|
@@ -3,8 +3,11 @@
|
|
|
package nsinit
|
|
|
|
|
|
import (
|
|
|
+ "fmt"
|
|
|
+ "io/ioutil"
|
|
|
"os"
|
|
|
"os/exec"
|
|
|
+ "path/filepath"
|
|
|
"syscall"
|
|
|
|
|
|
"github.com/dotcloud/docker/pkg/cgroups"
|
|
@@ -17,7 +20,7 @@ import (
|
|
|
|
|
|
// Exec performes setup outside of a namespace so that a container can be
|
|
|
// executed. Exec is a high level function for working with container namespaces.
|
|
|
-func (ns *linuxNs) Exec(container *libcontainer.Container, term Terminal, args []string) (int, error) {
|
|
|
+func (ns *linuxNs) Exec(container *libcontainer.Container, term Terminal, pidRoot string, args []string, startCallback func()) (int, error) {
|
|
|
var (
|
|
|
master *os.File
|
|
|
console string
|
|
@@ -53,24 +56,24 @@ func (ns *linuxNs) Exec(container *libcontainer.Container, term Terminal, args [
|
|
|
if err != nil {
|
|
|
return -1, err
|
|
|
}
|
|
|
- if err := ns.stateWriter.WritePid(command.Process.Pid, started); err != nil {
|
|
|
+ if err := WritePid(pidRoot, command.Process.Pid, started); err != nil {
|
|
|
command.Process.Kill()
|
|
|
return -1, err
|
|
|
}
|
|
|
- defer ns.stateWriter.DeletePid()
|
|
|
+ defer DeletePid(pidRoot)
|
|
|
|
|
|
// Do this before syncing with child so that no children
|
|
|
// can escape the cgroup
|
|
|
- activeCgroup, err := ns.SetupCgroups(container, command.Process.Pid)
|
|
|
+ cleaner, err := SetupCgroups(container, command.Process.Pid)
|
|
|
if err != nil {
|
|
|
command.Process.Kill()
|
|
|
return -1, err
|
|
|
}
|
|
|
- if activeCgroup != nil {
|
|
|
- defer activeCgroup.Cleanup()
|
|
|
+ if cleaner != nil {
|
|
|
+ defer cleaner.Cleanup()
|
|
|
}
|
|
|
|
|
|
- if err := ns.InitializeNetworking(container, command.Process.Pid, syncPipe); err != nil {
|
|
|
+ if err := InitializeNetworking(container, command.Process.Pid, syncPipe); err != nil {
|
|
|
command.Process.Kill()
|
|
|
return -1, err
|
|
|
}
|
|
@@ -78,6 +81,10 @@ func (ns *linuxNs) Exec(container *libcontainer.Container, term Terminal, args [
|
|
|
// Sync with child
|
|
|
syncPipe.Close()
|
|
|
|
|
|
+ if startCallback != nil {
|
|
|
+ startCallback()
|
|
|
+ }
|
|
|
+
|
|
|
if err := command.Wait(); err != nil {
|
|
|
if _, ok := err.(*exec.ExitError); !ok {
|
|
|
return -1, err
|
|
@@ -87,7 +94,9 @@ func (ns *linuxNs) Exec(container *libcontainer.Container, term Terminal, args [
|
|
|
return status, err
|
|
|
}
|
|
|
|
|
|
-func (ns *linuxNs) SetupCgroups(container *libcontainer.Container, nspid int) (cgroups.ActiveCgroup, error) {
|
|
|
+// SetupCgroups applies the cgroup restrictions to the process running in the contaienr based
|
|
|
+// on the container's configuration
|
|
|
+func SetupCgroups(container *libcontainer.Container, nspid int) (cgroups.ActiveCgroup, error) {
|
|
|
if container.Cgroups != nil {
|
|
|
c := container.Cgroups
|
|
|
if systemd.UseSystemd() {
|
|
@@ -98,7 +107,9 @@ func (ns *linuxNs) SetupCgroups(container *libcontainer.Container, nspid int) (c
|
|
|
return nil, nil
|
|
|
}
|
|
|
|
|
|
-func (ns *linuxNs) InitializeNetworking(container *libcontainer.Container, nspid int, pipe *SyncPipe) error {
|
|
|
+// InitializeNetworking creates the container's network stack outside of the namespace and moves
|
|
|
+// interfaces into the container's net namespaces if necessary
|
|
|
+func InitializeNetworking(container *libcontainer.Container, nspid int, pipe *SyncPipe) error {
|
|
|
context := libcontainer.Context{}
|
|
|
for _, config := range container.Networks {
|
|
|
strategy, err := network.GetStrategy(config.Type)
|
|
@@ -111,3 +122,23 @@ func (ns *linuxNs) InitializeNetworking(container *libcontainer.Container, nspid
|
|
|
}
|
|
|
return pipe.SendToChild(context)
|
|
|
}
|
|
|
+
|
|
|
+// WritePid writes the namespaced processes pid to pid and it's start time
|
|
|
+// to the path specified
|
|
|
+func WritePid(path string, pid int, startTime string) error {
|
|
|
+ err := ioutil.WriteFile(filepath.Join(path, "pid"), []byte(fmt.Sprint(pid)), 0655)
|
|
|
+ if err != nil {
|
|
|
+ return err
|
|
|
+ }
|
|
|
+ return ioutil.WriteFile(filepath.Join(path, "start"), []byte(startTime), 0655)
|
|
|
+}
|
|
|
+
|
|
|
+// DeletePid removes the pid and started file from disk when the container's process
|
|
|
+// dies and the container is cleanly removed
|
|
|
+func DeletePid(path string) error {
|
|
|
+ err := os.Remove(filepath.Join(path, "pid"))
|
|
|
+ if serr := os.Remove(filepath.Join(path, "start")); err == nil {
|
|
|
+ err = serr
|
|
|
+ }
|
|
|
+ return err
|
|
|
+}
|