Commit graph

169 commits

Author SHA1 Message Date
Matthew Heon
9529f565b2 Add option to use file-based locking for libkpod state
Signed-off-by: Matthew Heon <mheon@redhat.com>
2017-07-31 15:58:29 -04:00
umohnani8
412b98be26 Add 'kpod load' command
Signed-off-by: umohnani8 <umohnani@redhat.com>
2017-07-28 22:30:48 -04:00
Nalin Dahyabhai
40117e8bfe Use inspected creation dates
We already parse every image if there's a label filter so that we can
check against the filter, so when we do that, go ahead and read the
OCI-format configuration and inspection data as well, and use an image's
creation date as recorded in inspection data everywhere.

Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
2017-07-28 16:58:12 -04:00
Ryan Cole
2cb57e0cb5 Switch kpod save to use config
Signed-off-by: Ryan Cole <rcyoalne@gmail.com>
2017-07-28 15:51:11 -04:00
Mrunal Patel
d2a82a28c1 Merge pull request #678 from umohnani8/kpod_save
Add 'kpod save' command
2017-07-28 10:49:49 -07:00
Mrunal Patel
13c874753c Merge pull request #693 from 14rcole/libkpod-config
add basic config struct to libkpod
2017-07-28 06:24:45 -07:00
Ryan Cole
a8b6f2ad8a Update kpod commands to use getConfig()
Make getStore() take a config struct from which it pulls the store
options, then update the kpod commands so that they call getConfig()
and pass the config into getStore()

Signed-off-by: Ryan Cole <rcyoalne@gmail.com>
2017-07-27 15:58:55 -04:00
umohnani8
ff5eda509a Add 'kpod save' command
Signed-off-by: umohnani8 <umohnani@redhat.com>
2017-07-27 13:35:30 -04:00
Mrunal Patel
9dbd60a0df Merge pull request #698 from nalind/kpod-updates
kpod: avoid digging into unpublished formats
2017-07-27 10:20:46 -07:00
Ryan Cole
0c8f106ee8 add basic config struct to libkpod
Signed-off-by: Ryan Cole <rcyoalne@gmail.com>
2017-07-27 11:12:50 -04:00
Nalin Dahyabhai
cb0bb94c68 Avoid parsing image metadata
Avoid parsing metadata that the image library keeps in order to find an
image's top layer and creation date; instead, use the values which the
storage library now makes available, which will be correct once we merge
PR #654 or something like it.

Instead of assuming the last blob which was added for the image was the
manifest, read it directly and compute its digest ourselves.

Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
2017-07-26 16:33:02 -04:00
Mrunal Patel
1f40531dca Make the profile port configurable
Signed-off-by: Mrunal Patel <mpatel@redhat.com>
2017-07-26 10:57:55 -07:00
Nalin Dahyabhai
2e50006f1c Avoid using lower-level storage APIs
Switch from using the lower-level storage APIs (accessing LayerStore,
ImageStore, and ContainerStore types directly) in favor of the
higher-level ones that take care of synchronization and locking for us.

Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
2017-07-25 13:29:49 -04:00
Ryan Cole
18f94f38ba Remove GetImage() and make rmi use more robust FindImage()
Signed-off-by: Ryan Cole <rcyoalne@gmail.com>
2017-07-25 09:02:45 -04:00
Ryan Cole
c1706475c0 move functions supporting rmi command to libkpod/image
Signed-off-by: Ryan Cole <rcyoalne@gmail.com>
2017-07-24 16:17:26 -04:00
Ryan Cole
0f44ff1d3b move functions supporting images command to libkpod/image
Signed-off-by: Ryan Cole <rcyoalne@gmail.com>
2017-07-24 14:35:36 -04:00
Ryan Cole
df7536e3c0 move PushImage and PullImage to libkpod/image
Signed-off-by: Ryan Cole <rcyoalne@gmail.com>
2017-07-24 14:35:36 -04:00
Ryan Cole
14864f820e move code supporting push, pull, and inspect to libkpod and libkpod/image
Signed-off-by: Ryan Cole <rcyoalne@gmail.com>
2017-07-24 14:35:36 -04:00
Ryan Cole
2c1fd1ad3f move container-related functions out of kpod and into libkpod
Signed-off-by: Ryan Cole <rcyoalne@gmail.com>
2017-07-24 14:34:55 -04:00
Ryan Cole
a68a981d0b move image-related functions out of cmd/kpod/common.go and into libkpod/image
Signed-off-by: Ryan Cole <rcyoalne@gmail.com>
2017-07-24 14:34:55 -04:00
Ryan Cole
95e17b4a73 move driver and image metadata to libkpod
Signed-off-by: Ryan Cole <rcyoalne@gmail.com>
2017-07-24 14:34:55 -04:00
Dan Walsh
d76645680f Bump image, storage, and image-spec
Bump containers/image (pulling in its new dependency on ostree-go),
containers/storage, and updated image-spec.

This pulls in the OCI v1.0 specifications and code that allows us to
support 1.0 images.

Signed-off-by: Dan Walsh <dwalsh@redhat.com>
Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
2017-07-24 13:01:54 -04:00
Mrunal Patel
1aa0d5da86 Merge pull request #686 from sak0/dev
crioctl ctr stop: enable timeout input
2017-07-22 13:22:13 -07:00
CuiHaozhi
13fd708f04 crioctl ctr stop: enable timeout input
Signed-off-by: CuiHaozhi <cuihz@wise2c.com>
2017-07-21 09:48:22 -04:00
Ryan Cole
0d4305a261 Implement kpod inspect
kpod inspect allows the user to view low-level information about
containers and images

Signed-off-by: Ryan Cole <rcyoalne@gmail.com>
2017-07-21 08:11:27 -04:00
Ryan Cole
680f7a6106 Add kpod push command
Push an image to a specified location, such as to an atomic registry
or a local directory

Signed-off-by: Ryan Cole <rcyoalne@gmail.com>
2017-07-20 11:12:40 -04:00
Mrunal Patel
a7c1745aa2 Merge pull request #643 from umohnani8/kpod_history
Add 'kpod history' command
2017-07-19 16:15:28 -07:00
umohnani8
ad490708a4 Add 'kpod history' command
Signed-off-by: umohnani8 <umohnani@redhat.com>
2017-07-19 15:11:25 -04:00
CuiHaozhi
8c3950ad6d kpod images --digests output align
Signed-off-by: CuiHaozhi <cuihz@wise2c.com>
2017-07-18 23:07:29 -04:00
ab36ad50be
kpod: info subcommand
Design: The output of the `info` subcommand ought to be directly
consumable in a format like JSON or yaml.
The structure being a map of sorts.

Each subsection of information being an individual cluster under the
top-level, like platform info, debug, storage, etc.

Even if there are errors under the top level key, the value will be a
map with the key of "error" and the value as the message of the
`err.Error()`. In this way, the command always returns usable output.

Ideally there will be a means for anything that can register info to do
so independently from it being in the single info.go, so this approach
is having a typed signature for the function that gives info, but i'm
sure it could be better.

Current iteration of this outputs the following as a limited user:

```yaml
host:
  MemFree: 711307264
  MemTotal: 2096222208
  SwapFree: 2147479552
  SwapTotal: 2147479552
  arch: amd64
  cpus: 1
  os: linux
store:
  error: 'mkdir /var/run/containers/storage: permission denied'

```

and as root (`sudo kpod info -D`):

```yaml
debug:
  compiler: gc
  go version: go1.7.6
  goroutines: 3
host:
  MemFree: 717795328
  MemTotal: 2096222208
  SwapFree: 2147479552
  SwapTotal: 2147479552
  arch: amd64
  cpus: 1
  os: linux
store:
  ContainerStore:
    number: 1
  GraphDriverName: overlay2
  GraphRoot: /var/lib/containers/storage
  ImageStore:
    number: 1
```

And with the `--json --debug` flag:

```json
{
  "debug": {
    "compiler": "gc",
    "go version": "go1.7.6",
    "goroutines": 3
  },
  "host": {
    "MemFree": 709402624,
    "MemTotal": 2096222208,
    "SwapFree": 2147479552,
    "SwapTotal": 2147479552,
    "arch": "amd64",
    "cpus": 1,
    "os": "linux"
  },
  "store": {
    "ContainerStore": {
      "number": 1
    },
    "GraphDriverName": "overlay2",
    "GraphRoot": "/var/lib/containers/storage",
    "ImageStore": {
      "number": 1
    }
  }
}
```

Signed-off-by: Vincent Batts <vbatts@hashbangbash.com>
2017-07-17 14:23:53 -04:00
Daniel J Walsh
0bd5f6cebc Remove kpod launch example code
We now have actual kpod code, so no reason to have a not implemented feature.
Especially when we don't intend to create kpod launch.

Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
2017-07-15 06:54:41 -04:00
Mrunal Patel
7443263bd6 Add config for ImageVolumesBind option
Signed-off-by: Mrunal Patel <mrunalp@gmail.com>
2017-07-14 15:31:50 -07:00
umohnani8
f9b9f92d3f Remove repeated app.Flags in cmd/kpod/main.go
Signed-off-by: umohnani8 <umohnani@redhat.com>
2017-07-12 11:59:45 -04:00
Antonio Murdaca
17584facf0 Merge pull request #641 from mrunalp/pids_limit
Pids limit
2017-07-12 12:39:54 +02:00
Tobias Klauser
822172a892 all: Switch from package syscall to golang.org/x/sys/unix
The syscall package is locked down and the comment in [1] advises to
switch code to use the corresponding package from golang.org/x/sys. Do
so and replace usage of package syscall where possible (leave
syscall.SysProcAttr and syscall.Stat_t).

  [1] https://github.com/golang/go/blob/master/src/syscall/syscall.go#L21-L24

This will also allow to get updates and fixes just by re-vendoring
golang.org/x/sys/unix instead of having to update to a new go version.

Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2017-07-12 08:18:55 +02:00
Mrunal Patel
e49dd34657 Add support for container pids limit
We add a daemon level setting and will add a container
override once it is supported in CRI.

Signed-off-by: Mrunal Patel <mpatel@redhat.com>
2017-07-11 14:59:52 -07:00
Ryan Cole
a040f20a76 Add 'kpod images' and 'kpod rmi' commands
'kpod images' lists all images on a system.  'kpod rmi' removes
one or more images from a system.  The images will not be removed
if they are associated with a running container, unless the -f
option is used

Signed-off-by: Ryan Cole <rcyoalne@gmail.com>
2017-07-11 15:52:57 -04:00
Mrunal Patel
7fb772b7d1 Merge pull request #638 from umohnani8/kpod_pull
Add 'kpod pull' command
2017-07-11 12:23:01 -07:00
Mrunal Patel
d270de78c4 Merge pull request #645 from vbatts/kpod-version-failsafe
kpod: version should not fail
2017-07-11 07:30:15 -07:00
umohnani8
ac9b53266d Add 'kpod pull' command
Signed-off-by: umohnani8 <umohnani@redhat.com>
2017-07-11 09:05:17 -04:00
55d526e213
kpod: version should not fail
even when the variables are not provided at compile, the `kpod version`
command ought not fail.

Signed-off-by: Vincent Batts <vbatts@hashbangbash.com>
2017-07-10 17:02:13 -04:00
Mrunal Patel
dc55fd2f14 config: Add ImageVolumes configuration setting
Signed-off-by: Mrunal Patel <mpatel@redhat.com>
2017-07-10 13:46:14 -07:00
Ryan Cole
b84f064976 Add kpod tag command
Add one or more tags to an image

Signed-off-by: Ryan Cole <rcyoalne@gmail.com>
2017-07-06 10:10:51 -04:00
umohnani8
9595d7900e Add kpod version
Signed-off-by: umohnani8 <umohnani@redhat.com>
2017-06-27 16:48:24 -04:00
Antonio Murdaca
78e2fd3d5e
cmd/crio: fix reading insecure-registry flags
Signed-off-by: Antonio Murdaca <runcom@redhat.com>
2017-06-24 13:16:45 +02:00
Mrunal Patel
b82df188c6 version: Bump up version to 1.0.0-alpha.0
Signed-off-by: Mrunal Patel <mpatel@redhat.com>
2017-06-20 09:48:12 -07:00
Antonio Murdaca
20e11e3b90
cmd: crio: enable remote profiler
This patch also hides the profile under the debug flag as there's
runtime cost to enable the profiler.
This removes the old way of profiling (CPU) as that's not really
needed.

Signed-off-by: Antonio Murdaca <runcom@redhat.com>
2017-06-18 11:42:04 +02:00
Mrunal Patel
bd40bbc30b Add missing error checks and simplify bool check
Signed-off-by: Mrunal Patel <mpatel@redhat.com>
2017-06-16 15:49:16 -07:00
Samuel Ortiz
0e51bbb778 oci: Support mixing trusted and untrusted workloads
Container runtimes provide different levels of isolation, from kernel
namespaces to hardware virtualization. When starting a specific
container, one may want to decide which level of isolation to use
depending on how much we trust the container workload. Fully verified
and signed containers may not need the hardware isolation layer but e.g.
CI jobs pulling packages from many untrusted sources should probably not
run only on a kernel namespace isolation layer.

Here we allow CRI-O users to define a container runtime for trusted
containers and another one for untrusted containers, and also to define
a general, default trust level. This anticipates future kubelet
implementations that would be able to tag containers as trusted or
untrusted. When missing a kubelet hint, containers are trusted by
default.

A container becomes untrusted if we get a hint in that direction from
kubelet or if the default trust level is set to "untrusted" and the
container is not privileged. In both cases CRI-O will try to use the
untrusted container runtime. For any other cases, it will switch to the
trusted one.

Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2017-06-15 10:04:36 +02:00
Andrew Pilloud
c77b5fbea8 Add stream-address and stream-port flags to crio
Signed-off-by: Andrew Pilloud <andrewpilloud@igneoussystems.com>
2017-06-12 16:12:36 -07:00