Commit graph

1086 commits

Author SHA1 Message Date
Pengfei Ni
3195f45904 Merge pull request #367 from sameo/topic/host-privileged-runtime
Support alternate runtime for host privileged operations
2017-03-05 07:53:20 +08:00
Antonio Murdaca
4589048b18 Merge pull request #384 from mrunalp/fix_cgroup_parent
Fix cgroup parent
2017-03-04 10:20:29 +01:00
Mrunal Patel
38f497a701 Fix cgroup parent
We were using a variable before it was set.

Signed-off-by: Mrunal Patel <mrunalp@gmail.com>
2017-03-03 16:38:46 -08:00
Antonio Murdaca
0b6afbd78a Merge pull request #378 from mrunalp/add_scope_run
util: Add function to run in scope
2017-03-04 00:44:35 +01:00
Mrunal Patel
91ed3d4fbf Add a utility to run a pid in a systemd scope
Signed-off-by: Mrunal Patel <mrunalp@gmail.com>
2017-03-03 15:02:14 -08:00
Samuel Ortiz
f7eee71792 server: Reduce createSandboxContainer complexity
By factorizing the bind mounts generation code.

Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2017-03-03 19:06:29 +01:00
Samuel Ortiz
2ec696be41 server: Set sandbox and container privileged flags
The sandbox privileged flag is set to true only if either the
pod configuration privileged flag is set to true or when any
of the pod namespaces are the host ones.

A container inherit its privileged flag from its sandbox, and
will be run by the privileged runtime only if it's set to true.
In other words, the privileged runtime (when defined) will be
when one of the below conditions is true:

- The sandbox will be asked to run at least one privileged container.
- The sandbox requires access to either the host IPC or networking
  namespaces.

Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2017-03-03 19:06:04 +01:00
Samuel Ortiz
eab6b00ea6 oci: Support for the host privileged runtime path
We add a privileged flag to the container and sandbox structures
and can now select the appropriate runtime path for any container
operations depending on that flag.

Here again, the default runtime will be used for non privileged
containers and for privileged ones in case there are no privileged
runtime defined.

Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2017-03-03 17:22:09 +01:00
Samuel Ortiz
2fc4d0cac1 config: Add host privileged runtime configuration
Not all runtimes are able to handle some of the kubelet
security context options, in particular the ones granting
host privileges to containers.

By adding a host privileged runtime path configuration, we
allow ocid to use a different runtime for host privileged
operations like e.g. host namespaces access.

Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2017-03-03 17:22:09 +01:00
Mrunal Patel
b872bc2fde Merge pull request #380 from feiskyer/fix-make
Fix make
2017-03-02 08:07:06 -08:00
Antonio Murdaca
ce883cf741 Merge pull request #379 from mrunalp/fix_logo
Use png for logo as github doesn't display the svg
2017-03-02 16:34:22 +01:00
Mrunal Patel
ad90b3c23c Use rawgit CDN for logo to make SVG render correctly
Signed-off-by: Mrunal Patel <mrunalp@gmail.com>
2017-03-02 07:27:30 -08:00
Pengfei Ni
a1cfb250e1 Add make to traivs
Signed-off-by: Pengfei Ni <feiskyer@gmail.com>
2017-03-02 14:13:03 +08:00
Pengfei Ni
25cc9e9810 Fix make
Signed-off-by: Pengfei Ni <feiskyer@gmail.com>
2017-03-02 12:37:45 +08:00
Mrunal Patel
69ed8639cd Update dependencies to include github.com/godbus/dbus
Signed-off-by: Mrunal Patel <mrunalp@gmail.com>
2017-03-01 16:49:45 -08:00
Mrunal Patel
e4adfcc11a Merge pull request #376 from mairin/master
#370 - adding a logo for cri-o
2017-03-01 11:55:33 -08:00
Máirín Duffy
8c85795740 Adding new logo to README.md
Issue: 370
Signed-off-by: Máirín Duffy <duffy@redhat.com>
2017-03-01 13:54:32 -05:00
Máirín Duffy
127f123734 Adding cri-o logo artwork
Note that crio-logo-source is the full Inkscape SVG source and crio-logo.svg
is an SVGO-optimized version of just the white bg version of the logo.

Issue: #370
Signed-off-by: Máirín Duffy <duffy@redhat.com>
2017-03-01 13:34:30 -05:00
Antonio Murdaca
3a9e7036a1 Merge pull request #374 from vbmade2000/pkg-config-correction
Correct package name for pkg-config
2017-02-27 12:24:49 +01:00
Malhar Vora
54c4bc2bd2 Correct package name for pkg-config
Signed-off-by: Malhar Vora  <mlvora.2010@gmail.com>
2017-02-27 16:03:20 +05:30
Mrunal Patel
ecb7718ae9 Merge pull request #373 from rhatdan/storage-opt
Depracate --storage-option for --storage-opt
2017-02-25 20:56:29 -08:00
Daniel J Walsh
cf5b0ae57f Deprecate --storage-option for --storage-opt
container-storage-setup (Formerly docker-storage-setup) is being converted to
run with container runtimes outside of docker.  Specifically we want to use it
with CRI-O/ocid.  It does not know anything about the container runtimes it
is generating options for, so it generates them based on the storage CLI of
docker.  I see no reason to have the storage option for ocid to be different
and we can just depracate the option for now.

Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
2017-02-25 09:09:50 -05:00
Pengfei Ni
3690f4c971 Merge pull request #371 from apilloud/canonical_import
Use canonical import path for apimachinery
2017-02-23 15:54:56 +08:00
Andrew Pilloud
5f63cdcf89 Use canonical import path for apimachinery
Signed-off-by: Andrew Pilloud <andrewpilloud@igneoussystems.com>
2017-02-22 18:32:42 -08:00
Mrunal Patel
860c5419fd Merge pull request #368 from apilloud/no_seccomp
Run without seccomp
2017-02-22 12:01:17 -08:00
Andrew Pilloud
4ce17f893a Change bool style
Signed-off-by: Andrew Pilloud <andrewpilloud@igneoussystems.com>
2017-02-22 10:27:35 -08:00
Andrew Pilloud
2bb4191047 Move seccomp enabled check into seccomp package
Signed-off-by: Andrew Pilloud <andrewpilloud@igneoussystems.com>
2017-02-22 09:32:12 -08:00
Andrew Pilloud
44e7e88ff3 Run without seccomp support
Signed-off-by: Andrew Pilloud <andrewpilloud@igneoussystems.com>
2017-02-21 16:47:03 -08:00
Mrunal Patel
424fc8d0d6 Merge pull request #366 from apilloud/fix_ignore
Make ignore patterns absolute
2017-02-21 13:22:15 -08:00
Andrew Pilloud
0fb74ae661 sort .gitignore
Signed-off-by: Andrew Pilloud <andrewpilloud@igneoussystems.com>
2017-02-21 11:49:28 -08:00
Andrew Pilloud
f74145cc4c Make ignore paths absolute
Signed-off-by: Andrew Pilloud <andrewpilloud@igneoussystems.com>
2017-02-21 11:49:21 -08:00
Aleksa Sarai
7d56dae492
merge branch 'pr-364'
Closes #364
LGTMs: @cyphar @mikebrow
2017-02-21 08:28:21 +11:00
Antonio Murdaca
b041c716e7
.travis.yml: add go1.8
Signed-off-by: Antonio Murdaca <runcom@redhat.com>
2017-02-20 18:32:21 +01:00
Mrunal Patel
48426e3ebc Merge pull request #336 from cyphar/revert-goinstall-build
make: revert switch to 'go install'
2017-02-16 09:35:39 -08:00
Aleksa Sarai
0d7147ff5c
make: revert switch to 'go install'
go install acts incredibly weirdly and rarely does what you want, not to
mention that it's just bad for distribution build setups. Switch back to
go build, which works properly and doesn't have half as many issues.

Fixes: 6c9628cdb1 ("Build and install from GOPATH")
Signed-off-by: Aleksa Sarai <asarai@suse.de>
2017-02-17 03:22:12 +11:00
Mrunal Patel
6d76ea2fa1 Merge pull request #363 from jawnsy/travis-notifications
Travis CI notifications to Freenode #ocid
2017-02-14 09:13:40 -08:00
Jonathan Yu
3560be5d4d Travis CI notifications to Freenode #ocid
Signed-off-by: Jonathan Yu <jawnsy@redhat.com>
2017-02-13 21:14:09 -08:00
Antonio Murdaca
0639f06d03 Merge pull request #362 from nalind/nameasdigest
Don't try to parse an image ID a second time
2017-02-08 17:36:29 +01:00
Nalin Dahyabhai
3eca785331 Don't try to parse an image ID a second time
When looking for the image to use for creating a container, there's no
need to attempt parsing the ID a second time, and doing so can create
confusing error messages.

Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
2017-02-08 10:58:00 -05:00
Mrunal Patel
6bd7c53568 Merge pull request #360 from runcom/bump-runc
bump runc@b263a43430ac6996a4302b891688544225197294
2017-02-07 15:06:39 -08:00
Antonio Murdaca
c258a2d8f0
bump runc@b263a43430ac6996a4302b891688544225197294
Signed-off-by: Antonio Murdaca <runcom@redhat.com>
2017-02-07 10:57:46 +01:00
Mrunal Patel
65fc398da1 Merge pull request #342 from intelsdi-x/bump_vendors
Applying k8s kubelet v3 api to cri-o server
2017-02-06 15:18:00 -08:00
Michał Żyłowski
5c81217e09 Applying k8s.io v3 API for ocic and ocid
Signed-off-by: Michał Żyłowski <michal.zylowski@intel.com>
2017-02-06 13:05:10 +01:00
Mrunal Patel
73a0881dbb Merge pull request #353 from intelsdi-x/kubernetes_instruction
doc: Add instruction to run cri-o with kubernetes
2017-02-04 08:27:51 -08:00
Antonio Murdaca
9d085aef0a Merge pull request #356 from nalind/helpers
Minor tweaks to test helpers
2017-02-04 15:18:27 +01:00
Aleksa Sarai
3b1b862d06
merge branch 'pr-358'
Closes #358
LGTMs: @cyphar
2017-02-05 01:07:56 +11:00
Lorenzo Fontana
57971c5409
Specify glibc-static as build requirement, fixes #357
Signed-off-by: Lorenzo Fontana <fontanalorenz@gmail.com>
2017-02-04 02:21:10 +01:00
Antonio Murdaca
f5e5a4b848 Merge pull request #355 from mrunalp/update_image_lib
dep: Update containers/image to 1c202c5d85d2ee531acb1e91740144410066d19e
2017-02-03 23:34:23 +01:00
Nalin Dahyabhai
ff5c485e7f Make sure we don't read a host ocid.conf in tests
When generating an ocid.conf for use when running tests, make sure we
don't pick up any defaults from an installed copy of ocid by forcing our
copy to read /dev/null as its configuration file.

Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
2017-02-03 17:19:29 -05:00
Nalin Dahyabhai
5a89d5381d Wait when restarting ocid during tests
When we restart ocid as part of a test, wait for the daemon to exit when
we send it a SIGTERM, just as we do when we try to stop it for good.

Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
2017-02-03 17:18:26 -05:00