vbatts/pkg
1
0
Fork 0
Code Pull requests Releases Activity
568 commits 2 branches 0 tags 3.9 MiB
Commit graph

568 commits

This branch
This branch
All branches
Author SHA1 Message Date
Erik Hollensbe
18d68cf1a9 libcontainer/nsinit: remove Wait call from Exec and Kill from Attach in tty_term.go 
Docker-DCO-1.1-Signed-off-by: Erik Hollensbe <github@hollensbe.org> (github: erikh)
 2014-05-27 12:26:56 -07:00
Erik Hollensbe
36bd5bf98b Add Wait() calls in the appropriate spots 
Docker-DCO-1.1-Signed-off-by: Erik Hollensbe <github@hollensbe.org> (github: erikh)
 2014-05-27 12:26:56 -07:00
Michael Crosby
4a0d1718ee Merge pull request #6018 from vishh/stats_strongtype 
Strong type all stats exported by libcontainer
 2014-05-23 14:35:14 -07:00
Michael Crosby
1c07f75e6f Add check for iptables xlock support 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-05-23 14:18:50 -07:00
Vishnu Kannan
c5be84cd2d Added stats.go which provides strong types for all stats that will be exported by libcontainer. This commit only introduces the strong type. 
Docker-DCO-1.1-Signed-off-by: Vishnu Kannan <vishnuk@google.com> (github: vishh)
 2014-05-23 20:42:43 +00:00
Michael Crosby
cc706701b0 Add wait flag to iptables 
Fixes #1573
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-05-23 01:24:58 +00:00
Michael Crosby
b98c3f7fb4 Merge pull request #5995 from vieux/recur_nodes 
Add device nodes recursively
 2014-05-22 16:35:27 -07:00
Victor Vieux
4b1df3687b update test 
Docker-DCO-1.1-Signed-off-by: Victor Vieux <vieux@docker.com> (github: vieux)
 2014-05-22 22:50:41 +00:00
Victor Vieux
bf21f0d493 add recursive device nodes 
Docker-DCO-1.1-Signed-off-by: Victor Vieux <vieux@docker.com> (github: vieux)
 2014-05-22 22:29:13 +00:00
Victor Marmol
c88ecf6acd Make all cgroup stats output int64s instead of float64. 
Docker-DCO-1.1-Signed-off-by: Victor Marmol <vmarmol@google.com> (github: vmarmol)
 2014-05-22 20:53:36 +00:00
Victor Vieux
89b64d33ee Merge pull request #5976 from crosbymichael/getpids 
Move get pid into cgroup implementation
 2014-05-21 19:09:50 -07:00
Victor Vieux
a0841ff1eb Merge pull request #5922 from crosbymichael/host-dev-priv 
Mount /dev in tmpfs for privileged containers
 2014-05-21 18:56:24 -07:00
Michael Crosby
c6c0dc2ebb Move get pid into cgroup implementation 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-05-21 21:14:07 +00:00
Tianon Gravi
c3c5ddfc50 Revert "Always mount a /run tmpfs in the container" 
This reverts commit 905795ece624675abe2ec2622b0bbafdb9d7f44c.

Docker-DCO-1.1-Signed-off-by: Andrew Page <admwiggin@gmail.com> (github: tianon)
 2014-05-21 14:28:19 -06:00
Michael Crosby
3d95e5cf7b Update code post codereview 
Add specific types for Required and Optional DeviceNodes
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-05-21 00:40:41 +00:00
Michael Crosby
7fb3f86fec Update documentation for container struct in libcontainer 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-05-20 23:34:46 +00:00
Michael Crosby
d48b2cf390 Mount /dev in tmpfs for privileged containers 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-05-20 22:51:24 +00:00
Alexander Larsson
0f44c2849c cgroups: Allow mknod for any device in systemd cgroup backend 
Without this any container startup fails:
2014/05/20 09:20:36 setup mount namespace copy additional dev nodes mknod fuse operation not permitted

Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
 2014-05-20 09:29:32 +02:00
Michael Crosby
f06ca4fdd2 Make sure dev/fuse is created in container 
Fixes #5849

If the host system does not have fuse enabled in the kernel config we
will ignore the is not exist errors when trying to copy the device node
from the host system into the container.
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-05-19 20:46:59 +00:00
Victor Marmol
c6e60b57a2 Merge pull request #5903 from alexlarsson/writable-proc 
Make /proc writable, but not /proc/sys and /proc/sysrq-trigger
 2014-05-19 12:21:15 -07:00
Alexander Larsson
6b97c80b4d Make /proc writable, but not /proc/sys and /proc/sysrq-trigger 
Some applications want to write to /proc. For instance:

docker run -it centos groupadd foo

Gives: groupadd: failure while writing changes to /etc/group

And strace reveals why:

open("/proc/self/task/13/attr/fscreate", O_RDWR) = -1 EROFS (Read-only file system)

I've looked at what other systems do, and systemd-nspawn makes /proc read-write
and /proc/sys readonly, while lxc allows "proc:mixed" which does the same,
plus it makes /proc/sysrq-trigger also readonly.

The later seems like a prudent idea, so we follows lxc proc:mixed.
Additionally we make /proc/irq and /proc/bus, as these seem to let
you control various hardware things.

Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
 2014-05-19 20:46:05 +02:00
Victor Marmol
c3b01dfb59 Merge pull request #5792 from bernerdschaefer/nsinit-supports-pdeathsig 
Add PDEATHSIG support to nsinit library
 2014-05-19 11:13:23 -07:00
Michael Crosby
9e23d99fa2 Merge pull request #5865 from crosbymichael/add-all-caps 
Add the rest of the caps so that they are retained in privilged mode
 2014-05-19 09:56:55 -07:00
Michael Crosby
3e097e5052 Add the rest of the caps so that they are retained in privilged mode 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-05-19 16:43:31 +00:00
Alexandr Morozov
b089773388 Check uid ranges 
Fixes #5647
Docker-DCO-1.1-Signed-off-by: Alexandr Morozov <lk4d4math@gmail.com> (github: LK4D4)
 2014-05-18 20:49:08 +04:00
Victor Vieux
58ba10aa54 add support for CAP_FOWNER 
Docker-DCO-1.1-Signed-off-by: Victor Vieux <vieux@docker.com> (github: vieux)
 2014-05-17 01:16:07 +00:00
Victor Marmol
73f678f6f8 Make libcontainer's CapabilitiesMask into a []string (Capabilities). 
Docker-DCO-1.1-Signed-off-by: Victor Marmol <vmarmol@google.com> (github: vmarmol)
 2014-05-17 00:44:10 +00:00
Michael Crosby
724c84c6fc Merge pull request #5833 from ActiveState/fix_nsinit_env_panic 
fix panic when passing empty environment
 2014-05-16 12:03:26 -07:00
Sridhar Ratnakumar
18a7cee3c7 fix panic when passing empty environment 
Docker-DCO-1.1-Signed-off-by: Sridhar Ratnakumar <github@srid.name> (github: srid)
 2014-05-16 11:55:34 -07:00
Victor Marmol
fa7e4d6946 Merge pull request #5810 from vmarmol/drop-caps 
Change libcontainer to drop all capabilities by default.
 2014-05-16 11:51:41 -07:00
Bernerd Schaefer
2732a59592 nsinit.DefaultCreateCommand sets Pdeathsig to SIGKILL 
Docker-DCO-1.1-Signed-off-by: Bernerd Schaefer <bj.schaefer@gmail.com> (github: bernerdschaefer)
 2014-05-16 13:48:41 +02:00
Bernerd Schaefer
f6ddb6051c nsinit.Init() restores parent death signal before exec 
Docker-DCO-1.1-Signed-off-by: Bernerd Schaefer <bj.schaefer@gmail.com> (github: bernerdschaefer)
 2014-05-16 13:48:41 +02:00
Victor Marmol
3a423f3e4e Change libcontainer to drop all capabilities by default. Only keeps 
those that were specified in the config. This commit also explicitly
adds a set of capabilities that we were silently not dropping and were
assumed by the tests.

Docker-DCO-1.1-Signed-off-by: Victor Marmol <vmarmol@google.com> (github: vmarmol)
 2014-05-16 00:57:58 +00:00
lalyos
0b1aab5435 Fixes 5370 infinite/maxLoopCount loop for relative symlinks 
use path.IsAbs() instead of checking if first char is '/'

Docker-DCO-1.1-Signed-off-by: Lajos Papp <lajos.papp@sequenceiq.com> (github: lalyos)
 2014-05-16 01:03:11 +02:00
lalyos
02b08b3961 Defend against infinite loop when following symlinks 
ideally it should never reach it, but there was already multiple issues with infinite loop
at following symlinks. this fixes hanging unit tests

Docker-DCO-1.1-Signed-off-by: Lajos Papp <lajos.papp@sequenceiq.com> (github: lalyos)
 2014-05-16 00:47:20 +02:00
lalyos
64b6d99e35 Adding test case for symlink causes infinit loop, reproduces: dotcloud#5370 
normally symlinks are created as either
ln -s /path/existing /path/new-name
or
cd /path && ln -s ./existing new-name

but one can create it this way
cd /path && ln -s existing new-name

this drives FollowSymlinkInScope into infinite loop

Docker-DCO-1.1-Signed-off-by: Lajos Papp <lajos.papp@sequenceiq.com> (github: lalyos)
 2014-05-16 00:47:20 +02:00
Bernerd Schaefer
bb9eabf1ef Add GetParentDeathSignal() to pkg/system 
Docker-DCO-1.1-Signed-off-by: Bernerd Schaefer <bj.schaefer@gmail.com> (github: bernerdschaefer)
 2014-05-15 10:17:44 +02:00
Michael Crosby
9b677d0733 Remove the cgroups maintainer file 
We don't need this because it is covered by the libcontainer MAINTAINERS
file
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-05-14 16:01:45 -07:00
Michael Crosby
b30f280d2f Move cgroups package into libcontainer 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-05-14 15:21:44 -07:00
Bernerd Schaefer
9133caa6d3 Setup standard /dev symlinks 
After copying allowed device nodes, set up "/dev/fd", "/dev/stdin",
"/dev/stdout", and "/dev/stderr" symlinks.

Docker-DCO-1.1-Signed-off-by: Bernerd Schaefer <bj.schaefer@gmail.com> (github: bernerdschaefer)
[rebased by @crosbymichael]
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-05-14 13:59:13 -07:00
Guillaume J. Charmes
ceedff720e Merge pull request #5783 from LK4D4/fix_duplicate_ip_allocation_#5729 
Fix duplicate ip allocation
 2014-05-14 13:32:27 -07:00
Victor Vieux
05878da301 Merge pull request #5756 from crosbymichael/move-units-to-pkg 
Move duration and size to units pkg
 2014-05-14 11:36:14 -07:00
Michael Crosby
9e48ca7b79 Merge pull request #5791 from bernerdschaefer/nsinit-exec-forwards-signals 
"nsinit exec ..." forwards signals to container
 2014-05-14 11:05:27 -07:00
Victor Vieux
ffcd37b861 Merge pull request #5781 from creack/remove_bind_console 
Remove the bind mount for dev/console which override the mknod/label
 2014-05-14 10:57:21 -07:00
Bernerd Schaefer
31c9adba67 "nsinit exec ..." forwards signals to container 
Docker-DCO-1.1-Signed-off-by: Bernerd Schaefer <bj.schaefer@gmail.com> (github: bernerdschaefer)
 2014-05-14 11:01:02 +02:00
Alexandr Morozov
a42b2abb10 Refactoring collections/orderedintset and benchmarks for it 
Docker-DCO-1.1-Signed-off-by: Alexandr Morozov <lk4d4math@gmail.com> (github: LK4D4)
 2014-05-14 06:04:12 +04:00
Michael Crosby
1cc1c05a55 Copy parents cpus and mems for cpuset 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-05-13 18:01:31 -07:00
Guillaume J. Charmes
fd5a5dc56f Remove the bind mount for dev/console which override the mknod/label 
Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume@charmes.net> (github: creack)
 2014-05-13 11:59:27 -07:00
Michael Crosby
04ec76023a Add MAINTAINERS file to symlink pkg 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-05-13 11:27:24 -07:00
Michael Crosby
f2bd8e8486 Update code to handle new path to Follow Symlink func 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-05-13 10:54:08 -07:00