daemon_unix.go 63 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697989910010110210310410510610710810911011111211311411511611711811912012112212312412512612712812913013113213313413513613713813914014114214314414514614714814915015115215315415515615715815916016116216316416516616716816917017117217317417517617717817918018118218318418518618718818919019119219319419519619719819920020120220320420520620720820921021121221321421521621721821922022122222322422522622722822923023123223323423523623723823924024124224324424524624724824925025125225325425525625725825926026126226326426526626726826927027127227327427527627727827928028128228328428528628728828929029129229329429529629729829930030130230330430530630730830931031131231331431531631731831932032132232332432532632732832933033133233333433533633733833934034134234334434534634734834935035135235335435535635735835936036136236336436536636736836937037137237337437537637737837938038138238338438538638738838939039139239339439539639739839940040140240340440540640740840941041141241341441541641741841942042142242342442542642742842943043143243343443543643743843944044144244344444544644744844945045145245345445545645745845946046146246346446546646746846947047147247347447547647747847948048148248348448548648748848949049149249349449549649749849950050150250350450550650750850951051151251351451551651751851952052152252352452552652752852953053153253353453553653753853954054154254354454554654754854955055155255355455555655755855956056156256356456556656756856957057157257357457557657757857958058158258358458558658758858959059159259359459559659759859960060160260360460560660760860961061161261361461561661761861962062162262362462562662762862963063163263363463563663763863964064164264364464564664764864965065165265365465565665765865966066166266366466566666766866967067167267367467567667767867968068168268368468568668768868969069169269369469569669769869970070170270370470570670770870971071171271371471571671771871972072172272372472572672772872973073173273373473573673773873974074174274374474574674774874975075175275375475575675775875976076176276376476576676776876977077177277377477577677777877978078178278378478578678778878979079179279379479579679779879980080180280380480580680780880981081181281381481581681781881982082182282382482582682782882983083183283383483583683783883984084184284384484584684784884985085185285385485585685785885986086186286386486586686786886987087187287387487587687787887988088188288388488588688788888989089189289389489589689789889990090190290390490590690790890991091191291391491591691791891992092192292392492592692792892993093193293393493593693793893994094194294394494594694794894995095195295395495595695795895996096196296396496596696796896997097197297397497597697797897998098198298398498598698798898999099199299399499599699799899910001001100210031004100510061007100810091010101110121013101410151016101710181019102010211022102310241025102610271028102910301031103210331034103510361037103810391040104110421043104410451046104710481049105010511052105310541055105610571058105910601061106210631064106510661067106810691070107110721073107410751076107710781079108010811082108310841085108610871088108910901091109210931094109510961097109810991100110111021103110411051106110711081109111011111112111311141115111611171118111911201121112211231124112511261127112811291130113111321133113411351136113711381139114011411142114311441145114611471148114911501151115211531154115511561157115811591160116111621163116411651166116711681169117011711172117311741175117611771178117911801181118211831184118511861187118811891190119111921193119411951196119711981199120012011202120312041205120612071208120912101211121212131214121512161217121812191220122112221223122412251226122712281229123012311232123312341235123612371238123912401241124212431244124512461247124812491250125112521253125412551256125712581259126012611262126312641265126612671268126912701271127212731274127512761277127812791280128112821283128412851286128712881289129012911292129312941295129612971298129913001301130213031304130513061307130813091310131113121313131413151316131713181319132013211322132313241325132613271328132913301331133213331334133513361337133813391340134113421343134413451346134713481349135013511352135313541355135613571358135913601361136213631364136513661367136813691370137113721373137413751376137713781379138013811382138313841385138613871388138913901391139213931394139513961397139813991400140114021403140414051406140714081409141014111412141314141415141614171418141914201421142214231424142514261427142814291430143114321433143414351436143714381439144014411442144314441445144614471448144914501451145214531454145514561457145814591460146114621463146414651466146714681469147014711472147314741475147614771478147914801481148214831484148514861487148814891490149114921493149414951496149714981499150015011502150315041505150615071508150915101511151215131514151515161517151815191520152115221523152415251526152715281529153015311532153315341535153615371538153915401541154215431544154515461547154815491550155115521553155415551556155715581559156015611562156315641565156615671568156915701571157215731574157515761577157815791580158115821583158415851586158715881589159015911592159315941595159615971598159916001601160216031604160516061607160816091610161116121613161416151616161716181619162016211622162316241625162616271628162916301631163216331634163516361637163816391640164116421643164416451646164716481649165016511652165316541655165616571658165916601661166216631664166516661667166816691670167116721673167416751676167716781679168016811682168316841685168616871688168916901691169216931694169516961697169816991700170117021703170417051706170717081709171017111712171317141715171617171718171917201721172217231724172517261727172817291730173117321733173417351736173717381739174017411742174317441745174617471748174917501751
  1. //go:build linux || freebsd
  2. // +build linux freebsd
  3. package daemon // import "github.com/docker/docker/daemon"
  4. import (
  5. "bufio"
  6. "context"
  7. "fmt"
  8. "net"
  9. "os"
  10. "path/filepath"
  11. "runtime"
  12. "runtime/debug"
  13. "strconv"
  14. "strings"
  15. "sync"
  16. "time"
  17. "github.com/containerd/cgroups"
  18. statsV1 "github.com/containerd/cgroups/stats/v1"
  19. statsV2 "github.com/containerd/cgroups/v2/stats"
  20. "github.com/containerd/containerd/pkg/userns"
  21. "github.com/docker/docker/api/types"
  22. "github.com/docker/docker/api/types/blkiodev"
  23. pblkiodev "github.com/docker/docker/api/types/blkiodev"
  24. containertypes "github.com/docker/docker/api/types/container"
  25. "github.com/docker/docker/container"
  26. "github.com/docker/docker/daemon/config"
  27. "github.com/docker/docker/daemon/initlayer"
  28. "github.com/docker/docker/errdefs"
  29. "github.com/docker/docker/libcontainerd/remote"
  30. "github.com/docker/docker/libnetwork"
  31. nwconfig "github.com/docker/docker/libnetwork/config"
  32. "github.com/docker/docker/libnetwork/drivers/bridge"
  33. "github.com/docker/docker/libnetwork/netlabel"
  34. "github.com/docker/docker/libnetwork/options"
  35. lntypes "github.com/docker/docker/libnetwork/types"
  36. "github.com/docker/docker/opts"
  37. "github.com/docker/docker/pkg/containerfs"
  38. "github.com/docker/docker/pkg/idtools"
  39. "github.com/docker/docker/pkg/parsers"
  40. "github.com/docker/docker/pkg/parsers/kernel"
  41. "github.com/docker/docker/pkg/sysinfo"
  42. "github.com/docker/docker/runconfig"
  43. volumemounts "github.com/docker/docker/volume/mounts"
  44. "github.com/moby/sys/mount"
  45. specs "github.com/opencontainers/runtime-spec/specs-go"
  46. "github.com/opencontainers/selinux/go-selinux"
  47. "github.com/opencontainers/selinux/go-selinux/label"
  48. "github.com/pkg/errors"
  49. "github.com/sirupsen/logrus"
  50. "github.com/vishvananda/netlink"
  51. "golang.org/x/sys/unix"
  52. )
  53. const (
  54. isWindows = false
  55. // See https://git.kernel.org/cgit/linux/kernel/git/tip/tip.git/tree/kernel/sched/sched.h?id=8cd9234c64c584432f6992fe944ca9e46ca8ea76#n269
  56. linuxMinCPUShares = 2
  57. linuxMaxCPUShares = 262144
  58. platformSupported = true
  59. // It's not kernel limit, we want this 6M limit to account for overhead during startup, and to supply a reasonable functional container
  60. linuxMinMemory = 6291456
  61. // constants for remapped root settings
  62. defaultIDSpecifier = "default"
  63. defaultRemappedID = "dockremap"
  64. // constant for cgroup drivers
  65. cgroupFsDriver = "cgroupfs"
  66. cgroupSystemdDriver = "systemd"
  67. cgroupNoneDriver = "none"
  68. )
  69. type containerGetter interface {
  70. GetContainer(string) (*container.Container, error)
  71. }
  72. func getMemoryResources(config containertypes.Resources) *specs.LinuxMemory {
  73. memory := specs.LinuxMemory{}
  74. if config.Memory > 0 {
  75. memory.Limit = &config.Memory
  76. }
  77. if config.MemoryReservation > 0 {
  78. memory.Reservation = &config.MemoryReservation
  79. }
  80. if config.MemorySwap > 0 {
  81. memory.Swap = &config.MemorySwap
  82. }
  83. if config.MemorySwappiness != nil {
  84. swappiness := uint64(*config.MemorySwappiness)
  85. memory.Swappiness = &swappiness
  86. }
  87. if config.OomKillDisable != nil {
  88. memory.DisableOOMKiller = config.OomKillDisable
  89. }
  90. if config.KernelMemory != 0 {
  91. memory.Kernel = &config.KernelMemory
  92. }
  93. if config.KernelMemoryTCP != 0 {
  94. memory.KernelTCP = &config.KernelMemoryTCP
  95. }
  96. return &memory
  97. }
  98. func getPidsLimit(config containertypes.Resources) *specs.LinuxPids {
  99. if config.PidsLimit == nil {
  100. return nil
  101. }
  102. if *config.PidsLimit <= 0 {
  103. // docker API allows 0 and negative values to unset this to be consistent
  104. // with default values. When updating values, runc requires -1 to unset
  105. // the previous limit.
  106. return &specs.LinuxPids{Limit: -1}
  107. }
  108. return &specs.LinuxPids{Limit: *config.PidsLimit}
  109. }
  110. func getCPUResources(config containertypes.Resources) (*specs.LinuxCPU, error) {
  111. cpu := specs.LinuxCPU{}
  112. if config.CPUShares < 0 {
  113. return nil, fmt.Errorf("shares: invalid argument")
  114. }
  115. if config.CPUShares >= 0 {
  116. shares := uint64(config.CPUShares)
  117. cpu.Shares = &shares
  118. }
  119. if config.CpusetCpus != "" {
  120. cpu.Cpus = config.CpusetCpus
  121. }
  122. if config.CpusetMems != "" {
  123. cpu.Mems = config.CpusetMems
  124. }
  125. if config.NanoCPUs > 0 {
  126. // https://www.kernel.org/doc/Documentation/scheduler/sched-bwc.txt
  127. period := uint64(100 * time.Millisecond / time.Microsecond)
  128. quota := config.NanoCPUs * int64(period) / 1e9
  129. cpu.Period = &period
  130. cpu.Quota = &quota
  131. }
  132. if config.CPUPeriod != 0 {
  133. period := uint64(config.CPUPeriod)
  134. cpu.Period = &period
  135. }
  136. if config.CPUQuota != 0 {
  137. q := config.CPUQuota
  138. cpu.Quota = &q
  139. }
  140. if config.CPURealtimePeriod != 0 {
  141. period := uint64(config.CPURealtimePeriod)
  142. cpu.RealtimePeriod = &period
  143. }
  144. if config.CPURealtimeRuntime != 0 {
  145. c := config.CPURealtimeRuntime
  146. cpu.RealtimeRuntime = &c
  147. }
  148. return &cpu, nil
  149. }
  150. func getBlkioWeightDevices(config containertypes.Resources) ([]specs.LinuxWeightDevice, error) {
  151. var stat unix.Stat_t
  152. var blkioWeightDevices []specs.LinuxWeightDevice
  153. for _, weightDevice := range config.BlkioWeightDevice {
  154. if err := unix.Stat(weightDevice.Path, &stat); err != nil {
  155. return nil, errors.WithStack(&os.PathError{Op: "stat", Path: weightDevice.Path, Err: err})
  156. }
  157. weight := weightDevice.Weight
  158. d := specs.LinuxWeightDevice{Weight: &weight}
  159. // The type is 32bit on mips.
  160. d.Major = int64(unix.Major(uint64(stat.Rdev))) //nolint: unconvert
  161. d.Minor = int64(unix.Minor(uint64(stat.Rdev))) //nolint: unconvert
  162. blkioWeightDevices = append(blkioWeightDevices, d)
  163. }
  164. return blkioWeightDevices, nil
  165. }
  166. func (daemon *Daemon) parseSecurityOpt(container *container.Container, hostConfig *containertypes.HostConfig) error {
  167. container.NoNewPrivileges = daemon.configStore.NoNewPrivileges
  168. return parseSecurityOpt(container, hostConfig)
  169. }
  170. func parseSecurityOpt(container *container.Container, config *containertypes.HostConfig) error {
  171. var (
  172. labelOpts []string
  173. err error
  174. )
  175. for _, opt := range config.SecurityOpt {
  176. if opt == "no-new-privileges" {
  177. container.NoNewPrivileges = true
  178. continue
  179. }
  180. if opt == "disable" {
  181. labelOpts = append(labelOpts, "disable")
  182. continue
  183. }
  184. var con []string
  185. if strings.Contains(opt, "=") {
  186. con = strings.SplitN(opt, "=", 2)
  187. } else if strings.Contains(opt, ":") {
  188. con = strings.SplitN(opt, ":", 2)
  189. logrus.Warn("Security options with `:` as a separator are deprecated and will be completely unsupported in 17.04, use `=` instead.")
  190. }
  191. if len(con) != 2 {
  192. return fmt.Errorf("invalid --security-opt 1: %q", opt)
  193. }
  194. switch con[0] {
  195. case "label":
  196. labelOpts = append(labelOpts, con[1])
  197. case "apparmor":
  198. container.AppArmorProfile = con[1]
  199. case "seccomp":
  200. container.SeccompProfile = con[1]
  201. case "no-new-privileges":
  202. noNewPrivileges, err := strconv.ParseBool(con[1])
  203. if err != nil {
  204. return fmt.Errorf("invalid --security-opt 2: %q", opt)
  205. }
  206. container.NoNewPrivileges = noNewPrivileges
  207. default:
  208. return fmt.Errorf("invalid --security-opt 2: %q", opt)
  209. }
  210. }
  211. container.ProcessLabel, container.MountLabel, err = label.InitLabels(labelOpts)
  212. return err
  213. }
  214. func getBlkioThrottleDevices(devs []*blkiodev.ThrottleDevice) ([]specs.LinuxThrottleDevice, error) {
  215. var throttleDevices []specs.LinuxThrottleDevice
  216. var stat unix.Stat_t
  217. for _, d := range devs {
  218. if err := unix.Stat(d.Path, &stat); err != nil {
  219. return nil, errors.WithStack(&os.PathError{Op: "stat", Path: d.Path, Err: err})
  220. }
  221. d := specs.LinuxThrottleDevice{Rate: d.Rate}
  222. // the type is 32bit on mips
  223. d.Major = int64(unix.Major(uint64(stat.Rdev))) //nolint: unconvert
  224. d.Minor = int64(unix.Minor(uint64(stat.Rdev))) //nolint: unconvert
  225. throttleDevices = append(throttleDevices, d)
  226. }
  227. return throttleDevices, nil
  228. }
  229. // adjustParallelLimit takes a number of objects and a proposed limit and
  230. // figures out if it's reasonable (and adjusts it accordingly). This is only
  231. // used for daemon startup, which does a lot of parallel loading of containers
  232. // (and if we exceed RLIMIT_NOFILE then we're in trouble).
  233. func adjustParallelLimit(n int, limit int) int {
  234. // Rule-of-thumb overhead factor (how many files will each goroutine open
  235. // simultaneously). Yes, this is ugly but to be frank this whole thing is
  236. // ugly.
  237. const overhead = 2
  238. // On Linux, we need to ensure that parallelStartupJobs doesn't cause us to
  239. // exceed RLIMIT_NOFILE. If parallelStartupJobs is too large, we reduce it
  240. // and give a warning (since in theory the user should increase their
  241. // ulimits to the largest possible value for dockerd).
  242. var rlim unix.Rlimit
  243. if err := unix.Getrlimit(unix.RLIMIT_NOFILE, &rlim); err != nil {
  244. logrus.Warnf("Couldn't find dockerd's RLIMIT_NOFILE to double-check startup parallelism factor: %v", err)
  245. return limit
  246. }
  247. softRlimit := int(rlim.Cur)
  248. // Much fewer containers than RLIMIT_NOFILE. No need to adjust anything.
  249. if softRlimit > overhead*n {
  250. return limit
  251. }
  252. // RLIMIT_NOFILE big enough, no need to adjust anything.
  253. if softRlimit > overhead*limit {
  254. return limit
  255. }
  256. logrus.Warnf("Found dockerd's open file ulimit (%v) is far too small -- consider increasing it significantly (at least %v)", softRlimit, overhead*limit)
  257. return softRlimit / overhead
  258. }
  259. // adaptContainerSettings is called during container creation to modify any
  260. // settings necessary in the HostConfig structure.
  261. func (daemon *Daemon) adaptContainerSettings(hostConfig *containertypes.HostConfig, adjustCPUShares bool) error {
  262. if adjustCPUShares && hostConfig.CPUShares > 0 {
  263. // Handle unsupported CPUShares
  264. if hostConfig.CPUShares < linuxMinCPUShares {
  265. logrus.Warnf("Changing requested CPUShares of %d to minimum allowed of %d", hostConfig.CPUShares, linuxMinCPUShares)
  266. hostConfig.CPUShares = linuxMinCPUShares
  267. } else if hostConfig.CPUShares > linuxMaxCPUShares {
  268. logrus.Warnf("Changing requested CPUShares of %d to maximum allowed of %d", hostConfig.CPUShares, linuxMaxCPUShares)
  269. hostConfig.CPUShares = linuxMaxCPUShares
  270. }
  271. }
  272. if hostConfig.Memory > 0 && hostConfig.MemorySwap == 0 {
  273. // By default, MemorySwap is set to twice the size of Memory.
  274. hostConfig.MemorySwap = hostConfig.Memory * 2
  275. }
  276. if hostConfig.ShmSize == 0 {
  277. hostConfig.ShmSize = config.DefaultShmSize
  278. if daemon.configStore != nil {
  279. hostConfig.ShmSize = int64(daemon.configStore.ShmSize)
  280. }
  281. }
  282. // Set default IPC mode, if unset for container
  283. if hostConfig.IpcMode.IsEmpty() {
  284. m := config.DefaultIpcMode
  285. if daemon.configStore != nil {
  286. m = containertypes.IpcMode(daemon.configStore.IpcMode)
  287. }
  288. hostConfig.IpcMode = m
  289. }
  290. // Set default cgroup namespace mode, if unset for container
  291. if hostConfig.CgroupnsMode.IsEmpty() {
  292. // for cgroup v2: unshare cgroupns even for privileged containers
  293. // https://github.com/containers/libpod/pull/4374#issuecomment-549776387
  294. if hostConfig.Privileged && cgroups.Mode() != cgroups.Unified {
  295. hostConfig.CgroupnsMode = containertypes.CgroupnsModeHost
  296. } else {
  297. m := containertypes.CgroupnsModeHost
  298. if cgroups.Mode() == cgroups.Unified {
  299. m = containertypes.CgroupnsModePrivate
  300. }
  301. if daemon.configStore != nil {
  302. m = containertypes.CgroupnsMode(daemon.configStore.CgroupNamespaceMode)
  303. }
  304. hostConfig.CgroupnsMode = m
  305. }
  306. }
  307. adaptSharedNamespaceContainer(daemon, hostConfig)
  308. var err error
  309. secOpts, err := daemon.generateSecurityOpt(hostConfig)
  310. if err != nil {
  311. return err
  312. }
  313. hostConfig.SecurityOpt = append(hostConfig.SecurityOpt, secOpts...)
  314. if hostConfig.OomKillDisable == nil {
  315. defaultOomKillDisable := false
  316. hostConfig.OomKillDisable = &defaultOomKillDisable
  317. }
  318. return nil
  319. }
  320. // adaptSharedNamespaceContainer replaces container name with its ID in hostConfig.
  321. // To be more precisely, it modifies `container:name` to `container:ID` of PidMode, IpcMode
  322. // and NetworkMode.
  323. //
  324. // When a container shares its namespace with another container, use ID can keep the namespace
  325. // sharing connection between the two containers even the another container is renamed.
  326. func adaptSharedNamespaceContainer(daemon containerGetter, hostConfig *containertypes.HostConfig) {
  327. containerPrefix := "container:"
  328. if hostConfig.PidMode.IsContainer() {
  329. pidContainer := hostConfig.PidMode.Container()
  330. // if there is any error returned here, we just ignore it and leave it to be
  331. // handled in the following logic
  332. if c, err := daemon.GetContainer(pidContainer); err == nil {
  333. hostConfig.PidMode = containertypes.PidMode(containerPrefix + c.ID)
  334. }
  335. }
  336. if hostConfig.IpcMode.IsContainer() {
  337. ipcContainer := hostConfig.IpcMode.Container()
  338. if c, err := daemon.GetContainer(ipcContainer); err == nil {
  339. hostConfig.IpcMode = containertypes.IpcMode(containerPrefix + c.ID)
  340. }
  341. }
  342. if hostConfig.NetworkMode.IsContainer() {
  343. netContainer := hostConfig.NetworkMode.ConnectedContainer()
  344. if c, err := daemon.GetContainer(netContainer); err == nil {
  345. hostConfig.NetworkMode = containertypes.NetworkMode(containerPrefix + c.ID)
  346. }
  347. }
  348. }
  349. // verifyPlatformContainerResources performs platform-specific validation of the container's resource-configuration
  350. func verifyPlatformContainerResources(resources *containertypes.Resources, sysInfo *sysinfo.SysInfo, update bool) (warnings []string, err error) {
  351. fixMemorySwappiness(resources)
  352. // memory subsystem checks and adjustments
  353. if resources.Memory != 0 && resources.Memory < linuxMinMemory {
  354. return warnings, fmt.Errorf("Minimum memory limit allowed is 6MB")
  355. }
  356. if resources.Memory > 0 && !sysInfo.MemoryLimit {
  357. warnings = append(warnings, "Your kernel does not support memory limit capabilities or the cgroup is not mounted. Limitation discarded.")
  358. resources.Memory = 0
  359. resources.MemorySwap = -1
  360. }
  361. if resources.Memory > 0 && resources.MemorySwap != -1 && !sysInfo.SwapLimit {
  362. warnings = append(warnings, "Your kernel does not support swap limit capabilities or the cgroup is not mounted. Memory limited without swap.")
  363. resources.MemorySwap = -1
  364. }
  365. if resources.Memory > 0 && resources.MemorySwap > 0 && resources.MemorySwap < resources.Memory {
  366. return warnings, fmt.Errorf("Minimum memoryswap limit should be larger than memory limit, see usage")
  367. }
  368. if resources.Memory == 0 && resources.MemorySwap > 0 && !update {
  369. return warnings, fmt.Errorf("You should always set the Memory limit when using Memoryswap limit, see usage")
  370. }
  371. if resources.MemorySwappiness != nil && !sysInfo.MemorySwappiness {
  372. warnings = append(warnings, "Your kernel does not support memory swappiness capabilities or the cgroup is not mounted. Memory swappiness discarded.")
  373. resources.MemorySwappiness = nil
  374. }
  375. if resources.MemorySwappiness != nil {
  376. swappiness := *resources.MemorySwappiness
  377. if swappiness < 0 || swappiness > 100 {
  378. return warnings, fmt.Errorf("Invalid value: %v, valid memory swappiness range is 0-100", swappiness)
  379. }
  380. }
  381. if resources.MemoryReservation > 0 && !sysInfo.MemoryReservation {
  382. warnings = append(warnings, "Your kernel does not support memory soft limit capabilities or the cgroup is not mounted. Limitation discarded.")
  383. resources.MemoryReservation = 0
  384. }
  385. if resources.MemoryReservation > 0 && resources.MemoryReservation < linuxMinMemory {
  386. return warnings, fmt.Errorf("Minimum memory reservation allowed is 6MB")
  387. }
  388. if resources.Memory > 0 && resources.MemoryReservation > 0 && resources.Memory < resources.MemoryReservation {
  389. return warnings, fmt.Errorf("Minimum memory limit can not be less than memory reservation limit, see usage")
  390. }
  391. if resources.KernelMemory > 0 {
  392. // Kernel memory limit is not supported on cgroup v2.
  393. // Even on cgroup v1, kernel memory limit (`kmem.limit_in_bytes`) has been deprecated since kernel 5.4.
  394. // https://github.com/torvalds/linux/commit/0158115f702b0ba208ab0b5adf44cae99b3ebcc7
  395. if !sysInfo.KernelMemory {
  396. warnings = append(warnings, "Your kernel does not support kernel memory limit capabilities or the cgroup is not mounted. Limitation discarded.")
  397. resources.KernelMemory = 0
  398. }
  399. if resources.KernelMemory > 0 && resources.KernelMemory < linuxMinMemory {
  400. return warnings, fmt.Errorf("Minimum kernel memory limit allowed is 6MB")
  401. }
  402. if !kernel.CheckKernelVersion(4, 0, 0) {
  403. warnings = append(warnings, "You specified a kernel memory limit on a kernel older than 4.0. Kernel memory limits are experimental on older kernels, it won't work as expected and can cause your system to be unstable.")
  404. }
  405. }
  406. if resources.OomKillDisable != nil && !sysInfo.OomKillDisable {
  407. // only produce warnings if the setting wasn't to *disable* the OOM Kill; no point
  408. // warning the caller if they already wanted the feature to be off
  409. if *resources.OomKillDisable {
  410. warnings = append(warnings, "Your kernel does not support OomKillDisable. OomKillDisable discarded.")
  411. }
  412. resources.OomKillDisable = nil
  413. }
  414. if resources.OomKillDisable != nil && *resources.OomKillDisable && resources.Memory == 0 {
  415. warnings = append(warnings, "OOM killer is disabled for the container, but no memory limit is set, this can result in the system running out of resources.")
  416. }
  417. if resources.PidsLimit != nil && !sysInfo.PidsLimit {
  418. if *resources.PidsLimit > 0 {
  419. warnings = append(warnings, "Your kernel does not support PIDs limit capabilities or the cgroup is not mounted. PIDs limit discarded.")
  420. }
  421. resources.PidsLimit = nil
  422. }
  423. // cpu subsystem checks and adjustments
  424. if resources.NanoCPUs > 0 && resources.CPUPeriod > 0 {
  425. return warnings, fmt.Errorf("Conflicting options: Nano CPUs and CPU Period cannot both be set")
  426. }
  427. if resources.NanoCPUs > 0 && resources.CPUQuota > 0 {
  428. return warnings, fmt.Errorf("Conflicting options: Nano CPUs and CPU Quota cannot both be set")
  429. }
  430. if resources.NanoCPUs > 0 && !sysInfo.CPUCfs {
  431. return warnings, fmt.Errorf("NanoCPUs can not be set, as your kernel does not support CPU CFS scheduler or the cgroup is not mounted")
  432. }
  433. // The highest precision we could get on Linux is 0.001, by setting
  434. // cpu.cfs_period_us=1000ms
  435. // cpu.cfs_quota=1ms
  436. // See the following link for details:
  437. // https://www.kernel.org/doc/Documentation/scheduler/sched-bwc.txt
  438. // Here we don't set the lower limit and it is up to the underlying platform (e.g., Linux) to return an error.
  439. // The error message is 0.01 so that this is consistent with Windows
  440. if resources.NanoCPUs < 0 || resources.NanoCPUs > int64(sysinfo.NumCPU())*1e9 {
  441. return warnings, fmt.Errorf("Range of CPUs is from 0.01 to %d.00, as there are only %d CPUs available", sysinfo.NumCPU(), sysinfo.NumCPU())
  442. }
  443. if resources.CPUShares > 0 && !sysInfo.CPUShares {
  444. warnings = append(warnings, "Your kernel does not support CPU shares or the cgroup is not mounted. Shares discarded.")
  445. resources.CPUShares = 0
  446. }
  447. if (resources.CPUPeriod != 0 || resources.CPUQuota != 0) && !sysInfo.CPUCfs {
  448. warnings = append(warnings, "Your kernel does not support CPU CFS scheduler. CPU period/quota discarded.")
  449. resources.CPUPeriod = 0
  450. resources.CPUQuota = 0
  451. }
  452. if resources.CPUPeriod != 0 && (resources.CPUPeriod < 1000 || resources.CPUPeriod > 1000000) {
  453. return warnings, fmt.Errorf("CPU cfs period can not be less than 1ms (i.e. 1000) or larger than 1s (i.e. 1000000)")
  454. }
  455. if resources.CPUQuota > 0 && resources.CPUQuota < 1000 {
  456. return warnings, fmt.Errorf("CPU cfs quota can not be less than 1ms (i.e. 1000)")
  457. }
  458. if resources.CPUPercent > 0 {
  459. warnings = append(warnings, fmt.Sprintf("%s does not support CPU percent. Percent discarded.", runtime.GOOS))
  460. resources.CPUPercent = 0
  461. }
  462. // cpuset subsystem checks and adjustments
  463. if (resources.CpusetCpus != "" || resources.CpusetMems != "") && !sysInfo.Cpuset {
  464. warnings = append(warnings, "Your kernel does not support cpuset or the cgroup is not mounted. Cpuset discarded.")
  465. resources.CpusetCpus = ""
  466. resources.CpusetMems = ""
  467. }
  468. cpusAvailable, err := sysInfo.IsCpusetCpusAvailable(resources.CpusetCpus)
  469. if err != nil {
  470. return warnings, errors.Wrapf(err, "Invalid value %s for cpuset cpus", resources.CpusetCpus)
  471. }
  472. if !cpusAvailable {
  473. return warnings, fmt.Errorf("Requested CPUs are not available - requested %s, available: %s", resources.CpusetCpus, sysInfo.Cpus)
  474. }
  475. memsAvailable, err := sysInfo.IsCpusetMemsAvailable(resources.CpusetMems)
  476. if err != nil {
  477. return warnings, errors.Wrapf(err, "Invalid value %s for cpuset mems", resources.CpusetMems)
  478. }
  479. if !memsAvailable {
  480. return warnings, fmt.Errorf("Requested memory nodes are not available - requested %s, available: %s", resources.CpusetMems, sysInfo.Mems)
  481. }
  482. // blkio subsystem checks and adjustments
  483. if resources.BlkioWeight > 0 && !sysInfo.BlkioWeight {
  484. warnings = append(warnings, "Your kernel does not support Block I/O weight or the cgroup is not mounted. Weight discarded.")
  485. resources.BlkioWeight = 0
  486. }
  487. if resources.BlkioWeight > 0 && (resources.BlkioWeight < 10 || resources.BlkioWeight > 1000) {
  488. return warnings, fmt.Errorf("Range of blkio weight is from 10 to 1000")
  489. }
  490. if resources.IOMaximumBandwidth != 0 || resources.IOMaximumIOps != 0 {
  491. return warnings, fmt.Errorf("Invalid QoS settings: %s does not support Maximum IO Bandwidth or Maximum IO IOps", runtime.GOOS)
  492. }
  493. if len(resources.BlkioWeightDevice) > 0 && !sysInfo.BlkioWeightDevice {
  494. warnings = append(warnings, "Your kernel does not support Block I/O weight_device or the cgroup is not mounted. Weight-device discarded.")
  495. resources.BlkioWeightDevice = []*pblkiodev.WeightDevice{}
  496. }
  497. if len(resources.BlkioDeviceReadBps) > 0 && !sysInfo.BlkioReadBpsDevice {
  498. warnings = append(warnings, "Your kernel does not support BPS Block I/O read limit or the cgroup is not mounted. Block I/O BPS read limit discarded.")
  499. resources.BlkioDeviceReadBps = []*pblkiodev.ThrottleDevice{}
  500. }
  501. if len(resources.BlkioDeviceWriteBps) > 0 && !sysInfo.BlkioWriteBpsDevice {
  502. warnings = append(warnings, "Your kernel does not support BPS Block I/O write limit or the cgroup is not mounted. Block I/O BPS write limit discarded.")
  503. resources.BlkioDeviceWriteBps = []*pblkiodev.ThrottleDevice{}
  504. }
  505. if len(resources.BlkioDeviceReadIOps) > 0 && !sysInfo.BlkioReadIOpsDevice {
  506. warnings = append(warnings, "Your kernel does not support IOPS Block read limit or the cgroup is not mounted. Block I/O IOPS read limit discarded.")
  507. resources.BlkioDeviceReadIOps = []*pblkiodev.ThrottleDevice{}
  508. }
  509. if len(resources.BlkioDeviceWriteIOps) > 0 && !sysInfo.BlkioWriteIOpsDevice {
  510. warnings = append(warnings, "Your kernel does not support IOPS Block write limit or the cgroup is not mounted. Block I/O IOPS write limit discarded.")
  511. resources.BlkioDeviceWriteIOps = []*pblkiodev.ThrottleDevice{}
  512. }
  513. return warnings, nil
  514. }
  515. func (daemon *Daemon) getCgroupDriver() string {
  516. if UsingSystemd(daemon.configStore) {
  517. return cgroupSystemdDriver
  518. }
  519. if daemon.Rootless() {
  520. return cgroupNoneDriver
  521. }
  522. return cgroupFsDriver
  523. }
  524. // getCD gets the raw value of the native.cgroupdriver option, if set.
  525. func getCD(config *config.Config) string {
  526. for _, option := range config.ExecOptions {
  527. key, val, err := parsers.ParseKeyValueOpt(option)
  528. if err != nil || !strings.EqualFold(key, "native.cgroupdriver") {
  529. continue
  530. }
  531. return val
  532. }
  533. return ""
  534. }
  535. // verifyCgroupDriver validates native.cgroupdriver
  536. func verifyCgroupDriver(config *config.Config) error {
  537. cd := getCD(config)
  538. if cd == "" || cd == cgroupFsDriver || cd == cgroupSystemdDriver {
  539. return nil
  540. }
  541. if cd == cgroupNoneDriver {
  542. return fmt.Errorf("native.cgroupdriver option %s is internally used and cannot be specified manually", cd)
  543. }
  544. return fmt.Errorf("native.cgroupdriver option %s not supported", cd)
  545. }
  546. // UsingSystemd returns true if cli option includes native.cgroupdriver=systemd
  547. func UsingSystemd(config *config.Config) bool {
  548. cd := getCD(config)
  549. if cd == cgroupSystemdDriver {
  550. return true
  551. }
  552. // On cgroup v2 hosts, default to systemd driver
  553. if cd == "" && cgroups.Mode() == cgroups.Unified && isRunningSystemd() {
  554. return true
  555. }
  556. return false
  557. }
  558. var (
  559. runningSystemd bool
  560. detectSystemd sync.Once
  561. )
  562. // isRunningSystemd checks whether the host was booted with systemd as its init
  563. // system. This functions similarly to systemd's `sd_booted(3)`: internally, it
  564. // checks whether /run/systemd/system/ exists and is a directory.
  565. // http://www.freedesktop.org/software/systemd/man/sd_booted.html
  566. //
  567. // NOTE: This function comes from package github.com/coreos/go-systemd/util
  568. // It was borrowed here to avoid a dependency on cgo.
  569. func isRunningSystemd() bool {
  570. detectSystemd.Do(func() {
  571. fi, err := os.Lstat("/run/systemd/system")
  572. if err != nil {
  573. return
  574. }
  575. runningSystemd = fi.IsDir()
  576. })
  577. return runningSystemd
  578. }
  579. // verifyPlatformContainerSettings performs platform-specific validation of the
  580. // hostconfig and config structures.
  581. func verifyPlatformContainerSettings(daemon *Daemon, hostConfig *containertypes.HostConfig, update bool) (warnings []string, err error) {
  582. if hostConfig == nil {
  583. return nil, nil
  584. }
  585. sysInfo := daemon.RawSysInfo()
  586. w, err := verifyPlatformContainerResources(&hostConfig.Resources, sysInfo, update)
  587. // no matter err is nil or not, w could have data in itself.
  588. warnings = append(warnings, w...)
  589. if err != nil {
  590. return warnings, err
  591. }
  592. if !hostConfig.IpcMode.Valid() {
  593. return warnings, errors.Errorf("invalid IPC mode: %v", hostConfig.IpcMode)
  594. }
  595. if !hostConfig.PidMode.Valid() {
  596. return warnings, errors.Errorf("invalid PID mode: %v", hostConfig.PidMode)
  597. }
  598. if hostConfig.ShmSize < 0 {
  599. return warnings, fmt.Errorf("SHM size can not be less than 0")
  600. }
  601. if !hostConfig.UTSMode.Valid() {
  602. return warnings, errors.Errorf("invalid UTS mode: %v", hostConfig.UTSMode)
  603. }
  604. if hostConfig.OomScoreAdj < -1000 || hostConfig.OomScoreAdj > 1000 {
  605. return warnings, fmt.Errorf("Invalid value %d, range for oom score adj is [-1000, 1000]", hostConfig.OomScoreAdj)
  606. }
  607. // ip-forwarding does not affect container with '--net=host' (or '--net=none')
  608. if sysInfo.IPv4ForwardingDisabled && !(hostConfig.NetworkMode.IsHost() || hostConfig.NetworkMode.IsNone()) {
  609. warnings = append(warnings, "IPv4 forwarding is disabled. Networking will not work.")
  610. }
  611. if hostConfig.NetworkMode.IsHost() && len(hostConfig.PortBindings) > 0 {
  612. warnings = append(warnings, "Published ports are discarded when using host network mode")
  613. }
  614. // check for various conflicting options with user namespaces
  615. if daemon.configStore.RemappedRoot != "" && hostConfig.UsernsMode.IsPrivate() {
  616. if hostConfig.Privileged {
  617. return warnings, fmt.Errorf("privileged mode is incompatible with user namespaces. You must run the container in the host namespace when running privileged mode")
  618. }
  619. if hostConfig.NetworkMode.IsHost() && !hostConfig.UsernsMode.IsHost() {
  620. return warnings, fmt.Errorf("cannot share the host's network namespace when user namespaces are enabled")
  621. }
  622. if hostConfig.PidMode.IsHost() && !hostConfig.UsernsMode.IsHost() {
  623. return warnings, fmt.Errorf("cannot share the host PID namespace when user namespaces are enabled")
  624. }
  625. }
  626. if hostConfig.CgroupParent != "" && UsingSystemd(daemon.configStore) {
  627. // CgroupParent for systemd cgroup should be named as "xxx.slice"
  628. if len(hostConfig.CgroupParent) <= 6 || !strings.HasSuffix(hostConfig.CgroupParent, ".slice") {
  629. return warnings, fmt.Errorf("cgroup-parent for systemd cgroup should be a valid slice named as \"xxx.slice\"")
  630. }
  631. }
  632. if hostConfig.Runtime == "" {
  633. hostConfig.Runtime = daemon.configStore.GetDefaultRuntimeName()
  634. }
  635. if _, err := daemon.getRuntime(hostConfig.Runtime); err != nil {
  636. return warnings, err
  637. }
  638. parser := volumemounts.NewParser()
  639. for dest := range hostConfig.Tmpfs {
  640. if err := parser.ValidateTmpfsMountDestination(dest); err != nil {
  641. return warnings, err
  642. }
  643. }
  644. if !hostConfig.CgroupnsMode.Valid() {
  645. return warnings, fmt.Errorf("invalid cgroup namespace mode: %v", hostConfig.CgroupnsMode)
  646. }
  647. if hostConfig.CgroupnsMode.IsPrivate() {
  648. if !sysInfo.CgroupNamespaces {
  649. warnings = append(warnings, "Your kernel does not support cgroup namespaces. Cgroup namespace setting discarded.")
  650. }
  651. }
  652. return warnings, nil
  653. }
  654. // verifyDaemonSettings performs validation of daemon config struct
  655. func verifyDaemonSettings(conf *config.Config) error {
  656. if conf.ContainerdNamespace == conf.ContainerdPluginNamespace {
  657. return errors.New("containers namespace and plugins namespace cannot be the same")
  658. }
  659. // Check for mutually incompatible config options
  660. if conf.BridgeConfig.Iface != "" && conf.BridgeConfig.IP != "" {
  661. return fmt.Errorf("You specified -b & --bip, mutually exclusive options. Please specify only one")
  662. }
  663. if !conf.BridgeConfig.EnableIPTables && !conf.BridgeConfig.InterContainerCommunication {
  664. return fmt.Errorf("You specified --iptables=false with --icc=false. ICC=false uses iptables to function. Please set --icc or --iptables to true")
  665. }
  666. if conf.BridgeConfig.EnableIP6Tables && !conf.Experimental {
  667. return fmt.Errorf("ip6tables rules are only available if experimental features are enabled")
  668. }
  669. if !conf.BridgeConfig.EnableIPTables && conf.BridgeConfig.EnableIPMasq {
  670. conf.BridgeConfig.EnableIPMasq = false
  671. }
  672. if err := verifyCgroupDriver(conf); err != nil {
  673. return err
  674. }
  675. if conf.CgroupParent != "" && UsingSystemd(conf) {
  676. if len(conf.CgroupParent) <= 6 || !strings.HasSuffix(conf.CgroupParent, ".slice") {
  677. return fmt.Errorf("cgroup-parent for systemd cgroup should be a valid slice named as \"xxx.slice\"")
  678. }
  679. }
  680. if conf.Rootless && UsingSystemd(conf) && cgroups.Mode() != cgroups.Unified {
  681. return fmt.Errorf("exec-opt native.cgroupdriver=systemd requires cgroup v2 for rootless mode")
  682. }
  683. configureRuntimes(conf)
  684. if rtName := conf.GetDefaultRuntimeName(); rtName != "" {
  685. if conf.GetRuntime(rtName) == nil {
  686. if !config.IsPermissibleC8dRuntimeName(rtName) {
  687. return fmt.Errorf("specified default runtime '%s' does not exist", rtName)
  688. }
  689. }
  690. }
  691. return nil
  692. }
  693. // checkSystem validates platform-specific requirements
  694. func checkSystem() error {
  695. return nil
  696. }
  697. // configureMaxThreads sets the Go runtime max threads threshold
  698. // which is 90% of the kernel setting from /proc/sys/kernel/threads-max
  699. func configureMaxThreads(config *config.Config) error {
  700. mt, err := os.ReadFile("/proc/sys/kernel/threads-max")
  701. if err != nil {
  702. return err
  703. }
  704. mtint, err := strconv.Atoi(strings.TrimSpace(string(mt)))
  705. if err != nil {
  706. return err
  707. }
  708. maxThreads := (mtint / 100) * 90
  709. debug.SetMaxThreads(maxThreads)
  710. logrus.Debugf("Golang's threads limit set to %d", maxThreads)
  711. return nil
  712. }
  713. func overlaySupportsSelinux() (bool, error) {
  714. f, err := os.Open("/proc/kallsyms")
  715. if err != nil {
  716. if os.IsNotExist(err) {
  717. return false, nil
  718. }
  719. return false, err
  720. }
  721. defer f.Close()
  722. s := bufio.NewScanner(f)
  723. for s.Scan() {
  724. if strings.HasSuffix(s.Text(), " security_inode_copy_up") {
  725. return true, nil
  726. }
  727. }
  728. return false, s.Err()
  729. }
  730. // configureKernelSecuritySupport configures and validates security support for the kernel
  731. func configureKernelSecuritySupport(config *config.Config, driverName string) error {
  732. if config.EnableSelinuxSupport {
  733. if !selinux.GetEnabled() {
  734. logrus.Warn("Docker could not enable SELinux on the host system")
  735. return nil
  736. }
  737. if driverName == "overlay" || driverName == "overlay2" {
  738. // If driver is overlay or overlay2, make sure kernel
  739. // supports selinux with overlay.
  740. supported, err := overlaySupportsSelinux()
  741. if err != nil {
  742. return err
  743. }
  744. if !supported {
  745. logrus.Warnf("SELinux is not supported with the %v graph driver on this kernel", driverName)
  746. }
  747. }
  748. } else {
  749. selinux.SetDisabled()
  750. }
  751. return nil
  752. }
  753. // initNetworkController initializes the libnetwork controller and configures
  754. // network settings. If there's active sandboxes, configuration changes will not
  755. // take effect.
  756. func (daemon *Daemon) initNetworkController(activeSandboxes map[string]interface{}) error {
  757. netOptions, err := daemon.networkOptions(daemon.PluginStore, activeSandboxes)
  758. if err != nil {
  759. return err
  760. }
  761. daemon.netController, err = libnetwork.New(netOptions...)
  762. if err != nil {
  763. return fmt.Errorf("error obtaining controller instance: %v", err)
  764. }
  765. if len(activeSandboxes) > 0 {
  766. logrus.Info("there are running containers, updated network configuration will not take affect")
  767. } else if err := configureNetworking(daemon.netController, daemon.configStore); err != nil {
  768. return err
  769. }
  770. // Set HostGatewayIP to the default bridge's IP if it is empty
  771. setHostGatewayIP(daemon.netController, daemon.configStore)
  772. return nil
  773. }
  774. func configureNetworking(controller libnetwork.NetworkController, conf *config.Config) error {
  775. // Initialize default network on "null"
  776. if n, _ := controller.NetworkByName("none"); n == nil {
  777. if _, err := controller.NewNetwork("null", "none", "", libnetwork.NetworkOptionPersist(true)); err != nil {
  778. return errors.Wrap(err, `error creating default "null" network`)
  779. }
  780. }
  781. // Initialize default network on "host"
  782. if n, _ := controller.NetworkByName("host"); n == nil {
  783. if _, err := controller.NewNetwork("host", "host", "", libnetwork.NetworkOptionPersist(true)); err != nil {
  784. return errors.Wrap(err, `error creating default "host" network`)
  785. }
  786. }
  787. // Clear stale bridge network
  788. if n, err := controller.NetworkByName("bridge"); err == nil {
  789. if err = n.Delete(); err != nil {
  790. return errors.Wrap(err, `could not delete the default "bridge"" network`)
  791. }
  792. if len(conf.NetworkConfig.DefaultAddressPools.Value()) > 0 && !conf.LiveRestoreEnabled {
  793. removeDefaultBridgeInterface()
  794. }
  795. }
  796. if !conf.DisableBridge {
  797. // Initialize default driver "bridge"
  798. if err := initBridgeDriver(controller, conf); err != nil {
  799. return err
  800. }
  801. } else {
  802. removeDefaultBridgeInterface()
  803. }
  804. return nil
  805. }
  806. // setHostGatewayIP sets cfg.HostGatewayIP to the default bridge's IP if it is empty.
  807. func setHostGatewayIP(controller libnetwork.NetworkController, config *config.Config) {
  808. if config.HostGatewayIP != nil {
  809. return
  810. }
  811. if n, err := controller.NetworkByName("bridge"); err == nil {
  812. v4Info, v6Info := n.Info().IpamInfo()
  813. var gateway net.IP
  814. if len(v4Info) > 0 {
  815. gateway = v4Info[0].Gateway.IP
  816. } else if len(v6Info) > 0 {
  817. gateway = v6Info[0].Gateway.IP
  818. }
  819. config.HostGatewayIP = gateway
  820. }
  821. }
  822. func driverOptions(config *config.Config) nwconfig.Option {
  823. return nwconfig.OptionDriverConfig("bridge", options.Generic{
  824. netlabel.GenericData: options.Generic{
  825. "EnableIPForwarding": config.BridgeConfig.EnableIPForward,
  826. "EnableIPTables": config.BridgeConfig.EnableIPTables,
  827. "EnableIP6Tables": config.BridgeConfig.EnableIP6Tables,
  828. "EnableUserlandProxy": config.BridgeConfig.EnableUserlandProxy,
  829. "UserlandProxyPath": config.BridgeConfig.UserlandProxyPath,
  830. },
  831. })
  832. }
  833. func initBridgeDriver(controller libnetwork.NetworkController, config *config.Config) error {
  834. bridgeName := bridge.DefaultBridgeName
  835. if config.BridgeConfig.Iface != "" {
  836. bridgeName = config.BridgeConfig.Iface
  837. }
  838. netOption := map[string]string{
  839. bridge.BridgeName: bridgeName,
  840. bridge.DefaultBridge: strconv.FormatBool(true),
  841. netlabel.DriverMTU: strconv.Itoa(config.Mtu),
  842. bridge.EnableIPMasquerade: strconv.FormatBool(config.BridgeConfig.EnableIPMasq),
  843. bridge.EnableICC: strconv.FormatBool(config.BridgeConfig.InterContainerCommunication),
  844. }
  845. // --ip processing
  846. if config.BridgeConfig.DefaultIP != nil {
  847. netOption[bridge.DefaultBindingIP] = config.BridgeConfig.DefaultIP.String()
  848. }
  849. ipamV4Conf := &libnetwork.IpamConf{AuxAddresses: make(map[string]string)}
  850. // By default, libnetwork will request an arbitrary available address
  851. // pool for the network from the configured IPAM allocator.
  852. // Configure it to use the IPv4 network ranges of the existing bridge
  853. // interface if one exists with IPv4 addresses assigned to it.
  854. nwList, nw6List, err := ifaceAddrs(bridgeName)
  855. if err != nil {
  856. return errors.Wrap(err, "list bridge addresses failed")
  857. }
  858. if len(nwList) > 0 {
  859. nw := nwList[0]
  860. if len(nwList) > 1 && config.BridgeConfig.FixedCIDR != "" {
  861. _, fCIDR, err := net.ParseCIDR(config.BridgeConfig.FixedCIDR)
  862. if err != nil {
  863. return errors.Wrap(err, "parse CIDR failed")
  864. }
  865. // Iterate through in case there are multiple addresses for the bridge
  866. for _, entry := range nwList {
  867. if fCIDR.Contains(entry.IP) {
  868. nw = entry
  869. break
  870. }
  871. }
  872. }
  873. ipamV4Conf.PreferredPool = lntypes.GetIPNetCanonical(nw).String()
  874. hip, _ := lntypes.GetHostPartIP(nw.IP, nw.Mask)
  875. if hip.IsGlobalUnicast() {
  876. ipamV4Conf.Gateway = nw.IP.String()
  877. }
  878. }
  879. if config.BridgeConfig.IP != "" {
  880. ip, ipNet, err := net.ParseCIDR(config.BridgeConfig.IP)
  881. if err != nil {
  882. return err
  883. }
  884. ipamV4Conf.PreferredPool = ipNet.String()
  885. ipamV4Conf.Gateway = ip.String()
  886. } else if bridgeName == bridge.DefaultBridgeName && ipamV4Conf.PreferredPool != "" {
  887. logrus.Infof("Default bridge (%s) is assigned with an IP address %s. Daemon option --bip can be used to set a preferred IP address", bridgeName, ipamV4Conf.PreferredPool)
  888. }
  889. if config.BridgeConfig.FixedCIDR != "" {
  890. _, fCIDR, err := net.ParseCIDR(config.BridgeConfig.FixedCIDR)
  891. if err != nil {
  892. return err
  893. }
  894. ipamV4Conf.SubPool = fCIDR.String()
  895. }
  896. if config.BridgeConfig.DefaultGatewayIPv4 != nil {
  897. ipamV4Conf.AuxAddresses["DefaultGatewayIPv4"] = config.BridgeConfig.DefaultGatewayIPv4.String()
  898. }
  899. var (
  900. deferIPv6Alloc bool
  901. ipamV6Conf *libnetwork.IpamConf
  902. )
  903. if config.BridgeConfig.EnableIPv6 && config.BridgeConfig.FixedCIDRv6 == "" {
  904. return errdefs.InvalidParameter(errors.New("IPv6 is enabled for the default bridge, but no subnet is configured. Specify an IPv6 subnet using --fixed-cidr-v6"))
  905. } else if config.BridgeConfig.FixedCIDRv6 != "" {
  906. _, fCIDRv6, err := net.ParseCIDR(config.BridgeConfig.FixedCIDRv6)
  907. if err != nil {
  908. return err
  909. }
  910. // In case user has specified the daemon flag --fixed-cidr-v6 and the passed network has
  911. // at least 48 host bits, we need to guarantee the current behavior where the containers'
  912. // IPv6 addresses will be constructed based on the containers' interface MAC address.
  913. // We do so by telling libnetwork to defer the IPv6 address allocation for the endpoints
  914. // on this network until after the driver has created the endpoint and returned the
  915. // constructed address. Libnetwork will then reserve this address with the ipam driver.
  916. ones, _ := fCIDRv6.Mask.Size()
  917. deferIPv6Alloc = ones <= 80
  918. ipamV6Conf = &libnetwork.IpamConf{
  919. AuxAddresses: make(map[string]string),
  920. PreferredPool: fCIDRv6.String(),
  921. }
  922. // In case the --fixed-cidr-v6 is specified and the current docker0 bridge IPv6
  923. // address belongs to the same network, we need to inform libnetwork about it, so
  924. // that it can be reserved with IPAM and it will not be given away to somebody else
  925. for _, nw6 := range nw6List {
  926. if fCIDRv6.Contains(nw6.IP) {
  927. ipamV6Conf.Gateway = nw6.IP.String()
  928. break
  929. }
  930. }
  931. }
  932. if config.BridgeConfig.DefaultGatewayIPv6 != nil {
  933. if ipamV6Conf == nil {
  934. ipamV6Conf = &libnetwork.IpamConf{AuxAddresses: make(map[string]string)}
  935. }
  936. ipamV6Conf.AuxAddresses["DefaultGatewayIPv6"] = config.BridgeConfig.DefaultGatewayIPv6.String()
  937. }
  938. v4Conf := []*libnetwork.IpamConf{ipamV4Conf}
  939. v6Conf := []*libnetwork.IpamConf{}
  940. if ipamV6Conf != nil {
  941. v6Conf = append(v6Conf, ipamV6Conf)
  942. }
  943. // Initialize default network on "bridge" with the same name
  944. _, err = controller.NewNetwork("bridge", "bridge", "",
  945. libnetwork.NetworkOptionEnableIPv6(config.BridgeConfig.EnableIPv6),
  946. libnetwork.NetworkOptionDriverOpts(netOption),
  947. libnetwork.NetworkOptionIpam("default", "", v4Conf, v6Conf, nil),
  948. libnetwork.NetworkOptionDeferIPv6Alloc(deferIPv6Alloc))
  949. if err != nil {
  950. return fmt.Errorf("Error creating default \"bridge\" network: %v", err)
  951. }
  952. return nil
  953. }
  954. // Remove default bridge interface if present (--bridge=none use case)
  955. func removeDefaultBridgeInterface() {
  956. if lnk, err := netlink.LinkByName(bridge.DefaultBridgeName); err == nil {
  957. if err := netlink.LinkDel(lnk); err != nil {
  958. logrus.Warnf("Failed to remove bridge interface (%s): %v", bridge.DefaultBridgeName, err)
  959. }
  960. }
  961. }
  962. func setupInitLayer(idMapping idtools.IdentityMapping) func(containerfs.ContainerFS) error {
  963. return func(initPath containerfs.ContainerFS) error {
  964. return initlayer.Setup(initPath, idMapping.RootPair())
  965. }
  966. }
  967. // Parse the remapped root (user namespace) option, which can be one of:
  968. //
  969. // - username - valid username from /etc/passwd
  970. // - username:groupname - valid username; valid groupname from /etc/group
  971. // - uid - 32-bit unsigned int valid Linux UID value
  972. // - uid:gid - uid value; 32-bit unsigned int Linux GID value
  973. //
  974. // If no groupname is specified, and a username is specified, an attempt
  975. // will be made to lookup a gid for that username as a groupname
  976. //
  977. // If names are used, they are verified to exist in passwd/group
  978. func parseRemappedRoot(usergrp string) (string, string, error) {
  979. var (
  980. userID, groupID int
  981. username, groupname string
  982. )
  983. idparts := strings.Split(usergrp, ":")
  984. if len(idparts) > 2 {
  985. return "", "", fmt.Errorf("Invalid user/group specification in --userns-remap: %q", usergrp)
  986. }
  987. if uid, err := strconv.ParseInt(idparts[0], 10, 32); err == nil {
  988. // must be a uid; take it as valid
  989. userID = int(uid)
  990. luser, err := idtools.LookupUID(userID)
  991. if err != nil {
  992. return "", "", fmt.Errorf("Uid %d has no entry in /etc/passwd: %v", userID, err)
  993. }
  994. username = luser.Name
  995. if len(idparts) == 1 {
  996. // if the uid was numeric and no gid was specified, take the uid as the gid
  997. groupID = userID
  998. lgrp, err := idtools.LookupGID(groupID)
  999. if err != nil {
  1000. return "", "", fmt.Errorf("Gid %d has no entry in /etc/group: %v", groupID, err)
  1001. }
  1002. groupname = lgrp.Name
  1003. }
  1004. } else {
  1005. lookupName := idparts[0]
  1006. // special case: if the user specified "default", they want Docker to create or
  1007. // use (after creation) the "dockremap" user/group for root remapping
  1008. if lookupName == defaultIDSpecifier {
  1009. lookupName = defaultRemappedID
  1010. }
  1011. luser, err := idtools.LookupUser(lookupName)
  1012. if err != nil && idparts[0] != defaultIDSpecifier {
  1013. // error if the name requested isn't the special "dockremap" ID
  1014. return "", "", fmt.Errorf("Error during uid lookup for %q: %v", lookupName, err)
  1015. } else if err != nil {
  1016. // special case-- if the username == "default", then we have been asked
  1017. // to create a new entry pair in /etc/{passwd,group} for which the /etc/sub{uid,gid}
  1018. // ranges will be used for the user and group mappings in user namespaced containers
  1019. _, _, err := idtools.AddNamespaceRangesUser(defaultRemappedID)
  1020. if err == nil {
  1021. return defaultRemappedID, defaultRemappedID, nil
  1022. }
  1023. return "", "", fmt.Errorf("Error during %q user creation: %v", defaultRemappedID, err)
  1024. }
  1025. username = luser.Name
  1026. if len(idparts) == 1 {
  1027. // we only have a string username, and no group specified; look up gid from username as group
  1028. group, err := idtools.LookupGroup(lookupName)
  1029. if err != nil {
  1030. return "", "", fmt.Errorf("Error during gid lookup for %q: %v", lookupName, err)
  1031. }
  1032. groupname = group.Name
  1033. }
  1034. }
  1035. if len(idparts) == 2 {
  1036. // groupname or gid is separately specified and must be resolved
  1037. // to an unsigned 32-bit gid
  1038. if gid, err := strconv.ParseInt(idparts[1], 10, 32); err == nil {
  1039. // must be a gid, take it as valid
  1040. groupID = int(gid)
  1041. lgrp, err := idtools.LookupGID(groupID)
  1042. if err != nil {
  1043. return "", "", fmt.Errorf("Gid %d has no entry in /etc/passwd: %v", groupID, err)
  1044. }
  1045. groupname = lgrp.Name
  1046. } else {
  1047. // not a number; attempt a lookup
  1048. if _, err := idtools.LookupGroup(idparts[1]); err != nil {
  1049. return "", "", fmt.Errorf("Error during groupname lookup for %q: %v", idparts[1], err)
  1050. }
  1051. groupname = idparts[1]
  1052. }
  1053. }
  1054. return username, groupname, nil
  1055. }
  1056. func setupRemappedRoot(config *config.Config) (idtools.IdentityMapping, error) {
  1057. if runtime.GOOS != "linux" && config.RemappedRoot != "" {
  1058. return idtools.IdentityMapping{}, fmt.Errorf("User namespaces are only supported on Linux")
  1059. }
  1060. // if the daemon was started with remapped root option, parse
  1061. // the config option to the int uid,gid values
  1062. if config.RemappedRoot != "" {
  1063. username, groupname, err := parseRemappedRoot(config.RemappedRoot)
  1064. if err != nil {
  1065. return idtools.IdentityMapping{}, err
  1066. }
  1067. if username == "root" {
  1068. // Cannot setup user namespaces with a 1-to-1 mapping; "--root=0:0" is a no-op
  1069. // effectively
  1070. logrus.Warn("User namespaces: root cannot be remapped with itself; user namespaces are OFF")
  1071. return idtools.IdentityMapping{}, nil
  1072. }
  1073. logrus.Infof("User namespaces: ID ranges will be mapped to subuid/subgid ranges of: %s", username)
  1074. // update remapped root setting now that we have resolved them to actual names
  1075. config.RemappedRoot = fmt.Sprintf("%s:%s", username, groupname)
  1076. mappings, err := idtools.LoadIdentityMapping(username)
  1077. if err != nil {
  1078. return idtools.IdentityMapping{}, errors.Wrap(err, "Can't create ID mappings")
  1079. }
  1080. return mappings, nil
  1081. }
  1082. return idtools.IdentityMapping{}, nil
  1083. }
  1084. func setupDaemonRoot(config *config.Config, rootDir string, remappedRoot idtools.Identity) error {
  1085. config.Root = rootDir
  1086. // the docker root metadata directory needs to have execute permissions for all users (g+x,o+x)
  1087. // so that syscalls executing as non-root, operating on subdirectories of the graph root
  1088. // (e.g. mounted layers of a container) can traverse this path.
  1089. // The user namespace support will create subdirectories for the remapped root host uid:gid
  1090. // pair owned by that same uid:gid pair for proper write access to those needed metadata and
  1091. // layer content subtrees.
  1092. if _, err := os.Stat(rootDir); err == nil {
  1093. // root current exists; verify the access bits are correct by setting them
  1094. if err = os.Chmod(rootDir, 0711); err != nil {
  1095. return err
  1096. }
  1097. } else if os.IsNotExist(err) {
  1098. // no root exists yet, create it 0711 with root:root ownership
  1099. if err := os.MkdirAll(rootDir, 0711); err != nil {
  1100. return err
  1101. }
  1102. }
  1103. id := idtools.Identity{UID: idtools.CurrentIdentity().UID, GID: remappedRoot.GID}
  1104. // First make sure the current root dir has the correct perms.
  1105. if err := idtools.MkdirAllAndChown(config.Root, 0710, id); err != nil {
  1106. return errors.Wrapf(err, "could not create or set daemon root permissions: %s", config.Root)
  1107. }
  1108. // if user namespaces are enabled we will create a subtree underneath the specified root
  1109. // with any/all specified remapped root uid/gid options on the daemon creating
  1110. // a new subdirectory with ownership set to the remapped uid/gid (so as to allow
  1111. // `chdir()` to work for containers namespaced to that uid/gid)
  1112. if config.RemappedRoot != "" {
  1113. config.Root = filepath.Join(rootDir, fmt.Sprintf("%d.%d", remappedRoot.UID, remappedRoot.GID))
  1114. logrus.Debugf("Creating user namespaced daemon root: %s", config.Root)
  1115. // Create the root directory if it doesn't exist
  1116. if err := idtools.MkdirAllAndChown(config.Root, 0710, id); err != nil {
  1117. return fmt.Errorf("Cannot create daemon root: %s: %v", config.Root, err)
  1118. }
  1119. // we also need to verify that any pre-existing directories in the path to
  1120. // the graphroot won't block access to remapped root--if any pre-existing directory
  1121. // has strict permissions that don't allow "x", container start will fail, so
  1122. // better to warn and fail now
  1123. dirPath := config.Root
  1124. for {
  1125. dirPath = filepath.Dir(dirPath)
  1126. if dirPath == "/" {
  1127. break
  1128. }
  1129. if !idtools.CanAccess(dirPath, remappedRoot) {
  1130. return fmt.Errorf("a subdirectory in your graphroot path (%s) restricts access to the remapped root uid/gid; please fix by allowing 'o+x' permissions on existing directories", config.Root)
  1131. }
  1132. }
  1133. }
  1134. if err := setupDaemonRootPropagation(config); err != nil {
  1135. logrus.WithError(err).WithField("dir", config.Root).Warn("Error while setting daemon root propagation, this is not generally critical but may cause some functionality to not work or fallback to less desirable behavior")
  1136. }
  1137. return nil
  1138. }
  1139. func setupDaemonRootPropagation(cfg *config.Config) error {
  1140. rootParentMount, mountOptions, err := getSourceMount(cfg.Root)
  1141. if err != nil {
  1142. return errors.Wrap(err, "error getting daemon root's parent mount")
  1143. }
  1144. var cleanupOldFile bool
  1145. cleanupFile := getUnmountOnShutdownPath(cfg)
  1146. defer func() {
  1147. if !cleanupOldFile {
  1148. return
  1149. }
  1150. if err := os.Remove(cleanupFile); err != nil && !os.IsNotExist(err) {
  1151. logrus.WithError(err).WithField("file", cleanupFile).Warn("could not clean up old root propagation unmount file")
  1152. }
  1153. }()
  1154. if hasMountInfoOption(mountOptions, sharedPropagationOption, slavePropagationOption) {
  1155. cleanupOldFile = true
  1156. return nil
  1157. }
  1158. if err := mount.MakeShared(cfg.Root); err != nil {
  1159. return errors.Wrap(err, "could not setup daemon root propagation to shared")
  1160. }
  1161. // check the case where this may have already been a mount to itself.
  1162. // If so then the daemon only performed a remount and should not try to unmount this later.
  1163. if rootParentMount == cfg.Root {
  1164. cleanupOldFile = true
  1165. return nil
  1166. }
  1167. if err := os.MkdirAll(filepath.Dir(cleanupFile), 0700); err != nil {
  1168. return errors.Wrap(err, "error creating dir to store mount cleanup file")
  1169. }
  1170. if err := os.WriteFile(cleanupFile, nil, 0600); err != nil {
  1171. return errors.Wrap(err, "error writing file to signal mount cleanup on shutdown")
  1172. }
  1173. return nil
  1174. }
  1175. // getUnmountOnShutdownPath generates the path to used when writing the file that signals to the daemon that on shutdown
  1176. // the daemon root should be unmounted.
  1177. func getUnmountOnShutdownPath(config *config.Config) string {
  1178. return filepath.Join(config.ExecRoot, "unmount-on-shutdown")
  1179. }
  1180. // registerLinks registers network links between container and other containers
  1181. // with the daemon using the specification in hostConfig.
  1182. func (daemon *Daemon) registerLinks(container *container.Container, hostConfig *containertypes.HostConfig) error {
  1183. if hostConfig == nil || hostConfig.NetworkMode.IsUserDefined() {
  1184. return nil
  1185. }
  1186. for _, l := range hostConfig.Links {
  1187. name, alias, err := opts.ParseLink(l)
  1188. if err != nil {
  1189. return err
  1190. }
  1191. child, err := daemon.GetContainer(name)
  1192. if err != nil {
  1193. if errdefs.IsNotFound(err) {
  1194. // Trying to link to a non-existing container is not valid, and
  1195. // should return an "invalid parameter" error. Returning a "not
  1196. // found" error here would make the client report the container's
  1197. // image could not be found (see moby/moby#39823)
  1198. err = errdefs.InvalidParameter(err)
  1199. }
  1200. return errors.Wrapf(err, "could not get container for %s", name)
  1201. }
  1202. for child.HostConfig.NetworkMode.IsContainer() {
  1203. parts := strings.SplitN(string(child.HostConfig.NetworkMode), ":", 2)
  1204. child, err = daemon.GetContainer(parts[1])
  1205. if err != nil {
  1206. if errdefs.IsNotFound(err) {
  1207. // Trying to link to a non-existing container is not valid, and
  1208. // should return an "invalid parameter" error. Returning a "not
  1209. // found" error here would make the client report the container's
  1210. // image could not be found (see moby/moby#39823)
  1211. err = errdefs.InvalidParameter(err)
  1212. }
  1213. return errors.Wrapf(err, "Could not get container for %s", parts[1])
  1214. }
  1215. }
  1216. if child.HostConfig.NetworkMode.IsHost() {
  1217. return runconfig.ErrConflictHostNetworkAndLinks
  1218. }
  1219. if err := daemon.registerLink(container, child, alias); err != nil {
  1220. return err
  1221. }
  1222. }
  1223. return nil
  1224. }
  1225. // conditionalMountOnStart is a platform specific helper function during the
  1226. // container start to call mount.
  1227. func (daemon *Daemon) conditionalMountOnStart(container *container.Container) error {
  1228. return daemon.Mount(container)
  1229. }
  1230. // conditionalUnmountOnCleanup is a platform specific helper function called
  1231. // during the cleanup of a container to unmount.
  1232. func (daemon *Daemon) conditionalUnmountOnCleanup(container *container.Container) error {
  1233. return daemon.Unmount(container)
  1234. }
  1235. func copyBlkioEntry(entries []*statsV1.BlkIOEntry) []types.BlkioStatEntry {
  1236. out := make([]types.BlkioStatEntry, len(entries))
  1237. for i, re := range entries {
  1238. out[i] = types.BlkioStatEntry{
  1239. Major: re.Major,
  1240. Minor: re.Minor,
  1241. Op: re.Op,
  1242. Value: re.Value,
  1243. }
  1244. }
  1245. return out
  1246. }
  1247. func (daemon *Daemon) stats(c *container.Container) (*types.StatsJSON, error) {
  1248. if !c.IsRunning() {
  1249. return nil, errNotRunning(c.ID)
  1250. }
  1251. cs, err := daemon.containerd.Stats(context.Background(), c.ID)
  1252. if err != nil {
  1253. if strings.Contains(err.Error(), "container not found") {
  1254. return nil, containerNotFound(c.ID)
  1255. }
  1256. return nil, err
  1257. }
  1258. s := &types.StatsJSON{}
  1259. s.Read = cs.Read
  1260. stats := cs.Metrics
  1261. switch t := stats.(type) {
  1262. case *statsV1.Metrics:
  1263. return daemon.statsV1(s, t)
  1264. case *statsV2.Metrics:
  1265. return daemon.statsV2(s, t)
  1266. default:
  1267. return nil, errors.Errorf("unexpected type of metrics %+v", t)
  1268. }
  1269. }
  1270. func (daemon *Daemon) statsV1(s *types.StatsJSON, stats *statsV1.Metrics) (*types.StatsJSON, error) {
  1271. if stats.Blkio != nil {
  1272. s.BlkioStats = types.BlkioStats{
  1273. IoServiceBytesRecursive: copyBlkioEntry(stats.Blkio.IoServiceBytesRecursive),
  1274. IoServicedRecursive: copyBlkioEntry(stats.Blkio.IoServicedRecursive),
  1275. IoQueuedRecursive: copyBlkioEntry(stats.Blkio.IoQueuedRecursive),
  1276. IoServiceTimeRecursive: copyBlkioEntry(stats.Blkio.IoServiceTimeRecursive),
  1277. IoWaitTimeRecursive: copyBlkioEntry(stats.Blkio.IoWaitTimeRecursive),
  1278. IoMergedRecursive: copyBlkioEntry(stats.Blkio.IoMergedRecursive),
  1279. IoTimeRecursive: copyBlkioEntry(stats.Blkio.IoTimeRecursive),
  1280. SectorsRecursive: copyBlkioEntry(stats.Blkio.SectorsRecursive),
  1281. }
  1282. }
  1283. if stats.CPU != nil {
  1284. s.CPUStats = types.CPUStats{
  1285. CPUUsage: types.CPUUsage{
  1286. TotalUsage: stats.CPU.Usage.Total,
  1287. PercpuUsage: stats.CPU.Usage.PerCPU,
  1288. UsageInKernelmode: stats.CPU.Usage.Kernel,
  1289. UsageInUsermode: stats.CPU.Usage.User,
  1290. },
  1291. ThrottlingData: types.ThrottlingData{
  1292. Periods: stats.CPU.Throttling.Periods,
  1293. ThrottledPeriods: stats.CPU.Throttling.ThrottledPeriods,
  1294. ThrottledTime: stats.CPU.Throttling.ThrottledTime,
  1295. },
  1296. }
  1297. }
  1298. if stats.Memory != nil {
  1299. raw := map[string]uint64{
  1300. "cache": stats.Memory.Cache,
  1301. "rss": stats.Memory.RSS,
  1302. "rss_huge": stats.Memory.RSSHuge,
  1303. "mapped_file": stats.Memory.MappedFile,
  1304. "dirty": stats.Memory.Dirty,
  1305. "writeback": stats.Memory.Writeback,
  1306. "pgpgin": stats.Memory.PgPgIn,
  1307. "pgpgout": stats.Memory.PgPgOut,
  1308. "pgfault": stats.Memory.PgFault,
  1309. "pgmajfault": stats.Memory.PgMajFault,
  1310. "inactive_anon": stats.Memory.InactiveAnon,
  1311. "active_anon": stats.Memory.ActiveAnon,
  1312. "inactive_file": stats.Memory.InactiveFile,
  1313. "active_file": stats.Memory.ActiveFile,
  1314. "unevictable": stats.Memory.Unevictable,
  1315. "hierarchical_memory_limit": stats.Memory.HierarchicalMemoryLimit,
  1316. "hierarchical_memsw_limit": stats.Memory.HierarchicalSwapLimit,
  1317. "total_cache": stats.Memory.TotalCache,
  1318. "total_rss": stats.Memory.TotalRSS,
  1319. "total_rss_huge": stats.Memory.TotalRSSHuge,
  1320. "total_mapped_file": stats.Memory.TotalMappedFile,
  1321. "total_dirty": stats.Memory.TotalDirty,
  1322. "total_writeback": stats.Memory.TotalWriteback,
  1323. "total_pgpgin": stats.Memory.TotalPgPgIn,
  1324. "total_pgpgout": stats.Memory.TotalPgPgOut,
  1325. "total_pgfault": stats.Memory.TotalPgFault,
  1326. "total_pgmajfault": stats.Memory.TotalPgMajFault,
  1327. "total_inactive_anon": stats.Memory.TotalInactiveAnon,
  1328. "total_active_anon": stats.Memory.TotalActiveAnon,
  1329. "total_inactive_file": stats.Memory.TotalInactiveFile,
  1330. "total_active_file": stats.Memory.TotalActiveFile,
  1331. "total_unevictable": stats.Memory.TotalUnevictable,
  1332. }
  1333. if stats.Memory.Usage != nil {
  1334. s.MemoryStats = types.MemoryStats{
  1335. Stats: raw,
  1336. Usage: stats.Memory.Usage.Usage,
  1337. MaxUsage: stats.Memory.Usage.Max,
  1338. Limit: stats.Memory.Usage.Limit,
  1339. Failcnt: stats.Memory.Usage.Failcnt,
  1340. }
  1341. } else {
  1342. s.MemoryStats = types.MemoryStats{
  1343. Stats: raw,
  1344. }
  1345. }
  1346. // if the container does not set memory limit, use the machineMemory
  1347. if s.MemoryStats.Limit > daemon.machineMemory && daemon.machineMemory > 0 {
  1348. s.MemoryStats.Limit = daemon.machineMemory
  1349. }
  1350. }
  1351. if stats.Pids != nil {
  1352. s.PidsStats = types.PidsStats{
  1353. Current: stats.Pids.Current,
  1354. Limit: stats.Pids.Limit,
  1355. }
  1356. }
  1357. return s, nil
  1358. }
  1359. func (daemon *Daemon) statsV2(s *types.StatsJSON, stats *statsV2.Metrics) (*types.StatsJSON, error) {
  1360. if stats.Io != nil {
  1361. var isbr []types.BlkioStatEntry
  1362. for _, re := range stats.Io.Usage {
  1363. isbr = append(isbr,
  1364. types.BlkioStatEntry{
  1365. Major: re.Major,
  1366. Minor: re.Minor,
  1367. Op: "read",
  1368. Value: re.Rbytes,
  1369. },
  1370. types.BlkioStatEntry{
  1371. Major: re.Major,
  1372. Minor: re.Minor,
  1373. Op: "write",
  1374. Value: re.Wbytes,
  1375. },
  1376. )
  1377. }
  1378. s.BlkioStats = types.BlkioStats{
  1379. IoServiceBytesRecursive: isbr,
  1380. // Other fields are unsupported
  1381. }
  1382. }
  1383. if stats.CPU != nil {
  1384. s.CPUStats = types.CPUStats{
  1385. CPUUsage: types.CPUUsage{
  1386. TotalUsage: stats.CPU.UsageUsec * 1000,
  1387. // PercpuUsage is not supported
  1388. UsageInKernelmode: stats.CPU.SystemUsec * 1000,
  1389. UsageInUsermode: stats.CPU.UserUsec * 1000,
  1390. },
  1391. ThrottlingData: types.ThrottlingData{
  1392. Periods: stats.CPU.NrPeriods,
  1393. ThrottledPeriods: stats.CPU.NrThrottled,
  1394. ThrottledTime: stats.CPU.ThrottledUsec * 1000,
  1395. },
  1396. }
  1397. }
  1398. if stats.Memory != nil {
  1399. s.MemoryStats = types.MemoryStats{
  1400. // Stats is not compatible with v1
  1401. Stats: map[string]uint64{
  1402. "anon": stats.Memory.Anon,
  1403. "file": stats.Memory.File,
  1404. "kernel_stack": stats.Memory.KernelStack,
  1405. "slab": stats.Memory.Slab,
  1406. "sock": stats.Memory.Sock,
  1407. "shmem": stats.Memory.Shmem,
  1408. "file_mapped": stats.Memory.FileMapped,
  1409. "file_dirty": stats.Memory.FileDirty,
  1410. "file_writeback": stats.Memory.FileWriteback,
  1411. "anon_thp": stats.Memory.AnonThp,
  1412. "inactive_anon": stats.Memory.InactiveAnon,
  1413. "active_anon": stats.Memory.ActiveAnon,
  1414. "inactive_file": stats.Memory.InactiveFile,
  1415. "active_file": stats.Memory.ActiveFile,
  1416. "unevictable": stats.Memory.Unevictable,
  1417. "slab_reclaimable": stats.Memory.SlabReclaimable,
  1418. "slab_unreclaimable": stats.Memory.SlabUnreclaimable,
  1419. "pgfault": stats.Memory.Pgfault,
  1420. "pgmajfault": stats.Memory.Pgmajfault,
  1421. "workingset_refault": stats.Memory.WorkingsetRefault,
  1422. "workingset_activate": stats.Memory.WorkingsetActivate,
  1423. "workingset_nodereclaim": stats.Memory.WorkingsetNodereclaim,
  1424. "pgrefill": stats.Memory.Pgrefill,
  1425. "pgscan": stats.Memory.Pgscan,
  1426. "pgsteal": stats.Memory.Pgsteal,
  1427. "pgactivate": stats.Memory.Pgactivate,
  1428. "pgdeactivate": stats.Memory.Pgdeactivate,
  1429. "pglazyfree": stats.Memory.Pglazyfree,
  1430. "pglazyfreed": stats.Memory.Pglazyfreed,
  1431. "thp_fault_alloc": stats.Memory.ThpFaultAlloc,
  1432. "thp_collapse_alloc": stats.Memory.ThpCollapseAlloc,
  1433. },
  1434. Usage: stats.Memory.Usage,
  1435. // MaxUsage is not supported
  1436. Limit: stats.Memory.UsageLimit,
  1437. }
  1438. // if the container does not set memory limit, use the machineMemory
  1439. if s.MemoryStats.Limit > daemon.machineMemory && daemon.machineMemory > 0 {
  1440. s.MemoryStats.Limit = daemon.machineMemory
  1441. }
  1442. if stats.MemoryEvents != nil {
  1443. // Failcnt is set to the "oom" field of the "memory.events" file.
  1444. // See https://www.kernel.org/doc/html/latest/admin-guide/cgroup-v2.html
  1445. s.MemoryStats.Failcnt = stats.MemoryEvents.Oom
  1446. }
  1447. }
  1448. if stats.Pids != nil {
  1449. s.PidsStats = types.PidsStats{
  1450. Current: stats.Pids.Current,
  1451. Limit: stats.Pids.Limit,
  1452. }
  1453. }
  1454. return s, nil
  1455. }
  1456. // setDefaultIsolation determines the default isolation mode for the
  1457. // daemon to run in. This is only applicable on Windows
  1458. func (daemon *Daemon) setDefaultIsolation() error {
  1459. return nil
  1460. }
  1461. // setupDaemonProcess sets various settings for the daemon's process
  1462. func setupDaemonProcess(config *config.Config) error {
  1463. // setup the daemons oom_score_adj
  1464. if err := setupOOMScoreAdj(config.OOMScoreAdjust); err != nil {
  1465. return err
  1466. }
  1467. if err := setMayDetachMounts(); err != nil {
  1468. logrus.WithError(err).Warn("Could not set may_detach_mounts kernel parameter")
  1469. }
  1470. return nil
  1471. }
  1472. // This is used to allow removal of mountpoints that may be mounted in other
  1473. // namespaces on RHEL based kernels starting from RHEL 7.4.
  1474. // Without this setting, removals on these RHEL based kernels may fail with
  1475. // "device or resource busy".
  1476. // This setting is not available in upstream kernels as it is not configurable,
  1477. // but has been in the upstream kernels since 3.15.
  1478. func setMayDetachMounts() error {
  1479. f, err := os.OpenFile("/proc/sys/fs/may_detach_mounts", os.O_WRONLY, 0)
  1480. if err != nil {
  1481. if os.IsNotExist(err) {
  1482. return nil
  1483. }
  1484. return errors.Wrap(err, "error opening may_detach_mounts kernel config file")
  1485. }
  1486. defer f.Close()
  1487. _, err = f.WriteString("1")
  1488. if os.IsPermission(err) {
  1489. // Setting may_detach_mounts does not work in an
  1490. // unprivileged container. Ignore the error, but log
  1491. // it if we appear not to be in that situation.
  1492. if !userns.RunningInUserNS() {
  1493. logrus.Debugf("Permission denied writing %q to /proc/sys/fs/may_detach_mounts", "1")
  1494. }
  1495. return nil
  1496. }
  1497. return err
  1498. }
  1499. func setupOOMScoreAdj(score int) error {
  1500. if score == 0 {
  1501. return nil
  1502. }
  1503. f, err := os.OpenFile("/proc/self/oom_score_adj", os.O_WRONLY, 0)
  1504. if err != nil {
  1505. return err
  1506. }
  1507. defer f.Close()
  1508. stringScore := strconv.Itoa(score)
  1509. _, err = f.WriteString(stringScore)
  1510. if os.IsPermission(err) {
  1511. // Setting oom_score_adj does not work in an
  1512. // unprivileged container. Ignore the error, but log
  1513. // it if we appear not to be in that situation.
  1514. if !userns.RunningInUserNS() {
  1515. logrus.Debugf("Permission denied writing %q to /proc/self/oom_score_adj", stringScore)
  1516. }
  1517. return nil
  1518. }
  1519. return err
  1520. }
  1521. func (daemon *Daemon) initCPURtController(mnt, path string) error {
  1522. if path == "/" || path == "." {
  1523. return nil
  1524. }
  1525. // Recursively create cgroup to ensure that the system and all parent cgroups have values set
  1526. // for the period and runtime as this limits what the children can be set to.
  1527. if err := daemon.initCPURtController(mnt, filepath.Dir(path)); err != nil {
  1528. return err
  1529. }
  1530. path = filepath.Join(mnt, path)
  1531. if err := os.MkdirAll(path, 0755); err != nil {
  1532. return err
  1533. }
  1534. if err := maybeCreateCPURealTimeFile(daemon.configStore.CPURealtimePeriod, "cpu.rt_period_us", path); err != nil {
  1535. return err
  1536. }
  1537. return maybeCreateCPURealTimeFile(daemon.configStore.CPURealtimeRuntime, "cpu.rt_runtime_us", path)
  1538. }
  1539. func maybeCreateCPURealTimeFile(configValue int64, file string, path string) error {
  1540. if configValue == 0 {
  1541. return nil
  1542. }
  1543. return os.WriteFile(filepath.Join(path, file), []byte(strconv.FormatInt(configValue, 10)), 0700)
  1544. }
  1545. func (daemon *Daemon) setupSeccompProfile() error {
  1546. switch profile := daemon.configStore.SeccompProfile; profile {
  1547. case "", config.SeccompProfileDefault:
  1548. daemon.seccompProfilePath = config.SeccompProfileDefault
  1549. case config.SeccompProfileUnconfined:
  1550. daemon.seccompProfilePath = config.SeccompProfileUnconfined
  1551. default:
  1552. daemon.seccompProfilePath = profile
  1553. b, err := os.ReadFile(profile)
  1554. if err != nil {
  1555. return fmt.Errorf("opening seccomp profile (%s) failed: %v", profile, err)
  1556. }
  1557. daemon.seccompProfile = b
  1558. }
  1559. return nil
  1560. }
  1561. func getSysInfo(daemon *Daemon) *sysinfo.SysInfo {
  1562. var siOpts []sysinfo.Opt
  1563. if daemon.getCgroupDriver() == cgroupSystemdDriver {
  1564. if euid := os.Getenv("ROOTLESSKIT_PARENT_EUID"); euid != "" {
  1565. siOpts = append(siOpts, sysinfo.WithCgroup2GroupPath("/user.slice/user-"+euid+".slice"))
  1566. }
  1567. }
  1568. return sysinfo.New(siOpts...)
  1569. }
  1570. func (daemon *Daemon) initLibcontainerd(ctx context.Context) error {
  1571. var err error
  1572. daemon.containerd, err = remote.NewClient(
  1573. ctx,
  1574. daemon.containerdCli,
  1575. filepath.Join(daemon.configStore.ExecRoot, "containerd"),
  1576. daemon.configStore.ContainerdNamespace,
  1577. daemon,
  1578. )
  1579. return err
  1580. }
  1581. func recursiveUnmount(target string) error {
  1582. return mount.RecursiveUnmount(target)
  1583. }