Commit graph

869 commits

Author SHA1 Message Date
Michael Crosby
4a0d1718ee Merge pull request #6018 from vishh/stats_strongtype
Strong type all stats exported by libcontainer
2014-05-23 14:35:14 -07:00
Michael Crosby
1c07f75e6f Add check for iptables xlock support
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-05-23 14:18:50 -07:00
Vishnu Kannan
c5be84cd2d Added stats.go which provides strong types for all stats that will be exported by libcontainer. This commit only introduces the strong type.
Docker-DCO-1.1-Signed-off-by: Vishnu Kannan <vishnuk@google.com> (github: vishh)
2014-05-23 20:42:43 +00:00
Michael Crosby
cc706701b0 Add wait flag to iptables
Fixes #1573
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-05-23 01:24:58 +00:00
Michael Crosby
b98c3f7fb4 Merge pull request #5995 from vieux/recur_nodes
Add device nodes recursively
2014-05-22 16:35:27 -07:00
Victor Vieux
4b1df3687b update test
Docker-DCO-1.1-Signed-off-by: Victor Vieux <vieux@docker.com> (github: vieux)
2014-05-22 22:50:41 +00:00
Victor Vieux
bf21f0d493 add recursive device nodes
Docker-DCO-1.1-Signed-off-by: Victor Vieux <vieux@docker.com> (github: vieux)
2014-05-22 22:29:13 +00:00
Victor Marmol
c88ecf6acd Make all cgroup stats output int64s instead of float64.
Docker-DCO-1.1-Signed-off-by: Victor Marmol <vmarmol@google.com> (github: vmarmol)
2014-05-22 20:53:36 +00:00
Victor Vieux
89b64d33ee Merge pull request #5976 from crosbymichael/getpids
Move get pid into cgroup implementation
2014-05-21 19:09:50 -07:00
Victor Vieux
a0841ff1eb Merge pull request #5922 from crosbymichael/host-dev-priv
Mount /dev in tmpfs for privileged containers
2014-05-21 18:56:24 -07:00
Michael Crosby
c6c0dc2ebb Move get pid into cgroup implementation
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-05-21 21:14:07 +00:00
Tianon Gravi
c3c5ddfc50 Revert "Always mount a /run tmpfs in the container"
This reverts commit 905795ece624675abe2ec2622b0bbafdb9d7f44c.

Docker-DCO-1.1-Signed-off-by: Andrew Page <admwiggin@gmail.com> (github: tianon)
2014-05-21 14:28:19 -06:00
Michael Crosby
3d95e5cf7b Update code post codereview
Add specific types for Required and Optional DeviceNodes
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-05-21 00:40:41 +00:00
Michael Crosby
7fb3f86fec Update documentation for container struct in libcontainer
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-05-20 23:34:46 +00:00
Michael Crosby
d48b2cf390 Mount /dev in tmpfs for privileged containers
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-05-20 22:51:24 +00:00
Alexander Larsson
0f44c2849c cgroups: Allow mknod for any device in systemd cgroup backend
Without this any container startup fails:
2014/05/20 09:20:36 setup mount namespace copy additional dev nodes mknod fuse operation not permitted

Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
2014-05-20 09:29:32 +02:00
Michael Crosby
f06ca4fdd2 Make sure dev/fuse is created in container
Fixes #5849

If the host system does not have fuse enabled in the kernel config we
will ignore the is not exist errors when trying to copy the device node
from the host system into the container.
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-05-19 20:46:59 +00:00
Victor Marmol
c6e60b57a2 Merge pull request #5903 from alexlarsson/writable-proc
Make /proc writable, but not /proc/sys and /proc/sysrq-trigger
2014-05-19 12:21:15 -07:00
Alexander Larsson
6b97c80b4d Make /proc writable, but not /proc/sys and /proc/sysrq-trigger
Some applications want to write to /proc. For instance:

docker run -it centos groupadd foo

Gives: groupadd: failure while writing changes to /etc/group

And strace reveals why:

open("/proc/self/task/13/attr/fscreate", O_RDWR) = -1 EROFS (Read-only file system)

I've looked at what other systems do, and systemd-nspawn makes /proc read-write
and /proc/sys readonly, while lxc allows "proc:mixed" which does the same,
plus it makes /proc/sysrq-trigger also readonly.

The later seems like a prudent idea, so we follows lxc proc:mixed.
Additionally we make /proc/irq and /proc/bus, as these seem to let
you control various hardware things.

Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
2014-05-19 20:46:05 +02:00
Victor Marmol
c3b01dfb59 Merge pull request #5792 from bernerdschaefer/nsinit-supports-pdeathsig
Add PDEATHSIG support to nsinit library
2014-05-19 11:13:23 -07:00
Michael Crosby
9e23d99fa2 Merge pull request #5865 from crosbymichael/add-all-caps
Add the rest of the caps so that they are retained in privilged mode
2014-05-19 09:56:55 -07:00
Michael Crosby
3e097e5052 Add the rest of the caps so that they are retained in privilged mode
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-05-19 16:43:31 +00:00
Alexandr Morozov
b089773388 Check uid ranges
Fixes #5647
Docker-DCO-1.1-Signed-off-by: Alexandr Morozov <lk4d4math@gmail.com> (github: LK4D4)
2014-05-18 20:49:08 +04:00
Victor Vieux
58ba10aa54 add support for CAP_FOWNER
Docker-DCO-1.1-Signed-off-by: Victor Vieux <vieux@docker.com> (github: vieux)
2014-05-17 01:16:07 +00:00
Victor Marmol
73f678f6f8 Make libcontainer's CapabilitiesMask into a []string (Capabilities).
Docker-DCO-1.1-Signed-off-by: Victor Marmol <vmarmol@google.com> (github: vmarmol)
2014-05-17 00:44:10 +00:00
Michael Crosby
724c84c6fc Merge pull request #5833 from ActiveState/fix_nsinit_env_panic
fix panic when passing empty environment
2014-05-16 12:03:26 -07:00
Sridhar Ratnakumar
18a7cee3c7 fix panic when passing empty environment
Docker-DCO-1.1-Signed-off-by: Sridhar Ratnakumar <github@srid.name> (github: srid)
2014-05-16 11:55:34 -07:00
Victor Marmol
fa7e4d6946 Merge pull request #5810 from vmarmol/drop-caps
Change libcontainer to drop all capabilities by default.
2014-05-16 11:51:41 -07:00
Bernerd Schaefer
2732a59592 nsinit.DefaultCreateCommand sets Pdeathsig to SIGKILL
Docker-DCO-1.1-Signed-off-by: Bernerd Schaefer <bj.schaefer@gmail.com> (github: bernerdschaefer)
2014-05-16 13:48:41 +02:00
Bernerd Schaefer
f6ddb6051c nsinit.Init() restores parent death signal before exec
Docker-DCO-1.1-Signed-off-by: Bernerd Schaefer <bj.schaefer@gmail.com> (github: bernerdschaefer)
2014-05-16 13:48:41 +02:00
Victor Marmol
3a423f3e4e Change libcontainer to drop all capabilities by default. Only keeps
those that were specified in the config. This commit also explicitly
adds a set of capabilities that we were silently not dropping and were
assumed by the tests.

Docker-DCO-1.1-Signed-off-by: Victor Marmol <vmarmol@google.com> (github: vmarmol)
2014-05-16 00:57:58 +00:00
lalyos
0b1aab5435 Fixes 5370 infinite/maxLoopCount loop for relative symlinks
use path.IsAbs() instead of checking if first char is '/'

Docker-DCO-1.1-Signed-off-by: Lajos Papp <lajos.papp@sequenceiq.com> (github: lalyos)
2014-05-16 01:03:11 +02:00
lalyos
02b08b3961 Defend against infinite loop when following symlinks
ideally it should never reach it, but there was already multiple issues with infinite loop
at following symlinks. this fixes hanging unit tests

Docker-DCO-1.1-Signed-off-by: Lajos Papp <lajos.papp@sequenceiq.com> (github: lalyos)
2014-05-16 00:47:20 +02:00
lalyos
64b6d99e35 Adding test case for symlink causes infinit loop, reproduces: dotcloud#5370
normally symlinks are created as either
ln -s /path/existing /path/new-name
or
cd /path && ln -s ./existing new-name

but one can create it this way
cd /path && ln -s existing new-name

this drives FollowSymlinkInScope into infinite loop

Docker-DCO-1.1-Signed-off-by: Lajos Papp <lajos.papp@sequenceiq.com> (github: lalyos)
2014-05-16 00:47:20 +02:00
Bernerd Schaefer
bb9eabf1ef Add GetParentDeathSignal() to pkg/system
Docker-DCO-1.1-Signed-off-by: Bernerd Schaefer <bj.schaefer@gmail.com> (github: bernerdschaefer)
2014-05-15 10:17:44 +02:00
Michael Crosby
9b677d0733 Remove the cgroups maintainer file
We don't need this because it is covered by the libcontainer MAINTAINERS
file
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-05-14 16:01:45 -07:00
Michael Crosby
b30f280d2f Move cgroups package into libcontainer
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-05-14 15:21:44 -07:00
Bernerd Schaefer
9133caa6d3 Setup standard /dev symlinks
After copying allowed device nodes, set up "/dev/fd", "/dev/stdin",
"/dev/stdout", and "/dev/stderr" symlinks.

Docker-DCO-1.1-Signed-off-by: Bernerd Schaefer <bj.schaefer@gmail.com> (github: bernerdschaefer)
[rebased by @crosbymichael]
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-05-14 13:59:13 -07:00
Guillaume J. Charmes
ceedff720e Merge pull request #5783 from LK4D4/fix_duplicate_ip_allocation_#5729
Fix duplicate ip allocation
2014-05-14 13:32:27 -07:00
Victor Vieux
05878da301 Merge pull request #5756 from crosbymichael/move-units-to-pkg
Move duration and size to units pkg
2014-05-14 11:36:14 -07:00
Michael Crosby
9e48ca7b79 Merge pull request #5791 from bernerdschaefer/nsinit-exec-forwards-signals
"nsinit exec ..." forwards signals to container
2014-05-14 11:05:27 -07:00
Victor Vieux
ffcd37b861 Merge pull request #5781 from creack/remove_bind_console
Remove the bind mount for dev/console which override the mknod/label
2014-05-14 10:57:21 -07:00
Bernerd Schaefer
31c9adba67 "nsinit exec ..." forwards signals to container
Docker-DCO-1.1-Signed-off-by: Bernerd Schaefer <bj.schaefer@gmail.com> (github: bernerdschaefer)
2014-05-14 11:01:02 +02:00
Alexandr Morozov
a42b2abb10 Refactoring collections/orderedintset and benchmarks for it
Docker-DCO-1.1-Signed-off-by: Alexandr Morozov <lk4d4math@gmail.com> (github: LK4D4)
2014-05-14 06:04:12 +04:00
Michael Crosby
1cc1c05a55 Copy parents cpus and mems for cpuset
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-05-13 18:01:31 -07:00
Guillaume J. Charmes
fd5a5dc56f Remove the bind mount for dev/console which override the mknod/label
Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume@charmes.net> (github: creack)
2014-05-13 11:59:27 -07:00
Michael Crosby
04ec76023a Add MAINTAINERS file to symlink pkg
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-05-13 11:27:24 -07:00
Michael Crosby
f2bd8e8486 Update code to handle new path to Follow Symlink func
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-05-13 10:54:08 -07:00
Michael Crosby
e8a8022ba3 Move Follow symlink to pkg
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-05-13 10:35:57 -07:00
Alexander Larsson
4086e37e27 libcontainer: Ensure bind mount target files are inside rootfs
Before we create any files to bind-mount on, make sure they are
inside the container rootfs, handling for instance absolute symbolic
links inside the container.

Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
2014-05-13 10:24:52 -07:00