Commit graph

241 commits

Author SHA1 Message Date
Alexander Larsson
eebaba3215 Move all bind-mounts in the container inside the namespace
This moves the bind mounts like /.dockerinit, /etc/hostname, volumes,
etc into the container namespace, by setting them up using lxc.

This is useful to avoid littering the global namespace with a lot of
mounts that are internal to each container and are not generally
needed on the outside. In particular, it seems that having a lot of
mounts is problematic wrt scaling to a lot of containers on systems
where the root filesystem is mounted --rshared.

Note that the "private" option is only supported by the native driver, as
lxc doesn't support setting this. This is not a huge problem, but it does
mean that some mounts are unnecessarily shared inside the container if you're
using the lxc driver.

Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
2014-03-13 20:01:29 +01:00
Guillaume J. Charmes
3e89864534 Fix issue when /etc/apparmor.d does not exists
Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume@charmes.net> (github: creack)
2014-03-12 11:13:24 -07:00
Guillaume J. Charmes
02be9306bc Update email + add self to pkg/signal
Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume@charmes.net> (github: creack)
2014-03-10 20:26:45 -07:00
srid
115f88b346 nsinit: prefix errors with their source
Docker-DCO-1.1-Signed-off-by: Sridhar Ratnakumar <github@srid.name> (github: srid)
2014-03-10 17:08:50 -07:00
Michael Crosby
da605a43d6 Add env var to toggle pivot root or ms_move
Use the  DOCKER_RAMDISK env var to tell the native driver not to use
a pivot root when setting up the rootfs of a container.
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-03-06 19:30:52 -08:00
Michael Crosby
ca93316795 Revert "Revert "libcontainer: Use pivot_root instead of chroot""
This reverts commit 82f797f14096430c3edbace1cd30e04a483ec41f.

Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-03-06 17:19:59 -08:00
Michael Crosby
57e7760c26 Revert "Revert "libcontainer: Use MS_PRIVATE instead of MS_SLAVE""
This reverts commit bd263f5b15b51747e3429179fef7fcb425ccbe4a.

Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-03-06 17:19:47 -08:00
unclejack
0718fb409c Merge pull request #4512 from crosbymichael/no-pivot-root
No pivot root because of ramdisk
2014-03-07 02:54:03 +02:00
Michael Crosby
31c7d13466 Revert "libcontainer: Use MS_PRIVATE instead of MS_SLAVE"
This reverts commit 757b5775725fb90262cee1fa6068fa9dcbbff59f.

Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-03-06 16:41:03 -08:00
Michael Crosby
abd1f8da60 Revert "libcontainer: Use pivot_root instead of chroot"
This reverts commit 5b5c884cc8266d0c2a56da0bc2df14cc9d5d85e8.

Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-03-06 16:32:06 -08:00
Michael Crosby
fd8470acba Ensure that native containers die with the parent
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-03-06 16:30:56 -08:00
Michael Crosby
c0d5c529bb Remove the ghosts and kill everything
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-03-06 15:30:26 -08:00
Guillaume J. Charmes
f9bd82dd75 Merge pull request #4506 from creack/fix_apparmor
Use CGO for apparmor profile switch
2014-03-06 13:37:34 -08:00
Tianon Gravi
5c13d61425 Update build tags such that we can properly compile on all platforms (especially for packagers), and updated hack/PACKAGERS.md to mention the DOCKER_BUILDTAGS variable that will need to be set for binaries that might be used on AppArmor (such as Debian and especially Ubuntu)
Docker-DCO-1.1-Signed-off-by: Andrew Page <admwiggin@gmail.com> (github: tianon)
2014-03-06 13:39:17 -07:00
Guillaume J. Charmes
729080d46a Add buildflags to allow crosscompilation for apparmor
Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume.charmes@docker.com> (github: creack)
2014-03-06 12:05:03 -08:00
Guillaume J. Charmes
6fcfe645f8 Merge pull request #4503 from unclejack/attempt_to_fix_apparmor_profile
remove dbus from apparmor profile for Ubuntu 12.04
2014-03-06 11:20:06 -08:00
Guillaume J. Charmes
0ecd2aa284 Use CGO for apparmor profile switch
Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume.charmes@docker.com> (github: creack)
2014-03-06 11:10:58 -08:00
unclejack
b359efd9ec remove dbus from apparmor profile
This removes the dbus entry from the apparmor profile Docker creates.

Docker-DCO-1.1-Signed-off-by: Cristian Staretu <cristian.staretu@gmail.com> (github: unclejack)
2014-03-06 19:47:03 +02:00
Alexander Larsson
0caa2d3992 libcontainer: Don't use UsetCloseOnExec, it is racy
We can't keep file descriptors without close-on-exec except with
syscall.ForkLock held, as otherwise they could leak by accident into
other children from forks in other threads.

Instead we just use Cmd.ExtraFiles which handles all this for us.

This fixes https://github.com/dotcloud/docker/issues/4493

Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
2014-03-06 14:10:32 +01:00
Guillaume J. Charmes
d3bbd78cc5 Generate and load custom docker profile for apparmor
Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume.charmes@docker.com> (github: creack)
2014-03-05 15:02:11 -08:00
Michael Crosby
0eb4ea2f79 Some cleanup around logs
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-03-05 13:50:49 -08:00
Guillaume J. Charmes
73233223de Add AppArmor support to native driver + change pipe/dup logic
Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume.charmes@docker.com> (github: creack)
2014-03-05 13:08:24 -08:00
Alexander Larsson
88aed3bf92 libcontainer: Use MS_PRIVATE instead of MS_SLAVE
Now that we unmount all the mounts from the global namespace we can
use a private namespace rather than a slave one (as we have no need
for unmounts of inherited global mounts to propagate into the
container).

Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
2014-03-05 09:40:54 +01:00
Michael Crosby
2bddb20b91 Add shm size cap to mount
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-03-04 14:18:40 -08:00
Guillaume J. Charmes
9a5dead3c9 Remove /dev tmpfs mountpoint
Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume.charmes@docker.com> (github: creack)
2014-03-04 13:21:22 -08:00
Guillaume J. Charmes
91d13e5fa1 remove /run mountpoint
Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume.charmes@docker.com> (github: creack)
2014-03-04 12:32:17 -08:00
Guillaume J. Charmes
a8b87a47b6 Remove loopback mount bind
Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume.charmes@docker.com> (github: creack)
2014-03-04 12:30:52 -08:00
Michael Crosby
4f641377e0 Merge pull request #4452 from crosbymichael/small-fixes-to-libcontainer
Add find tests and remove panic in DEBUG
2014-03-04 14:37:41 -05:00
Michael Crosby
bd2d7a377c Add find tests and remove panic in DEBUG
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-03-04 08:55:12 -08:00
Alexander Larsson
83de20deb7 libcontainer: Use pivot_root instead of chroot
Instead of keeping all the old mounts in the container namespace and
just using subtree as root we pivot_root so that the actual root in
the namespace is the root we want, and then we unmount the previous
mounts.

This has multiple advantages:

* The namespace mount tree is smaller (in the kernel)
* If you break out of the chroot you could previously access the host
  filesystem. Now the host filesystem is fully invisible to the namespace.
* We get rid of all unrelated mounts from the parent namespace, which means
  we don't hog these. This is important if we later switch to MS_PRIVATE instead
  of MS_SLAVE as otherwise these mounts would be impossible to unmount from the
  parent namespace.

Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
2014-03-04 12:44:08 +01:00
Sven Dowideit
313d6a9e13 very minor spelling
Docker-DCO-1.1-Signed-off-by: Sven Dowideit <SvenDowideit@home.org.au> (github: SvenDowideit)
2014-03-04 10:12:12 +10:00
Michael Crosby
7dc071dca5 Factor out finalize namespace
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-03-03 12:15:47 -08:00
Michael Crosby
ab952e2502 Update readme to remove .nspid
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-03-03 11:31:37 -08:00
Michael Crosby
85696fdb67 Allow child process to live if daemon dies
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-02-27 09:33:36 -08:00
Michael Crosby
34301be200 Code review updates
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-02-26 19:21:46 -08:00
Michael Crosby
f8262b5748 Ensure that loopback devices are mounted inside the conatiner
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-02-26 17:21:09 -08:00
Michael Crosby
4f6cdc6f08 Make network a slice to support multiple types
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-02-26 14:20:41 -08:00
Michael Crosby
f85823b53d Fix cross compile for make cross
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-02-25 15:19:13 -08:00
Michael Crosby
2acaf7ca82 Move container.json and pid file into a root specific driver dir
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-02-25 12:41:31 -08:00
Guillaume J. Charmes
357ca32831 Better capability/namespace management
Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume.charmes@docker.com> (github: creack)
2014-02-24 21:52:29 -08:00
Michael Crosby
6daf56799f Refactor and improve libcontainer and driver
Remove logging for now because it is complicating things
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-02-24 21:11:52 -08:00
Michael Crosby
0e4d946dc4 Improve logging for nsinit
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-02-24 18:38:36 -08:00
Michael Crosby
c8ad8184ec Cgroups allow devices for privileged containers
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-02-24 15:47:23 -08:00
Michael Crosby
d50dc3cb7e Honor user passed on container in nsinit
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-02-24 13:52:56 -08:00
Michael Crosby
b899d9bc44 Fix tests with dockerinit lookup path
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-02-24 13:40:17 -08:00
Michael Crosby
a42c6fafbe Refactor driver to use Exec function from nsini
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-02-22 01:21:26 -08:00
Michael Crosby
1271ddcd61 Abstract out diff implementations for importing
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-02-22 00:29:21 -08:00
Michael Crosby
118ca3ae64 Add syncpipe for passing context
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-02-21 22:58:30 -08:00
Michael Crosby
c71bc03279 Refactor exec method
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-02-21 22:37:09 -08:00
Michael Crosby
609c298810 Refactor network creation and initialization into strategies
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-02-21 22:26:07 -08:00
Michael Crosby
cda4f27f57 Export functions of nsinit
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-02-21 21:14:21 -08:00
Michael Crosby
d2fa488fa2 Initial commit of libcontainer running docker
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-02-21 17:23:49 -08:00
Michael Crosby
fa64bff715 Pass tty master to Exec
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-02-21 16:40:32 -08:00
Michael Crosby
b3d2325c5f Pass pipes into Exec function
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-02-21 16:28:43 -08:00
Michael Crosby
b9bc36a8bb Use lookup path for init
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-02-21 16:17:18 -08:00
Michael Crosby
e90b85bdc0 User os.Args[0] as name to reexec
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-02-21 15:32:50 -08:00
Michael Crosby
d40fbbb69b Add good logging support to both sides
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-02-21 14:56:17 -08:00
Michael Crosby
d67915851d Move tty into container.json
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-02-21 14:56:17 -08:00
Michael Crosby
6054bda2b8 Refactor the flag management for main
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-02-21 14:56:17 -08:00
Michael Crosby
5d71533d4e Make nsinit a proper go pkg and add the main in another dir
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-02-21 14:56:17 -08:00
Guillaume J. Charmes
52fa4de610 Make sure to close the pipe upon ctrl-d
Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume.charmes@docker.com> (github: creack)
2014-02-21 14:56:17 -08:00
Guillaume J. Charmes
97738ffed3 Handle non-tty mode
Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume.charmes@docker.com> (github: creack)
2014-02-21 14:56:17 -08:00
Guillaume J. Charmes
41696722fa Minor cleanup
Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume.charmes@docker.com> (github: creack)
2014-02-21 14:56:17 -08:00
Guillaume J. Charmes
b2e01cbe8c Use a custom pipe instead of stdin for sync net namespace
Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume.charmes@docker.com> (github: creack)
2014-02-21 14:56:16 -08:00
Guillaume J. Charmes
3677967f4e Use flag for init
Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume.charmes@docker.com> (github: creack)
2014-02-21 14:56:16 -08:00
Michael Crosby
ccc915b7b9 Move rest of cgroups functions into cgroups pkg
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-02-21 14:56:16 -08:00
Michael Crosby
c4769ec624 Change IP to address because it includes the subnet
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-02-21 14:56:16 -08:00
Michael Crosby
1cecb00003 Refactory cgroups into general pkg
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-02-21 14:56:16 -08:00
Michael Crosby
b90aaf6828 Remove clone_vfork
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-02-21 14:56:16 -08:00
Michael Crosby
848fd7638b Revert "WIP for setup kmsg"
This reverts commit 80db9a918337c4ae80ffa9a001da13bd24e848c8.

Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-02-21 14:56:16 -08:00
Alexander Larsson
3de41b34a2 libcontainer: Initial version of cgroups support
This is a minimal version of raw cgroup support for libcontainer.
It has only enough for what docker needs, and it has no support
for systemd yet.

Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
2014-02-21 14:56:16 -08:00
Michael Crosby
8590435fa0 WIP for setup kmsg
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-02-21 14:56:16 -08:00
Michael Crosby
d68ba7742f Remove privileged.json config
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-02-21 14:56:16 -08:00
Michael Crosby
c20c1dfb04 Add comments to many functions
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-02-21 14:56:16 -08:00
Michael Crosby
ca0e7f087c Add CAP_NET_ADMIN
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-02-21 14:56:16 -08:00
Michael Crosby
3ded9b431a Update readme and add TODO
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-02-21 14:56:16 -08:00
Michael Crosby
bb59129b2f Refactor to remove cmd from container
Pass the container's command via args
Remove execin function and just look for an
existing nspid file to join the namespace
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-02-21 14:56:16 -08:00
Michael Crosby
663518ba66 Add execin function to running a process in a namespace
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-02-21 14:56:16 -08:00
Michael Crosby
e3d5adc9e2 Refactor large funcs
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-02-21 14:56:16 -08:00
Guillaume J. Charmes
b48bc85967 OSX compilation
Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume.charmes@dotcloud.com> (github: creack)
2014-02-21 14:56:16 -08:00
Michael Crosby
84ba029e25 General cleanup of libcontainer
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-02-21 14:56:16 -08:00
Michael Crosby
ab6864d0c0 Add dynamic veth name
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-02-21 14:56:16 -08:00
Michael Crosby
8430fbf11e Implement init veth creation
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-02-21 14:56:15 -08:00
Michael Crosby
e25ebdd06c Simplify namespaces with only nsinit
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-02-21 14:56:15 -08:00
Michael Crosby
c1f8606d50 Use nsinit as app
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-02-21 14:56:15 -08:00
Guillaume J. Charmes
d62cc1cc66 Fix ptmx issue on libcontainer
Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume.charmes@docker.com> (github: creack)
2014-02-21 14:56:15 -08:00
Guillaume J. Charmes
a304eab9d4 Improve general quality of libcontainer
Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume.charmes@docker.com> (github: creack)
2014-02-21 14:56:15 -08:00
Michael Crosby
593219d191 Use nsinit for setting up namespace
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-02-21 14:56:15 -08:00
Michael Crosby
c2777d4611 WIP moving to nsini
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-02-21 14:56:15 -08:00
Michael Crosby
b0cdb601b9 Make separate nsinit pkg for a dockerinit like init
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-02-21 14:56:15 -08:00
Michael Crosby
81d2c67492 Initial commit of libcontainer
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-02-21 14:56:15 -08:00