Commit graph

149 commits

Author SHA1 Message Date
Rohit Jnagal
35c12256c7 Add enabled option to namespaces and capabilities spec in
container.json. Although we don't yet check for enabled everywhere.

Docker-DCO-1.1-Signed-off-by: Rohit Jnagal <jnagal@google.com> (github: rjnagal)
2014-04-25 01:10:11 +00:00
Rohit Jnagal
8173da962b Fix typos in nsinit logs.
Docker-DCO-1.1-Signed-off-by: Rohit Jnagal <jnagal@google.com> (github: rjnagal)
2014-04-25 00:20:14 +00:00
Rohit Jnagal
60159f9737 Fix container.json sample to be loadable by nsinit.
Docker-DCO-1.1-Signed-off-by: Rohit Jnagal <jnagal@google.com> (github: rjnagal)
2014-04-25 00:17:45 +00:00
Guillaume J. Charmes
3ee90e1348 Merge pull request #5328 from crosbymichael/refactor-cgroups
Refactor cgroups into subsystems and support metrics
2014-04-21 14:06:17 -07:00
Michael Crosby
8cc8aca9cc Move raw cgroups into fs package (filesystem)
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-04-18 21:34:26 -07:00
Michael Crosby
9f508e4b3e Move systemd code into pkg
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-04-18 21:30:08 -07:00
Michael Crosby
a183681b1d Refactor cgroups file locations
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-04-18 21:14:58 -07:00
Michael Crosby
ca3224687b Move apparmor to top level pkg
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-04-13 23:33:25 +00:00
Michael Crosby
b0dfd5c5d9 Use apparmor_parser directly
The current load script does alot of things.  If it does not find the
parser loaded on the system it will just exit 0 and not load the
profile.  We think it should fail loudly if it cannot load the profile
and apparmor is enabled on the system.
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-04-13 23:31:10 +00:00
Victor Vieux
0fe679322b Merge pull request #5143 from kzys/ns-nil
Avoid "invalid memory address or nil pointer dereference" panic
2014-04-10 11:07:35 -07:00
Guillaume J. Charmes
eb0ec63b59 Merge pull request #5131 from crosbymichael/shm-mode
Change shm mode to 1777
2014-04-10 07:50:32 -07:00
Guillaume J. Charmes
8a64aa8f4b Merge pull request #5115 from alexlarsson/fix-libcontainer-network-rhel6
Fix libcontainer network support on rhel6
2014-04-10 07:45:12 -07:00
Kato Kazuyoshi
8dc1d8b6c0 Avoid "invalid memory address or nil pointer dereference" panic
libcontainer.GetNamespace returns nil on FreeBSD because
libcontainer.namespaceList is empty. In this case, Namespaces#Get should
return nil instead of being panic.

Docker-DCO-1.1-Signed-off-by: Kato Kazuyoshi <kato.kazuyoshi@gmail.com> (github: kzys)
2014-04-10 22:07:29 +09:00
Alexander Larsson
db1a117450 Fix libcontainer network support on rhel6
It seems that netlink in older kernels, including RHEL6, does not
support RTM_SETLINK with IFLA_MASTER. It just silently ignores it, reporting
no error, causing netlink.NetworkSetMaster() to not do anything yet
return no error.

We fix this by introducing and using AddToBridge() in a very similar manner
to CreateBridge(), which use the old ioctls directly.

This fixes https://github.com/dotcloud/docker/issues/4668

Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
2014-04-09 15:44:18 +02:00
Michael Crosby
6b4ca764f0 Change shm mode to 1777
Fixes #5126
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-04-09 10:53:32 +00:00
Michael Crosby
4b3bfc742b Check for apparmor enabled on host to populate profile
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-04-09 10:22:17 +00:00
Guillaume J. Charmes
2538689b31 Backup current docker apparmor profile and replace it with the new one
Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume@charmes.net> (github: creack)
2014-04-08 11:09:31 -07:00
Guillaume J. Charmes
908be5a3d9 Merge pull request #5049 from Supermathie/aa-fix
apparmor: docker-default: Include base abstraction
2014-04-07 21:34:01 -07:00
Guillaume J. Charmes
23ce43ac20 Merge pull request #5025 from dstine/readme-fix
fixed two readme typos
2014-04-07 19:31:16 -07:00
Dan Stine
3a7b63669c fixed three more typos 2014-04-07 22:09:15 -04:00
Michael Crosby
8824b08802 Ensure that ro mounts are remounted
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-04-07 18:23:22 -07:00
Michael Brown
7c63627a7f apparmor: pull in variables from tunables/global
The variables that were defined at the top of the apparmor profile are best
pulled in via the <tunables/global> include.

Docker-DCO-1.1-Signed-off-by: Michael Brown <michael.brown@discourse.org> (github: Supermathie)
2014-04-07 03:04:27 -04:00
Michael Brown
0bcebe0347 apparmor: abstractions/base expects pid variable
Add 'pid' variable pointing to 'self' to allow parsing of profile to succeed

Docker-DCO-1.1-Signed-off-by: Michael Brown <michael.brown@discourse.org> (github: Supermathie)
2014-04-07 02:47:43 -04:00
Michael Brown
264a89788c apparmor: docker-default: Include base abstraction
Encountered problems on 14.04 relating to signals between container
processes being blocked by apparmor. The base abstraction contains
appropriate rules to allow this communication.

Docker-DCO-1.1-Signed-off-by: Michael Brown <michael.brown@discourse.org> (github: Supermathie)
2014-04-07 02:19:38 -04:00
Dan Stine
e59092b62c fixed two readme typos 2014-04-04 08:12:17 -04:00
Michael Crosby
f1e3abf694 Remove loopback setup for native driver
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-04-02 13:12:52 +00:00
Victor Vieux
534990bda9 Merge pull request #4953 from rhatdan/selinux
These two patches should fix problems we see with running docker in the wild.
2014-04-02 16:36:41 -07:00
unclejack
879855ec98 Merge pull request #4867 from crosbymichael/clean-shutdown
Cleanly shutdown docker
2014-04-02 01:48:03 +03:00
Michael Crosby
9bf96eece4 Merge pull request #4942 from vieux/cleanup_dev_libcontainer
remove setupDev from libcontainer
2014-04-01 14:28:17 -07:00
Dan Walsh
f71121b1fa In certain cases, setting the process label will not happen.
When the code attempts to set the ProcessLabel, it checks if SELinux Is
enabled.  We have seen a case with some of our patches where the code
is fooled by the container to think that SELinux is not enabled.  Calling
label.Init before setting up the rest of the container, tells the library that
SELinux is enabled and everything works fine.

Docker-DCO-1.1-Signed-off-by: Dan Walsh <dwalsh@redhat.com> (github: rhatdan)
2014-04-01 13:30:10 -04:00
Michael Crosby
6a7bbbdddc Don't send prctl to be consistent with other drivers
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-04-01 07:12:50 +00:00
Michael Crosby
b16b1a04ff Ensure a reliable way to kill ghost containers on reboot
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-04-01 07:11:41 +00:00
Victor Vieux
fdcc31546e remove setupDev from libcontainer
Docker-DCO-1.1-Signed-off-by: Victor Vieux <victor.vieux@docker.com> (github: vieux)
2014-04-01 00:28:44 +00:00
Alexander Larsson
fce532280b cgroups: Splity out Apply/Cleanup to separate file/interface
This leaves only the generic cgroup helper functions in cgroups.go and
will allow easy implementations of other cgroup managers.

This also wires up the call to Cleanup the cgroup which was missing
before.

Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
2014-03-27 21:47:47 +01:00
Michael Crosby
42be9fb9d2 Merge branch 'master' into pluginflag
Conflicts:
	pkg/cgroups/cgroups.go
	pkg/libcontainer/nsinit/exec.go
	pkg/libcontainer/nsinit/init.go
	pkg/libcontainer/nsinit/mount.go
	runconfig/hostconfig.go
	runconfig/parse.go
	runtime/execdriver/driver.go
	runtime/execdriver/lxc/lxc_template.go
	runtime/execdriver/lxc/lxc_template_unit_test.go
	runtime/execdriver/native/default_template.go
	runtime/execdriver/native/driver.go

Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-03-27 08:00:18 +00:00
Dan Walsh
2b01982d1f This patch adds SELinux labeling support.
docker will run the process(es) within the container with an SELinux label and will label
all of  the content within the container with mount label.  Any temporary file systems
created within the container need to be mounted with the same mount label.

The user can override the process label by specifying

-Z With a string of space separated options.

-Z "user=unconfined_u role=unconfined_r type=unconfined_t level=s0"

Would cause the process label to run with unconfined_u:unconfined_r:unconfined_t:s0"

By default the processes will run execute within the container as svirt_lxc_net_t.
All of the content in the container as svirt_sandbox_file_t.

The process mcs level is based of the PID of the docker process that is creating the container.

If you run the container in --priv mode, the labeling will be disabled.

Docker-DCO-1.1-Signed-off-by: Dan Walsh <dwalsh@redhat.com> (github: rhatdan)
2014-03-26 15:30:40 -04:00
Michael Crosby
ea56bc4614 Change placement of readonly filesystem
We need to change it to read only at the very end so that bound,
copy dev nodes and other ops do not fail.
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-03-21 14:17:17 +00:00
Michael Crosby
a740cd779e Allow containers to join the net namespace of other conatiners
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-03-21 00:48:17 +00:00
Michael Crosby
acff50596b Merge branch 'proppy-nsinit' into pluginflag
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-03-21 00:36:23 +00:00
Michael Crosby
0114737132 Add ability to work with individual namespaces
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-03-21 00:23:34 +00:00
Michael Crosby
67a1625791 Allow caps to be toggled in native driver with plugin flag
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-03-21 00:10:24 +00:00
Michael Crosby
f6a8719dd5 Dont use custom marshaling for caps and namespaces
This also adds an enabled field to the types so that they
can be easily toggled.
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-03-20 23:09:01 +00:00
Johan Euphrosine
b00757fda6 libcontainer: remove duplicate imports
Docker-DCO-1.1-Signed-off-by: Johan Euphrosine <proppy@google.com> (github: proppy)
2014-03-18 16:25:26 -07:00
Johan Euphrosine
fc0982872a libcontainer: goimports
Docker-DCO-1.1-Signed-off-by: Johan Euphrosine <proppy@google.com> (github: proppy)
2014-03-18 16:18:34 -07:00
Johan Euphrosine
76d3c99530 libcontainer/nsinit/init: move mount namespace after network
Docker-DCO-1.1-Signed-off-by: Johan Euphrosine <proppy@google.com> (github: proppy)
2014-03-18 16:18:04 -07:00
Johan Euphrosine
e50e99bb8b libcontainer/network: add netns strategy
Docker-DCO-1.1-Signed-off-by: Johan Euphrosine <proppy@google.com> (github: proppy)
2014-03-18 16:17:28 -07:00
Michael Crosby
0424993f6d Only unshare the mount namespace for execin
Fixes #4728
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-03-17 18:52:56 -07:00
Timothy Hobbs
1cad0a1d6c Fix issue #4681 - No loopback interface within container when networking is disabled.
Docker-DCO-1.1-Signed-off-by: Timothy Hobbs <timothyhobbs@seznam.cz> (github: https://github.com/timthelion)

Remove loopback code from veth strategy

Docker-DCO-1.1-Signed-off-by: Timothy Hobbs <timothyhobbs@seznam.cz> (github: https://github.com/timthelion)

Looback strategy: Get rid of uneeded code in Create
Docker-DCO-1.1-Signed-off-by: Timothy Hobbs <timothyhobbs@seznam.cz> (github: https://github.com/timthelion)

Use append when building network strategy list

Docker-DCO-1.1-Signed-off-by: Timothy Hobbs <timothyhobbs@seznam.cz> (github: https://github.com/timthelion)

Swap loopback and veth strategies in Networks list

Docker-DCO-1.1-Signed-off-by: Timothy Hobbs <timothyhobbs@seznam.cz> (github: https://github.com/timthelion)

Revert "Swap loopback and veth strategies in Networks list"

This reverts commit 3b8b2c8454171d79bed5e9a80165172617e92fc7.

Docker-DCO-1.1-Signed-off-by: Timothy Hobbs <timothyhobbs@seznam.cz> (github: https://github.com/timthelion)

When initializing networks, only return from the loop if there is an error

Docker-DCO-1.1-Signed-off-by: Timothy Hobbs <timothyhobbs@seznam.cz> (github: https://github.com/timthelion)
2014-03-17 22:01:24 +01:00
Guillaume J. Charmes
dce2f20bec Merge pull request #4645 from crosbymichael/add-logger
Add logger to libcontainer
2014-03-17 11:30:14 -07:00
Brandon Philips
c6b2c2f6b0 chore(libcontainer): small grammar fix in types_test
Someone probably got really used to typing er on the end of contain :)

Docker-DCO-1.1-Signed-off-by: Brandon Philips <brandon.philips@coreos.com> (github: philips)
2014-03-17 11:07:29 -07:00