+
+	status, err := s.manager.ContainerStatus(req.GetContainerId())
+	if err != nil {
+		return nil, err
+	}
+
+	resp := &pb.ContainerStatusResponse{
+		Status: status,
+	}
+	logrus.Debugf("ContainerStatusResponse: %+v", resp)
+
+	return resp, nil
+}
+
+// StopContainer stops a running container with a grace period (i.e., timeout).
+func (s *Server) StopContainer(ctx context.Context, req *pb.StopContainerRequest) (*pb.StopContainerResponse, error) {
+	logrus.Debugf("StopContainerRequest %+v", req)
+
+	if err := s.manager.StopContainer(req.GetContainerId(), req.GetTimeout()); err != nil {
+		return nil, err
+	}
+
+	resp := &pb.StopContainerResponse{}
+	logrus.Debugf("StopContainerResponse: %+v", resp)
+	return resp, nil
+}
+
+// UpdateRuntimeConfig updates the configuration of a running container.
+func (s *Server) UpdateRuntimeConfig(ctx context.Context, req *pb.UpdateRuntimeConfigRequest) (*pb.UpdateRuntimeConfigResponse, error) {
+	return nil, nil
 }

server/container_attach.go

@@ -1,11 +0,0 @@
-package server
-
-import (
-	"golang.org/x/net/context"
-	pb "k8s.io/kubernetes/pkg/kubelet/api/v1alpha1/runtime"
-)
-
-// Attach prepares a streaming endpoint to attach to a running container.
-func (s *Server) Attach(ctx context.Context, req *pb.AttachRequest) (*pb.AttachResponse, error) {
-	return nil, nil
-}

server/container_exec.go

@@ -1,11 +0,0 @@
-package server
-
-import (
-	"golang.org/x/net/context"
-	pb "k8s.io/kubernetes/pkg/kubelet/api/v1alpha1/runtime"
-)
-
-// Exec prepares a streaming endpoint to execute a command in the container.
-func (s *Server) Exec(ctx context.Context, req *pb.ExecRequest) (*pb.ExecResponse, error) {
-	return nil, nil
-}

server/container_execsync.go

@@ -1,46 +0,0 @@
-package server
-
-import (
-	"fmt"
-
-	"github.com/Sirupsen/logrus"
-	"github.com/kubernetes-incubator/cri-o/oci"
-	"golang.org/x/net/context"
-	pb "k8s.io/kubernetes/pkg/kubelet/api/v1alpha1/runtime"
-)
-
-// ExecSync runs a command in a container synchronously.
-func (s *Server) ExecSync(ctx context.Context, req *pb.ExecSyncRequest) (*pb.ExecSyncResponse, error) {
-	logrus.Debugf("ExecSyncRequest %+v", req)
-	c, err := s.getContainerFromRequest(req)
-	if err != nil {
-		return nil, err
-	}
-
-	if err = s.runtime.UpdateStatus(c); err != nil {
-		return nil, err
-	}
-
-	cState := s.runtime.ContainerStatus(c)
-	if !(cState.Status == oci.ContainerStateRunning || cState.Status == oci.ContainerStateCreated) {
-		return nil, fmt.Errorf("container is not created or running")
-	}
-
-	cmd := req.GetCmd()
-	if cmd == nil {
-		return nil, fmt.Errorf("exec command cannot be empty")
-	}
-
-	execResp, err := s.runtime.ExecSync(c, cmd, req.GetTimeout())
-	if err != nil {
-		return nil, err
-	}
-	resp := &pb.ExecSyncResponse{
-		Stdout:   execResp.Stdout,
-		Stderr:   execResp.Stderr,
-		ExitCode: &execResp.ExitCode,
-	}
-
-	logrus.Debugf("ExecSyncResponse: %+v", resp)
-	return resp, nil
-}

server/container_portforward.go

@@ -1,11 +0,0 @@
-package server
-
-import (
-	"golang.org/x/net/context"
-	pb "k8s.io/kubernetes/pkg/kubelet/api/v1alpha1/runtime"
-)
-
-// PortForward prepares a streaming endpoint to forward ports from a PodSandbox.
-func (s *Server) PortForward(ctx context.Context, req *pb.PortForwardRequest) (*pb.PortForwardResponse, error) {
-	return nil, nil
-}

server/container_remove.go

@@ -1,53 +0,0 @@
-package server
-
-import (
-	"fmt"
-	"os"
-	"path/filepath"
-
-	"github.com/Sirupsen/logrus"
-	"github.com/kubernetes-incubator/cri-o/oci"
-	"golang.org/x/net/context"
-	pb "k8s.io/kubernetes/pkg/kubelet/api/v1alpha1/runtime"
-)
-
-// RemoveContainer removes the container. If the container is running, the container
-// should be force removed.
-func (s *Server) RemoveContainer(ctx context.Context, req *pb.RemoveContainerRequest) (*pb.RemoveContainerResponse, error) {
-	logrus.Debugf("RemoveContainerRequest %+v", req)
-	c, err := s.getContainerFromRequest(req)
-	if err != nil {
-		return nil, err
-	}
-
-	if err := s.runtime.UpdateStatus(c); err != nil {
-		return nil, fmt.Errorf("failed to update container state: %v", err)
-	}
-
-	cState := s.runtime.ContainerStatus(c)
-	if cState.Status == oci.ContainerStateCreated || cState.Status == oci.ContainerStateRunning {
-		if err := s.runtime.StopContainer(c); err != nil {
-			return nil, fmt.Errorf("failed to stop container %s: %v", c.ID(), err)
-		}
-	}
-
-	if err := s.runtime.DeleteContainer(c); err != nil {
-		return nil, fmt.Errorf("failed to delete container %s: %v", c.ID(), err)
-	}
-
-	containerDir := filepath.Join(s.runtime.ContainerDir(), c.ID())
-	if err := os.RemoveAll(containerDir); err != nil {
-		return nil, fmt.Errorf("failed to remove container %s directory: %v", c.ID(), err)
-	}
-
-	s.releaseContainerName(c.Name())
-	s.removeContainer(c)
-
-	if err := s.ctrIDIndex.Delete(c.ID()); err != nil {
-		return nil, err
-	}
-
-	resp := &pb.RemoveContainerResponse{}
-	logrus.Debugf("RemoveContainerResponse: %+v", resp)
-	return resp, nil
-}

server/container_start.go

@@ -1,26 +0,0 @@
-package server
-
-import (
-	"fmt"
-
-	"github.com/Sirupsen/logrus"
-	"golang.org/x/net/context"
-	pb "k8s.io/kubernetes/pkg/kubelet/api/v1alpha1/runtime"
-)
-
-// StartContainer starts the container.
-func (s *Server) StartContainer(ctx context.Context, req *pb.StartContainerRequest) (*pb.StartContainerResponse, error) {
-	logrus.Debugf("StartContainerRequest %+v", req)
-	c, err := s.getContainerFromRequest(req)
-	if err != nil {
-		return nil, err
-	}
-
-	if err := s.runtime.StartContainer(c); err != nil {
-		return nil, fmt.Errorf("failed to start container %s: %v", c.ID(), err)
-	}
-
-	resp := &pb.StartContainerResponse{}
-	logrus.Debugf("StartContainerResponse %+v", resp)
-	return resp, nil
-}

server/container_status.go

@@ -1,59 +0,0 @@
-package server
-
-import (
-	"github.com/Sirupsen/logrus"
-	"github.com/kubernetes-incubator/cri-o/oci"
-	"golang.org/x/net/context"
-	pb "k8s.io/kubernetes/pkg/kubelet/api/v1alpha1/runtime"
-)
-
-// ContainerStatus returns status of the container.
-func (s *Server) ContainerStatus(ctx context.Context, req *pb.ContainerStatusRequest) (*pb.ContainerStatusResponse, error) {
-	logrus.Debugf("ContainerStatusRequest %+v", req)
-	c, err := s.getContainerFromRequest(req)
-	if err != nil {
-		return nil, err
-	}
-
-	if err := s.runtime.UpdateStatus(c); err != nil {
-		return nil, err
-	}
-
-	containerID := c.ID()
-	resp := &pb.ContainerStatusResponse{
-		Status: &pb.ContainerStatus{
-			Id:       &containerID,
-			Metadata: c.Metadata(),
-		},
-	}
-
-	cState := s.runtime.ContainerStatus(c)
-	rStatus := pb.ContainerState_CONTAINER_UNKNOWN
-
-	switch cState.Status {
-	case oci.ContainerStateCreated:
-		rStatus = pb.ContainerState_CONTAINER_CREATED
-		created := cState.Created.UnixNano()
-		resp.Status.CreatedAt = int64Ptr(created)
-	case oci.ContainerStateRunning:
-		rStatus = pb.ContainerState_CONTAINER_RUNNING
-		created := cState.Created.UnixNano()
-		resp.Status.CreatedAt = int64Ptr(created)
-		started := cState.Started.UnixNano()
-		resp.Status.StartedAt = int64Ptr(started)
-	case oci.ContainerStateStopped:
-		rStatus = pb.ContainerState_CONTAINER_EXITED
-		created := cState.Created.UnixNano()
-		resp.Status.CreatedAt = int64Ptr(created)
-		started := cState.Started.UnixNano()
-		resp.Status.StartedAt = int64Ptr(started)
-		finished := cState.Finished.UnixNano()
-		resp.Status.FinishedAt = int64Ptr(finished)
-		resp.Status.ExitCode = int32Ptr(cState.ExitCode)
-	}
-
-	resp.Status.State = &rStatus
-
-	logrus.Debugf("ContainerStatusResponse: %+v", resp)
-	return resp, nil
-}

server/container_stop.go

@@ -1,33 +0,0 @@
-package server
-
-import (
-	"fmt"
-
-	"github.com/Sirupsen/logrus"
-	"github.com/kubernetes-incubator/cri-o/oci"
-	"golang.org/x/net/context"
-	pb "k8s.io/kubernetes/pkg/kubelet/api/v1alpha1/runtime"
-)
-
-// StopContainer stops a running container with a grace period (i.e., timeout).
-func (s *Server) StopContainer(ctx context.Context, req *pb.StopContainerRequest) (*pb.StopContainerResponse, error) {
-	logrus.Debugf("StopContainerRequest %+v", req)
-	c, err := s.getContainerFromRequest(req)
-	if err != nil {
-		return nil, err
-	}
-
-	if err := s.runtime.UpdateStatus(c); err != nil {
-		return nil, err
-	}
-	cStatus := s.runtime.ContainerStatus(c)
-	if cStatus.Status != oci.ContainerStateStopped {
-		if err := s.runtime.StopContainer(c); err != nil {
-			return nil, fmt.Errorf("failed to stop container %s: %v", c.ID(), err)
-		}
-	}
-
-	resp := &pb.StopContainerResponse{}
-	logrus.Debugf("StopContainerResponse: %+v", resp)
-	return resp, nil
-}

server/container_updateruntimeconfig.go

@@ -1,11 +0,0 @@
-package server
-
-import (
-	"golang.org/x/net/context"
-	pb "k8s.io/kubernetes/pkg/kubelet/api/v1alpha1/runtime"
-)
-
-// UpdateRuntimeConfig updates the configuration of a running container.
-func (s *Server) UpdateRuntimeConfig(ctx context.Context, req *pb.UpdateRuntimeConfigRequest) (*pb.UpdateRuntimeConfigResponse, error) {
-	return nil, nil
-}

server/image.go

@@ -0,0 +1,42 @@
+package server
+
+import (
+	"github.com/Sirupsen/logrus"
+	"golang.org/x/net/context"
+	pb "k8s.io/kubernetes/pkg/kubelet/api/v1alpha1/runtime"
+)
+
+// ListImages lists existing images.
+func (s *Server) ListImages(ctx context.Context, req *pb.ListImagesRequest) (*pb.ListImagesResponse, error) {
+	logrus.Debugf("ListImages: %+v", req)
+	// TODO
+	// containers/storage will take care of this by looking inside /var/lib/ocid/images
+	// and listing images.
+	return &pb.ListImagesResponse{}, nil
+}
+
+// PullImage pulls a image with authentication config.
+func (s *Server) PullImage(ctx context.Context, req *pb.PullImageRequest) (*pb.PullImageResponse, error) {
+	logrus.Debugf("PullImage: %+v", req)
+
+	if err := s.manager.PullImage(req.GetImage(), req.GetAuth(), req.GetSandboxConfig()); err != nil {
+		return nil, err
+	}
+
+	return &pb.PullImageResponse{}, nil
+}
+
+// RemoveImage removes the image.
+func (s *Server) RemoveImage(ctx context.Context, req *pb.RemoveImageRequest) (*pb.RemoveImageResponse, error) {
+	logrus.Debugf("RemoveImage: %+v", req)
+	return &pb.RemoveImageResponse{}, nil
+}
+
+// ImageStatus returns the status of the image.
+func (s *Server) ImageStatus(ctx context.Context, req *pb.ImageStatusRequest) (*pb.ImageStatusResponse, error) {
+	logrus.Debugf("ImageStatus: %+v", req)
+	// TODO
+	// containers/storage will take care of this by looking inside /var/lib/ocid/images
+	// and getting the image status
+	return &pb.ImageStatusResponse{}, nil
+}

server/image_list.go

@@ -1,16 +0,0 @@
-package server
-
-import (
-	"github.com/Sirupsen/logrus"
-	"golang.org/x/net/context"
-	pb "k8s.io/kubernetes/pkg/kubelet/api/v1alpha1/runtime"
-)
-
-// ListImages lists existing images.
-func (s *Server) ListImages(ctx context.Context, req *pb.ListImagesRequest) (*pb.ListImagesResponse, error) {
-	logrus.Debugf("ListImages: %+v", req)
-	// TODO
-	// containers/storage will take care of this by looking inside /var/lib/ocid/images
-	// and listing images.
-	return &pb.ListImagesResponse{}, nil
-}

server/image_remove.go

@@ -1,13 +0,0 @@
-package server
-
-import (
-	"github.com/Sirupsen/logrus"
-	"golang.org/x/net/context"
-	pb "k8s.io/kubernetes/pkg/kubelet/api/v1alpha1/runtime"
-)
-
-// RemoveImage removes the image.
-func (s *Server) RemoveImage(ctx context.Context, req *pb.RemoveImageRequest) (*pb.RemoveImageResponse, error) {
-	logrus.Debugf("RemoveImage: %+v", req)
-	return &pb.RemoveImageResponse{}, nil
-}

server/image_status.go

@@ -1,16 +0,0 @@
-package server
-
-import (
-	"github.com/Sirupsen/logrus"
-	"golang.org/x/net/context"
-	pb "k8s.io/kubernetes/pkg/kubelet/api/v1alpha1/runtime"
-)
-
-// ImageStatus returns the status of the image.
-func (s *Server) ImageStatus(ctx context.Context, req *pb.ImageStatusRequest) (*pb.ImageStatusResponse, error) {
-	logrus.Debugf("ImageStatus: %+v", req)
-	// TODO
-	// containers/storage will take care of this by looking inside /var/lib/ocid/images
-	// and getting the image status
-	return &pb.ImageStatusResponse{}, nil
-}

server/runtime_status.go

@@ -7,34 +7,13 @@ import (
 
 // Status returns the status of the runtime
 func (s *Server) Status(ctx context.Context, req *pb.StatusRequest) (*pb.StatusResponse, error) {
-
+	status, err := s.manager.Status()
-	// Deal with Runtime conditions
-	runtimeReady, err := s.runtime.RuntimeReady()
 	if err != nil {
 		return nil, err
 	}
-	networkReady, err := s.runtime.NetworkReady()
-	if err != nil {
-		return nil, err
-	}
-
-	// Use vendored strings
-	runtimeReadyConditionString := pb.RuntimeReady
-	networkReadyConditionString := pb.NetworkReady
 
 	resp := &pb.StatusResponse{
-		Status: &pb.RuntimeStatus{
+		Status: status,
-			Conditions: []*pb.RuntimeCondition{
-				&pb.RuntimeCondition{
-					Type:   &runtimeReadyConditionString,
-					Status: &runtimeReady,
-				},
-				&pb.RuntimeCondition{
-					Type:   &networkReadyConditionString,
-					Status: &networkReady,
-				},
-			},
-		},
 	}
 
 	return resp, nil

server/sandbox.go

@@ -1,270 +1,83 @@
 package server
 
 import (
-	"crypto/rand"
+	"golang.org/x/net/context"
-	"errors"
-	"fmt"
-	"os"
-	"path/filepath"
-	"sync"
 
 	"github.com/Sirupsen/logrus"
-	"github.com/docker/docker/pkg/stringid"
-	"github.com/kubernetes-incubator/cri-o/oci"
-	"github.com/containernetworking/cni/pkg/ns"
-	"k8s.io/kubernetes/pkg/fields"
 	pb "k8s.io/kubernetes/pkg/kubelet/api/v1alpha1/runtime"
 )
 
-type sandboxNetNs struct {
+// ListPodSandbox returns a list of SandBoxes.
-	sync.Mutex
+func (s *Server) ListPodSandbox(ctx context.Context, req *pb.ListPodSandboxRequest) (*pb.ListPodSandboxResponse, error) {
-	ns      ns.NetNS
+	logrus.Debugf("ListPodSandboxRequest %+v", req)
-	symlink *os.File
-	closed  bool
-}
 
-func (ns *sandboxNetNs) symlinkCreate(name string) error {
+	pods, err := s.manager.ListPodSandbox(req.GetFilter())
-	b := make([]byte, 4)
-	_, randErr := rand.Reader.Read(b)
-	if randErr != nil {
-		return randErr
-	}
-
-	nsName := fmt.Sprintf("%s-%x", name, b)
-	symlinkPath := filepath.Join(nsRunDir, nsName)
-
-	if err := os.Symlink(ns.ns.Path(), symlinkPath); err != nil {
-		return err
-	}
-
-	fd, err := os.Open(symlinkPath)
-	if err != nil {
-		if removeErr := os.RemoveAll(symlinkPath); removeErr != nil {
-			return removeErr
-		}
-
-		return err
-	}
-
-	ns.symlink = fd
-
-	return nil
-}
-
-func (ns *sandboxNetNs) symlinkRemove() error {
-	if err := ns.symlink.Close(); err != nil {
-		return err
-	}
-
-	return os.RemoveAll(ns.symlink.Name())
-}
-
-func isSymbolicLink(path string) (bool, error) {
-	fi, err := os.Lstat(path)
-	if err != nil {
-		return false, err
-	}
-
-	return fi.Mode()&os.ModeSymlink == os.ModeSymlink, nil
-}
-
-func netNsGet(nspath, name string) (*sandboxNetNs, error) {
-	if err := ns.IsNSorErr(nspath); err != nil {
-		return nil, errSandboxClosedNetNS
-	}
-
-	symlink, symlinkErr := isSymbolicLink(nspath)
-	if symlinkErr != nil {
-		return nil, symlinkErr
-	}
-
-	var resolvedNsPath string
-	if symlink {
-		path, err := os.Readlink(nspath)
-		if err != nil {
-			return nil, err
-		}
-		resolvedNsPath = path
-	} else {
-		resolvedNsPath = nspath
-	}
-
-	netNS, err := ns.GetNS(resolvedNsPath)
 	if err != nil {
 		return nil, err
 	}
 
-	netNs := &sandboxNetNs{ns: netNS, closed: false,}
+	resp := &pb.ListPodSandboxResponse{
-
+		Items: pods,
-	if symlink {
-		fd, err := os.Open(nspath)
-		if err != nil {
-			return nil, err
-		}
-
-		netNs.symlink = fd
-	} else {
-		if err := netNs.symlinkCreate(name); err != nil {
-			return nil, err
-		}
 	}
-
+	logrus.Debugf("ListPodSandboxResponse %+v", resp)
-	return netNs, nil
+	return resp, nil
 }
 
-func hostNetNsPath() (string, error) {
+// RemovePodSandbox deletes the sandbox. If there are any running containers in the
-	netNS, err := ns.GetCurrentNS()
+// sandbox, they should be force deleted.
+func (s *Server) RemovePodSandbox(ctx context.Context, req *pb.RemovePodSandboxRequest) (*pb.RemovePodSandboxResponse, error) {
+	logrus.Debugf("RemovePodSandboxRequest %+v", req)
+
+	if err := s.manager.RemovePodSandbox(req.GetPodSandboxId()); err != nil {
+		return nil, err
+	}
+
+	resp := &pb.RemovePodSandboxResponse{}
+	logrus.Debugf("RemovePodSandboxResponse %+v", resp)
+	return resp, nil
+}
+
+// RunPodSandbox creates and runs a pod-level sandbox.
+func (s *Server) RunPodSandbox(ctx context.Context, req *pb.RunPodSandboxRequest) (resp *pb.RunPodSandboxResponse, err error) {
+	logrus.Debugf("RunPodSandboxRequest %+v", req)
+
+	id, err := s.manager.RunPodSandbox(req.GetConfig())
 	if err != nil {
-		return "", err
+		return nil, err
 	}
 
-	defer netNS.Close()
+	resp = &pb.RunPodSandboxResponse{PodSandboxId: &id}
-
+	logrus.Debugf("RunPodSandboxResponse: %+v", resp)
-	return netNS.Path(), nil
+	return resp, nil
 }
 
-type sandbox struct {
+// PodSandboxStatus returns the Status of the PodSandbox.
-	id             string
+func (s *Server) PodSandboxStatus(ctx context.Context, req *pb.PodSandboxStatusRequest) (*pb.PodSandboxStatusResponse, error) {
-	name           string
+	logrus.Debugf("PodSandboxStatusRequest %+v", req)
-	logDir         string
-	labels         fields.Set
-	annotations    map[string]string
-	infraContainer *oci.Container
-	containers     oci.Store
-	processLabel   string
-	mountLabel     string
-	netns          *sandboxNetNs
-	metadata       *pb.PodSandboxMetadata
-	shmPath        string
-}
 
-const (
+	status, err := s.manager.PodSandboxStatus(req.GetPodSandboxId())
-	podDefaultNamespace = "default"
-	defaultShmSize      = 64 * 1024 * 1024
-	nsRunDir            = "/var/run/netns"
-)
-
-var (
-	errSandboxIDEmpty     = errors.New("PodSandboxId should not be empty")
-	errSandboxClosedNetNS = errors.New("PodSandbox networking namespace is closed")
-)
-
-func (s *sandbox) addContainer(c *oci.Container) {
-	s.containers.Add(c.Name(), c)
-}
-
-func (s *sandbox) getContainer(name string) *oci.Container {
-	return s.containers.Get(name)
-}
-
-func (s *sandbox) removeContainer(c *oci.Container) {
-	s.containers.Delete(c.Name())
-}
-
-func (s *sandbox) netNs() ns.NetNS {
-	if s.netns == nil {
-		return nil
-	}
-
-	return s.netns.ns
-}
-
-func (s *sandbox) netNsPath() string {
-	if s.netns == nil {
-		return ""
-	}
-
-	return s.netns.symlink.Name()
-}
-
-func (s *sandbox) netNsCreate() error {
-	if s.netns != nil {
-		return fmt.Errorf("net NS already created")
-	}
-
-	netNS, err := ns.NewNS()
 	if err != nil {
-		return err
+		return nil, err
 	}
 
-	s.netns = &sandboxNetNs{
+	resp := &pb.PodSandboxStatusResponse{
-		ns: netNS,
+		Status: status,
-		closed: false,
 	}
 
-	if err := s.netns.symlinkCreate(s.name); err != nil {
+	logrus.Infof("PodSandboxStatusResponse: %+v", resp)
-		logrus.Warnf("Could not create nentns symlink %v", err)
+	return resp, nil
-
-		if err := s.netns.ns.Close(); err != nil {
-			return err
-		}
-
-		return err
-	}
-
-	return nil
 }
 
-func (s *sandbox) netNsRemove() error {
+// StopPodSandbox stops the sandbox. If there are any running containers in the
-	if s.netns == nil {
+// sandbox, they should be force terminated.
-		logrus.Warn("no networking namespace")
+func (s *Server) StopPodSandbox(ctx context.Context, req *pb.StopPodSandboxRequest) (*pb.StopPodSandboxResponse, error) {
-		return nil
+	logrus.Debugf("StopPodSandboxRequest %+v", req)
+
+	if err := s.manager.StopPodSandbox(req.GetPodSandboxId()); err != nil {
+		return nil, err
 	}
 
-	s.netns.Lock()
+	resp := &pb.StopPodSandboxResponse{}
-	defer s.netns.Unlock()
+	logrus.Debugf("StopPodSandboxResponse: %+v", resp)
-
+	return resp, nil
-	if s.netns.closed {
-		// netNsRemove() can be called multiple
-		// times without returning an error.
-		return nil
-	}
-
-	if err := s.netns.symlinkRemove(); err != nil {
-		return err
-	}
-
-	if err := s.netns.ns.Close(); err != nil {
-		return err
-	}
-
-	s.netns.closed = true
-	return nil
-}
-
-func (s *Server) generatePodIDandName(name string, namespace string, attempt uint32) (string, string, error) {
-	var (
-		err error
-		id  = stringid.GenerateNonCryptoID()
-	)
-	if namespace == "" {
-		namespace = podDefaultNamespace
-	}
-
-	if name, err = s.reservePodName(id, fmt.Sprintf("%s-%s-%v", namespace, name, attempt)); err != nil {
-		return "", "", err
-	}
-	return id, name, err
-}
-
-type podSandboxRequest interface {
-	GetPodSandboxId() string
-}
-
-func (s *Server) getPodSandboxFromRequest(req podSandboxRequest) (*sandbox, error) {
-	sbID := req.GetPodSandboxId()
-	if sbID == "" {
-		return nil, errSandboxIDEmpty
-	}
-
-	sandboxID, err := s.podIDIndex.Get(sbID)
-	if err != nil {
-		return nil, fmt.Errorf("PodSandbox with ID starting with %s not found: %v", sbID, err)
-	}
-
-	sb := s.getSandbox(sandboxID)
-	if sb == nil {
-		return nil, fmt.Errorf("specified sandbox not found: %s", sandboxID)
-	}
-	return sb, nil
 }

server/sandbox_remove.go

@@ -1,95 +0,0 @@
-package server
-
-import (
-	"fmt"
-	"os"
-	"path/filepath"
-	"syscall"
-
-	"github.com/Sirupsen/logrus"
-	"github.com/kubernetes-incubator/cri-o/oci"
-	"github.com/opencontainers/runc/libcontainer/label"
-	"golang.org/x/net/context"
-	pb "k8s.io/kubernetes/pkg/kubelet/api/v1alpha1/runtime"
-)
-
-// RemovePodSandbox deletes the sandbox. If there are any running containers in the
-// sandbox, they should be force deleted.
-func (s *Server) RemovePodSandbox(ctx context.Context, req *pb.RemovePodSandboxRequest) (*pb.RemovePodSandboxResponse, error) {
-	logrus.Debugf("RemovePodSandboxRequest %+v", req)
-	sb, err := s.getPodSandboxFromRequest(req)
-	if err != nil {
-		if err == errSandboxIDEmpty {
-			return nil, err
-		}
-
-		resp := &pb.RemovePodSandboxResponse{}
-		logrus.Warnf("could not get sandbox %s, it's probably been removed already: %v", req.GetPodSandboxId(), err)
-		return resp, nil
-	}
-
-	podInfraContainer := sb.infraContainer
-	containers := sb.containers.List()
-	containers = append(containers, podInfraContainer)
-
-	// Delete all the containers in the sandbox
-	for _, c := range containers {
-		if err := s.runtime.UpdateStatus(c); err != nil {
-			return nil, fmt.Errorf("failed to update container state: %v", err)
-		}
-
-		cState := s.runtime.ContainerStatus(c)
-		if cState.Status == oci.ContainerStateCreated || cState.Status == oci.ContainerStateRunning {
-			if err := s.runtime.StopContainer(c); err != nil {
-				return nil, fmt.Errorf("failed to stop container %s: %v", c.Name(), err)
-			}
-		}
-
-		if err := s.runtime.DeleteContainer(c); err != nil {
-			return nil, fmt.Errorf("failed to delete container %s in sandbox %s: %v", c.Name(), sb.id, err)
-		}
-
-		if c == podInfraContainer {
-			continue
-		}
-
-		containerDir := filepath.Join(s.runtime.ContainerDir(), c.ID())
-		if err := os.RemoveAll(containerDir); err != nil {
-			return nil, fmt.Errorf("failed to remove container %s directory: %v", c.Name(), err)
-		}
-
-		s.releaseContainerName(c.Name())
-		s.removeContainer(c)
-	}
-
-	if err := label.UnreserveLabel(sb.processLabel); err != nil {
-		return nil, err
-	}
-
-	// unmount the shm for the pod
-	if sb.shmPath != "/dev/shm" {
-		if err := syscall.Unmount(sb.shmPath, syscall.MNT_DETACH); err != nil {
-			return nil, err
-		}
-	}
-
-	if err := sb.netNsRemove(); err != nil {
-		return nil, fmt.Errorf("failed to remove networking namespace for sandbox %s: %v", sb.id, err)
-	}
-
-	// Remove the files related to the sandbox
-	podSandboxDir := filepath.Join(s.config.SandboxDir, sb.id)
-	if err := os.RemoveAll(podSandboxDir); err != nil {
-		return nil, fmt.Errorf("failed to remove sandbox %s directory: %v", sb.id, err)
-	}
-	s.releaseContainerName(podInfraContainer.Name())
-	s.removeContainer(podInfraContainer)
-	sb.infraContainer = nil
-
-	s.releasePodName(sb.name)
-	s.removeSandbox(sb.id)
-
-	resp := &pb.RemovePodSandboxResponse{}
-	logrus.Debugf("RemovePodSandboxResponse %+v", resp)
-	return resp, nil
-}

server/sandbox_status.go

@@ -1,62 +0,0 @@
-package server
-
-import (
-	"github.com/Sirupsen/logrus"
-	"github.com/kubernetes-incubator/cri-o/oci"
-	"golang.org/x/net/context"
-	pb "k8s.io/kubernetes/pkg/kubelet/api/v1alpha1/runtime"
-)
-
-// PodSandboxStatus returns the Status of the PodSandbox.
-func (s *Server) PodSandboxStatus(ctx context.Context, req *pb.PodSandboxStatusRequest) (*pb.PodSandboxStatusResponse, error) {
-	logrus.Debugf("PodSandboxStatusRequest %+v", req)
-	sb, err := s.getPodSandboxFromRequest(req)
-	if err != nil {
-		return nil, err
-	}
-
-	podInfraContainer := sb.infraContainer
-	if err = s.runtime.UpdateStatus(podInfraContainer); err != nil {
-		return nil, err
-	}
-
-	cState := s.runtime.ContainerStatus(podInfraContainer)
-	created := cState.Created.UnixNano()
-
-	netNsPath, err := podInfraContainer.NetNsPath()
-	if err != nil {
-		return nil, err
-	}
-	podNamespace := ""
-	ip, err := s.netPlugin.GetContainerNetworkStatus(netNsPath, podNamespace, sb.id, podInfraContainer.Name())
-	if err != nil {
-		// ignore the error on network status
-		ip = ""
-	}
-
-	rStatus := pb.PodSandboxState_SANDBOX_NOTREADY
-	if cState.Status == oci.ContainerStateRunning {
-		rStatus = pb.PodSandboxState_SANDBOX_READY
-	}
-
-	sandboxID := sb.id
-	resp := &pb.PodSandboxStatusResponse{
-		Status: &pb.PodSandboxStatus{
-			Id:        &sandboxID,
-			CreatedAt: int64Ptr(created),
-			Linux: &pb.LinuxPodSandboxStatus{
-				Namespaces: &pb.Namespace{
-					Network: sPtr(netNsPath),
-				},
-			},
-			Network:     &pb.PodSandboxNetworkStatus{Ip: &ip},
-			State:       &rStatus,
-			Labels:      sb.labels,
-			Annotations: sb.annotations,
-			Metadata:    sb.metadata,
-		},
-	}
-
-	logrus.Infof("PodSandboxStatusResponse: %+v", resp)
-	return resp, nil
-}

server/sandbox_stop.go

@@ -1,61 +0,0 @@
-package server
-
-import (
-	"fmt"
-	"os"
-
-	"github.com/Sirupsen/logrus"
-	"github.com/kubernetes-incubator/cri-o/oci"
-	"golang.org/x/net/context"
-	pb "k8s.io/kubernetes/pkg/kubelet/api/v1alpha1/runtime"
-)
-
-// StopPodSandbox stops the sandbox. If there are any running containers in the
-// sandbox, they should be force terminated.
-func (s *Server) StopPodSandbox(ctx context.Context, req *pb.StopPodSandboxRequest) (*pb.StopPodSandboxResponse, error) {
-	logrus.Debugf("StopPodSandboxRequest %+v", req)
-	sb, err := s.getPodSandboxFromRequest(req)
-	if err != nil {
-		return nil, err
-	}
-
-	podNamespace := ""
-	podInfraContainer := sb.infraContainer
-	netnsPath, err := podInfraContainer.NetNsPath()
-	if err != nil {
-		return nil, err
-	}
-	if _, err := os.Stat(netnsPath); err == nil {
-		if err2 := s.netPlugin.TearDownPod(netnsPath, podNamespace, sb.id, podInfraContainer.Name()); err2 != nil {
-			return nil, fmt.Errorf("failed to destroy network for container %s in sandbox %s: %v",
-				podInfraContainer.Name(), sb.id, err2)
-		}
-	} else if !os.IsNotExist(err) { // it's ok for netnsPath to *not* exist
-		return nil, fmt.Errorf("failed to stat netns path for container %s in sandbox %s before tearing down the network: %v",
-			podInfraContainer.Name(), sb.id, err)
-	}
-
-	// Close the sandbox networking namespace.
-	if err := sb.netNsRemove(); err != nil {
-		return nil, err
-	}
-
-	containers := sb.containers.List()
-	containers = append(containers, podInfraContainer)
-
-	for _, c := range containers {
-		if err := s.runtime.UpdateStatus(c); err != nil {
-			return nil, err
-		}
-		cStatus := s.runtime.ContainerStatus(c)
-		if cStatus.Status != oci.ContainerStateStopped {
-			if err := s.runtime.StopContainer(c); err != nil {
-				return nil, fmt.Errorf("failed to stop container %s in sandbox %s: %v", c.Name(), sb.id, err)
-			}
-		}
-	}
-
-	resp := &pb.StopPodSandboxResponse{}
-	logrus.Debugf("StopPodSandboxResponse: %+v", resp)
-	return resp, nil
-}

server/server.go

@@ -1,25 +1,11 @@
 package server
 
 import (
-	"encoding/json"
 	"fmt"
-	"io/ioutil"
 	"os"
-	"path/filepath"
-	"sync"
-	"syscall"
 
-	"github.com/Sirupsen/logrus"
+	runtimeManager "github.com/kubernetes-incubator/cri-o/manager"
-	"github.com/docker/docker/pkg/registrar"
-	"github.com/docker/docker/pkg/truncindex"
-	"github.com/kubernetes-incubator/cri-o/oci"
-	"github.com/kubernetes-incubator/cri-o/server/apparmor"
-	"github.com/kubernetes-incubator/cri-o/server/seccomp"
 	"github.com/kubernetes-incubator/cri-o/utils"
-	"github.com/opencontainers/runc/libcontainer/label"
-	rspec "github.com/opencontainers/runtime-spec/specs-go"
-	"github.com/rajatchopra/ocicni"
-	pb "k8s.io/kubernetes/pkg/kubelet/api/v1alpha1/runtime"
 )
 
 const (
@@ -28,275 +14,11 @@ const (
 
 // Server implements the RuntimeService and ImageService
 type Server struct {
-	config       Config
+	manager *runtimeManager.Manager
-	runtime      *oci.Runtime
-	stateLock    sync.Mutex
-	state        *serverState
-	netPlugin    ocicni.CNIPlugin
-	podNameIndex *registrar.Registrar
-	podIDIndex   *truncindex.TruncIndex
-	ctrNameIndex *registrar.Registrar
-	ctrIDIndex   *truncindex.TruncIndex
-
-	seccompEnabled bool
-	seccompProfile seccomp.Seccomp
-
-	appArmorEnabled bool
-	appArmorProfile string
-}
-
-func (s *Server) loadContainer(id string) error {
-	config, err := ioutil.ReadFile(filepath.Join(s.runtime.ContainerDir(), id, "config.json"))
-	if err != nil {
-		return err
-	}
-	var m rspec.Spec
-	if err = json.Unmarshal(config, &m); err != nil {
-		return err
-	}
-	labels := make(map[string]string)
-	if err = json.Unmarshal([]byte(m.Annotations["ocid/labels"]), &labels); err != nil {
-		return err
-	}
-	name := m.Annotations["ocid/name"]
-	name, err = s.reserveContainerName(id, name)
-	if err != nil {
-		return err
-	}
-	var metadata pb.ContainerMetadata
-	if err = json.Unmarshal([]byte(m.Annotations["ocid/metadata"]), &metadata); err != nil {
-		return err
-	}
-	sb := s.getSandbox(m.Annotations["ocid/sandbox_id"])
-	if sb == nil {
-		logrus.Warnf("could not get sandbox with id %s, skipping", m.Annotations["ocid/sandbox_id"])
-		return nil
-	}
-
-	var tty bool
-	if v := m.Annotations["ocid/tty"]; v == "true" {
-		tty = true
-	}
-	containerPath := filepath.Join(s.runtime.ContainerDir(), id)
-
-	var img *pb.ImageSpec
-	image, ok := m.Annotations["ocid/image"]
-	if ok {
-		img = &pb.ImageSpec{
-			Image: &image,
-		}
-	}
-
-	annotations := make(map[string]string)
-	if err = json.Unmarshal([]byte(m.Annotations["ocid/annotations"]), &annotations); err != nil {
-		return err
-	}
-
-	ctr, err := oci.NewContainer(id, name, containerPath, m.Annotations["ocid/log_path"], sb.netNs(), labels, annotations, img, &metadata, sb.id, tty)
-	if err != nil {
-		return err
-	}
-	s.addContainer(ctr)
-	if err = s.runtime.UpdateStatus(ctr); err != nil {
-		logrus.Warnf("error updating status for container %s: %v", ctr.ID(), err)
-	}
-	if err = s.ctrIDIndex.Add(id); err != nil {
-		return err
-	}
-	return nil
-}
-
-func configNetNsPath(spec rspec.Spec) (string, error) {
-	for _, ns := range spec.Linux.Namespaces {
-		if ns.Type != rspec.NetworkNamespace {
-			continue
-		}
-
-		if ns.Path == "" {
-			return "", fmt.Errorf("empty networking namespace")
-		}
-
-		return ns.Path, nil
-	}
-
-	return "", fmt.Errorf("missing networking namespace")
-}
-
-func (s *Server) loadSandbox(id string) error {
-	config, err := ioutil.ReadFile(filepath.Join(s.config.SandboxDir, id, "config.json"))
-	if err != nil {
-		return err
-	}
-	var m rspec.Spec
-	if err = json.Unmarshal(config, &m); err != nil {
-		return err
-	}
-	labels := make(map[string]string)
-	if err = json.Unmarshal([]byte(m.Annotations["ocid/labels"]), &labels); err != nil {
-		return err
-	}
-	name := m.Annotations["ocid/name"]
-	name, err = s.reservePodName(id, name)
-	if err != nil {
-		return err
-	}
-	var metadata pb.PodSandboxMetadata
-	if err = json.Unmarshal([]byte(m.Annotations["ocid/metadata"]), &metadata); err != nil {
-		return err
-	}
-
-	processLabel, mountLabel, err := label.InitLabels(label.DupSecOpt(m.Process.SelinuxLabel))
-	if err != nil {
-		return err
-	}
-
-	annotations := make(map[string]string)
-	if err = json.Unmarshal([]byte(m.Annotations["ocid/annotations"]), &annotations); err != nil {
-		return err
-	}
-
-	sb := &sandbox{
-		id:           id,
-		name:         name,
-		logDir:       m.Annotations["ocid/log_path"],
-		labels:       labels,
-		containers:   oci.NewMemoryStore(),
-		processLabel: processLabel,
-		mountLabel:   mountLabel,
-		annotations:  annotations,
-		metadata:     &metadata,
-		shmPath:      m.Annotations["ocid/shm_path"],
-	}
-
-	// We add a netNS only if we can load a permanent one.
-	// Otherwise, the sandbox will live in the host namespace.
-	netNsPath, err := configNetNsPath(m)
-	if err == nil {
-		netNS, nsErr := netNsGet(netNsPath, sb.name)
-		// If we can't load the networking namespace
-		// because it's closed, we just set the sb netns
-		// pointer to nil. Otherwise we return an error.
-		if nsErr != nil && nsErr != errSandboxClosedNetNS {
-			return nsErr
-		}
-
-		sb.netns = netNS
-	}
-
-	s.addSandbox(sb)
-
-	sandboxPath := filepath.Join(s.config.SandboxDir, id)
-
-	if err = label.ReserveLabel(processLabel); err != nil {
-		return err
-	}
-
-	cname, err := s.reserveContainerName(m.Annotations["ocid/container_id"], m.Annotations["ocid/container_name"])
-	if err != nil {
-		return err
-	}
-	scontainer, err := oci.NewContainer(m.Annotations["ocid/container_id"], cname, sandboxPath, sandboxPath, sb.netNs(), labels, annotations, nil, nil, id, false)
-	if err != nil {
-		return err
-	}
-	sb.infraContainer = scontainer
-	if err = s.runtime.UpdateStatus(scontainer); err != nil {
-		logrus.Warnf("error updating status for container %s: %v", scontainer.ID(), err)
-	}
-	if err = s.ctrIDIndex.Add(scontainer.ID()); err != nil {
-		return err
-	}
-	if err = s.podIDIndex.Add(id); err != nil {
-		return err
-	}
-	return nil
-}
-
-func (s *Server) restore() {
-	sandboxDir, err := ioutil.ReadDir(s.config.SandboxDir)
-	if err != nil && !os.IsNotExist(err) {
-		logrus.Warnf("could not read sandbox directory %s: %v", sandboxDir, err)
-	}
-	for _, v := range sandboxDir {
-		if !v.IsDir() {
-			continue
-		}
-		if err = s.loadSandbox(v.Name()); err != nil {
-			logrus.Warnf("could not restore sandbox %s: %v", v.Name(), err)
-		}
-	}
-	containerDir, err := ioutil.ReadDir(s.runtime.ContainerDir())
-	if err != nil && !os.IsNotExist(err) {
-		logrus.Warnf("could not read container directory %s: %v", s.runtime.ContainerDir(), err)
-	}
-	for _, v := range containerDir {
-		if !v.IsDir() {
-			continue
-		}
-		if err := s.loadContainer(v.Name()); err != nil {
-			logrus.Warnf("could not restore container %s: %v", v.Name(), err)
-
-		}
-	}
-}
-
-func (s *Server) reservePodName(id, name string) (string, error) {
-	if err := s.podNameIndex.Reserve(name, id); err != nil {
-		if err == registrar.ErrNameReserved {
-			id, err := s.podNameIndex.Get(name)
-			if err != nil {
-				logrus.Warnf("conflict, pod name %q already reserved", name)
-				return "", err
-			}
-			return "", fmt.Errorf("conflict, name %q already reserved for pod %q", name, id)
-		}
-		return "", fmt.Errorf("error reserving pod name %q", name)
-	}
-	return name, nil
-}
-
-func (s *Server) releasePodName(name string) {
-	s.podNameIndex.Release(name)
-}
-
-func (s *Server) reserveContainerName(id, name string) (string, error) {
-	if err := s.ctrNameIndex.Reserve(name, id); err != nil {
-		if err == registrar.ErrNameReserved {
-			id, err := s.ctrNameIndex.Get(name)
-			if err != nil {
-				logrus.Warnf("conflict, ctr name %q already reserved", name)
-				return "", err
-			}
-			return "", fmt.Errorf("conflict, name %q already reserved for ctr %q", name, id)
-		}
-		return "", fmt.Errorf("error reserving ctr name %s", name)
-	}
-	return name, nil
-}
-
-func (s *Server) releaseContainerName(name string) {
-	s.ctrNameIndex.Release(name)
-}
-
-const (
-	// SeccompModeFilter refers to the syscall argument SECCOMP_MODE_FILTER.
-	SeccompModeFilter = uintptr(2)
-)
-
-func seccompEnabled() bool {
-	var enabled bool
-	// Check if Seccomp is supported, via CONFIG_SECCOMP.
-	if _, _, err := syscall.RawSyscall(syscall.SYS_PRCTL, syscall.PR_GET_SECCOMP, 0, 0); err != syscall.EINVAL {
-		// Make sure the kernel has CONFIG_SECCOMP_FILTER.
-		if _, _, err := syscall.RawSyscall(syscall.SYS_PRCTL, syscall.PR_SET_SECCOMP, SeccompModeFilter, 0); err != syscall.EINVAL {
-			enabled = true
-		}
-	}
-	return enabled
 }
 
 // New creates a new Server with options provided
-func New(config *Config) (*Server, error) {
+func New(config *runtimeManager.Config) (*Server, error) {
 	// TODO: This will go away later when we have wrapper process or systemd acting as
 	// subreaper.
 	if err := utils.SetSubreaper(1); err != nil {
@@ -313,107 +35,13 @@ func New(config *Config) (*Server, error) {
 		return nil, err
 	}
 
-	r, err := oci.New(config.Runtime, config.ContainerDir, config.Conmon, config.ConmonEnv)
+	manager, err := runtimeManager.New(config)
-	if err != nil {
-		return nil, err
-	}
-	sandboxes := make(map[string]*sandbox)
-	containers := oci.NewMemoryStore()
-	netPlugin, err := ocicni.InitCNI("")
 	if err != nil {
 		return nil, err
 	}
 	s := &Server{
-		runtime:   r,
+		manager: manager,
-		netPlugin: netPlugin,
-		config:    *config,
-		state: &serverState{
-			sandboxes:  sandboxes,
-			containers: containers,
-		},
-		seccompEnabled:  seccompEnabled(),
-		appArmorEnabled: apparmor.IsEnabled(),
-		appArmorProfile: config.ApparmorProfile,
-	}
-	seccompProfile, err := ioutil.ReadFile(config.SeccompProfile)
-	if err != nil {
-		return nil, fmt.Errorf("opening seccomp profile (%s) failed: %v", config.SeccompProfile, err)
-	}
-	var seccompConfig seccomp.Seccomp
-	if err := json.Unmarshal(seccompProfile, &seccompConfig); err != nil {
-		return nil, fmt.Errorf("decoding seccomp profile failed: %v", err)
-	}
-	s.seccompProfile = seccompConfig
-
-	if s.appArmorEnabled && s.appArmorProfile == apparmor.DefaultApparmorProfile {
-		if err := apparmor.EnsureDefaultApparmorProfile(); err != nil {
-			return nil, fmt.Errorf("ensuring the default apparmor profile is installed failed: %v", err)
-		}
 	}
 
-	s.podIDIndex = truncindex.NewTruncIndex([]string{})
-	s.podNameIndex = registrar.NewRegistrar()
-	s.ctrIDIndex = truncindex.NewTruncIndex([]string{})
-	s.ctrNameIndex = registrar.NewRegistrar()
-
-	s.restore()
-
-	logrus.Debugf("sandboxes: %v", s.state.sandboxes)
-	logrus.Debugf("containers: %v", s.state.containers)
 	return s, nil
 }
-
-type serverState struct {
-	sandboxes  map[string]*sandbox
-	containers oci.Store
-}
-
-func (s *Server) addSandbox(sb *sandbox) {
-	s.stateLock.Lock()
-	s.state.sandboxes[sb.id] = sb
-	s.stateLock.Unlock()
-}
-
-func (s *Server) getSandbox(id string) *sandbox {
-	s.stateLock.Lock()
-	sb := s.state.sandboxes[id]
-	s.stateLock.Unlock()
-	return sb
-}
-
-func (s *Server) hasSandbox(id string) bool {
-	s.stateLock.Lock()
-	_, ok := s.state.sandboxes[id]
-	s.stateLock.Unlock()
-	return ok
-}
-
-func (s *Server) removeSandbox(id string) {
-	s.stateLock.Lock()
-	delete(s.state.sandboxes, id)
-	s.stateLock.Unlock()
-}
-
-func (s *Server) addContainer(c *oci.Container) {
-	s.stateLock.Lock()
-	sandbox := s.state.sandboxes[c.Sandbox()]
-	// TODO(runcom): handle !ok above!!! otherwise it panics!
-	sandbox.addContainer(c)
-	s.state.containers.Add(c.ID(), c)
-	s.stateLock.Unlock()
-}
-
-func (s *Server) getContainer(id string) *oci.Container {
-	s.stateLock.Lock()
-	c := s.state.containers.Get(id)
-	s.stateLock.Unlock()
-	return c
-}
-
-func (s *Server) removeContainer(c *oci.Container) {
-	s.stateLock.Lock()
-	sandbox := s.state.sandboxes[c.Sandbox()]
-	sandbox.removeContainer(c)
-	s.state.containers.Delete(c.ID())
-	s.stateLock.Unlock()
-}

server/streaming.go

@@ -0,0 +1,42 @@
+package server
+
+import (
+	"golang.org/x/net/context"
+
+	"github.com/Sirupsen/logrus"
+	pb "k8s.io/kubernetes/pkg/kubelet/api/v1alpha1/runtime"
+)
+
+// ExecSync runs a command in a container synchronously.
+func (s *Server) ExecSync(ctx context.Context, req *pb.ExecSyncRequest) (*pb.ExecSyncResponse, error) {
+	logrus.Debugf("ExecSyncRequest %+v", req)
+
+	execResp, err := s.manager.ExecSync(req.GetContainerId(), req.GetCmd(), req.GetTimeout())
+	if err != nil {
+		return nil, err
+	}
+
+	resp := &pb.ExecSyncResponse{
+		Stdout:   execResp.Stdout,
+		Stderr:   execResp.Stderr,
+		ExitCode: &execResp.ExitCode,
+	}
+
+	logrus.Debugf("ExecSyncResponse: %+v", resp)
+	return resp, nil
+}
+
+// Attach prepares a streaming endpoint to attach to a running container.
+func (s *Server) Attach(ctx context.Context, req *pb.AttachRequest) (*pb.AttachResponse, error) {
+	return nil, nil
+}
+
+// Exec prepares a streaming endpoint to execute a command in the container.
+func (s *Server) Exec(ctx context.Context, req *pb.ExecRequest) (*pb.ExecResponse, error) {
+	return nil, nil
+}
+
+// PortForward prepares a streaming endpoint to forward ports from a PodSandbox.
+func (s *Server) PortForward(ctx context.Context, req *pb.PortForwardRequest) (*pb.PortForwardResponse, error) {
+	return nil, nil
+}

server/version.go

@@ -8,7 +8,7 @@ import (
 // Version returns the runtime name, runtime version and runtime API version
 func (s *Server) Version(ctx context.Context, req *pb.VersionRequest) (*pb.VersionResponse, error) {
 
-	runtimeVersion, err := s.runtime.Version()
+	versionResp, err := s.manager.Version()
 	if err != nil {
 		return nil, err
 	}
@@ -18,12 +18,11 @@ func (s *Server) Version(ctx context.Context, req *pb.VersionRequest) (*pb.Versi
 
 	// taking const address
 	rav := runtimeAPIVersion
-	runtimeName := s.runtime.Name()
 
 	return &pb.VersionResponse{
 		Version:           &version,
-		RuntimeName:       &runtimeName,
+		RuntimeName:       &versionResp.RuntimeName,
-		RuntimeVersion:    &runtimeVersion,
+		RuntimeVersion:    &versionResp.RuntimeVersion,
 		RuntimeApiVersion: &rav,
 	}, nil
 }