vbatts/pkg
1
0
Fork 0
Code Pull requests Releases Activity
435 commits 2 branches 0 tags 3.9 MiB
Commit graph

167 commits

Author SHA1 Message Date
Victor Vieux
a94e54c65b Merge pull request #5449 from tianon/remove-libcontainer-root-special-case 
Remove "root" and "" special cases in libcontainer
 2014-04-28 16:29:08 -07:00
Rohit Jnagal
8cb62581de Merge branch 'master' into libcontainer-fixes 
Conflicts:
	pkg/libcontainer/README.md
	pkg/libcontainer/container.json

Docker-DCO-1.1-Signed-off-by: Rohit Jnagal <jnagal@google.com> (github: rjnagal)
 2014-04-28 23:04:04 +00:00
Tianon Gravi
c54bc4ca04 Remove "root" and "" special cases in libcontainer 
These are unnecessary since the user package handles these cases properly already (as evidenced by the LXC backend not having these special cases).

I also updated the errors returned to match the other libcontainer error messages in this same file.

Also, switching from Setresuid to Setuid directly isn't a problem, because the "setuid" system call will automatically do that if our own effective UID is root currently: (from `man 2 setuid`)

    setuid() sets the effective user ID of the calling process.  If the
    effective UID of the caller is root, the real UID and saved set-user-
    ID are also set.

Docker-DCO-1.1-Signed-off-by: Andrew Page <admwiggin@gmail.com> (github: tianon)
 2014-04-28 16:46:03 -06:00
Rohit Jnagal
030155d44d Updated sample config to be usable. We should change the namespace 
config to not need "value" later.

Docker-DCO-1.1-Signed-off-by: Rohit Jnagal <jnagal@google.com> (github: rjnagal)
 2014-04-25 21:10:23 +00:00
Rohit Jnagal
aeb186a0ba Updated sample config and README to match the default template for 
native execdriver.

Docker-DCO-1.1-Signed-off-by: Rohit Jnagal <jnagal@google.com> (github: rjnagal)
 2014-04-25 06:02:30 +00:00
Rohit Jnagal
c81ca6ef71 Improved README formatting. 
Docker-DCO-1.1-Signed-off-by: Rohit Jnagal <jnagal@google.com> (github: rjnagal)
 2014-04-25 01:23:48 +00:00
Rohit Jnagal
35c12256c7 Add enabled option to namespaces and capabilities spec in 
container.json. Although we don't yet check for enabled everywhere.

Docker-DCO-1.1-Signed-off-by: Rohit Jnagal <jnagal@google.com> (github: rjnagal)
 2014-04-25 01:10:11 +00:00
Rohit Jnagal
8173da962b Fix typos in nsinit logs. 
Docker-DCO-1.1-Signed-off-by: Rohit Jnagal <jnagal@google.com> (github: rjnagal)
 2014-04-25 00:20:14 +00:00
Rohit Jnagal
60159f9737 Fix container.json sample to be loadable by nsinit. 
Docker-DCO-1.1-Signed-off-by: Rohit Jnagal <jnagal@google.com> (github: rjnagal)
 2014-04-25 00:17:45 +00:00
Michael Crosby
76a06effef Ignore isnot exists errors for proc paths 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-04-24 10:35:20 -07:00
Michael Crosby
2ecea22c8c Update init for new apparmor import path 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-04-24 10:35:20 -07:00
Michael Crosby
bd7c140c01 Update container.json and readme 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-04-24 10:35:20 -07:00
Michael Crosby
e40bde54a5 Move capabilities into security pkg 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-04-24 10:35:20 -07:00
Michael Crosby
454751e768 Move mounts into types.go 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-04-24 10:35:20 -07:00
Michael Crosby
824ee83816 Move rest of console functions to pkg 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-04-24 10:35:20 -07:00
Michael Crosby
a77846506b Refactor mounts into pkg to make changes easier 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-04-24 10:35:20 -07:00
Michael Crosby
323ea01c18 Move console into its own package 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-04-24 10:35:20 -07:00
Michael Crosby
cc900b9db8 Mount over dev and only copy allowed nodes in 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-04-24 10:35:20 -07:00
Michael Crosby
ef923907df No not mount sysfs by default for non privilged containers 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-04-24 10:35:20 -07:00
Michael Crosby
3d546f20db Add restrictions to proc in libcontainer 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-04-24 10:35:19 -07:00
Michael Crosby
b5434b5d7f Move apparmor into security sub dir 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-04-24 10:35:19 -07:00
Guillaume J. Charmes
3ee90e1348 Merge pull request #5328 from crosbymichael/refactor-cgroups 
Refactor cgroups into subsystems and support metrics
 2014-04-21 14:06:17 -07:00
Michael Crosby
8cc8aca9cc Move raw cgroups into fs package (filesystem) 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-04-18 21:34:26 -07:00
Michael Crosby
9f508e4b3e Move systemd code into pkg 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-04-18 21:30:08 -07:00
Michael Crosby
a183681b1d Refactor cgroups file locations 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-04-18 21:14:58 -07:00
Michael Crosby
ca3224687b Move apparmor to top level pkg 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-04-13 23:33:25 +00:00
Michael Crosby
b0dfd5c5d9 Use apparmor_parser directly 
The current load script does alot of things.  If it does not find the
parser loaded on the system it will just exit 0 and not load the
profile.  We think it should fail loudly if it cannot load the profile
and apparmor is enabled on the system.
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-04-13 23:31:10 +00:00
Victor Vieux
0fe679322b Merge pull request #5143 from kzys/ns-nil 
Avoid "invalid memory address or nil pointer dereference" panic
 2014-04-10 11:07:35 -07:00
Guillaume J. Charmes
eb0ec63b59 Merge pull request #5131 from crosbymichael/shm-mode 
Change shm mode to 1777
 2014-04-10 07:50:32 -07:00
Guillaume J. Charmes
8a64aa8f4b Merge pull request #5115 from alexlarsson/fix-libcontainer-network-rhel6 
Fix libcontainer network support on rhel6
 2014-04-10 07:45:12 -07:00
Kato Kazuyoshi
8dc1d8b6c0 Avoid "invalid memory address or nil pointer dereference" panic 
libcontainer.GetNamespace returns nil on FreeBSD because
libcontainer.namespaceList is empty. In this case, Namespaces#Get should
return nil instead of being panic.

Docker-DCO-1.1-Signed-off-by: Kato Kazuyoshi <kato.kazuyoshi@gmail.com> (github: kzys)
 2014-04-10 22:07:29 +09:00
Alexander Larsson
db1a117450 Fix libcontainer network support on rhel6 
It seems that netlink in older kernels, including RHEL6, does not
support RTM_SETLINK with IFLA_MASTER. It just silently ignores it, reporting
no error, causing netlink.NetworkSetMaster() to not do anything yet
return no error.

We fix this by introducing and using AddToBridge() in a very similar manner
to CreateBridge(), which use the old ioctls directly.

This fixes https://github.com/dotcloud/docker/issues/4668

Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
 2014-04-09 15:44:18 +02:00
Michael Crosby
6b4ca764f0 Change shm mode to 1777 
Fixes #5126
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-04-09 10:53:32 +00:00
Michael Crosby
4b3bfc742b Check for apparmor enabled on host to populate profile 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-04-09 10:22:17 +00:00
Guillaume J. Charmes
2538689b31 Backup current docker apparmor profile and replace it with the new one 
Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume@charmes.net> (github: creack)
 2014-04-08 11:09:31 -07:00
Guillaume J. Charmes
908be5a3d9 Merge pull request #5049 from Supermathie/aa-fix 
apparmor: docker-default: Include base abstraction
 2014-04-07 21:34:01 -07:00
Guillaume J. Charmes
23ce43ac20 Merge pull request #5025 from dstine/readme-fix 
fixed two readme typos
 2014-04-07 19:31:16 -07:00
Dan Stine
3a7b63669c fixed three more typos 2014-04-07 22:09:15 -04:00
Michael Crosby
8824b08802 Ensure that ro mounts are remounted 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-04-07 18:23:22 -07:00
Michael Brown
7c63627a7f apparmor: pull in variables from tunables/global 
The variables that were defined at the top of the apparmor profile are best
pulled in via the <tunables/global> include.

Docker-DCO-1.1-Signed-off-by: Michael Brown <michael.brown@discourse.org> (github: Supermathie)
 2014-04-07 03:04:27 -04:00
Michael Brown
0bcebe0347 apparmor: abstractions/base expects pid variable 
Add 'pid' variable pointing to 'self' to allow parsing of profile to succeed

Docker-DCO-1.1-Signed-off-by: Michael Brown <michael.brown@discourse.org> (github: Supermathie)
 2014-04-07 02:47:43 -04:00
Michael Brown
264a89788c apparmor: docker-default: Include base abstraction 
Encountered problems on 14.04 relating to signals between container
processes being blocked by apparmor. The base abstraction contains
appropriate rules to allow this communication.

Docker-DCO-1.1-Signed-off-by: Michael Brown <michael.brown@discourse.org> (github: Supermathie)
 2014-04-07 02:19:38 -04:00
Dan Stine
e59092b62c fixed two readme typos 2014-04-04 08:12:17 -04:00
Michael Crosby
f1e3abf694 Remove loopback setup for native driver 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-04-02 13:12:52 +00:00
Victor Vieux
534990bda9 Merge pull request #4953 from rhatdan/selinux 
These two patches should fix problems we see with running docker in the wild.
 2014-04-02 16:36:41 -07:00
unclejack
879855ec98 Merge pull request #4867 from crosbymichael/clean-shutdown 
Cleanly shutdown docker
 2014-04-02 01:48:03 +03:00
Michael Crosby
9bf96eece4 Merge pull request #4942 from vieux/cleanup_dev_libcontainer 
remove setupDev from libcontainer
 2014-04-01 14:28:17 -07:00
Dan Walsh
f71121b1fa In certain cases, setting the process label will not happen. 
When the code attempts to set the ProcessLabel, it checks if SELinux Is
enabled.  We have seen a case with some of our patches where the code
is fooled by the container to think that SELinux is not enabled.  Calling
label.Init before setting up the rest of the container, tells the library that
SELinux is enabled and everything works fine.

Docker-DCO-1.1-Signed-off-by: Dan Walsh <dwalsh@redhat.com> (github: rhatdan)
 2014-04-01 13:30:10 -04:00
Michael Crosby
6a7bbbdddc Don't send prctl to be consistent with other drivers 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-04-01 07:12:50 +00:00
Michael Crosby
b16b1a04ff Ensure a reliable way to kill ghost containers on reboot 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-04-01 07:11:41 +00:00