0ct0pu5/moby
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
9855 commits 14 branches 412 tags 338 MiB
Commit graph

693 commits

Author SHA1 Message Date
Guillaume J. Charmes
0b15944cb0 Merge pull request #5354 from alexlarsson/cgroups-systemd-fixes 
cgroups: Update systemd to match fs backend
 2014-05-05 16:00:56 -07:00
Victor Vieux
3744452ecf add resolvconf 
Docker-DCO-1.1-Signed-off-by: Victor Vieux <vieux@docker.com> (github: vieux)
 2014-05-05 22:55:32 +00:00
Victor Vieux
a1a029f6d7 add etchosts 
Docker-DCO-1.1-Signed-off-by: Victor Vieux <vieux@docker.com> (github: vieux)
 2014-05-05 22:43:38 +00:00
Michael Crosby
2165a4993b Merge pull request #5602 from crosbymichael/libcontainer-enable 
Improve libcontainer namespace and cap format
 2014-05-05 13:50:08 -07:00
Michael Crosby
99be235332 Merge pull request #5400 from bmatsuo/5398-fix-pkg/graphdb-osx 2014-05-05 13:41:43 -07:00
Michael Crosby
db5f6b4aa0 Improve libcontainer namespace and cap format 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-05-05 12:34:21 -07:00
Rohit Jnagal
412324cfbe Check supplied hostname before using it. 
Docker-DCO-1.1-Signed-off-by: Rohit Jnagal <jnagal@google.com> (github: rjnagal)
 2014-05-05 18:12:25 +00:00
Alexander Larsson
5b094530c0 cgroups: Update systemd to match fs backend 
This updates systemd.Apply to match the fs backend by:
* Always join blockio controller (for stats)
* Support CpusetCpus
* Support MemorySwap

Also, it removes the generic UnitProperties in favour of a single
option to set the slice.

Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
 2014-05-05 20:06:44 +02:00
Michael Crosby
3a1f0dedc7 Merge pull request #5556 from crosbymichael/no-restrict-lxc 
Don't restrict lxc because of apparmor
 2014-05-02 17:20:27 -07:00
Guillaume J. Charmes
a7ccbfd5f1
Month devpts before mounting subdirs 
Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume@charmes.net> (github: creack)
 2014-05-02 13:55:45 -07:00
Michael Crosby
59fe77bfa6 Don't restrict lxc because of apparmor 
We don't have the flexibility to do extra things with lxc because it is
a black box and most fo the magic happens before we get a chance to
interact with it in dockerinit.
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-05-02 11:14:24 -07:00
Guillaume J. Charmes
1c5a3123cc Merge pull request #5529 from crosbymichael/restrict-proc 
Mount /proc and /sys read-only, except in privileged containers
 2014-05-02 10:52:53 -07:00
Michael Crosby
76fa7d588a Apply apparmor before restrictions 
There is not need for the remount hack, we use aa_change_onexec so the
apparmor profile is not applied until we exec the users app.
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-05-01 19:09:12 -07:00
Victor Marmol
71e3757174 Adding Rohit Jnagal and Victor Marmol to pkg/libcontainer maintainers. 
Docker-DCO-1.1-Signed-off-by: Victor Marmol <vmarmol@google.com> (github: vmarmol)
 2014-05-01 15:51:38 -07:00
Victor Marmol
91b5fe8502 Adding Rohit Jnagal and Victor Marmol to pkg/cgroups maintainers. 
Docker-DCO-1.1-Signed-off-by: Victor Marmol <vmarmol@google.com> (github: vmarmol)
 2014-05-01 15:48:16 -07:00
Michael Crosby
24e0df8136 Fix /proc/kcore mount of /dev/null 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-05-01 15:26:58 -07:00
Michael Crosby
3f74bdd93f Mount attr and task as rw for selinux support 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-05-01 15:26:58 -07:00
Michael Crosby
f5139233b9 Update restrictions for better handling of mounts 
This also cleans up some of the left over restriction paths code from
before.
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-05-01 15:26:58 -07:00
Michael Crosby
83982e8b1d Update to enable cross compile 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-05-01 15:26:58 -07:00
Jérôme Petazzoni
1c4202a614 Mount /proc and /sys read-only, except in privileged containers. 
It has been pointed out that some files in /proc and /sys can be used
to break out of containers. However, if those filesystems are mounted
read-only, most of the known exploits are mitigated, since they rely
on writing some file in those filesystems.

This does not replace security modules (like SELinux or AppArmor), it
is just another layer of security. Likewise, it doesn't mean that the
other mitigations (shadowing parts of /proc or /sys with bind mounts)
are useless. Those measures are still useful. As such, the shadowing
of /proc/kcore is still enabled with both LXC and native drivers.

Special care has to be taken with /proc/1/attr, which still needs to
be mounted read-write in order to enable the AppArmor profile. It is
bind-mounted from a private read-write mount of procfs.

All that enforcement is done in dockerinit. The code doing the real
work is in libcontainer. The init function for the LXC driver calls
the function from libcontainer to avoid code duplication.

Docker-DCO-1.1-Signed-off-by: Jérôme Petazzoni <jerome@docker.com> (github: jpetazzo)
 2014-05-01 15:26:58 -07:00
Victor Vieux
de191e8632 skip apparmor with dind 
Docker-DCO-1.1-Signed-off-by: Victor Vieux <vieux@docker.com> (github: vieux)
 2014-05-01 22:22:08 +00:00
Eiichi Tsukata
cac0cea03f drop CAP_SYSLOG capability 
Kernel capabilities for privileged syslog operations are currently splitted into
CAP_SYS_ADMIN and CAP_SYSLOG since the following commit:
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=ce6ada35bdf710d16582cc4869c26722547e6f11

This patch drops CAP_SYSLOG to prevent containers from messing with
host's syslog (e.g. `dmesg -c` clears up host's printk ring buffer).

Closes #5491

Docker-DCO-1.1-Signed-off-by: Eiichi Tsukata <devel@etsukata.com> (github: Etsukata)
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-05-01 11:43:55 -07:00
Guillaume J. Charmes
fe4a25546a Merge pull request #5515 from crosbymichael/refactor-libcontainer2 
Remove CommandFactory and NsInit interface
 2014-05-01 11:41:54 -07:00
Alexander Larsson
24f9187a04 beam: Add simple framing system for UnixConn 
This is needed for Send/Recieve to correctly handle borders between
the messages.

The framing uses a single 32bit uint32 length for each frame, of which
the high bit is used to indicate whether the message contains a file
descriptor or not. This is enough to separate out each message sent
and to decide to which message each file descriptors belongs, even
though multiple Sends may be coalesced into a single read, and/or one
Send can be split into multiple writes.

Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
 2014-05-01 11:06:01 -07:00
Michael Crosby
d0bee79394 Remove container.json from readme 
No need to duplicate this information when we already have a
container.json file in the root of libcontainer
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-04-30 18:52:15 -07:00
Michael Crosby
da0d6dbd7b Make native driver use Exec func with different CreateCommand 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-04-30 18:49:24 -07:00
Michael Crosby
aa9705f832 Fix execin with environment and Enabled support 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-04-30 18:24:47 -07:00
Michael Crosby
60e4276f5a Integrate new structure into docker's native driver 
This duplicates some of the Exec code but I think it it worth it because
the native driver is more straight forward and does not have the
complexity have handling the type issues for now.
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-04-30 18:20:01 -07:00
Michael Crosby
176c49d7a9 Remove command factory and NsInit interface from libcontainer 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-04-30 17:55:15 -07:00
Michael Crosby
b6b0dfdba7 Export more functions from libcontainer 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-04-30 17:18:07 -07:00
Michael Crosby
aecb9c39ab Split term files to make it easier to manage 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-04-30 17:04:24 -07:00
Michael Crosby
a3e96abb5a Export syncpipe fields 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-04-30 17:02:45 -07:00
Guillaume J. Charmes
26ac05c8bc Merge pull request #5511 from crosbymichael/refactor-libcontainer 
Refactor: remove statewriter type and all callback for process start
 2014-04-30 16:50:57 -07:00
Guillaume J. Charmes
be013c7820 Merge pull request #5512 from crosbymichael/set-freezer 
Add ability to set cgroups freezer
 2014-04-30 16:50:01 -07:00
Michael Crosby
5f6fda8cfd Add ability to set cgroups freezer 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-04-30 16:07:12 -07:00
Michael Crosby
f110401437 Remove statewriter interface, export more libcontainer funcs 
This temp. expands the Exec method's signature but adds a more robust
way to know when the container's process is actually released and begins
to run.  The network interfaces are not guaranteed to be up yet but this
provides a more accurate view with a single callback at this time.
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-04-30 15:52:40 -07:00
Michael Crosby
cd8cec854b Export SetupUser 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-04-30 15:27:59 -07:00
Michael Crosby
162dafbcd5 Remove logger from nsinit struct 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-04-30 15:24:18 -07:00
Michael Crosby
bfedf247a4 Merge pull request #5498 from tianon/better-apparmor-missing-error 2014-04-30 15:16:43 -07:00
Guillaume J. Charmes
2a711d16e0 Merge pull request #5448 from crosbymichael/selinux-defaults 
Add selinux label support for processes and mount
 2014-04-30 14:14:39 -07:00
Michael Crosby
2fc5bed61d Merge pull request #5506 from crosbymichael/add-system-maintainer 
Add system maintainers
 2014-04-30 14:14:21 -07:00
Michael Crosby
e88ef454b7 Merge pull request #5464 from tianon/close-leftover-fds 2014-04-30 12:27:52 -07:00
Michael Crosby
6203d8b462 Add system maintainers 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-04-30 12:01:06 -07:00
Bryan Matsuo
99284a24e7 FIXES #5398: pkg/graphdb build only dependent on cgo tag 
Docker-DCO-1.1-Signed-off-by: Bryan Matsuo <bryan.matsuo@gmail.com> (github: bmatsuo)
 2014-04-30 11:57:10 -06:00
Tianon Gravi
defecac279 Fix various MAINTAINERS format inconsistencies 
Docker-DCO-1.1-Signed-off-by: Andrew Page <admwiggin@gmail.com> (github: tianon)
 2014-04-30 11:22:11 -06:00
Alexander Larsson
e802b69146 beam: Add more tests to unix_test.go 
These are failing, and indicate things that need to be fixed.  The
primarily problem is the lack of framing between beam messages.

Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
[solomon@docker.com: rebased on master]
Signed-off-by: Solomon Hykes <solomon@docker.com>
 2014-04-30 02:10:09 -07:00
Tianon Gravi
a1a9baf926 Update pkg/apparmor to provide a better error message when apparmor_parser cannot be found 
Docker-DCO-1.1-Signed-off-by: Andrew Page <admwiggin@gmail.com> (github: tianon)
 2014-04-29 23:19:21 -06:00
Tianon Gravi
d5d62ff955 Close extraneous file descriptors in containers 
Without this patch, containers inherit the open file descriptors of the daemon, so my "exec 42>&2" allows us to "echo >&42 some nasty error with some bad advice" directly into the daemon log. :)

Also, "hack/dind" was already doing this due to issues caused by the inheritance, so I'm removing that hack too since this patch obsoletes it by generalizing it for all containers.

Docker-DCO-1.1-Signed-off-by: Andrew Page <admwiggin@gmail.com> (github: tianon)
 2014-04-29 16:45:28 -06:00
Michael Crosby
bf59e67232 Merge pull request #5476 from rjnagal/libcontainer-fixes 
Cleanup cgroups on Set failures
 2014-04-29 12:27:31 -07:00
Rohit Jnagal
070747a213 Cleanup existing controllers when cleanup fails mid-way. 
Docker-DCO-1.1-Signed-off-by: Rohit Jnagal <jnagal@google.com> (github: rjnagal)
 2014-04-29 18:59:20 +00:00
Michael Crosby
0c7143b323 Add mountlabel to dev 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-04-29 03:41:44 -07:00
Michael Crosby
46e05ed2d9 Update process labels to be set at create not start 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-04-29 03:40:05 -07:00
Dan Walsh
12934ef3a4 Fix SELinux errors caused by multi-threading 
Occasionally the selinux_test program will fail because we are setting file
context based on the Process ID but not the TID.  THis change will always
use the TID to set SELinux labels.

Docker-DCO-1.1-Signed-off-by: Daniel Walsh <dwalsh@redhat.com> (github: rhatdan)
Docker-DCO-1.1-Signed-off-by: Dan Walsh <dwalsh@redhat.com> (github: crosbymichael)
 2014-04-29 03:40:05 -07:00
Dan Walsh
b7942ec2ca This patch reworks the SELinux patch to be only run on demand by the daemon 
Added --selinux-enable switch to daemon to enable SELinux labeling.

The daemon will now generate a new unique random SELinux label when a
container starts, and remove it when the container is removed.   The MCS
labels will be stored in the daemon memory.  The labels of containers will
be stored in the container.json file.

When the daemon restarts on boot or if done by an admin, it will read all containers json files and reserve the MCS labels.

A potential problem would be conflicts if you setup thousands of containers,
current scheme would handle ~500,000 containers.

Docker-DCO-1.1-Signed-off-by: Dan Walsh <dwalsh@redhat.com> (github: rhatdan)
Docker-DCO-1.1-Signed-off-by: Dan Walsh <dwalsh@redhat.com> (github: crosbymichael)
 2014-04-29 03:40:05 -07:00
Michael Crosby
f0e6e135a8 Initial work on selinux patch 
This has every container using the docker daemon's pid for the processes
label so it does not work correctly.
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-04-29 03:40:05 -07:00
Michael Crosby
69d56acd45 Merge pull request #5455 from rjnagal/cgroup-stats 
Add throttling stats for cpu cgroup
 2014-04-28 17:53:37 -07:00
Rohit Jnagal
d724242297 Another test to check for invalid stats. 
Docker-DCO-1.1-Signed-off-by: Rohit Jnagal <jnagal@google.com> (github: rjnagal)
 2014-04-29 00:32:05 +00:00
Rohit Jnagal
61f156d521 Add cpu throttling stats. 
Docker-DCO-1.1-Signed-off-by: Rohit Jnagal <jnagal@google.com> (github: rjnagal)
 2014-04-29 00:18:18 +00:00
Michael Crosby
5b3f7851d8 Merge pull request #5451 from vmarmol/add-memory-stats 
Adding a unit test for stats in pkg/cgroup/fs/memory.go
 2014-04-28 16:38:34 -07:00
Victor Vieux
eb6a1c9f49 Merge pull request #5449 from tianon/remove-libcontainer-root-special-case 
Remove "root" and "" special cases in libcontainer
 2014-04-28 16:29:08 -07:00
Rohit Jnagal
c44c51e3ce Merge branch 'master' into libcontainer-fixes 
Conflicts:
	pkg/libcontainer/README.md
	pkg/libcontainer/container.json

Docker-DCO-1.1-Signed-off-by: Rohit Jnagal <jnagal@google.com> (github: rjnagal)
 2014-04-28 23:04:04 +00:00
Victor Marmol
76f95294a3 Adding a unit test for pkg/cgroup/fs/memory.go 
Docker-DCO-1.1-Signed-off-by: Victor Marmol <vmarmol@google.com> (github: vmarmol)
 2014-04-28 22:58:25 +00:00
Tianon Gravi
d98069030d Remove "root" and "" special cases in libcontainer 
These are unnecessary since the user package handles these cases properly already (as evidenced by the LXC backend not having these special cases).

I also updated the errors returned to match the other libcontainer error messages in this same file.

Also, switching from Setresuid to Setuid directly isn't a problem, because the "setuid" system call will automatically do that if our own effective UID is root currently: (from `man 2 setuid`)

    setuid() sets the effective user ID of the calling process.  If the
    effective UID of the caller is root, the real UID and saved set-user-
    ID are also set.

Docker-DCO-1.1-Signed-off-by: Andrew Page <admwiggin@gmail.com> (github: tianon)
 2014-04-28 16:46:03 -06:00
Michael Crosby
b386f2f558 Merge pull request #5412 from vmarmol/add-blkio-test 
Adding a test for blkio stats.
 2014-04-28 12:50:20 -07:00
Michael Crosby
3c5bac0348 Merge pull request #5394 from vmarmol/add-croup-memory-stats 
Add memory usage and max usage stats.
 2014-04-28 12:44:34 -07:00
Victor Marmol
f4055ee2a4 Adding a test for blkio stats. 
Also adds a test utility we can use for other cgroup tests.

Docker-DCO-1.1-Signed-off-by: Victor Marmol <vmarmol@google.com> (github: vmarmol)
 2014-04-26 07:29:13 +00:00
unclejack
44140f7909 Merge pull request #5411 from crosbymichael/lockdown 
Update default restrictions for exec drivers
 2014-04-26 03:27:56 +03:00
Rohit Jnagal
8cdb720d26 Updated sample config to be usable. We should change the namespace 
config to not need "value" later.

Docker-DCO-1.1-Signed-off-by: Rohit Jnagal <jnagal@google.com> (github: rjnagal)
 2014-04-25 21:10:23 +00:00
Rohit Jnagal
24f978094d Updated sample config and README to match the default template for 
native execdriver.

Docker-DCO-1.1-Signed-off-by: Rohit Jnagal <jnagal@google.com> (github: rjnagal)
 2014-04-25 06:02:30 +00:00
Victor Marmol
ad924959a9 Add memory usage and max usage stats. 
Docker-DCO-1.1-Signed-off-by: Victor Marmol <vmarmol@google.com> (github: vmarmol)
 2014-04-25 02:51:28 +00:00
Rohit Jnagal
580c2620e7 Improved README formatting. 
Docker-DCO-1.1-Signed-off-by: Rohit Jnagal <jnagal@google.com> (github: rjnagal)
 2014-04-25 01:23:48 +00:00
Rohit Jnagal
569b234135 Add enabled option to namespaces and capabilities spec in 
container.json. Although we don't yet check for enabled everywhere.

Docker-DCO-1.1-Signed-off-by: Rohit Jnagal <jnagal@google.com> (github: rjnagal)
 2014-04-25 01:10:11 +00:00
Rohit Jnagal
0aacca3ae6 Fix typos in nsinit logs. 
Docker-DCO-1.1-Signed-off-by: Rohit Jnagal <jnagal@google.com> (github: rjnagal)
 2014-04-25 00:20:14 +00:00
Rohit Jnagal
14b2a9de87 Fix container.json sample to be loadable by nsinit. 
Docker-DCO-1.1-Signed-off-by: Rohit Jnagal <jnagal@google.com> (github: rjnagal)
 2014-04-25 00:17:45 +00:00
Victor Marmol
f188b9f623 Separating cgroup Memory and MemoryReservation. 
This will allow for these to be set independently. Keep the current Docker behavior where Memory and MemoryReservation are set to the value of Memory.

Docker-DCO-1.1-Signed-off-by: Victor Marmol <vmarmol@google.com> (github: vmarmol)
 2014-04-24 11:09:38 -07:00
Michael Crosby
d5c9f61ecc Ignore isnot exists errors for proc paths 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-04-24 10:35:20 -07:00
Michael Crosby
fa5cabf9fe Update init for new apparmor import path 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-04-24 10:35:20 -07:00
Michael Crosby
2d31aeb911 Update container.json and readme 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-04-24 10:35:20 -07:00
Michael Crosby
7a0b361066 Move capabilities into security pkg 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-04-24 10:35:20 -07:00
Michael Crosby
156987c118 Move mounts into types.go 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-04-24 10:35:20 -07:00
Michael Crosby
a949d39f19 Move rest of console functions to pkg 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-04-24 10:35:20 -07:00
Michael Crosby
05b611574f Refactor mounts into pkg to make changes easier 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-04-24 10:35:20 -07:00
Michael Crosby
de3d51b0a8 Move console into its own package 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-04-24 10:35:20 -07:00
Michael Crosby
5ba1242bdc Mount over dev and only copy allowed nodes in 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-04-24 10:35:20 -07:00
Michael Crosby
81e5026a6a No not mount sysfs by default for non privilged containers 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-04-24 10:35:20 -07:00
Michael Crosby
60a90970bc Add restrictions to proc in libcontainer 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-04-24 10:35:19 -07:00
Michael Crosby
d26ea78e42 Move apparmor into security sub dir 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-04-24 10:35:19 -07:00
Rohit Jnagal
264dc8a46b Add support for cpu hardcapping to cgroups. 
Docker-DCO-1.1-Signed-off-by: Rohit Jnagal <jnagal@google.com> (github: rjnagal)
 2014-04-24 14:43:02 +00:00
Solomon Hykes
bf51f36d8f Fix Go formatting in beam and dockerscript 
Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
 2014-04-22 16:16:29 -07:00
Solomon Hykes
0bf2109121 pkg/dockerscript: add MAINTAINERS file 
Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
 2014-04-22 15:50:24 -07:00
Solomon Hykes
bc6303f15d beam/examples/beamsh: 'chdir' changes the current directory 
Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
 2014-04-22 15:50:24 -07:00
Solomon Hykes
6ce4d2c842 beam/examples/beamsh: 'exec' can communicate with its child via beam. 
Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
 2014-04-22 15:50:24 -07:00
Solomon Hykes
271ba18043 beam/examples/beamsh: use beam.Router to simplify 'multiprint' and fix job passthrough 
Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
 2014-04-22 15:50:23 -07:00
Solomon Hykes
0d08d36bf5 beam: new routing functions Route.KeyEquals, Route.KeyIncludes, Route.NoKey 
Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
 2014-04-22 15:50:23 -07:00
Solomon Hykes
30424f4e3a beam/examples/beamsh: use beam.Router to simplify 'trace' 
Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
 2014-04-22 15:50:23 -07:00
Solomon Hykes
d3df4b5baf beam/examples/beamsh: move builtins to a separate file for readability 
Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
 2014-04-22 15:50:23 -07:00
Solomon Hykes
0822d67b2d beam/examples/beamsh: simplify commands by always creating and sending stdout and stderr for them 
Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
 2014-04-22 15:50:23 -07:00
Solomon Hykes
63fd2ec0f7 beam/examples/beamsh: use beam.Router to simplify 'logger' 
Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
 2014-04-22 15:50:23 -07:00
Solomon Hykes
9206b18818 beam/examples/beamsh: use beam.Router to simplify the 'stdio' command 
Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
 2014-04-22 15:50:23 -07:00
Solomon Hykes
8f5435e80c beam: Router can route beam messages with a convenient set of rules and handlers 
Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
 2014-04-22 15:50:23 -07:00
Solomon Hykes
40b4f86eab beam/examples/beamsh: move example scripts to scripts/ 
Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
 2014-04-22 15:50:22 -07:00
Alexander Larsson
1fb0bf1b3b beam: Fix double close of fds in SendUnix 
Instead of calling syscall.Close() on the fds in sendUnix() we call
Close() on the *os.File in Send(). Otherwise the fd will be closed, but
the *os.File will continue to live, and when it is finalized the
fd will be closed (which by then may be reused and can be anything).

This also adds a note to Send() the the file is closed.

Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
 2014-04-22 15:50:22 -07:00
Solomon Hykes
a88d8d678b beam: more unit tests 
This adds testing to SendConn.

Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
 2014-04-22 15:50:22 -07:00
Solomon Hykes
06df94d55b beam/examples/beamsh: add scripts to reproduce various bugs 
Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
 2014-04-22 15:50:22 -07:00
Solomon Hykes
d0ca66dded beam/examples/beamsh: fix 'print' to be pass-through 
Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
 2014-04-22 15:50:22 -07:00
Solomon Hykes
b97375fc29 beam/examples/beamsh: rename 'log' to 'logger' to avoid conflict with stdout/stderr 
Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
 2014-04-22 15:50:22 -07:00
Solomon Hykes
a2b88b4915 beam/examples/beamsh: 'prompt' asks the user for a value and sends it. 
Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
 2014-04-22 15:50:22 -07:00
Solomon Hykes
ed62ca5b2f beam/examples/beamsh: commands are messages. 
Commands in the pipeline should either implement or pass-through command messages.

This amounts to a proof-of-concept implementation of the "pipeline"
design of Docker plugins.

Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
 2014-04-22 15:50:22 -07:00
Solomon Hykes
2f4b8b7e8d beam/examples/beamsh: cosmetic fix in Fatalf 
Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
 2014-04-22 15:50:22 -07:00
Solomon Hykes
4f92ffb500 beam: replace SendPair() with the simpler SendConn() 
Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
 2014-04-22 15:50:21 -07:00
Solomon Hykes
5833e78887 beam/examples/beamsh: miniserver.ds demo 
Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
 2014-04-22 15:50:21 -07:00
Solomon Hykes
70d3262161 beam: improve the API with Sender/Receiver interfaces and utilities: Copy/SendPipe/SendPair 
Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
 2014-04-22 15:50:21 -07:00
Alexander Larsson
b0228d94be beam: Make extracted Fds CloseOnExec 
Grab forklock to make sure no forks accidentally inherit the new fds
before they are made CLOEXEC There is a slight race condition between
ReadMsgUnix returns and when we grap the lock, so this is not
perfect. Unfortunately There is no way to pass MSG_CMSG_CLOEXEC to
recvmsg() nor any way to implement non-blocking i/o in go, so this is
hard to fix.

Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
 2014-04-22 15:50:21 -07:00
Solomon Hykes
207e604bad beam/examples/beamsh: add a few example dockerscripts 
Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
 2014-04-22 15:50:21 -07:00
Solomon Hykes
29ddf2be1e beam/examples/beamsh: simplify code by using sendWPipe utility 
Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
 2014-04-22 15:50:21 -07:00
Solomon Hykes
1dc449e11d beam/examples/beamsh: move code around for readability 
Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
 2014-04-22 15:50:21 -07:00
Solomon Hykes
3a2b31a30b beam/examples/beamsh: 'exec' adds 'fromcmd' field to its output 
Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
 2014-04-22 15:50:21 -07:00
Solomon Hykes
7534f7a34b beam/examples/beamsh: simple 'log' command tees streams to a local directory 
Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
 2014-04-22 15:50:21 -07:00
Solomon Hykes
4f5b94d369 beam/examples/beamsh: 'render' and 'beamsh -x' 
Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
 2014-04-22 15:50:20 -07:00
Solomon Hykes
4ebe7aab91 beam/examples/beamsh: run commands in an implicit context of pre-loaded 'plugins' 
Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
 2014-04-22 15:50:20 -07:00
Solomon Hykes
cd85af06fe beam/examples/beamsh: convenience commands 'devnull', 'echo' and 'stdio' 
Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
 2014-04-22 15:50:20 -07:00
Solomon Hykes
6d9cdbf24f beam/examples/beamsh: 'emit' supports key=value syntax to compose arbitrary objects 
Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
 2014-04-22 15:50:20 -07:00
Solomon Hykes
2b81fb8424 dockerscript: '=' is not a special character 
Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
 2014-04-22 15:50:20 -07:00
Solomon Hykes
6e0a156d90 beam/examples/beamsh: support for background commands with '&' terminator 
Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
 2014-04-22 15:50:20 -07:00
Solomon Hykes
08686f1d21 beam/data: Message.Parse creates a message from shell-style 'key=value' arguments 
Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
 2014-04-22 15:50:20 -07:00
Solomon Hykes
ffe19414b1 dockerscript: support '#' line comments 
Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
 2014-04-22 15:50:20 -07:00
Solomon Hykes
e1c8dbba97 beam/examples/beamsh: scripts can be passed as filenames 
Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
 2014-04-22 15:50:20 -07:00
Solomon Hykes
222fc87ade beam/examples/beamsh: remote communication over beam (experimental). 
Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
 2014-04-22 15:50:20 -07:00
Solomon Hykes
371f6fc63d beam/examples/beamsh: 'in' chdirs to a directory. 'pass' does simple passthrough 
Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
 2014-04-22 15:50:19 -07:00
Solomon Hykes
6d5c75a224 beam/examples/beamsh: 'beamsend' command serializes all messages and sends them over a network connection 
Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
 2014-04-22 15:50:19 -07:00
Solomon Hykes
5ddf673851 beam/examples/beamsh: 'exec' command correctly closes stdout and stderr when the process exists 
Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
 2014-04-22 15:50:19 -07:00
Solomon Hykes
e512fef425 beam/examples/beamsh: don't print discarded messages in Devnull 
This avoids false alarms when process exits without printing. Devnull
doesn't require synchronization.

Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
 2014-04-22 15:50:19 -07:00
Solomon Hykes
34c5724b89 beam/examples/beamsh: more useful debugging 
Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
 2014-04-22 15:50:19 -07:00
Solomon Hykes
a5bc75d406 beam/data: expose EncodeString for convenience access to the underlying netstring primitive 
Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
 2014-04-22 15:50:19 -07:00
Solomon Hykes
fb1af1f0bc beam/examples/beamsh: utility function 'fileToConn' 
Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
 2014-04-22 15:50:19 -07:00
Solomon Hykes
74b90c25d9 beam/examples/beamsh: 'connect' command 
Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
 2014-04-22 15:50:19 -07:00
Solomon Hykes
dff9854305 beam/examples/beamsh: 'exec' and 'listen' commands 
Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
 2014-04-22 15:50:19 -07:00
Solomon Hykes
3686d50429 beam/examples/beamsh: prettier devnull 
Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
 2014-04-22 15:50:18 -07:00
Solomon Hykes
c9b8e0fcac beam/data: prettier Message.Pretty() 
Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
 2014-04-22 15:50:18 -07:00
Solomon Hykes
d7a2ae8e13 beam/examples/beamsh: prettier 'trace' command 
Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
 2014-04-22 15:50:18 -07:00
Solomon Hykes
eca6fecb59 beam/data: convenience Message.Pretty() function 
Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
 2014-04-22 15:50:18 -07:00
Solomon Hykes
d4920b3fff beam/examples/beamsh: basic implementation of the pipeline design, with static handlers for now. 
In the pipeline design, several beam commands can be run concurrently,
with their respective inputs and outputs connected in such a way that
beam messages flow from the first to last. This is similar to the way
a unix shell executes commands in a pipeline: instead of STDIN and
STDOUT, each beam command has a "BEAMIN" and "BEAMOUT".

Since beam allows for richer communication than plain byte streams, beam
pipelines can express more powerful computation, while retaining the
fundamental elegance and ease of use of unix-style composition.

Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
 2014-04-22 15:50:18 -07:00
Solomon Hykes
ec288895e5 beam/examples/beamsh: better debugging messages 
Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
 2014-04-22 15:50:18 -07:00
Solomon Hykes
ab2010cfd3 beam/examples/beamsh: simple 'exec' command 
Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
 2014-04-22 15:50:18 -07:00
Solomon Hykes
5689792171 beam/examples/beamsh: catch introspection calls from jobs for proper nesting 
Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
 2014-04-22 15:50:18 -07:00
Solomon Hykes
bcd31405cf beam: fix FD leaks in SendPipe 
This fixes file descriptor leaks in the SendPipe function.

Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
 2014-04-22 15:50:18 -07:00
Solomon Hykes
1737063904 beam: more hooks for interactive debugging 
This inserts low-level hooks for interactive step-by-step debugging.
Hooks are triggered by setting the *TEST* environment variable.

This is particularly useful for tracking down file descriptor leaks,
double-closing, or other issues which are difficult to debug with
the usual toolbox.

Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
 2014-04-22 15:50:17 -07:00
Solomon Hykes
6072dec9e7 beam/examples/beamsh: first try at nested execution 
The "wiring" is broken because engine does not keep a reference for handling introspection calls.

Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
 2014-04-22 15:50:17 -07:00
Solomon Hykes
8697490740 beam/examples/beamsh: fix a bug in the log command 
Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
 2014-04-22 15:50:17 -07:00
Solomon Hykes
488fe61354 beam/data: convenience Message.Get 
Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
 2014-04-22 15:50:17 -07:00
Solomon Hykes
460c98d92d beam/examples/beamsh: use beam/data 
Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
 2014-04-22 15:50:17 -07:00
Solomon Hykes
5bcf2a736c beam/data: Message.Bytes() convenience method 
Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
 2014-04-22 15:50:17 -07:00
Solomon Hykes
99dda11d45 beam/data: fix a bug in encoding of multi-value maps 
Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
 2014-04-22 15:50:17 -07:00
Solomon Hykes
276fb1918d beam/data: convenience Message type for chained manipulation 
Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
 2014-04-22 15:50:17 -07:00
Solomon Hykes
916372c76f Beam: remove leftover debugging messages 
Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
 2014-04-22 15:50:17 -07:00
Solomon Hykes
cb66e8c136 beam/examples/beamsh: hide debug messages in examples/beamsh by default 
Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
 2014-04-22 15:50:17 -07:00
Solomon Hykes
97a2c0ebe6 beam/data: a simple format for sending structured data over beam 
Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
 2014-04-22 15:50:16 -07:00
Solomon Hykes
771e493457 beam/examples/beamsh: more bells and whistles for demos 
* Automatically switch to interactive mode when stdin is a terminal

* Basic implementation of "responses"

Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
 2014-04-22 15:50:16 -07:00
Solomon Hykes
851c1b05d0 Beam: fix bug in beamsh which 'swapped' FDs because of underlying implementation of net.FileConn 
Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
 2014-04-22 15:50:16 -07:00
Solomon Hykes
4481e80636 pkg/dockerscript: <!> is not a special character 
Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
 2014-04-22 15:50:16 -07:00
Solomon Hykes
07c03944ff Beam: don't close the attachment FD when closing superfluous FDs 
Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
 2014-04-22 15:50:16 -07:00
Solomon Hykes
8875cdf561 Beam: debugging hooks for easy step-by-step inspection of the FD table 
Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
 2014-04-22 15:50:16 -07:00
Solomon Hykes
f586dcf307 beam/examples/beamsh: use 'log' command to pass stdout 
Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
 2014-04-22 15:50:16 -07:00
Solomon Hykes
d00a6b7648 beam/examples/beamsh: basic execution of commands, with in-process beam and dummy handlers 
Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
 2014-04-22 15:50:16 -07:00
Solomon Hykes
f0933a91b0 pkg/dockerscript: remove debug messages 
Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
 2014-04-22 15:50:16 -07:00
Solomon Hykes
5c14c3ada5 pkg/dockerscript: '.' is not a special character 
Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
 2014-04-22 15:50:15 -07:00
Solomon Hykes
f94a18677a Beam: Send: pass the underlying error unchanged to allow io.EOF detection 
Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
 2014-04-22 15:50:15 -07:00
Solomon Hykes
11f2531da6 pkg/dockerscript: expose a simple, clean API with a single Parse method 
Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
 2014-04-22 15:50:15 -07:00
Solomon Hykes
7f00a3b665 beam/examples/beamsh: correctly parse nested commands 
Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
 2014-04-22 15:50:15 -07:00
Solomon Hykes
fd890136a9 dockerscript: patch text/scanner to use a shell-like syntax instead of the default go-like syntax 
Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
 2014-04-22 15:50:15 -07:00
Solomon Hykes
cd8ddacdc7 pkg/dockerscript: a simple shell-like syntax to express docker operations 
Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
 2014-04-22 15:50:15 -07:00
Solomon Hykes
be470f2497 Beam: beamsh is a mini-shell which runs processes and communicates with them over beam 
Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
 2014-04-22 15:50:15 -07:00
Solomon Hykes
0e42c7d889 Beam: basic test harness for the unix socket implementation. 
Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
 2014-04-22 15:50:15 -07:00
Solomon Hykes
59853c188d Beam: USocketPair returns a *net.UnixConn socket pair for convenience. 
Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
 2014-04-22 15:50:15 -07:00
Solomon Hykes
c401c43cae Beam: fix file descriptor leaks 
* Close all file descriptors successfully sent as attachment
* Close duplicate file descriptors created by net.FileCon and net.UnixConn.File

Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
 2014-04-22 15:50:15 -07:00
Solomon Hykes
b637e5f04a Beam: change the prototype of SendPipe() to return a *net.UnixSocket 
Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
 2014-04-22 15:50:14 -07:00
Solomon Hykes
188c2ef806 Beam: allow sending messages without attachments. 
Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
 2014-04-22 15:50:14 -07:00
Solomon Hykes
3960da04c8 Beam: convenience functions Listen and Connect 
These convenience functions expose a familiar face to the unknown and bizarre world of beam networking.

Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
 2014-04-22 15:50:14 -07:00
Solomon Hykes
5957e6b385 Beam: a simple stream-oriented communication protocol for distributed systems. 
This patch includes a stripped down implementation with a bare minimum
unix socket transport. It relies on fd passing for stream multiplexing.

The purpose of this first patch is to allow implementation of dynamic
linking, which will allow advanced service discovery.

Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
 2014-04-22 15:50:14 -07:00
Guillaume J. Charmes
7816712457 Merge pull request #5328 from crosbymichael/refactor-cgroups 
Refactor cgroups into subsystems and support metrics
 2014-04-21 14:06:17 -07:00
unclejack
c0d5eac120 Merge pull request #5223 from crosbymichael/load-profile 
Use apparmor parser directly
 2014-04-21 21:50:59 +03:00
Guillaume J. Charmes
813cebc64f
Merge branch 'master' into load-profile 
Conflicts:
	daemon/execdriver/native/create.go
	daemon/execdriver/native/driver.go

Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume@charmes.net> (github: creack)
 2014-04-21 10:32:13 -07:00
Guillaume J. Charmes
ac814ee3c7
Make sure @proc is defined 
Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume@charmes.net> (github: creack)
 2014-04-21 10:28:04 -07:00
Michael Crosby
004cf556e8 Use cgo to get systems clock ticks for metrics 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-04-21 10:26:22 -07:00
Michael Crosby
f59be989dc Refactor stat parsing to use only 8 fields 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-04-20 20:45:08 -07:00
Evan Hazlett
2f24b5a9dc work on cpu stats 
Docker-DCO-1.1-Signed-off-by: Evan Hazlett <ejhazlett@gmail.com> (github: ehazlett)
 2014-04-21 00:07:05 -04:00
Michael Crosby
bce49dff0d Add freezer stats 
This one is a problem because the most useful stat is a string and not a
float like verything else.  We may have to change the return type
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-04-20 18:35:33 -07:00
Michael Crosby
3bfe13de2c Reuse cpuacct stats for cpu subsystem 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-04-20 18:20:44 -07:00
Michael Crosby
37248039e1 Fix parsing of blkio files 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-04-20 18:18:17 -07:00
Michael Crosby
7f12260fd1 Add external function to get cgroup stats 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-04-20 17:36:20 -07:00
Michael Crosby
9b65f16355 Refactor stats and add them to all subsystems 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-04-20 12:02:39 -07:00
Michael Crosby
86e34ce59f Squashed commit of the following: 
commit 75af1649b063abbc5d662fd2f8bc4ff62c927687
Author: Evan Hazlett <ejhazlett@gmail.com>
Date:   Sun Apr 20 01:32:42 2014 -0400

    more refactor

commit 43b36d0f15d634497127bcb17dacaa70ae92e903
Author: Evan Hazlett <ejhazlett@gmail.com>
Date:   Sun Apr 20 01:11:49 2014 -0400

    refactored cgroup param parsing to util func

commit e3738b0168a075bd92ec828879b0e46bdbbe3845
Author: Evan Hazlett <ejhazlett@gmail.com>
Date:   Sun Apr 20 00:57:19 2014 -0400

    dat error checking

commit 57872bcc59403ecd308cfe97c78f73d6ca58d165
Author: Evan Hazlett <ejhazlett@gmail.com>
Date:   Sun Apr 20 00:43:25 2014 -0400

    proper use of fmt.Errorf

commit 43dad6acc0cb21aac2b04ce074699879898ee820
Author: Evan Hazlett <ejhazlett@gmail.com>
Date:   Sun Apr 20 00:36:45 2014 -0400

    proper placement of defer

commit b7f20b934b2bc92cd39397dbc608b77bff28493c
Author: Evan Hazlett <ejhazlett@gmail.com>
Date:   Sun Apr 20 00:34:39 2014 -0400

    defers, error checking, panic avoidance

commit 7a9a6ff267f8806dfe6676486f73fe89b72968fb
Author: Evan Hazlett <ejhazlett@gmail.com>
Date:   Sun Apr 20 00:22:00 2014 -0400

    data param to use container info instead of host

commit 0e0cf7309be1644687160d6519db792b23cd26e9
Author: Evan Hazlett <ejhazlett@gmail.com>
Date:   Sun Apr 20 00:11:29 2014 -0400

    added stats for cpuacct, memory, and blkio

Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-04-20 11:34:28 -07:00
Michael Crosby
7fdeda8717 Add remove method to subsystems 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-04-18 22:17:31 -07:00
Michael Crosby
e92f2fd395 Break down groups into subsystems 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-04-18 22:10:30 -07:00
Michael Crosby
06db0604e5 Move raw cgroups into fs package (filesystem) 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-04-18 21:34:26 -07:00
Michael Crosby
ec43ec50b4 Move systemd code into pkg 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-04-18 21:30:08 -07:00
Michael Crosby
42fb2973c6 Refactor cgroups file locations 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-04-18 21:14:58 -07:00
Kato Kazuyoshi
92ea101bc4 SQLite is also available in FreeBSD 
Docker-DCO-1.1-Signed-off-by: Kato Kazuyoshi <kato.kazuyoshi@gmail.com> (github: kzys)
 2014-04-17 07:19:30 +09:00
Kato Kazuyoshi
3754fdd7ca Support FreeBSD on pkg/mount 
Docker-DCO-1.1-Signed-off-by: Kato Kazuyoshi <kato.kazuyoshi@gmail.com> (github: kzys)
 2014-04-15 23:16:51 +09:00
Kato Kazuyoshi
ca7a0e6d6e FreeBSD's nullfs doesn't support file mount 
FreeBSD doesn't have "bind" mount, but nullfs might be a similar feature.
However nullfs can mount only directories.

Docker-DCO-1.1-Signed-off-by: Kato Kazuyoshi <kato.kazuyoshi@gmail.com> (github: kzys)
 2014-04-15 05:40:23 +09:00
Kato Kazuyoshi
a7e181c857 Add a test for mount.GetMounts 
Because mount.parseInfoFile is only available on Linux

Docker-DCO-1.1-Signed-off-by: Kato Kazuyoshi <kato.kazuyoshi@gmail.com> (github: kzys)
 2014-04-15 05:40:23 +09:00
Victor Vieux
5fc1b4d2cd Merge pull request #5132 from crosbymichael/fix-cgroup-hiar 
Setup cgroups for supported subsystems
 2014-04-14 10:56:15 -07:00
Guillaume J. Charmes
f98ed28c1d Merge pull request #4878 from kzys/freebsd-utimes 
Support FreeBSD on pkg/system/utimes_*.go
 2014-04-14 10:39:25 -07:00
Michael Crosby
3061a6a2ab Generate imports based on what is avaliable 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-04-14 05:22:45 +00:00
Michael Crosby
184728e7bc Ignore not exist errors for joining default subsystems 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-04-14 00:07:48 +00:00
Michael Crosby
6c26a87901 Ignore is not exist error 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-04-14 00:03:35 +00:00
Michael Crosby
052cc5a637 Move apparmor to top level pkg 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-04-13 23:33:25 +00:00
Michael Crosby
5f4bc4f916 Use apparmor_parser directly 
The current load script does alot of things.  If it does not find the
parser loaded on the system it will just exit 0 and not load the
profile.  We think it should fail loudly if it cannot load the profile
and apparmor is enabled on the system.
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-04-13 23:31:10 +00:00
Alexander Larsson
4ddfffcab3 Join memory and cpu cgroup in systemd too 
Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: crosbymichael)
 2014-04-11 17:29:40 +00:00
Michael Crosby
505184d2dc Join cpuacct, freezer, perf_event, and blkio groups 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-04-11 17:28:27 +00:00
Michael Crosby
031fcb31d3 Setup cgroups for all subsystems 
Fixes #5117
Fixes #5118
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-04-11 17:28:27 +00:00
Victor Vieux
b8c10d8af2 Merge pull request #5143 from kzys/ns-nil 
Avoid "invalid memory address or nil pointer dereference" panic
 2014-04-10 11:07:35 -07:00
Guillaume J. Charmes
042a50a8fe Merge pull request #5131 from crosbymichael/shm-mode 
Change shm mode to 1777
 2014-04-10 07:50:32 -07:00
Guillaume J. Charmes
5b242c95da Merge pull request #5115 from alexlarsson/fix-libcontainer-network-rhel6 
Fix libcontainer network support on rhel6
 2014-04-10 07:45:12 -07:00
Kato Kazuyoshi
c5226d94fa Avoid "invalid memory address or nil pointer dereference" panic 
libcontainer.GetNamespace returns nil on FreeBSD because
libcontainer.namespaceList is empty. In this case, Namespaces#Get should
return nil instead of being panic.

Docker-DCO-1.1-Signed-off-by: Kato Kazuyoshi <kato.kazuyoshi@gmail.com> (github: kzys)
 2014-04-10 22:07:29 +09:00
Kato Kazuyoshi
1c90a4dd9a Support FreeBSD on pkg/system/utimes_*.go 
Implement system.LUtimesNano and system.UtimesNano. The latter might be
removed in future because it's basically same as os.Chtimes. That's why
the test is mainly focusing LUtimesNano.

Docker-DCO-1.1-Signed-off-by: Kato Kazuyoshi <kato.kazuyoshi@gmail.com> (github: kzys)
 2014-04-10 07:34:37 +09:00
Alexander Larsson
59c1b2880b Fix libcontainer network support on rhel6 
It seems that netlink in older kernels, including RHEL6, does not
support RTM_SETLINK with IFLA_MASTER. It just silently ignores it, reporting
no error, causing netlink.NetworkSetMaster() to not do anything yet
return no error.

We fix this by introducing and using AddToBridge() in a very similar manner
to CreateBridge(), which use the old ioctls directly.

This fixes https://github.com/dotcloud/docker/issues/4668

Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
 2014-04-09 15:44:18 +02:00
Michael Crosby
63c303eecd Revert "Support hairpin NAT without going through docker server" 
This reverts commit b39d02b611.

Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-04-09 11:55:08 +00:00
Michael Crosby
986cf931c3 Change shm mode to 1777 
Fixes #5126
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-04-09 10:53:32 +00:00
Michael Crosby
87f0d63fb2 Check for apparmor enabled on host to populate profile 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-04-09 10:22:17 +00:00
Guillaume J. Charmes
4f828d67f0
Backup current docker apparmor profile and replace it with the new one 
Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume@charmes.net> (github: creack)
 2014-04-08 11:09:31 -07:00
Guillaume J. Charmes
8cfbc44661 Merge pull request #5049 from Supermathie/aa-fix 
apparmor: docker-default: Include base abstraction
 2014-04-07 21:34:01 -07:00
Guillaume J. Charmes
1d2126be6c Merge pull request #5025 from dstine/readme-fix 
fixed two readme typos
 2014-04-07 19:31:16 -07:00
Dan Stine
9c4d10b9a9 fixed three more typos 2014-04-07 22:09:15 -04:00
Michael Crosby
b6042f252d Ensure that ro mounts are remounted 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-04-07 18:23:22 -07:00
Michael Crosby
028d44d126 Remove and unexport selinux functions 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-04-07 14:59:44 -07:00
Michael Crosby
82f37b874e Ensure that selinux is disabled by default 
This also includes some portability changes so that the package can be
imported with the top level runtime.
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-04-07 14:44:53 -07:00
Michael Crosby
aaf018017c Add more label checks for selinux enabled 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-04-07 14:44:53 -07:00
Michael Brown
726206f2aa apparmor: pull in variables from tunables/global 
The variables that were defined at the top of the apparmor profile are best
pulled in via the <tunables/global> include.

Docker-DCO-1.1-Signed-off-by: Michael Brown <michael.brown@discourse.org> (github: Supermathie)
 2014-04-07 03:04:27 -04:00
Michael Brown
320b3e0d21 apparmor: abstractions/base expects pid variable 
Add 'pid' variable pointing to 'self' to allow parsing of profile to succeed

Docker-DCO-1.1-Signed-off-by: Michael Brown <michael.brown@discourse.org> (github: Supermathie)
 2014-04-07 02:47:43 -04:00
Michael Brown
e35c23311f apparmor: docker-default: Include base abstraction 
Encountered problems on 14.04 relating to signals between container
processes being blocked by apparmor. The base abstraction contains
appropriate rules to allow this communication.

Docker-DCO-1.1-Signed-off-by: Michael Brown <michael.brown@discourse.org> (github: Supermathie)
 2014-04-07 02:19:38 -04:00
Dan Stine
bea71245c8 fixed two readme typos 2014-04-04 08:12:17 -04:00
unclejack
a255849129 Merge pull request #5002 from crosbymichael/rhatdan-selinux 
Improve selinux label handling
 2014-04-04 04:43:16 +03:00
Victor Vieux
a278656330 Merge pull request #4991 from ruphin/fix_name_typo 
Fix typo in names-generator
 2014-04-03 16:24:14 -07:00
Goffert van Gool
6cf1378601 Fix typo in names-generator 
Docker-DCO-1.1-Signed-off-by: Goffert van Gool <ruphin@ruphin.net> (github: ruphin)
 2014-04-04 00:57:43 +02:00
Victor Vieux
9687c087ab Merge pull request #4953 from rhatdan/selinux 
These two patches should fix problems we see with running docker in the wild.
 2014-04-02 16:36:41 -07:00
Michael Crosby
94233a204f Fix lxc label handleing 
This also improves the logic around formatting the labels for selinux
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-04-02 16:52:49 +00:00
Michael Crosby
6e7a93628b Merge branch 'selinux' of https://github.com/rhatdan/docker into rhatdan-selinux 
Conflicts:
	pkg/selinux/selinux.go
	runtime/execdriver/lxc/lxc_template.go

Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-04-02 16:11:35 +00:00
Dan Walsh
d76ac4d429 In certain cases, setting the process label will not happen. 
When the code attempts to set the ProcessLabel, it checks if SELinux Is
enabled.  We have seen a case with some of our patches where the code
is fooled by the container to think that SELinux is not enabled.  Calling
label.Init before setting up the rest of the container, tells the library that
SELinux is enabled and everything works fine.

Docker-DCO-1.1-Signed-off-by: Dan Walsh <dwalsh@redhat.com> (github: rhatdan)
 2014-04-03 09:32:29 -04:00
Dan Walsh
32ad78b043 Remove hard coding of SELinux labels on systems without proper selinux policy. 
If a system is configured for SELinux but does not know about docker or
containers, then we want the transitions of the policy to work.  Hard coding
the labels causes docker to break on older Fedora and RHEL systems

Docker-DCO-1.1-Signed-off-by: Dan Walsh <dwalsh@redhat.com> (github: rhatdan)
 2014-04-03 09:32:29 -04:00
Michael Crosby
18ef3cc24a Remove loopback setup for native driver 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-04-02 13:12:52 +00:00
Kevin Wallace
c94111b619 Allow non-privileged containers to create device nodes. 
Such nodes could already be created by importing a tarball to a container; now
they can be created from within the container itself.

This gives non-privileged containers the mknod kernel capability, and modifies
their cgroup settings to allow creation of *any* node, not just whitelisted
ones.  Use of such nodes is still controlled by the existing cgroup whitelist.

Docker-DCO-1.1-Signed-off-by: Kevin Wallace <kevin@pentabarf.net> (github: kevinwallace)
 2014-04-03 18:44:13 +00:00
Victor Vieux
93bb208164 Merge pull request #4961 from creack/update_version_pkg 
Update Version to not use string anymore
 2014-04-01 18:37:25 -07:00
Victor Vieux
431046e0f5 Merge pull request #4902 from shykes/wozniak_is_not_boring 
Steve Wozniak is not boring.
 2014-04-01 16:49:56 -07:00
unclejack
ceed9382d0 Merge pull request #4931 from crosbymichael/gen-mac-addr-for-bridge 
Set bridge mac addr on supported kernels
 2014-04-02 02:47:56 +03:00
unclejack
30ff3fa954 Merge pull request #4867 from crosbymichael/clean-shutdown 
Cleanly shutdown docker
 2014-04-02 01:48:03 +03:00
Guillaume J. Charmes
3ee37f547f
Update Version to not use string anymore 
Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume@charmes.net> (github: creack)
 2014-04-01 15:46:52 -07:00
Michael Crosby
9cf89f8542 Merge pull request #4942 from vieux/cleanup_dev_libcontainer 
remove setupDev from libcontainer
 2014-04-01 14:28:17 -07:00
Guillaume J. Charmes
b4b87413d8 Merge pull request #4833 from crosbymichael/pluginflag 
Add opts flag for fine grained control over drivers
 2014-04-01 13:34:08 -07:00
Dan Walsh
2224e0d65a In certain cases, setting the process label will not happen. 
When the code attempts to set the ProcessLabel, it checks if SELinux Is
enabled.  We have seen a case with some of our patches where the code
is fooled by the container to think that SELinux is not enabled.  Calling
label.Init before setting up the rest of the container, tells the library that
SELinux is enabled and everything works fine.

Docker-DCO-1.1-Signed-off-by: Dan Walsh <dwalsh@redhat.com> (github: rhatdan)
 2014-04-01 13:30:10 -04:00