vbatts/pkg
1
0
Fork 0
Code Pull requests Releases Activity

Export more functions from libcontainer

Browse source 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
This commit is contained in:
Michael Crosby 2014-04-30 17:18:07 -07:00
parent aecfa0d890
commit 2db754f3ee
5 changed files with 26 additions and 22 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

16
libcontainer/nsinit/command.go
View file

@ -1,10 +1,11 @@
package nsinit package nsinit
import ( import (
"github.com/dotcloud/docker/pkg/libcontainer"
"github.com/dotcloud/docker/pkg/system"
"os" "os"
"os/exec" "os/exec"
"github.com/dotcloud/docker/pkg/libcontainer"
"github.com/dotcloud/docker/pkg/system"
) )
// CommandFactory takes the container's configuration and options passed by the // CommandFactory takes the container's configuration and options passed by the
@ -34,14 +35,3 @@ func (c *DefaultCommandFactory) Create(container *libcontainer.Container, consol
command.ExtraFiles = []*os.File{pipe} command.ExtraFiles = []*os.File{pipe}
return command return command
} }
// GetNamespaceFlags parses the container's Namespaces options to set the correct
// flags on clone, unshare, and setns
func GetNamespaceFlags(namespaces libcontainer.Namespaces) (flag int) {
for _, ns := range namespaces {
if ns.Enabled {
flag |= ns.Value
}
}
return flag
}

11
libcontainer/nsinit/exec.go
View file

@ -142,3 +142,14 @@ func DeletePid(path string) error {
} }
return err return err
} }
// GetNamespaceFlags parses the container's Namespaces options to set the correct
// flags on clone, unshare, and setns
func GetNamespaceFlags(namespaces libcontainer.Namespaces) (flag int) {
for _, ns := range namespaces {
if ns.Enabled {
flag |= ns.Value
}
}
return flag
}

2
libcontainer/nsinit/execin.go
View file

@ -82,7 +82,7 @@ func (ns *linuxNs) ExecIn(container *libcontainer.Container, nspid int, args []s
os.Exit(state.Sys().(syscall.WaitStatus).ExitStatus()) os.Exit(state.Sys().(syscall.WaitStatus).ExitStatus())
} }
dropAndExec: dropAndExec:
if err := finalizeNamespace(container); err != nil { if err := FinalizeNamespace(container); err != nil {
return -1, err return -1, err
} }
err = label.SetProcessLabel(processLabel) err = label.SetProcessLabel(processLabel)

15
libcontainer/nsinit/init.go
View file

@ -54,23 +54,22 @@ func (ns *linuxNs) Init(container *libcontainer.Container, uncleanRootfs, consol
} }
label.Init() label.Init()
if err := mount.InitializeMountNamespace(rootfs, consolePath, container); err != nil { if err := mount.InitializeMountNamespace(rootfs, consolePath, container); err != nil {
return fmt.Errorf("setup mount namespace %s", err) return fmt.Errorf("setup mount namespace %s", err)
} }
if err := system.Sethostname(container.Hostname); err != nil { if err := system.Sethostname(container.Hostname); err != nil {
return fmt.Errorf("sethostname %s", err) return fmt.Errorf("sethostname %s", err)
} }
if err := finalizeNamespace(container); err != nil { if err := FinalizeNamespace(container); err != nil {
return fmt.Errorf("finalize namespace %s", err) return fmt.Errorf("finalize namespace %s", err)
} }
if profile := container.Context["apparmor_profile"]; profile != "" {
if err := apparmor.ApplyProfile(os.Getpid(), profile); err != nil {
return err
}
}
runtime.LockOSThread() runtime.LockOSThread()
if err := apparmor.ApplyProfile(os.Getpid(), container.Context["apparmor_profile"]); err != nil {
return err
}
if err := label.SetProcessLabel(container.Context["process_label"]); err != nil { if err := label.SetProcessLabel(container.Context["process_label"]); err != nil {
return fmt.Errorf("set process label %s", err) return fmt.Errorf("set process label %s", err)
} }
@ -113,10 +112,10 @@ func setupNetwork(container *libcontainer.Container, context libcontainer.Contex
return nil return nil
} }
// finalizeNamespace drops the caps, sets the correct user // FinalizeNamespace drops the caps, sets the correct user
// and working dir, and closes any leaky file descriptors // and working dir, and closes any leaky file descriptors
// before execing the command inside the namespace // before execing the command inside the namespace
func finalizeNamespace(container *libcontainer.Container) error { func FinalizeNamespace(container *libcontainer.Container) error {
if err := capabilities.DropCapabilities(container); err != nil { if err := capabilities.DropCapabilities(container); err != nil {
return fmt.Errorf("drop capabilities %s", err) return fmt.Errorf("drop capabilities %s", err)
} }

4
libcontainer/nsinit/unsupported.go
View file

@ -17,3 +17,7 @@ func (ns *linuxNs) ExecIn(container *libcontainer.Container, nspid int, args []s
func (ns *linuxNs) Init(container *libcontainer.Container, uncleanRootfs, console string, syncPipe *SyncPipe, args []string) error { func (ns *linuxNs) Init(container *libcontainer.Container, uncleanRootfs, console string, syncPipe *SyncPipe, args []string) error {
return libcontainer.ErrUnsupported return libcontainer.ErrUnsupported
} }
func GetNamespaceFlags(namespaces libcontainer.Namespaces) (flag int) {
return 0
}