Daniel J Walsh
GitHub
commit
fe69289566
23 changed files with 5197 additions and 9 deletions
|
|
@ -49,7 +49,7 @@ func getRuntime(c *cli.Context) (*libpod.Runtime, error) {
|
|||
options.GraphDriverName = config.Storage
|
||||
options.GraphDriverOptions = config.StorageOptions
|
||||
|
||||
return libpod.NewRuntime(libpod.WithStorageConfig(options))
|
||||
return libpod.NewRuntime(libpod.WithStorageConfig(options), libpod.WithConmonPath(config.Conmon), libpod.WithOCIRuntime(config.Runtime))
|
||||
}
|
||||
|
||||
func shutdownStores() {
|
||||
|
|
@ -82,7 +82,9 @@ func getConfig(c *cli.Context) (*libkpod.Config, error) {
|
|||
if c.GlobalIsSet("runroot") {
|
||||
config.RunRoot = c.GlobalString("runroot")
|
||||
}
|
||||
|
||||
if c.GlobalIsSet("conmon") {
|
||||
config.Conmon = c.GlobalString("conmon")
|
||||
}
|
||||
if c.GlobalIsSet("storage-driver") {
|
||||
config.Storage = c.GlobalString("storage-driver")
|
||||
}
|
||||
|
|
@ -133,3 +135,316 @@ func validateFlags(c *cli.Context, flags []cli.Flag) error {
|
|||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// Common flags shared between commands
|
||||
var createFlags = []cli.Flag{
|
||||
cli.StringSliceFlag{
|
||||
Name: "add-host",
|
||||
Usage: "Add a custom host-to-IP mapping (host:ip) (default [])",
|
||||
},
|
||||
cli.StringSliceFlag{
|
||||
Name: "attach, a",
|
||||
Usage: "Attach to STDIN, STDOUT or STDERR (default [])",
|
||||
},
|
||||
cli.StringFlag{
|
||||
Name: "blkio-weight",
|
||||
Usage: "Block IO weight (relative weight) accepts a weight value between 10 and 1000.",
|
||||
},
|
||||
cli.StringSliceFlag{
|
||||
Name: "blkio-weight-device",
|
||||
Usage: "Block IO weight (relative device weight, format: `DEVICE_NAME:WEIGHT`)",
|
||||
},
|
||||
cli.StringSliceFlag{
|
||||
Name: "cap-add",
|
||||
Usage: "Add capabilities to the container",
|
||||
},
|
||||
cli.StringSliceFlag{
|
||||
Name: "cap-drop",
|
||||
Usage: "Drop capabilities from the container",
|
||||
},
|
||||
cli.StringFlag{
|
||||
Name: "cgroup-parent",
|
||||
Usage: "Optional parent cgroup for the container",
|
||||
},
|
||||
cli.StringFlag{
|
||||
Name: "cidfile",
|
||||
Usage: "Write the container ID to the file",
|
||||
},
|
||||
cli.Uint64Flag{
|
||||
Name: "cpu-period",
|
||||
Usage: "Limit the CPU CFS (Completely Fair Scheduler) period",
|
||||
},
|
||||
cli.Int64Flag{
|
||||
Name: "cpu-quota",
|
||||
Usage: "Limit the CPU CFS (Completely Fair Scheduler) quota",
|
||||
},
|
||||
cli.Uint64Flag{
|
||||
Name: "cpu-rt-period",
|
||||
Usage: "Limit the CPU real-time period in microseconds",
|
||||
},
|
||||
cli.Int64Flag{
|
||||
Name: "cpu-rt-runtime",
|
||||
Usage: "Limit the CPU real-time runtime in microseconds",
|
||||
},
|
||||
cli.Uint64Flag{
|
||||
Name: "cpu-shares",
|
||||
Usage: "CPU shares (relative weight)",
|
||||
},
|
||||
cli.StringFlag{
|
||||
Name: "cpus",
|
||||
Usage: "Number of CPUs. The default is 0.000 which means no limit",
|
||||
},
|
||||
cli.StringFlag{
|
||||
Name: "cpuset-cpus",
|
||||
Usage: "CPUs in which to allow execution (0-3, 0,1)",
|
||||
},
|
||||
cli.StringFlag{
|
||||
Name: "cpuset-mems",
|
||||
Usage: "Memory nodes (MEMs) in which to allow execution (0-3, 0,1). Only effective on NUMA systems.",
|
||||
},
|
||||
cli.BoolFlag{
|
||||
Name: "detach, d",
|
||||
Usage: "Run container in background and print container ID",
|
||||
},
|
||||
cli.StringFlag{
|
||||
Name: "detach-keys",
|
||||
Usage: "Override the key sequence for detaching a container. Format is a single character `[a-Z]` or `ctrl-<value>` where `<value>` is one of: `a-z`, `@`, `^`, `[`, `,` or `_`",
|
||||
},
|
||||
cli.StringSliceFlag{
|
||||
Name: "device",
|
||||
Usage: "Add a host device to the container (default [])",
|
||||
},
|
||||
cli.StringSliceFlag{
|
||||
Name: "device-read-bps",
|
||||
Usage: "Limit read rate (bytes per second) from a device (e.g. --device-read-bps=/dev/sda:1mb)",
|
||||
},
|
||||
cli.StringSliceFlag{
|
||||
Name: "device-read-iops",
|
||||
Usage: "Limit read rate (IO per second) from a device (e.g. --device-read-iops=/dev/sda:1000)",
|
||||
},
|
||||
cli.StringSliceFlag{
|
||||
Name: "device-write-bps",
|
||||
Usage: "Limit write rate (bytes per second) to a device (e.g. --device-write-bps=/dev/sda:1mb)",
|
||||
},
|
||||
cli.StringSliceFlag{
|
||||
Name: "device-write-iops",
|
||||
Usage: "Limit write rate (IO per second) to a device (e.g. --device-write-iops=/dev/sda:1000)",
|
||||
},
|
||||
cli.StringSliceFlag{
|
||||
Name: "dns",
|
||||
Usage: "Set custom DNS servers",
|
||||
},
|
||||
cli.StringSliceFlag{
|
||||
Name: "dns-opt",
|
||||
Usage: "Set custom DNS options",
|
||||
},
|
||||
cli.StringSliceFlag{
|
||||
Name: "dns-search",
|
||||
Usage: "Set custom DNS search domains",
|
||||
},
|
||||
cli.StringFlag{
|
||||
Name: "entrypoint",
|
||||
Usage: "Overwrite the default ENTRYPOINT of the image",
|
||||
},
|
||||
cli.StringSliceFlag{
|
||||
Name: "env, e",
|
||||
Usage: "Set environment variables in container",
|
||||
},
|
||||
cli.StringSliceFlag{
|
||||
Name: "env-file",
|
||||
Usage: "Read in a file of environment variables",
|
||||
},
|
||||
cli.StringSliceFlag{
|
||||
Name: "expose",
|
||||
Usage: "Expose a port or a range of ports (default [])",
|
||||
},
|
||||
cli.StringSliceFlag{
|
||||
Name: "group-add",
|
||||
Usage: "Add additional groups to join (default [])",
|
||||
},
|
||||
cli.StringFlag{
|
||||
Name: "hostname",
|
||||
Usage: "Set container hostname",
|
||||
},
|
||||
cli.BoolFlag{
|
||||
Name: "interactive, i",
|
||||
Usage: "Keep STDIN open even if not attached",
|
||||
},
|
||||
cli.StringFlag{
|
||||
Name: "ip",
|
||||
Usage: "Container IPv4 address (e.g. 172.23.0.9)",
|
||||
},
|
||||
cli.StringFlag{
|
||||
Name: "ip6",
|
||||
Usage: "Container IPv6 address (e.g. 2001:db8::1b99)",
|
||||
},
|
||||
cli.StringFlag{
|
||||
Name: "ipc",
|
||||
Usage: "IPC Namespace to use",
|
||||
},
|
||||
cli.StringFlag{
|
||||
Name: "kernel-memory",
|
||||
Usage: "Kernel memory limit (format: `<number>[<unit>]`, where unit = b, k, m or g)",
|
||||
},
|
||||
cli.StringSliceFlag{
|
||||
Name: "label",
|
||||
Usage: "Set metadata on container (default [])",
|
||||
},
|
||||
cli.StringSliceFlag{
|
||||
Name: "label-file",
|
||||
Usage: "Read in a line delimited file of labels (default [])",
|
||||
},
|
||||
cli.StringSliceFlag{
|
||||
Name: "link-local-ip",
|
||||
Usage: "Container IPv4/IPv6 link-local addresses (default [])",
|
||||
},
|
||||
cli.StringFlag{
|
||||
Name: "log-driver",
|
||||
Usage: "Logging driver for the container",
|
||||
},
|
||||
cli.StringSliceFlag{
|
||||
Name: "log-opt",
|
||||
Usage: "Logging driver options (default [])",
|
||||
},
|
||||
cli.StringFlag{
|
||||
Name: "mac-address",
|
||||
Usage: "Container MAC address (e.g. 92:d0:c6:0a:29:33)",
|
||||
},
|
||||
cli.StringFlag{
|
||||
Name: "memory, m",
|
||||
Usage: "Memory limit (format: <number>[<unit>], where unit = b, k, m or g)",
|
||||
},
|
||||
cli.StringFlag{
|
||||
Name: "memory-reservation",
|
||||
Usage: "Memory soft limit (format: <number>[<unit>], where unit = b, k, m or g)",
|
||||
},
|
||||
cli.StringFlag{
|
||||
Name: "memory-swap",
|
||||
Usage: "Swap limit equal to memory plus swap: '-1' to enable unlimited swap",
|
||||
},
|
||||
cli.Int64Flag{
|
||||
Name: "memory-swappiness",
|
||||
Usage: "Tune container memory swappiness (0 to 100) (default -1)",
|
||||
},
|
||||
cli.StringFlag{
|
||||
Name: "name",
|
||||
Usage: "Assign a name to the container",
|
||||
},
|
||||
cli.StringFlag{
|
||||
Name: "net",
|
||||
Usage: "Setup the network namespace",
|
||||
},
|
||||
cli.StringFlag{
|
||||
Name: "network",
|
||||
Usage: "Connect a container to a network (default 'default')",
|
||||
},
|
||||
cli.StringSliceFlag{
|
||||
Name: "network-alias",
|
||||
Usage: "Add network-scoped alias for the container (default [])",
|
||||
},
|
||||
cli.BoolFlag{
|
||||
Name: "oom-kill-disable",
|
||||
Usage: "Disable OOM Killer",
|
||||
},
|
||||
cli.StringFlag{
|
||||
Name: "oom-score-adj",
|
||||
Usage: "Tune the host's OOM preferences (-1000 to 1000)",
|
||||
},
|
||||
cli.StringFlag{
|
||||
Name: "pid",
|
||||
Usage: "PID Namespace to use",
|
||||
},
|
||||
cli.Int64Flag{
|
||||
Name: "pids-limit",
|
||||
Usage: "Tune container pids limit (set -1 for unlimited)",
|
||||
},
|
||||
cli.StringFlag{
|
||||
Name: "pod",
|
||||
Usage: "Run container in an existing pod",
|
||||
},
|
||||
cli.BoolFlag{
|
||||
Name: "privileged",
|
||||
Usage: "Give extended privileges to container",
|
||||
},
|
||||
cli.StringSliceFlag{
|
||||
Name: "publish, p",
|
||||
Usage: "Publish a container's port, or a range of ports, to the host (default [])",
|
||||
},
|
||||
cli.BoolFlag{
|
||||
Name: "publish-all, P",
|
||||
Usage: "Publish all exposed ports to random ports on the host interface",
|
||||
},
|
||||
cli.BoolFlag{
|
||||
Name: "read-only",
|
||||
Usage: "Make containers root filesystem read-only",
|
||||
},
|
||||
cli.BoolFlag{
|
||||
Name: "rm",
|
||||
Usage: "Remove container (and pod if created) after exit",
|
||||
},
|
||||
cli.StringSliceFlag{
|
||||
Name: "security-opt",
|
||||
Usage: "Security Options (default [])",
|
||||
},
|
||||
cli.StringFlag{
|
||||
Name: "shm-size",
|
||||
Usage: "Size of `/dev/shm`. The format is `<number><unit>`. default is 64 MB",
|
||||
},
|
||||
cli.BoolFlag{
|
||||
Name: "sig-proxy",
|
||||
Usage: "Proxy received signals to the process (default true)",
|
||||
},
|
||||
cli.StringFlag{
|
||||
Name: "stop-signal",
|
||||
Usage: "Signal to stop a container. Default is SIGTERM",
|
||||
},
|
||||
cli.IntFlag{
|
||||
Name: "stop-timeout",
|
||||
Usage: "Timeout (in seconds) to stop a container. Default is 10",
|
||||
},
|
||||
cli.StringSliceFlag{
|
||||
Name: "storage-opt",
|
||||
Usage: "Storage driver options per container (default [])",
|
||||
},
|
||||
cli.StringSliceFlag{
|
||||
Name: "sysctl",
|
||||
Usage: "Sysctl options (default [])",
|
||||
},
|
||||
cli.StringSliceFlag{
|
||||
Name: "tmpfs",
|
||||
Usage: "Mount a temporary filesystem (`tmpfs`) into a container (default [])",
|
||||
},
|
||||
cli.BoolFlag{
|
||||
Name: "tty, t",
|
||||
Usage: "Allocate a pseudo-TTY for container",
|
||||
},
|
||||
cli.StringSliceFlag{
|
||||
Name: "ulimit",
|
||||
Usage: "Ulimit options (default [])",
|
||||
},
|
||||
cli.StringFlag{
|
||||
Name: "user, u",
|
||||
Usage: "Username or UID (format: <name|uid>[:<group|gid>])",
|
||||
},
|
||||
cli.StringFlag{
|
||||
Name: "userns",
|
||||
Usage: "User namespace to use",
|
||||
},
|
||||
cli.StringFlag{
|
||||
Name: "uts",
|
||||
Usage: "UTS namespace to use",
|
||||
},
|
||||
cli.StringSliceFlag{
|
||||
Name: "volume, v",
|
||||
Usage: "Bind mount a volume into the container (default [])",
|
||||
},
|
||||
cli.StringSliceFlag{
|
||||
Name: "volumes-from",
|
||||
Usage: "Mount volumes from the specified container(s) (default [])",
|
||||
},
|
||||
cli.StringFlag{
|
||||
Name: "workdir, w",
|
||||
Usage: "Working `directory inside the container",
|
||||
Value: "/",
|
||||
},
|
||||
}
|
||||
|
|
|
|||
343
cmd/kpod/create.go
Normal file
343
cmd/kpod/create.go
Normal file
|
|
@ -0,0 +1,343 @@
|
|||
package main
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"strconv"
|
||||
|
||||
"github.com/docker/go-units"
|
||||
"github.com/kubernetes-incubator/cri-o/libpod"
|
||||
"github.com/pkg/errors"
|
||||
"github.com/urfave/cli"
|
||||
pb "k8s.io/kubernetes/pkg/kubelet/apis/cri/v1alpha1/runtime"
|
||||
)
|
||||
|
||||
type mountType string
|
||||
|
||||
// Type constants
|
||||
const (
|
||||
// TypeBind is the type for mounting host dir
|
||||
TypeBind mountType = "bind"
|
||||
// TypeVolume is the type for remote storage volumes
|
||||
// TypeVolume mountType = "volume" // re-enable upon use
|
||||
// TypeTmpfs is the type for mounting tmpfs
|
||||
TypeTmpfs mountType = "tmpfs"
|
||||
)
|
||||
|
||||
var (
|
||||
defaultEnvVariables = []string{"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", "TERM=xterm"}
|
||||
)
|
||||
|
||||
type createResourceConfig struct {
|
||||
blkioDevice []string // blkio-weight-device
|
||||
blkioWeight uint16 // blkio-weight
|
||||
cpuPeriod uint64 // cpu-period
|
||||
cpuQuota int64 // cpu-quota
|
||||
cpuRtPeriod uint64 // cpu-rt-period
|
||||
cpuRtRuntime int64 // cpu-rt-runtime
|
||||
cpuShares uint64 // cpu-shares
|
||||
cpus string // cpus
|
||||
cpusetCpus string
|
||||
cpusetMems string // cpuset-mems
|
||||
deviceReadBps []string // device-read-bps
|
||||
deviceReadIops []string // device-read-iops
|
||||
deviceWriteBps []string // device-write-bps
|
||||
deviceWriteIops []string // device-write-iops
|
||||
disableOomKiller bool // oom-kill-disable
|
||||
kernelMemory int64 // kernel-memory
|
||||
memory int64 //memory
|
||||
memoryReservation int64 // memory-reservation
|
||||
memorySwap int64 //memory-swap
|
||||
memorySwapiness uint64 // memory-swappiness
|
||||
oomScoreAdj int //oom-score-adj
|
||||
pidsLimit int64 // pids-limit
|
||||
shmSize string
|
||||
ulimit []string //ulimit
|
||||
}
|
||||
|
||||
type createConfig struct {
|
||||
args []string
|
||||
capAdd []string // cap-add
|
||||
capDrop []string // cap-drop
|
||||
cidFile string
|
||||
cgroupParent string // cgroup-parent
|
||||
command []string
|
||||
detach bool // detach
|
||||
devices []*pb.Device // device
|
||||
dnsOpt []string //dns-opt
|
||||
dnsSearch []string //dns-search
|
||||
dnsServers []string //dns
|
||||
entrypoint string //entrypoint
|
||||
env []string //env
|
||||
expose []string //expose
|
||||
groupAdd []uint32 // group-add
|
||||
hostname string //hostname
|
||||
image string
|
||||
interactive bool //interactive
|
||||
ip6Address string //ipv6
|
||||
ipAddress string //ip
|
||||
labels map[string]string //label
|
||||
linkLocalIP []string // link-local-ip
|
||||
logDriver string // log-driver
|
||||
logDriverOpt []string // log-opt
|
||||
macAddress string //mac-address
|
||||
name string //name
|
||||
network string //network
|
||||
networkAlias []string //network-alias
|
||||
nsIPC string // ipc
|
||||
nsNet string //net
|
||||
nsPID string //pid
|
||||
nsUser string
|
||||
pod string //pod
|
||||
privileged bool //privileged
|
||||
publish []string //publish
|
||||
publishAll bool //publish-all
|
||||
readOnlyRootfs bool //read-only
|
||||
resources createResourceConfig
|
||||
rm bool //rm
|
||||
securityOpts []string //security-opt
|
||||
sigProxy bool //sig-proxy
|
||||
stopSignal string // stop-signal
|
||||
stopTimeout int64 // stop-timeout
|
||||
storageOpts []string //storage-opt
|
||||
sysctl map[string]string //sysctl
|
||||
tmpfs []string // tmpfs
|
||||
tty bool //tty
|
||||
user uint32 //user
|
||||
group uint32 // group
|
||||
volumes []string //volume
|
||||
volumesFrom []string //volumes-from
|
||||
workDir string //workdir
|
||||
}
|
||||
|
||||
var createDescription = "Creates a new container from the given image or" +
|
||||
" storage and prepares it for running the specified command. The" +
|
||||
" container ID is then printed to stdout. You can then start it at" +
|
||||
" any time with the kpod start <container_id> command. The container" +
|
||||
" will be created with the initial state 'created'."
|
||||
|
||||
var createCommand = cli.Command{
|
||||
Name: "create",
|
||||
Usage: "create but do not start a container",
|
||||
Description: createDescription,
|
||||
Flags: createFlags,
|
||||
Action: createCmd,
|
||||
ArgsUsage: "IMAGE [COMMAND [ARG...]]",
|
||||
}
|
||||
|
||||
func createCmd(c *cli.Context) error {
|
||||
// TODO should allow user to create based off a directory on the host not just image
|
||||
// Need CLI support for this
|
||||
if err := validateFlags(c, createFlags); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
runtime, err := getRuntime(c)
|
||||
if err != nil {
|
||||
return errors.Wrapf(err, "error creating libpod runtime")
|
||||
}
|
||||
|
||||
createConfig, err := parseCreateOpts(c, runtime)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
// Deal with the image after all the args have been checked
|
||||
createImage := runtime.NewImage(createConfig.image)
|
||||
if !createImage.HasImageLocal() {
|
||||
// The image wasnt found by the user input'd name or its fqname
|
||||
// Pull the image
|
||||
fmt.Printf("Trying to pull %s...", createImage.PullName)
|
||||
createImage.Pull()
|
||||
}
|
||||
|
||||
runtimeSpec, err := createConfigToOCISpec(createConfig)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
defer runtime.Shutdown(false)
|
||||
imageName, err := createImage.GetFQName()
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
imageID, err := createImage.GetImageID()
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
options, err := createConfig.GetContainerCreateOptions(c)
|
||||
if err != nil {
|
||||
return errors.Wrapf(err, "unable to parse new container options")
|
||||
}
|
||||
// Gather up the options for NewContainer which consist of With... funcs
|
||||
options = append(options, libpod.WithRootFSFromImage(imageID, imageName, false))
|
||||
ctr, err := runtime.NewContainer(runtimeSpec, options...)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
if c.String("cidfile") != "" {
|
||||
libpod.WriteFile(ctr.ID(), c.String("cidfile"))
|
||||
} else {
|
||||
fmt.Printf("%s\n", ctr.ID())
|
||||
}
|
||||
|
||||
return nil
|
||||
}
|
||||
|
||||
// Parses CLI options related to container creation into a config which can be
|
||||
// parsed into an OCI runtime spec
|
||||
func parseCreateOpts(c *cli.Context, runtime *libpod.Runtime) (*createConfig, error) {
|
||||
var command []string
|
||||
var memoryLimit, memoryReservation, memorySwap, memoryKernel int64
|
||||
var blkioWeight uint16
|
||||
var uid, gid uint32
|
||||
|
||||
image := c.Args()[0]
|
||||
|
||||
if len(c.Args()) < 1 {
|
||||
return nil, errors.Errorf("image name or ID is required")
|
||||
}
|
||||
if len(c.Args()) > 1 {
|
||||
command = c.Args()[1:]
|
||||
}
|
||||
|
||||
// LABEL VARIABLES
|
||||
labels, err := getAllLabels(c)
|
||||
if err != nil {
|
||||
return &createConfig{}, errors.Wrapf(err, "unable to process labels")
|
||||
}
|
||||
// ENVIRONMENT VARIABLES
|
||||
// TODO where should env variables be verified to be x=y format
|
||||
env, err := getAllEnvironmentVariables(c)
|
||||
if err != nil {
|
||||
return &createConfig{}, errors.Wrapf(err, "unable to process environment variables")
|
||||
}
|
||||
|
||||
sysctl, err := convertStringSliceToMap(c.StringSlice("sysctl"), "=")
|
||||
if err != nil {
|
||||
return &createConfig{}, errors.Wrapf(err, "sysctl values must be in the form of KEY=VALUE")
|
||||
}
|
||||
|
||||
groupAdd, err := stringSlicetoUint32Slice(c.StringSlice("group-add"))
|
||||
if err != nil {
|
||||
return &createConfig{}, errors.Wrapf(err, "invalid value for groups provided")
|
||||
}
|
||||
|
||||
if c.String("user") != "" {
|
||||
// TODO
|
||||
// We need to mount the imagefs and get the uid/gid
|
||||
// For now, user zeros
|
||||
uid = 0
|
||||
gid = 0
|
||||
}
|
||||
|
||||
if c.String("memory") != "" {
|
||||
memoryLimit, err = units.RAMInBytes(c.String("memory"))
|
||||
if err != nil {
|
||||
return nil, errors.Wrapf(err, "invalid value for memory")
|
||||
}
|
||||
}
|
||||
if c.String("memory-reservation") != "" {
|
||||
memoryReservation, err = units.RAMInBytes(c.String("memory-reservation"))
|
||||
if err != nil {
|
||||
return nil, errors.Wrapf(err, "invalid value for memory-reservation")
|
||||
}
|
||||
}
|
||||
if c.String("memory-swap") != "" {
|
||||
memorySwap, err = units.RAMInBytes(c.String("memory-swap"))
|
||||
if err != nil {
|
||||
return nil, errors.Wrapf(err, "invalid value for memory-swap")
|
||||
}
|
||||
}
|
||||
if c.String("kernel-memory") != "" {
|
||||
memoryKernel, err = units.RAMInBytes(c.String("kernel-memory"))
|
||||
if err != nil {
|
||||
return nil, errors.Wrapf(err, "invalid value for kernel-memory")
|
||||
}
|
||||
}
|
||||
if c.String("blkio-weight") != "" {
|
||||
u, err := strconv.ParseUint(c.String("blkio-weight"), 10, 16)
|
||||
if err != nil {
|
||||
return nil, errors.Wrapf(err, "invalid value for blkio-weight")
|
||||
}
|
||||
blkioWeight = uint16(u)
|
||||
}
|
||||
|
||||
config := &createConfig{
|
||||
capAdd: c.StringSlice("cap-add"),
|
||||
capDrop: c.StringSlice("cap-drop"),
|
||||
cgroupParent: c.String("cgroup-parent"),
|
||||
command: command,
|
||||
detach: c.Bool("detach"),
|
||||
dnsOpt: c.StringSlice("dns-opt"),
|
||||
dnsSearch: c.StringSlice("dns-search"),
|
||||
dnsServers: c.StringSlice("dns"),
|
||||
entrypoint: c.String("entrypoint"),
|
||||
env: env,
|
||||
expose: c.StringSlice("env"),
|
||||
groupAdd: groupAdd,
|
||||
hostname: c.String("hostname"),
|
||||
image: image,
|
||||
interactive: c.Bool("interactive"),
|
||||
ip6Address: c.String("ipv6"),
|
||||
ipAddress: c.String("ip"),
|
||||
labels: labels,
|
||||
linkLocalIP: c.StringSlice("link-local-ip"),
|
||||
logDriver: c.String("log-driver"),
|
||||
logDriverOpt: c.StringSlice("log-opt"),
|
||||
macAddress: c.String("mac-address"),
|
||||
name: c.String("name"),
|
||||
network: c.String("network"),
|
||||
networkAlias: c.StringSlice("network-alias"),
|
||||
nsIPC: c.String("ipc"),
|
||||
nsNet: c.String("net"),
|
||||
nsPID: c.String("pid"),
|
||||
pod: c.String("pod"),
|
||||
privileged: c.Bool("privileged"),
|
||||
publish: c.StringSlice("publish"),
|
||||
publishAll: c.Bool("publish-all"),
|
||||
readOnlyRootfs: c.Bool("read-only"),
|
||||
resources: createResourceConfig{
|
||||
blkioWeight: blkioWeight,
|
||||
blkioDevice: c.StringSlice("blkio-weight-device"),
|
||||
cpuShares: c.Uint64("cpu-shares"),
|
||||
cpuPeriod: c.Uint64("cpu-period"),
|
||||
cpusetCpus: c.String("cpu-period"),
|
||||
cpusetMems: c.String("cpuset-mems"),
|
||||
cpuQuota: c.Int64("cpu-quota"),
|
||||
cpuRtPeriod: c.Uint64("cpu-rt-period"),
|
||||
cpuRtRuntime: c.Int64("cpu-rt-runtime"),
|
||||
cpus: c.String("cpus"),
|
||||
deviceReadBps: c.StringSlice("device-read-bps"),
|
||||
deviceReadIops: c.StringSlice("device-read-iops"),
|
||||
deviceWriteBps: c.StringSlice("device-write-bps"),
|
||||
deviceWriteIops: c.StringSlice("device-write-iops"),
|
||||
disableOomKiller: c.Bool("oom-kill-disable"),
|
||||
shmSize: c.String("shm-size"),
|
||||
memory: memoryLimit,
|
||||
memoryReservation: memoryReservation,
|
||||
memorySwap: memorySwap,
|
||||
memorySwapiness: c.Uint64("memory-swapiness"),
|
||||
kernelMemory: memoryKernel,
|
||||
oomScoreAdj: c.Int("oom-score-adj"),
|
||||
|
||||
pidsLimit: c.Int64("pids-limit"),
|
||||
ulimit: c.StringSlice("ulimit"),
|
||||
},
|
||||
rm: c.Bool("rm"),
|
||||
securityOpts: c.StringSlice("security-opt"),
|
||||
sigProxy: c.Bool("sig-proxy"),
|
||||
stopSignal: c.String("stop-signal"),
|
||||
stopTimeout: c.Int64("stop-timeout"),
|
||||
storageOpts: c.StringSlice("storage-opt"),
|
||||
sysctl: sysctl,
|
||||
tmpfs: c.StringSlice("tmpfs"),
|
||||
tty: c.Bool("tty"),
|
||||
user: uid,
|
||||
group: gid,
|
||||
volumes: c.StringSlice("volume"),
|
||||
volumesFrom: c.StringSlice("volumes-from"),
|
||||
workDir: c.String("workdir"),
|
||||
}
|
||||
|
||||
return config, nil
|
||||
}
|
||||
52
cmd/kpod/create_cli.go
Normal file
52
cmd/kpod/create_cli.go
Normal file
|
|
@ -0,0 +1,52 @@
|
|||
package main
|
||||
|
||||
import (
|
||||
"strings"
|
||||
|
||||
"github.com/pkg/errors"
|
||||
"github.com/urfave/cli"
|
||||
)
|
||||
|
||||
func getAllLabels(cli *cli.Context) (map[string]string, error) {
|
||||
var labelValues []string
|
||||
labels := make(map[string]string)
|
||||
labelValues, labelErr := readKVStrings(cli.StringSlice("label-file"), cli.StringSlice("label"))
|
||||
if labelErr != nil {
|
||||
return labels, errors.Wrapf(labelErr, "unable to process labels from --label and label-file")
|
||||
}
|
||||
// Process KEY=VALUE stringslice in string map for WithLabels func
|
||||
if len(labelValues) > 0 {
|
||||
for _, i := range labelValues {
|
||||
spliti := strings.Split(i, "=")
|
||||
if len(spliti) > 1 {
|
||||
return labels, errors.Errorf("labels must be in KEY=VALUE format: %s is invalid", i)
|
||||
}
|
||||
labels[spliti[0]] = spliti[1]
|
||||
}
|
||||
}
|
||||
return labels, nil
|
||||
}
|
||||
|
||||
func getAllEnvironmentVariables(cli *cli.Context) ([]string, error) {
|
||||
env, err := readKVStrings(cli.StringSlice("env-file"), cli.StringSlice("env"))
|
||||
if err != nil {
|
||||
return []string{}, errors.Wrapf(err, "unable to process variables from --env and --env-file")
|
||||
}
|
||||
// Add default environment variables if nothing defined
|
||||
if len(env) == 0 {
|
||||
env = append(env, defaultEnvVariables...)
|
||||
}
|
||||
return env, nil
|
||||
}
|
||||
|
||||
func convertStringSliceToMap(strSlice []string, delimiter string) (map[string]string, error) {
|
||||
sysctl := make(map[string]string)
|
||||
for _, inputSysctl := range strSlice {
|
||||
values := strings.Split(inputSysctl, delimiter)
|
||||
if len(values) < 2 {
|
||||
return sysctl, errors.Errorf("%s in an invalid sysctl value", inputSysctl)
|
||||
}
|
||||
sysctl[values[0]] = values[1]
|
||||
}
|
||||
return sysctl, nil
|
||||
}
|
||||
|
|
@ -31,6 +31,7 @@ func main() {
|
|||
app.Version = v
|
||||
|
||||
app.Commands = []cli.Command{
|
||||
createCommand,
|
||||
diffCommand,
|
||||
exportCommand,
|
||||
historyCommand,
|
||||
|
|
@ -50,6 +51,7 @@ func main() {
|
|||
renameCommand,
|
||||
rmCommand,
|
||||
rmiCommand,
|
||||
runCommand,
|
||||
saveCommand,
|
||||
statsCommand,
|
||||
stopCommand,
|
||||
|
|
@ -92,6 +94,10 @@ func main() {
|
|||
Name: "config, c",
|
||||
Usage: "path of a config file detailing container server configuration options",
|
||||
},
|
||||
cli.StringFlag{
|
||||
Name: "conmon",
|
||||
Usage: "path of the conmon binary",
|
||||
},
|
||||
cli.StringFlag{
|
||||
Name: "log-level",
|
||||
Usage: "log messages above specified level: debug, info, warn, error (default), fatal or panic",
|
||||
|
|
|
|||
886
cmd/kpod/parse.go
Normal file
886
cmd/kpod/parse.go
Normal file
|
|
@ -0,0 +1,886 @@
|
|||
//nolint
|
||||
// most of these validate and parse functions have been taken from projectatomic/docker
|
||||
// and modified for cri-o
|
||||
package main
|
||||
|
||||
import (
|
||||
"bufio"
|
||||
"bytes"
|
||||
"encoding/json"
|
||||
"fmt"
|
||||
"io/ioutil"
|
||||
"net"
|
||||
"os"
|
||||
"os/user"
|
||||
"path"
|
||||
"regexp"
|
||||
"strconv"
|
||||
"strings"
|
||||
|
||||
units "github.com/docker/go-units"
|
||||
specs "github.com/opencontainers/runtime-spec/specs-go"
|
||||
"github.com/pkg/errors"
|
||||
pb "k8s.io/kubernetes/pkg/kubelet/apis/cri/v1alpha1/runtime"
|
||||
)
|
||||
|
||||
// Note: for flags that are in the form <number><unit>, use the RAMInBytes function
|
||||
// from the units package in docker/go-units/size.go
|
||||
|
||||
var (
|
||||
whiteSpaces = " \t"
|
||||
alphaRegexp = regexp.MustCompile(`[a-zA-Z]`)
|
||||
domainRegexp = regexp.MustCompile(`^(:?(:?[a-zA-Z0-9]|(:?[a-zA-Z0-9][a-zA-Z0-9\-]*[a-zA-Z0-9]))(:?\.(:?[a-zA-Z0-9]|(:?[a-zA-Z0-9][a-zA-Z0-9\-]*[a-zA-Z0-9])))*)\.?\s*$`)
|
||||
)
|
||||
|
||||
// validateExtraHost validates that the specified string is a valid extrahost and returns it.
|
||||
// ExtraHost is in the form of name:ip where the ip has to be a valid ip (ipv4 or ipv6).
|
||||
// for add-host flag
|
||||
func validateExtraHost(val string) (string, error) { //nolint
|
||||
// allow for IPv6 addresses in extra hosts by only splitting on first ":"
|
||||
arr := strings.SplitN(val, ":", 2)
|
||||
if len(arr) != 2 || len(arr[0]) == 0 {
|
||||
return "", fmt.Errorf("bad format for add-host: %q", val)
|
||||
}
|
||||
if _, err := validateIPAddress(arr[1]); err != nil {
|
||||
return "", fmt.Errorf("invalid IP address in add-host: %q", arr[1])
|
||||
}
|
||||
return val, nil
|
||||
}
|
||||
|
||||
// validateIPAddress validates an Ip address.
|
||||
// for dns, ip, and ip6 flags also
|
||||
func validateIPAddress(val string) (string, error) {
|
||||
var ip = net.ParseIP(strings.TrimSpace(val))
|
||||
if ip != nil {
|
||||
return ip.String(), nil
|
||||
}
|
||||
return "", fmt.Errorf("%s is not an ip address", val)
|
||||
}
|
||||
|
||||
// validateAttach validates that the specified string is a valid attach option.
|
||||
// for attach flag
|
||||
func validateAttach(val string) (string, error) { //nolint
|
||||
s := strings.ToLower(val)
|
||||
for _, str := range []string{"stdin", "stdout", "stderr"} {
|
||||
if s == str {
|
||||
return s, nil
|
||||
}
|
||||
}
|
||||
return val, fmt.Errorf("valid streams are STDIN, STDOUT and STDERR")
|
||||
}
|
||||
|
||||
// validate the blkioWeight falls in the range of 10 to 1000
|
||||
// for blkio-weight flag
|
||||
func validateBlkioWeight(val int64) (int64, error) { //nolint
|
||||
if val >= 10 && val <= 1000 {
|
||||
return val, nil
|
||||
}
|
||||
return -1, errors.Errorf("invalid blkio weight %q, should be between 10 and 1000", val)
|
||||
}
|
||||
|
||||
// weightDevice is a structure that holds device:weight pair
|
||||
type weightDevice struct {
|
||||
path string
|
||||
weight uint16
|
||||
}
|
||||
|
||||
func (w *weightDevice) String() string {
|
||||
return fmt.Sprintf("%s:%d", w.path, w.weight)
|
||||
}
|
||||
|
||||
// validateweightDevice validates that the specified string has a valid device-weight format
|
||||
// for blkio-weight-device flag
|
||||
func validateweightDevice(val string) (*weightDevice, error) {
|
||||
split := strings.SplitN(val, ":", 2)
|
||||
if len(split) != 2 {
|
||||
return nil, fmt.Errorf("bad format: %s", val)
|
||||
}
|
||||
if !strings.HasPrefix(split[0], "/dev/") {
|
||||
return nil, fmt.Errorf("bad format for device path: %s", val)
|
||||
}
|
||||
weight, err := strconv.ParseUint(split[1], 10, 0)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("invalid weight for device: %s", val)
|
||||
}
|
||||
if weight > 0 && (weight < 10 || weight > 1000) {
|
||||
return nil, fmt.Errorf("invalid weight for device: %s", val)
|
||||
}
|
||||
|
||||
return &weightDevice{
|
||||
path: split[0],
|
||||
weight: uint16(weight),
|
||||
}, nil
|
||||
}
|
||||
|
||||
// parseDevice parses a device mapping string to a container.DeviceMapping struct
|
||||
// for device flag
|
||||
func parseDevice(device string) (*pb.Device, error) { //nolint
|
||||
_, err := validateDevice(device)
|
||||
if err != nil {
|
||||
return nil, errors.Wrapf(err, "device string not valid %q", device)
|
||||
}
|
||||
|
||||
src := ""
|
||||
dst := ""
|
||||
permissions := "rwm"
|
||||
arr := strings.Split(device, ":")
|
||||
switch len(arr) {
|
||||
case 3:
|
||||
permissions = arr[2]
|
||||
fallthrough
|
||||
case 2:
|
||||
if validDeviceMode(arr[1]) {
|
||||
permissions = arr[1]
|
||||
} else {
|
||||
dst = arr[1]
|
||||
}
|
||||
fallthrough
|
||||
case 1:
|
||||
src = arr[0]
|
||||
default:
|
||||
return nil, fmt.Errorf("invalid device specification: %s", device)
|
||||
}
|
||||
|
||||
if dst == "" {
|
||||
dst = src
|
||||
}
|
||||
|
||||
deviceMapping := &pb.Device{
|
||||
ContainerPath: dst,
|
||||
HostPath: src,
|
||||
Permissions: permissions,
|
||||
}
|
||||
return deviceMapping, nil
|
||||
}
|
||||
|
||||
// validDeviceMode checks if the mode for device is valid or not.
|
||||
// Valid mode is a composition of r (read), w (write), and m (mknod).
|
||||
func validDeviceMode(mode string) bool {
|
||||
var legalDeviceMode = map[rune]bool{
|
||||
'r': true,
|
||||
'w': true,
|
||||
'm': true,
|
||||
}
|
||||
if mode == "" {
|
||||
return false
|
||||
}
|
||||
for _, c := range mode {
|
||||
if !legalDeviceMode[c] {
|
||||
return false
|
||||
}
|
||||
legalDeviceMode[c] = false
|
||||
}
|
||||
return true
|
||||
}
|
||||
|
||||
// validateDevice validates a path for devices
|
||||
// It will make sure 'val' is in the form:
|
||||
// [host-dir:]container-path[:mode]
|
||||
// It also validates the device mode.
|
||||
func validateDevice(val string) (string, error) {
|
||||
return validatePath(val, validDeviceMode)
|
||||
}
|
||||
|
||||
func validatePath(val string, validator func(string) bool) (string, error) {
|
||||
var containerPath string
|
||||
var mode string
|
||||
|
||||
if strings.Count(val, ":") > 2 {
|
||||
return val, fmt.Errorf("bad format for path: %s", val)
|
||||
}
|
||||
|
||||
split := strings.SplitN(val, ":", 3)
|
||||
if split[0] == "" {
|
||||
return val, fmt.Errorf("bad format for path: %s", val)
|
||||
}
|
||||
switch len(split) {
|
||||
case 1:
|
||||
containerPath = split[0]
|
||||
val = path.Clean(containerPath)
|
||||
case 2:
|
||||
if isValid := validator(split[1]); isValid {
|
||||
containerPath = split[0]
|
||||
mode = split[1]
|
||||
val = fmt.Sprintf("%s:%s", path.Clean(containerPath), mode)
|
||||
} else {
|
||||
containerPath = split[1]
|
||||
val = fmt.Sprintf("%s:%s", split[0], path.Clean(containerPath))
|
||||
}
|
||||
case 3:
|
||||
containerPath = split[1]
|
||||
mode = split[2]
|
||||
if isValid := validator(split[2]); !isValid {
|
||||
return val, fmt.Errorf("bad mode specified: %s", mode)
|
||||
}
|
||||
val = fmt.Sprintf("%s:%s:%s", split[0], containerPath, mode)
|
||||
}
|
||||
|
||||
if !path.IsAbs(containerPath) {
|
||||
return val, fmt.Errorf("%s is not an absolute path", containerPath)
|
||||
}
|
||||
return val, nil
|
||||
}
|
||||
|
||||
// throttleDevice is a structure that holds device:rate_per_second pair
|
||||
type throttleDevice struct {
|
||||
path string
|
||||
rate uint64
|
||||
}
|
||||
|
||||
func (t *throttleDevice) String() string {
|
||||
return fmt.Sprintf("%s:%d", t.path, t.rate)
|
||||
}
|
||||
|
||||
// validateBpsDevice validates that the specified string has a valid device-rate format
|
||||
// for device-read-bps and device-write-bps flags
|
||||
func validateBpsDevice(val string) (*throttleDevice, error) {
|
||||
split := strings.SplitN(val, ":", 2)
|
||||
if len(split) != 2 {
|
||||
return nil, fmt.Errorf("bad format: %s", val)
|
||||
}
|
||||
if !strings.HasPrefix(split[0], "/dev/") {
|
||||
return nil, fmt.Errorf("bad format for device path: %s", val)
|
||||
}
|
||||
rate, err := units.RAMInBytes(split[1])
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("invalid rate for device: %s. The correct format is <device-path>:<number>[<unit>]. Number must be a positive integer. Unit is optional and can be kb, mb, or gb", val)
|
||||
}
|
||||
if rate < 0 {
|
||||
return nil, fmt.Errorf("invalid rate for device: %s. The correct format is <device-path>:<number>[<unit>]. Number must be a positive integer. Unit is optional and can be kb, mb, or gb", val)
|
||||
}
|
||||
|
||||
return &throttleDevice{
|
||||
path: split[0],
|
||||
rate: uint64(rate),
|
||||
}, nil
|
||||
}
|
||||
|
||||
// validateIOpsDevice validates that the specified string has a valid device-rate format
|
||||
// for device-write-iops and device-read-iops flags
|
||||
func validateIOpsDevice(val string) (*throttleDevice, error) { //nolint
|
||||
split := strings.SplitN(val, ":", 2)
|
||||
if len(split) != 2 {
|
||||
return nil, fmt.Errorf("bad format: %s", val)
|
||||
}
|
||||
if !strings.HasPrefix(split[0], "/dev/") {
|
||||
return nil, fmt.Errorf("bad format for device path: %s", val)
|
||||
}
|
||||
rate, err := strconv.ParseUint(split[1], 10, 64)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("invalid rate for device: %s. The correct format is <device-path>:<number>. Number must be a positive integer", val)
|
||||
}
|
||||
if rate < 0 {
|
||||
return nil, fmt.Errorf("invalid rate for device: %s. The correct format is <device-path>:<number>. Number must be a positive integer", val)
|
||||
}
|
||||
|
||||
return &throttleDevice{
|
||||
path: split[0],
|
||||
rate: uint64(rate),
|
||||
}, nil
|
||||
}
|
||||
|
||||
// validateDNSSearch validates domain for resolvconf search configuration.
|
||||
// A zero length domain is represented by a dot (.).
|
||||
// for dns-search flag
|
||||
func validateDNSSearch(val string) (string, error) { //nolint
|
||||
if val = strings.Trim(val, " "); val == "." {
|
||||
return val, nil
|
||||
}
|
||||
return validateDomain(val)
|
||||
}
|
||||
|
||||
func validateDomain(val string) (string, error) {
|
||||
if alphaRegexp.FindString(val) == "" {
|
||||
return "", fmt.Errorf("%s is not a valid domain", val)
|
||||
}
|
||||
ns := domainRegexp.FindSubmatch([]byte(val))
|
||||
if len(ns) > 0 && len(ns[1]) < 255 {
|
||||
return string(ns[1]), nil
|
||||
}
|
||||
return "", fmt.Errorf("%s is not a valid domain", val)
|
||||
}
|
||||
|
||||
// validateEnv validates an environment variable and returns it.
|
||||
// If no value is specified, it returns the current value using os.Getenv.
|
||||
// for env flag
|
||||
func validateEnv(val string) (string, error) { //nolint
|
||||
arr := strings.Split(val, "=")
|
||||
if len(arr) > 1 {
|
||||
return val, nil
|
||||
}
|
||||
if !doesEnvExist(val) {
|
||||
return val, nil
|
||||
}
|
||||
return fmt.Sprintf("%s=%s", val, os.Getenv(val)), nil
|
||||
}
|
||||
|
||||
func doesEnvExist(name string) bool {
|
||||
for _, entry := range os.Environ() {
|
||||
parts := strings.SplitN(entry, "=", 2)
|
||||
if parts[0] == name {
|
||||
return true
|
||||
}
|
||||
}
|
||||
return false
|
||||
}
|
||||
|
||||
// reads a file of line terminated key=value pairs, and overrides any keys
|
||||
// present in the file with additional pairs specified in the override parameter
|
||||
// for env-file and labels-file flags
|
||||
func readKVStrings(files []string, override []string) ([]string, error) {
|
||||
envVariables := []string{}
|
||||
for _, ef := range files {
|
||||
parsedVars, err := parseEnvFile(ef)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
envVariables = append(envVariables, parsedVars...)
|
||||
}
|
||||
// parse the '-e' and '--env' after, to allow override
|
||||
envVariables = append(envVariables, override...)
|
||||
|
||||
return envVariables, nil
|
||||
}
|
||||
|
||||
// parseEnvFile reads a file with environment variables enumerated by lines
|
||||
func parseEnvFile(filename string) ([]string, error) {
|
||||
fh, err := os.Open(filename)
|
||||
if err != nil {
|
||||
return []string{}, err
|
||||
}
|
||||
defer fh.Close()
|
||||
|
||||
lines := []string{}
|
||||
scanner := bufio.NewScanner(fh)
|
||||
for scanner.Scan() {
|
||||
// trim the line from all leading whitespace first
|
||||
line := strings.TrimLeft(scanner.Text(), whiteSpaces)
|
||||
// line is not empty, and not starting with '#'
|
||||
if len(line) > 0 && !strings.HasPrefix(line, "#") {
|
||||
data := strings.SplitN(line, "=", 2)
|
||||
|
||||
// trim the front of a variable, but nothing else
|
||||
variable := strings.TrimLeft(data[0], whiteSpaces)
|
||||
if strings.ContainsAny(variable, whiteSpaces) {
|
||||
return []string{}, errors.Errorf("variable %q has white spaces, poorly formatted environment", variable)
|
||||
}
|
||||
|
||||
if len(data) > 1 {
|
||||
|
||||
// pass the value through, no trimming
|
||||
lines = append(lines, fmt.Sprintf("%s=%s", variable, data[1]))
|
||||
} else {
|
||||
// if only a pass-through variable is given, clean it up.
|
||||
lines = append(lines, fmt.Sprintf("%s=%s", strings.TrimSpace(line), os.Getenv(line)))
|
||||
}
|
||||
}
|
||||
}
|
||||
return lines, scanner.Err()
|
||||
}
|
||||
|
||||
// NsIpc represents the container ipc stack.
|
||||
// for ipc flag
|
||||
type NsIpc string
|
||||
|
||||
// IsPrivate indicates whether the container uses its private ipc stack.
|
||||
func (n NsIpc) IsPrivate() bool {
|
||||
return !(n.IsHost() || n.IsContainer())
|
||||
}
|
||||
|
||||
// IsHost indicates whether the container uses the host's ipc stack.
|
||||
func (n NsIpc) IsHost() bool {
|
||||
return n == "host"
|
||||
}
|
||||
|
||||
// IsContainer indicates whether the container uses a container's ipc stack.
|
||||
func (n NsIpc) IsContainer() bool {
|
||||
parts := strings.SplitN(string(n), ":", 2)
|
||||
return len(parts) > 1 && parts[0] == "container"
|
||||
}
|
||||
|
||||
// Valid indicates whether the ipc stack is valid.
|
||||
func (n NsIpc) Valid() bool {
|
||||
parts := strings.Split(string(n), ":")
|
||||
switch mode := parts[0]; mode {
|
||||
case "", "host":
|
||||
case "container":
|
||||
if len(parts) != 2 || parts[1] == "" {
|
||||
return false
|
||||
}
|
||||
default:
|
||||
return false
|
||||
}
|
||||
return true
|
||||
}
|
||||
|
||||
// Container returns the name of the container ipc stack is going to be used.
|
||||
func (n NsIpc) Container() string {
|
||||
parts := strings.SplitN(string(n), ":", 2)
|
||||
if len(parts) > 1 {
|
||||
return parts[1]
|
||||
}
|
||||
return ""
|
||||
}
|
||||
|
||||
// validateLabel validates that the specified string is a valid label, and returns it.
|
||||
// Labels are in the form on key=value.
|
||||
// for label flag
|
||||
func validateLabel(val string) (string, error) { //nolint
|
||||
if strings.Count(val, "=") < 1 {
|
||||
return "", fmt.Errorf("bad attribute format: %s", val)
|
||||
}
|
||||
return val, nil
|
||||
}
|
||||
|
||||
// validateMACAddress validates a MAC address.
|
||||
// for mac-address flag
|
||||
func validateMACAddress(val string) (string, error) { //nolint
|
||||
_, err := net.ParseMAC(strings.TrimSpace(val))
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
return val, nil
|
||||
}
|
||||
|
||||
// validateLink validates that the specified string has a valid link format (containerName:alias).
|
||||
func validateLink(val string) (string, error) { //nolint
|
||||
if _, _, err := parseLink(val); err != nil {
|
||||
return val, err
|
||||
}
|
||||
return val, nil
|
||||
}
|
||||
|
||||
// parseLink parses and validates the specified string as a link format (name:alias)
|
||||
func parseLink(val string) (string, string, error) {
|
||||
if val == "" {
|
||||
return "", "", fmt.Errorf("empty string specified for links")
|
||||
}
|
||||
arr := strings.Split(val, ":")
|
||||
if len(arr) > 2 {
|
||||
return "", "", fmt.Errorf("bad format for links: %s", val)
|
||||
}
|
||||
if len(arr) == 1 {
|
||||
return val, val, nil
|
||||
}
|
||||
// This is kept because we can actually get a HostConfig with links
|
||||
// from an already created container and the format is not `foo:bar`
|
||||
// but `/foo:/c1/bar`
|
||||
if strings.HasPrefix(arr[0], "/") {
|
||||
_, alias := path.Split(arr[1])
|
||||
return arr[0][1:], alias, nil
|
||||
}
|
||||
return arr[0], arr[1], nil
|
||||
}
|
||||
|
||||
// parseLoggingOpts validates the logDriver and logDriverOpts
|
||||
// for log-opt and log-driver flags
|
||||
func parseLoggingOpts(logDriver string, logDriverOpt []string) (map[string]string, error) { //nolint
|
||||
logOptsMap := convertKVStringsToMap(logDriverOpt)
|
||||
if logDriver == "none" && len(logDriverOpt) > 0 {
|
||||
return map[string]string{}, errors.Errorf("invalid logging opts for driver %s", logDriver)
|
||||
}
|
||||
return logOptsMap, nil
|
||||
}
|
||||
|
||||
// NsPid represents the pid namespace of the container.
|
||||
//for pid flag
|
||||
type NsPid string
|
||||
|
||||
// IsPrivate indicates whether the container uses its own new pid namespace.
|
||||
func (n NsPid) IsPrivate() bool {
|
||||
return !(n.IsHost() || n.IsContainer())
|
||||
}
|
||||
|
||||
// IsHost indicates whether the container uses the host's pid namespace.
|
||||
func (n NsPid) IsHost() bool {
|
||||
return n == "host"
|
||||
}
|
||||
|
||||
// IsContainer indicates whether the container uses a container's pid namespace.
|
||||
func (n NsPid) IsContainer() bool {
|
||||
parts := strings.SplitN(string(n), ":", 2)
|
||||
return len(parts) > 1 && parts[0] == "container"
|
||||
}
|
||||
|
||||
// Valid indicates whether the pid namespace is valid.
|
||||
func (n NsPid) Valid() bool {
|
||||
parts := strings.Split(string(n), ":")
|
||||
switch mode := parts[0]; mode {
|
||||
case "", "host":
|
||||
case "container":
|
||||
if len(parts) != 2 || parts[1] == "" {
|
||||
return false
|
||||
}
|
||||
default:
|
||||
return false
|
||||
}
|
||||
return true
|
||||
}
|
||||
|
||||
// Container returns the name of the container whose pid namespace is going to be used.
|
||||
func (n NsPid) Container() string {
|
||||
parts := strings.SplitN(string(n), ":", 2)
|
||||
if len(parts) > 1 {
|
||||
return parts[1]
|
||||
}
|
||||
return ""
|
||||
}
|
||||
|
||||
// parsePortSpecs receives port specs in the format of ip:public:private/proto and parses
|
||||
// these in to the internal types
|
||||
// for publish, publish-all, and expose flags
|
||||
func parsePortSpecs(ports []string) ([]*pb.PortMapping, error) { //nolint
|
||||
var portMappings []*pb.PortMapping
|
||||
for _, rawPort := range ports {
|
||||
portMapping, err := parsePortSpec(rawPort)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
portMappings = append(portMappings, portMapping...)
|
||||
}
|
||||
return portMappings, nil
|
||||
}
|
||||
|
||||
func validateProto(proto string) bool {
|
||||
for _, availableProto := range []string{"tcp", "udp"} {
|
||||
if availableProto == proto {
|
||||
return true
|
||||
}
|
||||
}
|
||||
return false
|
||||
}
|
||||
|
||||
// parsePortSpec parses a port specification string into a slice of PortMappings
|
||||
func parsePortSpec(rawPort string) ([]*pb.PortMapping, error) {
|
||||
var proto string
|
||||
rawIP, hostPort, containerPort := splitParts(rawPort)
|
||||
proto, containerPort = splitProtoPort(containerPort)
|
||||
|
||||
// Strip [] from IPV6 addresses
|
||||
ip, _, err := net.SplitHostPort(rawIP + ":")
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("Invalid ip address %v: %s", rawIP, err)
|
||||
}
|
||||
if ip != "" && net.ParseIP(ip) == nil {
|
||||
return nil, fmt.Errorf("Invalid ip address: %s", ip)
|
||||
}
|
||||
if containerPort == "" {
|
||||
return nil, fmt.Errorf("No port specified: %s<empty>", rawPort)
|
||||
}
|
||||
|
||||
startPort, endPort, err := parsePortRange(containerPort)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("Invalid containerPort: %s", containerPort)
|
||||
}
|
||||
|
||||
var startHostPort, endHostPort uint64 = 0, 0
|
||||
if len(hostPort) > 0 {
|
||||
startHostPort, endHostPort, err = parsePortRange(hostPort)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("Invalid hostPort: %s", hostPort)
|
||||
}
|
||||
}
|
||||
|
||||
if hostPort != "" && (endPort-startPort) != (endHostPort-startHostPort) {
|
||||
// Allow host port range iff containerPort is not a range.
|
||||
// In this case, use the host port range as the dynamic
|
||||
// host port range to allocate into.
|
||||
if endPort != startPort {
|
||||
return nil, fmt.Errorf("Invalid ranges specified for container and host Ports: %s and %s", containerPort, hostPort)
|
||||
}
|
||||
}
|
||||
|
||||
if !validateProto(strings.ToLower(proto)) {
|
||||
return nil, fmt.Errorf("invalid proto: %s", proto)
|
||||
}
|
||||
|
||||
protocol := pb.Protocol_TCP
|
||||
if strings.ToLower(proto) == "udp" {
|
||||
protocol = pb.Protocol_UDP
|
||||
}
|
||||
|
||||
var ports []*pb.PortMapping
|
||||
for i := uint64(0); i <= (endPort - startPort); i++ {
|
||||
containerPort = strconv.FormatUint(startPort+i, 10)
|
||||
if len(hostPort) > 0 {
|
||||
hostPort = strconv.FormatUint(startHostPort+i, 10)
|
||||
}
|
||||
// Set hostPort to a range only if there is a single container port
|
||||
// and a dynamic host port.
|
||||
if startPort == endPort && startHostPort != endHostPort {
|
||||
hostPort = fmt.Sprintf("%s-%s", hostPort, strconv.FormatUint(endHostPort, 10))
|
||||
}
|
||||
|
||||
ctrPort, err := strconv.ParseInt(containerPort, 10, 32)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
hPort, err := strconv.ParseInt(hostPort, 10, 32)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
port := &pb.PortMapping{
|
||||
Protocol: protocol,
|
||||
ContainerPort: int32(ctrPort),
|
||||
HostPort: int32(hPort),
|
||||
HostIp: ip,
|
||||
}
|
||||
|
||||
ports = append(ports, port)
|
||||
}
|
||||
return ports, nil
|
||||
}
|
||||
|
||||
// parsePortRange parses and validates the specified string as a port-range (8000-9000)
|
||||
func parsePortRange(ports string) (uint64, uint64, error) {
|
||||
if ports == "" {
|
||||
return 0, 0, fmt.Errorf("empty string specified for ports")
|
||||
}
|
||||
if !strings.Contains(ports, "-") {
|
||||
start, err := strconv.ParseUint(ports, 10, 16)
|
||||
end := start
|
||||
return start, end, err
|
||||
}
|
||||
|
||||
parts := strings.Split(ports, "-")
|
||||
start, err := strconv.ParseUint(parts[0], 10, 16)
|
||||
if err != nil {
|
||||
return 0, 0, err
|
||||
}
|
||||
end, err := strconv.ParseUint(parts[1], 10, 16)
|
||||
if err != nil {
|
||||
return 0, 0, err
|
||||
}
|
||||
if end < start {
|
||||
return 0, 0, fmt.Errorf("Invalid range specified for the Port: %s", ports)
|
||||
}
|
||||
return start, end, nil
|
||||
}
|
||||
|
||||
// splitParts separates the different parts of rawPort
|
||||
func splitParts(rawport string) (string, string, string) {
|
||||
parts := strings.Split(rawport, ":")
|
||||
n := len(parts)
|
||||
containerport := parts[n-1]
|
||||
|
||||
switch n {
|
||||
case 1:
|
||||
return "", "", containerport
|
||||
case 2:
|
||||
return "", parts[0], containerport
|
||||
case 3:
|
||||
return parts[0], parts[1], containerport
|
||||
default:
|
||||
return strings.Join(parts[:n-2], ":"), parts[n-2], containerport
|
||||
}
|
||||
}
|
||||
|
||||
// splitProtoPort splits a port in the format of port/proto
|
||||
func splitProtoPort(rawPort string) (string, string) {
|
||||
parts := strings.Split(rawPort, "/")
|
||||
l := len(parts)
|
||||
if len(rawPort) == 0 || l == 0 || len(parts[0]) == 0 {
|
||||
return "", ""
|
||||
}
|
||||
if l == 1 {
|
||||
return "tcp", rawPort
|
||||
}
|
||||
if len(parts[1]) == 0 {
|
||||
return "tcp", parts[0]
|
||||
}
|
||||
return parts[1], parts[0]
|
||||
}
|
||||
|
||||
// takes a local seccomp file and reads its file contents
|
||||
// for security-opt flag
|
||||
func parseSecurityOpts(securityOpts []string) ([]string, error) { //nolint
|
||||
for key, opt := range securityOpts {
|
||||
con := strings.SplitN(opt, "=", 2)
|
||||
if len(con) == 1 && con[0] != "no-new-privileges" {
|
||||
if strings.Index(opt, ":") != -1 {
|
||||
con = strings.SplitN(opt, ":", 2)
|
||||
} else {
|
||||
return securityOpts, fmt.Errorf("Invalid --security-opt: %q", opt)
|
||||
}
|
||||
}
|
||||
if con[0] == "seccomp" && con[1] != "unconfined" {
|
||||
f, err := ioutil.ReadFile(con[1])
|
||||
if err != nil {
|
||||
return securityOpts, fmt.Errorf("opening seccomp profile (%s) failed: %v", con[1], err)
|
||||
}
|
||||
b := bytes.NewBuffer(nil)
|
||||
if err := json.Compact(b, f); err != nil {
|
||||
return securityOpts, fmt.Errorf("compacting json for seccomp profile (%s) failed: %v", con[1], err)
|
||||
}
|
||||
securityOpts[key] = fmt.Sprintf("seccomp=%s", b.Bytes())
|
||||
}
|
||||
}
|
||||
|
||||
return securityOpts, nil
|
||||
}
|
||||
|
||||
// parses storage options per container into a map
|
||||
// for storage-opt flag
|
||||
func parseStorageOpts(storageOpts []string) (map[string]string, error) { //nolint
|
||||
m := make(map[string]string)
|
||||
for _, option := range storageOpts {
|
||||
if strings.Contains(option, "=") {
|
||||
opt := strings.SplitN(option, "=", 2)
|
||||
m[opt[0]] = opt[1]
|
||||
} else {
|
||||
return nil, errors.Errorf("invalid storage option %q", option)
|
||||
}
|
||||
}
|
||||
return m, nil
|
||||
}
|
||||
|
||||
// parseUser parses the the uid and gid in the format <name|uid>[:<group|gid>]
|
||||
// for user flag
|
||||
// FIXME: Issue from https://github.com/projectatomic/buildah/issues/66
|
||||
func parseUser(rootdir, userspec string) (specs.User, error) { //nolint
|
||||
var gid64 uint64
|
||||
var gerr error = user.UnknownGroupError("error looking up group")
|
||||
|
||||
spec := strings.SplitN(userspec, ":", 2)
|
||||
userspec = spec[0]
|
||||
groupspec := ""
|
||||
if userspec == "" {
|
||||
return specs.User{}, nil
|
||||
}
|
||||
if len(spec) > 1 {
|
||||
groupspec = spec[1]
|
||||
}
|
||||
|
||||
uid64, uerr := strconv.ParseUint(userspec, 10, 32)
|
||||
if uerr == nil && groupspec == "" {
|
||||
// We parsed the user name as a number, and there's no group
|
||||
// component, so we need to look up the user's primary GID.
|
||||
var name string
|
||||
name, gid64, gerr = lookupGroupForUIDInContainer(rootdir, uid64)
|
||||
if gerr == nil {
|
||||
userspec = name
|
||||
} else {
|
||||
if userrec, err := user.LookupId(userspec); err == nil {
|
||||
gid64, gerr = strconv.ParseUint(userrec.Gid, 10, 32)
|
||||
userspec = userrec.Name
|
||||
}
|
||||
}
|
||||
}
|
||||
if uerr != nil {
|
||||
uid64, gid64, uerr = lookupUserInContainer(rootdir, userspec)
|
||||
gerr = uerr
|
||||
}
|
||||
if uerr != nil {
|
||||
if userrec, err := user.Lookup(userspec); err == nil {
|
||||
uid64, uerr = strconv.ParseUint(userrec.Uid, 10, 32)
|
||||
gid64, gerr = strconv.ParseUint(userrec.Gid, 10, 32)
|
||||
}
|
||||
}
|
||||
|
||||
if groupspec != "" {
|
||||
gid64, gerr = strconv.ParseUint(groupspec, 10, 32)
|
||||
if gerr != nil {
|
||||
gid64, gerr = lookupGroupInContainer(rootdir, groupspec)
|
||||
}
|
||||
if gerr != nil {
|
||||
if group, err := user.LookupGroup(groupspec); err == nil {
|
||||
gid64, gerr = strconv.ParseUint(group.Gid, 10, 32)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
if uerr == nil && gerr == nil {
|
||||
u := specs.User{
|
||||
UID: uint32(uid64),
|
||||
GID: uint32(gid64),
|
||||
Username: userspec,
|
||||
}
|
||||
return u, nil
|
||||
}
|
||||
|
||||
err := errors.Wrapf(uerr, "error determining run uid")
|
||||
if uerr == nil {
|
||||
err = errors.Wrapf(gerr, "error determining run gid")
|
||||
}
|
||||
return specs.User{}, err
|
||||
}
|
||||
|
||||
// convertKVStringsToMap converts ["key=value"] to {"key":"value"}
|
||||
func convertKVStringsToMap(values []string) map[string]string {
|
||||
result := make(map[string]string, len(values))
|
||||
for _, value := range values {
|
||||
kv := strings.SplitN(value, "=", 2)
|
||||
if len(kv) == 1 {
|
||||
result[kv[0]] = ""
|
||||
} else {
|
||||
result[kv[0]] = kv[1]
|
||||
}
|
||||
}
|
||||
|
||||
return result
|
||||
}
|
||||
|
||||
// NsUser represents userns mode in the container.
|
||||
// for userns flag
|
||||
type NsUser string
|
||||
|
||||
// IsHost indicates whether the container uses the host's userns.
|
||||
func (n NsUser) IsHost() bool {
|
||||
return n == "host"
|
||||
}
|
||||
|
||||
// IsPrivate indicates whether the container uses the a private userns.
|
||||
func (n NsUser) IsPrivate() bool {
|
||||
return !(n.IsHost())
|
||||
}
|
||||
|
||||
// Valid indicates whether the userns is valid.
|
||||
func (n NsUser) Valid() bool {
|
||||
parts := strings.Split(string(n), ":")
|
||||
switch mode := parts[0]; mode {
|
||||
case "", "host":
|
||||
default:
|
||||
return false
|
||||
}
|
||||
return true
|
||||
}
|
||||
|
||||
// NsUts represents the UTS namespace of the container.
|
||||
// for uts flag
|
||||
type NsUts string
|
||||
|
||||
// IsPrivate indicates whether the container uses its private UTS namespace.
|
||||
func (n NsUts) IsPrivate() bool {
|
||||
return !(n.IsHost())
|
||||
}
|
||||
|
||||
// IsHost indicates whether the container uses the host's UTS namespace.
|
||||
func (n NsUts) IsHost() bool {
|
||||
return n == "host"
|
||||
}
|
||||
|
||||
// Valid indicates whether the UTS namespace is valid.
|
||||
func (n NsUts) Valid() bool {
|
||||
parts := strings.Split(string(n), ":")
|
||||
switch mode := parts[0]; mode {
|
||||
case "", "host":
|
||||
default:
|
||||
return false
|
||||
}
|
||||
return true
|
||||
}
|
||||
|
||||
// Takes a stringslice and converts to a uint32slice
|
||||
func stringSlicetoUint32Slice(inputSlice []string) ([]uint32, error) {
|
||||
var outputSlice []uint32
|
||||
for _, v := range inputSlice {
|
||||
u, err := strconv.ParseUint(v, 10, 32)
|
||||
if err != nil {
|
||||
return outputSlice, err
|
||||
}
|
||||
outputSlice = append(outputSlice, uint32(u))
|
||||
}
|
||||
return outputSlice, nil
|
||||
}
|
||||
104
cmd/kpod/run.go
Normal file
104
cmd/kpod/run.go
Normal file
|
|
@ -0,0 +1,104 @@
|
|||
package main
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
|
||||
"github.com/kubernetes-incubator/cri-o/libpod"
|
||||
"github.com/pkg/errors"
|
||||
"github.com/sirupsen/logrus"
|
||||
"github.com/urfave/cli"
|
||||
)
|
||||
|
||||
var runDescription = "Runs a command in a new container from the given image"
|
||||
|
||||
var runCommand = cli.Command{
|
||||
Name: "run",
|
||||
Usage: "run a command in a new container",
|
||||
Description: runDescription,
|
||||
Flags: createFlags,
|
||||
Action: runCmd,
|
||||
ArgsUsage: "IMAGE [COMMAND [ARG...]]",
|
||||
}
|
||||
|
||||
func runCmd(c *cli.Context) error {
|
||||
if err := validateFlags(c, createFlags); err != nil {
|
||||
return err
|
||||
}
|
||||
runtime, err := getRuntime(c)
|
||||
|
||||
if err != nil {
|
||||
return errors.Wrapf(err, "error creating libpod runtime")
|
||||
}
|
||||
|
||||
createConfig, err := parseCreateOpts(c, runtime)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
createImage := runtime.NewImage(createConfig.image)
|
||||
|
||||
if !createImage.HasImageLocal() {
|
||||
// The image wasnt found by the user input'd name or its fqname
|
||||
// Pull the image
|
||||
fmt.Printf("Trying to pull %s...", createImage.PullName)
|
||||
createImage.Pull()
|
||||
}
|
||||
|
||||
runtimeSpec, err := createConfigToOCISpec(createConfig)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
defer runtime.Shutdown(false)
|
||||
logrus.Debug("spec is ", runtimeSpec)
|
||||
|
||||
imageName, err := createImage.GetFQName()
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
logrus.Debug("imageName is ", imageName)
|
||||
|
||||
imageID, err := createImage.GetImageID()
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
logrus.Debug("imageID is ", imageID)
|
||||
|
||||
options, err := createConfig.GetContainerCreateOptions(c)
|
||||
if err != nil {
|
||||
return errors.Wrapf(err, "unable to parse new container options")
|
||||
}
|
||||
|
||||
// Gather up the options for NewContainer which consist of With... funcs
|
||||
options = append(options, libpod.WithRootFSFromImage(imageID, imageName, false))
|
||||
ctr, err := runtime.NewContainer(runtimeSpec, options...)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
logrus.Debug("new container created ", ctr.ID())
|
||||
if err := ctr.Create(); err != nil {
|
||||
return err
|
||||
}
|
||||
logrus.Debug("container storage created for %q", ctr.ID())
|
||||
|
||||
if c.String("cidfile") != "" {
|
||||
libpod.WriteFile(ctr.ID(), c.String("cidfile"))
|
||||
return nil
|
||||
}
|
||||
// Start the container
|
||||
if err := ctr.Start(); err != nil {
|
||||
return errors.Wrapf(err, "unable to start container %q", ctr.ID())
|
||||
}
|
||||
logrus.Debug("started container ", ctr.ID())
|
||||
if createConfig.tty {
|
||||
// Attach to the running container
|
||||
logrus.Debug("trying to attach to the container %s", ctr.ID())
|
||||
if err := ctr.Attach(false, c.String("detach-keys")); err != nil {
|
||||
return errors.Wrapf(err, "unable to attach to container %s", ctr.ID())
|
||||
}
|
||||
} else {
|
||||
fmt.Printf("%s\n", ctr.ID())
|
||||
}
|
||||
|
||||
return nil
|
||||
}
|
||||
490
cmd/kpod/spec.go
Normal file
490
cmd/kpod/spec.go
Normal file
|
|
@ -0,0 +1,490 @@
|
|||
package main
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"strings"
|
||||
|
||||
"github.com/kubernetes-incubator/cri-o/libpod"
|
||||
ann "github.com/kubernetes-incubator/cri-o/pkg/annotations"
|
||||
spec "github.com/opencontainers/runtime-spec/specs-go"
|
||||
"github.com/pkg/errors"
|
||||
"github.com/sirupsen/logrus"
|
||||
"github.com/urfave/cli"
|
||||
"golang.org/x/sys/unix"
|
||||
)
|
||||
|
||||
// Parses information needed to create a container into an OCI runtime spec
|
||||
func createConfigToOCISpec(config *createConfig) (*spec.Spec, error) {
|
||||
spec := config.GetDefaultLinuxSpec()
|
||||
spec.Process.Cwd = config.workDir
|
||||
spec.Process.Args = config.command
|
||||
|
||||
spec.Process.Terminal = config.tty
|
||||
|
||||
// User and Group must go together
|
||||
spec.Process.User.UID = config.user
|
||||
spec.Process.User.GID = config.group
|
||||
spec.Process.User.AdditionalGids = config.groupAdd
|
||||
|
||||
spec.Process.Env = config.env
|
||||
|
||||
//TODO
|
||||
// Need examples of capacity additions so I can load that properly
|
||||
|
||||
spec.Root.Readonly = config.readOnlyRootfs
|
||||
spec.Hostname = config.hostname
|
||||
|
||||
// BIND MOUNTS
|
||||
spec.Mounts = append(spec.Mounts, config.GetVolumeMounts()...)
|
||||
|
||||
// TMPFS MOUNTS
|
||||
spec.Mounts = append(spec.Mounts, config.GetTmpfsMounts()...)
|
||||
|
||||
// RESOURCES - MEMORY
|
||||
spec.Linux.Sysctl = config.sysctl
|
||||
|
||||
if config.resources.memory != 0 {
|
||||
spec.Linux.Resources.Memory.Limit = &config.resources.memory
|
||||
}
|
||||
if config.resources.memoryReservation != 0 {
|
||||
spec.Linux.Resources.Memory.Reservation = &config.resources.memoryReservation
|
||||
}
|
||||
if config.resources.memorySwap != 0 {
|
||||
spec.Linux.Resources.Memory.Swap = &config.resources.memorySwap
|
||||
}
|
||||
if config.resources.kernelMemory != 0 {
|
||||
spec.Linux.Resources.Memory.Kernel = &config.resources.kernelMemory
|
||||
}
|
||||
if config.resources.memorySwapiness != 0 {
|
||||
spec.Linux.Resources.Memory.Swappiness = &config.resources.memorySwapiness
|
||||
}
|
||||
if config.resources.disableOomKiller {
|
||||
spec.Linux.Resources.Memory.DisableOOMKiller = &config.resources.disableOomKiller
|
||||
}
|
||||
|
||||
// RESOURCES - CPU
|
||||
|
||||
if config.resources.cpuShares != 0 {
|
||||
spec.Linux.Resources.CPU.Shares = &config.resources.cpuShares
|
||||
}
|
||||
if config.resources.cpuQuota != 0 {
|
||||
spec.Linux.Resources.CPU.Quota = &config.resources.cpuQuota
|
||||
}
|
||||
if config.resources.cpuPeriod != 0 {
|
||||
spec.Linux.Resources.CPU.Period = &config.resources.cpuPeriod
|
||||
}
|
||||
if config.resources.cpuRtRuntime != 0 {
|
||||
spec.Linux.Resources.CPU.RealtimeRuntime = &config.resources.cpuRtRuntime
|
||||
}
|
||||
if config.resources.cpuRtPeriod != 0 {
|
||||
spec.Linux.Resources.CPU.RealtimePeriod = &config.resources.cpuRtPeriod
|
||||
}
|
||||
if config.resources.cpus != "" {
|
||||
spec.Linux.Resources.CPU.Cpus = config.resources.cpus
|
||||
}
|
||||
if config.resources.cpusetMems != "" {
|
||||
spec.Linux.Resources.CPU.Mems = config.resources.cpusetMems
|
||||
}
|
||||
|
||||
// RESOURCES - PIDS
|
||||
if config.resources.pidsLimit != 0 {
|
||||
spec.Linux.Resources.Pids.Limit = config.resources.pidsLimit
|
||||
}
|
||||
|
||||
/*
|
||||
Capabilities: &spec.LinuxCapabilities{
|
||||
// Rlimits []PosixRlimit // Where does this come from
|
||||
// Type string
|
||||
// Hard uint64
|
||||
// Limit uint64
|
||||
// NoNewPrivileges bool // No user input for this
|
||||
// ApparmorProfile string // No user input for this
|
||||
OOMScoreAdj: &config.resources.oomScoreAdj,
|
||||
// Selinuxlabel
|
||||
},
|
||||
Hooks: &spec.Hooks{},
|
||||
//Annotations
|
||||
Resources: &spec.LinuxResources{
|
||||
Devices: config.GetDefaultDevices(),
|
||||
BlockIO: &blkio,
|
||||
//HugepageLimits:
|
||||
Network: &spec.LinuxNetwork{
|
||||
// ClassID *uint32
|
||||
// Priorites []LinuxInterfacePriority
|
||||
},
|
||||
},
|
||||
//CgroupsPath:
|
||||
//Namespaces: []LinuxNamespace
|
||||
//Devices
|
||||
Seccomp: &spec.LinuxSeccomp{
|
||||
// DefaultAction:
|
||||
// Architectures
|
||||
// Syscalls:
|
||||
},
|
||||
// RootfsPropagation
|
||||
// MaskedPaths
|
||||
// ReadonlyPaths:
|
||||
// MountLabel
|
||||
// IntelRdt
|
||||
},
|
||||
}
|
||||
*/
|
||||
return &spec, nil
|
||||
}
|
||||
|
||||
func (c *createConfig) CreateBlockIO() (spec.LinuxBlockIO, error) {
|
||||
bio := spec.LinuxBlockIO{}
|
||||
bio.Weight = &c.resources.blkioWeight
|
||||
if len(c.resources.blkioDevice) > 0 {
|
||||
var lwds []spec.LinuxWeightDevice
|
||||
for _, i := range c.resources.blkioDevice {
|
||||
wd, err := validateweightDevice(i)
|
||||
if err != nil {
|
||||
return bio, errors.Wrapf(err, "invalid values for blkio-weight-device")
|
||||
}
|
||||
wdStat := getStatFromPath(wd.path)
|
||||
lwd := spec.LinuxWeightDevice{
|
||||
Weight: &wd.weight,
|
||||
}
|
||||
lwd.Major = int64(unix.Major(wdStat.Rdev))
|
||||
lwd.Minor = int64(unix.Minor(wdStat.Rdev))
|
||||
lwds = append(lwds, lwd)
|
||||
}
|
||||
}
|
||||
if len(c.resources.deviceReadBps) > 0 {
|
||||
readBps, err := makeThrottleArray(c.resources.deviceReadBps)
|
||||
if err != nil {
|
||||
return bio, err
|
||||
}
|
||||
bio.ThrottleReadBpsDevice = readBps
|
||||
}
|
||||
if len(c.resources.deviceWriteBps) > 0 {
|
||||
writeBpds, err := makeThrottleArray(c.resources.deviceWriteBps)
|
||||
if err != nil {
|
||||
return bio, err
|
||||
}
|
||||
bio.ThrottleWriteBpsDevice = writeBpds
|
||||
}
|
||||
if len(c.resources.deviceReadIops) > 0 {
|
||||
readIops, err := makeThrottleArray(c.resources.deviceReadIops)
|
||||
if err != nil {
|
||||
return bio, err
|
||||
}
|
||||
bio.ThrottleReadIOPSDevice = readIops
|
||||
}
|
||||
if len(c.resources.deviceWriteIops) > 0 {
|
||||
writeIops, err := makeThrottleArray(c.resources.deviceWriteIops)
|
||||
if err != nil {
|
||||
return bio, err
|
||||
}
|
||||
bio.ThrottleWriteIOPSDevice = writeIops
|
||||
}
|
||||
|
||||
return bio, nil
|
||||
}
|
||||
|
||||
func (c *createConfig) GetDefaultMounts() []spec.Mount {
|
||||
// Default to 64K default per man page
|
||||
shmSize := "65536k"
|
||||
if c.resources.shmSize != "" {
|
||||
shmSize = c.resources.shmSize
|
||||
}
|
||||
return []spec.Mount{
|
||||
{
|
||||
Destination: "/proc",
|
||||
Type: "proc",
|
||||
Source: "proc",
|
||||
Options: []string{"nosuid", "noexec", "nodev"},
|
||||
},
|
||||
{
|
||||
Destination: "/dev",
|
||||
Type: "tmpfs",
|
||||
Source: "tmpfs",
|
||||
Options: []string{"nosuid", "strictatime", "mode=755", "size=65536k"},
|
||||
},
|
||||
{
|
||||
Destination: "/dev/pts",
|
||||
Type: "devpts",
|
||||
Source: "devpts",
|
||||
Options: []string{"nosuid", "noexec", "newinstance", "ptmxmode=0666", "mode=0620", "gid=5"},
|
||||
},
|
||||
{
|
||||
Destination: "/sys",
|
||||
Type: "sysfs",
|
||||
Source: "sysfs",
|
||||
Options: []string{"nosuid", "noexec", "nodev", "ro"},
|
||||
},
|
||||
{
|
||||
Destination: "/sys/fs/cgroup",
|
||||
Type: "cgroup",
|
||||
Source: "cgroup",
|
||||
Options: []string{"ro", "nosuid", "noexec", "nodev"},
|
||||
},
|
||||
{
|
||||
Destination: "/dev/mqueue",
|
||||
Type: "mqueue",
|
||||
Source: "mqueue",
|
||||
Options: []string{"nosuid", "noexec", "nodev"},
|
||||
},
|
||||
{
|
||||
Destination: "/dev/shm",
|
||||
Type: "tmpfs",
|
||||
Source: "shm",
|
||||
Options: []string{"nosuid", "noexec", "nodev", "mode=1777", fmt.Sprintf("size=%s", shmSize)},
|
||||
},
|
||||
}
|
||||
}
|
||||
|
||||
func iPtr(i int64) *int64 { return &i }
|
||||
|
||||
func (c *createConfig) GetDefaultDevices() []spec.LinuxDeviceCgroup {
|
||||
return []spec.LinuxDeviceCgroup{
|
||||
{
|
||||
Allow: false,
|
||||
Access: "rwm",
|
||||
},
|
||||
{
|
||||
Allow: true,
|
||||
Type: "c",
|
||||
Major: iPtr(1),
|
||||
Minor: iPtr(5),
|
||||
Access: "rwm",
|
||||
},
|
||||
{
|
||||
Allow: true,
|
||||
Type: "c",
|
||||
Major: iPtr(1),
|
||||
Minor: iPtr(3),
|
||||
Access: "rwm",
|
||||
},
|
||||
{
|
||||
Allow: true,
|
||||
Type: "c",
|
||||
Major: iPtr(1),
|
||||
Minor: iPtr(9),
|
||||
Access: "rwm",
|
||||
},
|
||||
{
|
||||
Allow: true,
|
||||
Type: "c",
|
||||
Major: iPtr(1),
|
||||
Minor: iPtr(8),
|
||||
Access: "rwm",
|
||||
},
|
||||
{
|
||||
Allow: true,
|
||||
Type: "c",
|
||||
Major: iPtr(5),
|
||||
Minor: iPtr(0),
|
||||
Access: "rwm",
|
||||
},
|
||||
{
|
||||
Allow: true,
|
||||
Type: "c",
|
||||
Major: iPtr(5),
|
||||
Minor: iPtr(1),
|
||||
Access: "rwm",
|
||||
},
|
||||
{
|
||||
Allow: false,
|
||||
Type: "c",
|
||||
Major: iPtr(10),
|
||||
Minor: iPtr(229),
|
||||
Access: "rwm",
|
||||
},
|
||||
}
|
||||
}
|
||||
|
||||
func defaultCapabilities() []string {
|
||||
return []string{
|
||||
"CAP_CHOWN",
|
||||
"CAP_DAC_OVERRIDE",
|
||||
"CAP_FSETID",
|
||||
"CAP_FOWNER",
|
||||
"CAP_MKNOD",
|
||||
"CAP_NET_RAW",
|
||||
"CAP_SETGID",
|
||||
"CAP_SETUID",
|
||||
"CAP_SETFCAP",
|
||||
"CAP_SETPCAP",
|
||||
"CAP_NET_BIND_SERVICE",
|
||||
"CAP_SYS_CHROOT",
|
||||
"CAP_KILL",
|
||||
"CAP_AUDIT_WRITE",
|
||||
}
|
||||
}
|
||||
|
||||
func (c *createConfig) GetDefaultLinuxSpec() spec.Spec {
|
||||
s := spec.Spec{
|
||||
Version: spec.Version,
|
||||
Root: &spec.Root{},
|
||||
}
|
||||
s.Annotations = c.GetAnnotations()
|
||||
s.Mounts = c.GetDefaultMounts()
|
||||
s.Process = &spec.Process{
|
||||
Capabilities: &spec.LinuxCapabilities{
|
||||
Bounding: defaultCapabilities(),
|
||||
Permitted: defaultCapabilities(),
|
||||
Inheritable: defaultCapabilities(),
|
||||
Effective: defaultCapabilities(),
|
||||
},
|
||||
}
|
||||
s.Linux = &spec.Linux{
|
||||
MaskedPaths: []string{
|
||||
"/proc/kcore",
|
||||
"/proc/latency_stats",
|
||||
"/proc/timer_list",
|
||||
"/proc/timer_stats",
|
||||
"/proc/sched_debug",
|
||||
},
|
||||
ReadonlyPaths: []string{
|
||||
"/proc/asound",
|
||||
"/proc/bus",
|
||||
"/proc/fs",
|
||||
"/proc/irq",
|
||||
"/proc/sys",
|
||||
"/proc/sysrq-trigger",
|
||||
},
|
||||
Namespaces: []spec.LinuxNamespace{
|
||||
{Type: "mount"},
|
||||
{Type: "network"},
|
||||
{Type: "uts"},
|
||||
{Type: "pid"},
|
||||
{Type: "ipc"},
|
||||
},
|
||||
Devices: []spec.LinuxDevice{},
|
||||
Resources: &spec.LinuxResources{
|
||||
Devices: c.GetDefaultDevices(),
|
||||
},
|
||||
}
|
||||
|
||||
return s
|
||||
}
|
||||
|
||||
// GetAnnotations returns the all the annotations for the container
|
||||
func (c *createConfig) GetAnnotations() map[string]string {
|
||||
a := getDefaultAnnotations()
|
||||
// TODO
|
||||
// Which annotations do we want added by default
|
||||
if c.tty {
|
||||
a["io.kubernetes.cri-o.TTY"] = "true"
|
||||
}
|
||||
return a
|
||||
}
|
||||
|
||||
func getDefaultAnnotations() map[string]string {
|
||||
var annotations map[string]string
|
||||
annotations = make(map[string]string)
|
||||
annotations[ann.Annotations] = ""
|
||||
annotations[ann.ContainerID] = ""
|
||||
annotations[ann.ContainerName] = ""
|
||||
annotations[ann.ContainerType] = ""
|
||||
annotations[ann.Created] = ""
|
||||
annotations[ann.HostName] = ""
|
||||
annotations[ann.IP] = ""
|
||||
annotations[ann.Image] = ""
|
||||
annotations[ann.ImageName] = ""
|
||||
annotations[ann.ImageRef] = ""
|
||||
annotations[ann.KubeName] = ""
|
||||
annotations[ann.Labels] = ""
|
||||
annotations[ann.LogPath] = ""
|
||||
annotations[ann.Metadata] = ""
|
||||
annotations[ann.Name] = ""
|
||||
annotations[ann.PrivilegedRuntime] = ""
|
||||
annotations[ann.ResolvPath] = ""
|
||||
annotations[ann.HostnamePath] = ""
|
||||
annotations[ann.SandboxID] = ""
|
||||
annotations[ann.SandboxName] = ""
|
||||
annotations[ann.ShmPath] = ""
|
||||
annotations[ann.MountPoint] = ""
|
||||
annotations[ann.TrustedSandbox] = ""
|
||||
annotations[ann.TTY] = "false"
|
||||
annotations[ann.Stdin] = ""
|
||||
annotations[ann.StdinOnce] = ""
|
||||
annotations[ann.Volumes] = ""
|
||||
|
||||
return annotations
|
||||
}
|
||||
|
||||
//GetVolumeMounts takes user provided input for bind mounts and creates Mount structs
|
||||
func (c *createConfig) GetVolumeMounts() []spec.Mount {
|
||||
var m []spec.Mount
|
||||
var options []string
|
||||
for _, i := range c.volumes {
|
||||
// We need to handle SELinux options better here, specifically :Z
|
||||
spliti := strings.Split(i, ":")
|
||||
if len(spliti) > 2 {
|
||||
options = strings.Split(spliti[2], ",")
|
||||
}
|
||||
// always add rbind bc mount ignores the bind filesystem when mounting
|
||||
options = append(options, "rbind")
|
||||
m = append(m, spec.Mount{
|
||||
Destination: spliti[1],
|
||||
Type: string(TypeBind),
|
||||
Source: spliti[0],
|
||||
Options: options,
|
||||
})
|
||||
}
|
||||
return m
|
||||
}
|
||||
|
||||
//GetTmpfsMounts takes user provided input for tmpfs mounts and creates Mount structs
|
||||
func (c *createConfig) GetTmpfsMounts() []spec.Mount {
|
||||
var m []spec.Mount
|
||||
for _, i := range c.tmpfs {
|
||||
// Default options if nothing passed
|
||||
options := []string{"rw", "noexec", "nosuid", "nodev", "size=65536k"}
|
||||
spliti := strings.Split(i, ":")
|
||||
destPath := spliti[0]
|
||||
if len(spliti) > 1 {
|
||||
options = strings.Split(spliti[1], ",")
|
||||
}
|
||||
m = append(m, spec.Mount{
|
||||
Destination: destPath,
|
||||
Type: string(TypeTmpfs),
|
||||
Options: options,
|
||||
Source: string(TypeTmpfs),
|
||||
})
|
||||
}
|
||||
return m
|
||||
}
|
||||
|
||||
func (c *createConfig) GetContainerCreateOptions(cli *cli.Context) ([]libpod.CtrCreateOption, error) {
|
||||
var options []libpod.CtrCreateOption
|
||||
|
||||
// Uncomment after talking to mheon about unimplemented funcs
|
||||
// options = append(options, libpod.WithLabels(c.labels))
|
||||
|
||||
if c.interactive {
|
||||
options = append(options, libpod.WithStdin())
|
||||
}
|
||||
if c.name != "" {
|
||||
logrus.Debug("appending name %s", c.name)
|
||||
options = append(options, libpod.WithName(c.name))
|
||||
}
|
||||
|
||||
return options, nil
|
||||
}
|
||||
|
||||
func getStatFromPath(path string) unix.Stat_t {
|
||||
s := unix.Stat_t{}
|
||||
_ = unix.Stat(path, &s)
|
||||
return s
|
||||
}
|
||||
|
||||
func makeThrottleArray(throttleInput []string) ([]spec.LinuxThrottleDevice, error) {
|
||||
var ltds []spec.LinuxThrottleDevice
|
||||
for _, i := range throttleInput {
|
||||
t, err := validateBpsDevice(i)
|
||||
if err != nil {
|
||||
return []spec.LinuxThrottleDevice{}, err
|
||||
}
|
||||
ltd := spec.LinuxThrottleDevice{}
|
||||
ltd.Rate = t.rate
|
||||
ltdStat := getStatFromPath(t.path)
|
||||
ltd.Major = int64(unix.Major(ltdStat.Rdev))
|
||||
ltd.Minor = int64(unix.Major(ltdStat.Rdev))
|
||||
ltds = append(ltds, ltd)
|
||||
}
|
||||
return ltds, nil
|
||||
}
|
||||
121
cmd/kpod/user.go
Normal file
121
cmd/kpod/user.go
Normal file
|
|
@ -0,0 +1,121 @@
|
|||
package main
|
||||
|
||||
// #include <sys/types.h>
|
||||
// #include <grp.h>
|
||||
// #include <pwd.h>
|
||||
// #include <stdlib.h>
|
||||
// #include <stdio.h>
|
||||
// #include <string.h>
|
||||
// typedef FILE * pFILE;
|
||||
import "C"
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"os/user"
|
||||
"path/filepath"
|
||||
"sync"
|
||||
"syscall"
|
||||
"unsafe"
|
||||
|
||||
"github.com/pkg/errors"
|
||||
)
|
||||
|
||||
func fopenContainerFile(rootdir, filename string) (C.pFILE, error) {
|
||||
var st, lst syscall.Stat_t
|
||||
|
||||
ctrfile := filepath.Join(rootdir, filename)
|
||||
cctrfile := C.CString(ctrfile)
|
||||
defer C.free(unsafe.Pointer(cctrfile))
|
||||
mode := C.CString("r")
|
||||
defer C.free(unsafe.Pointer(mode))
|
||||
f, err := C.fopen(cctrfile, mode)
|
||||
if f == nil || err != nil {
|
||||
return nil, errors.Wrapf(err, "error opening %q", ctrfile)
|
||||
}
|
||||
if err = syscall.Fstat(int(C.fileno(f)), &st); err != nil {
|
||||
return nil, errors.Wrapf(err, "fstat(%q)", ctrfile)
|
||||
}
|
||||
if err = syscall.Lstat(ctrfile, &lst); err != nil {
|
||||
return nil, errors.Wrapf(err, "lstat(%q)", ctrfile)
|
||||
}
|
||||
if st.Dev != lst.Dev || st.Ino != lst.Ino {
|
||||
return nil, errors.Errorf("%q is not a regular file", ctrfile)
|
||||
}
|
||||
return f, nil
|
||||
}
|
||||
|
||||
var (
|
||||
lookupUser, lookupGroup sync.Mutex
|
||||
)
|
||||
|
||||
func lookupUserInContainer(rootdir, username string) (uint64, uint64, error) {
|
||||
name := C.CString(username)
|
||||
defer C.free(unsafe.Pointer(name))
|
||||
|
||||
f, err := fopenContainerFile(rootdir, "/etc/passwd")
|
||||
if err != nil {
|
||||
return 0, 0, err
|
||||
}
|
||||
defer C.fclose(f)
|
||||
|
||||
lookupUser.Lock()
|
||||
defer lookupUser.Unlock()
|
||||
|
||||
pwd := C.fgetpwent(f)
|
||||
for pwd != nil {
|
||||
if C.strcmp(pwd.pw_name, name) != 0 {
|
||||
pwd = C.fgetpwent(f)
|
||||
continue
|
||||
}
|
||||
return uint64(pwd.pw_uid), uint64(pwd.pw_gid), nil
|
||||
}
|
||||
|
||||
return 0, 0, user.UnknownUserError(fmt.Sprintf("error looking up user %q", username))
|
||||
}
|
||||
|
||||
func lookupGroupForUIDInContainer(rootdir string, userid uint64) (string, uint64, error) {
|
||||
f, err := fopenContainerFile(rootdir, "/etc/passwd")
|
||||
if err != nil {
|
||||
return "", 0, err
|
||||
}
|
||||
defer C.fclose(f)
|
||||
|
||||
lookupUser.Lock()
|
||||
defer lookupUser.Unlock()
|
||||
|
||||
pwd := C.fgetpwent(f)
|
||||
for pwd != nil {
|
||||
if uint64(pwd.pw_uid) != userid {
|
||||
pwd = C.fgetpwent(f)
|
||||
continue
|
||||
}
|
||||
return C.GoString(pwd.pw_name), uint64(pwd.pw_gid), nil
|
||||
}
|
||||
|
||||
return "", 0, user.UnknownUserError(fmt.Sprintf("error looking up user with UID %d", userid))
|
||||
}
|
||||
|
||||
func lookupGroupInContainer(rootdir, groupname string) (uint64, error) {
|
||||
name := C.CString(groupname)
|
||||
defer C.free(unsafe.Pointer(name))
|
||||
|
||||
f, err := fopenContainerFile(rootdir, "/etc/group")
|
||||
if err != nil {
|
||||
return 0, err
|
||||
}
|
||||
defer C.fclose(f)
|
||||
|
||||
lookupGroup.Lock()
|
||||
defer lookupGroup.Unlock()
|
||||
|
||||
grp := C.fgetgrent(f)
|
||||
for grp != nil {
|
||||
if C.strcmp(grp.gr_name, name) != 0 {
|
||||
grp = C.fgetgrent(f)
|
||||
continue
|
||||
}
|
||||
return uint64(grp.gr_gid), nil
|
||||
}
|
||||
|
||||
return 0, user.UnknownGroupError(fmt.Sprintf("error looking up group %q", groupname))
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue