container_unix.go 39 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798991001011021031041051061071081091101111121131141151161171181191201211221231241251261271281291301311321331341351361371381391401411421431441451461471481491501511521531541551561571581591601611621631641651661671681691701711721731741751761771781791801811821831841851861871881891901911921931941951961971981992002012022032042052062072082092102112122132142152162172182192202212222232242252262272282292302312322332342352362372382392402412422432442452462472482492502512522532542552562572582592602612622632642652662672682692702712722732742752762772782792802812822832842852862872882892902912922932942952962972982993003013023033043053063073083093103113123133143153163173183193203213223233243253263273283293303313323333343353363373383393403413423433443453463473483493503513523533543553563573583593603613623633643653663673683693703713723733743753763773783793803813823833843853863873883893903913923933943953963973983994004014024034044054064074084094104114124134144154164174184194204214224234244254264274284294304314324334344354364374384394404414424434444454464474484494504514524534544554564574584594604614624634644654664674684694704714724734744754764774784794804814824834844854864874884894904914924934944954964974984995005015025035045055065075085095105115125135145155165175185195205215225235245255265275285295305315325335345355365375385395405415425435445455465475485495505515525535545555565575585595605615625635645655665675685695705715725735745755765775785795805815825835845855865875885895905915925935945955965975985996006016026036046056066076086096106116126136146156166176186196206216226236246256266276286296306316326336346356366376386396406416426436446456466476486496506516526536546556566576586596606616626636646656666676686696706716726736746756766776786796806816826836846856866876886896906916926936946956966976986997007017027037047057067077087097107117127137147157167177187197207217227237247257267277287297307317327337347357367377387397407417427437447457467477487497507517527537547557567577587597607617627637647657667677687697707717727737747757767777787797807817827837847857867877887897907917927937947957967977987998008018028038048058068078088098108118128138148158168178188198208218228238248258268278288298308318328338348358368378388398408418428438448458468478488498508518528538548558568578588598608618628638648658668678688698708718728738748758768778788798808818828838848858868878888898908918928938948958968978988999009019029039049059069079089099109119129139149159169179189199209219229239249259269279289299309319329339349359369379389399409419429439449459469479489499509519529539549559569579589599609619629639649659669679689699709719729739749759769779789799809819829839849859869879889899909919929939949959969979989991000100110021003100410051006100710081009101010111012101310141015101610171018101910201021102210231024102510261027102810291030103110321033103410351036103710381039104010411042104310441045104610471048104910501051105210531054105510561057105810591060106110621063106410651066106710681069107010711072107310741075107610771078107910801081108210831084108510861087108810891090109110921093109410951096109710981099110011011102110311041105110611071108110911101111111211131114111511161117111811191120112111221123112411251126112711281129113011311132113311341135113611371138113911401141114211431144114511461147114811491150115111521153115411551156115711581159116011611162116311641165116611671168116911701171117211731174117511761177117811791180118111821183118411851186118711881189119011911192119311941195119611971198119912001201120212031204120512061207120812091210121112121213121412151216121712181219122012211222122312241225122612271228122912301231123212331234123512361237123812391240124112421243124412451246124712481249125012511252125312541255125612571258125912601261126212631264126512661267126812691270127112721273127412751276127712781279128012811282128312841285128612871288128912901291129212931294129512961297129812991300130113021303130413051306130713081309131013111312131313141315131613171318131913201321132213231324132513261327132813291330133113321333133413351336133713381339134013411342134313441345134613471348134913501351135213531354135513561357135813591360136113621363136413651366136713681369137013711372137313741375137613771378137913801381138213831384138513861387138813891390139113921393139413951396139713981399140014011402140314041405140614071408140914101411141214131414141514161417141814191420142114221423142414251426142714281429143014311432143314341435143614371438143914401441144214431444144514461447
  1. // +build linux freebsd
  2. package daemon
  3. import (
  4. "fmt"
  5. "io/ioutil"
  6. "net"
  7. "os"
  8. "path"
  9. "path/filepath"
  10. "strconv"
  11. "strings"
  12. "syscall"
  13. "time"
  14. "github.com/Sirupsen/logrus"
  15. "github.com/docker/docker/daemon/execdriver"
  16. "github.com/docker/docker/daemon/links"
  17. "github.com/docker/docker/daemon/network"
  18. derr "github.com/docker/docker/errors"
  19. "github.com/docker/docker/pkg/directory"
  20. "github.com/docker/docker/pkg/nat"
  21. "github.com/docker/docker/pkg/stringid"
  22. "github.com/docker/docker/pkg/system"
  23. "github.com/docker/docker/pkg/ulimit"
  24. "github.com/docker/docker/runconfig"
  25. "github.com/docker/docker/utils"
  26. "github.com/docker/docker/volume"
  27. "github.com/docker/docker/volume/store"
  28. "github.com/docker/libnetwork"
  29. "github.com/docker/libnetwork/netlabel"
  30. "github.com/docker/libnetwork/options"
  31. "github.com/docker/libnetwork/types"
  32. "github.com/opencontainers/runc/libcontainer/configs"
  33. "github.com/opencontainers/runc/libcontainer/devices"
  34. "github.com/opencontainers/runc/libcontainer/label"
  35. )
  36. // DefaultPathEnv is unix style list of directories to search for
  37. // executables. Each directory is separated from the next by a colon
  38. // ':' character .
  39. const DefaultPathEnv = "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
  40. // Container holds the fields specific to unixen implementations. See
  41. // CommonContainer for standard fields common to all containers.
  42. type Container struct {
  43. CommonContainer
  44. // Fields below here are platform specific.
  45. activeLinks map[string]*links.Link
  46. AppArmorProfile string
  47. HostnamePath string
  48. HostsPath string
  49. ShmPath string
  50. MqueuePath string
  51. MountPoints map[string]*mountPoint
  52. ResolvConfPath string
  53. Volumes map[string]string // Deprecated since 1.7, kept for backwards compatibility
  54. VolumesRW map[string]bool // Deprecated since 1.7, kept for backwards compatibility
  55. }
  56. func killProcessDirectly(container *Container) error {
  57. if _, err := container.WaitStop(10 * time.Second); err != nil {
  58. // Ensure that we don't kill ourselves
  59. if pid := container.getPID(); pid != 0 {
  60. logrus.Infof("Container %s failed to exit within 10 seconds of kill - trying direct SIGKILL", stringid.TruncateID(container.ID))
  61. if err := syscall.Kill(pid, 9); err != nil {
  62. if err != syscall.ESRCH {
  63. return err
  64. }
  65. logrus.Debugf("Cannot kill process (pid=%d) with signal 9: no such process.", pid)
  66. }
  67. }
  68. }
  69. return nil
  70. }
  71. func (container *Container) setupLinkedContainers() ([]string, error) {
  72. var (
  73. env []string
  74. daemon = container.daemon
  75. )
  76. children, err := daemon.children(container.Name)
  77. if err != nil {
  78. return nil, err
  79. }
  80. if len(children) > 0 {
  81. for linkAlias, child := range children {
  82. if !child.IsRunning() {
  83. return nil, derr.ErrorCodeLinkNotRunning.WithArgs(child.Name, linkAlias)
  84. }
  85. link := links.NewLink(
  86. container.NetworkSettings.IPAddress,
  87. child.NetworkSettings.IPAddress,
  88. linkAlias,
  89. child.Config.Env,
  90. child.Config.ExposedPorts,
  91. )
  92. for _, envVar := range link.ToEnv() {
  93. env = append(env, envVar)
  94. }
  95. }
  96. }
  97. return env, nil
  98. }
  99. func (container *Container) createDaemonEnvironment(linkedEnv []string) []string {
  100. // if a domain name was specified, append it to the hostname (see #7851)
  101. fullHostname := container.Config.Hostname
  102. if container.Config.Domainname != "" {
  103. fullHostname = fmt.Sprintf("%s.%s", fullHostname, container.Config.Domainname)
  104. }
  105. // Setup environment
  106. env := []string{
  107. "PATH=" + DefaultPathEnv,
  108. "HOSTNAME=" + fullHostname,
  109. // Note: we don't set HOME here because it'll get autoset intelligently
  110. // based on the value of USER inside dockerinit, but only if it isn't
  111. // set already (ie, that can be overridden by setting HOME via -e or ENV
  112. // in a Dockerfile).
  113. }
  114. if container.Config.Tty {
  115. env = append(env, "TERM=xterm")
  116. }
  117. env = append(env, linkedEnv...)
  118. // because the env on the container can override certain default values
  119. // we need to replace the 'env' keys where they match and append anything
  120. // else.
  121. env = utils.ReplaceOrAppendEnvValues(env, container.Config.Env)
  122. return env
  123. }
  124. func getDevicesFromPath(deviceMapping runconfig.DeviceMapping) (devs []*configs.Device, err error) {
  125. device, err := devices.DeviceFromPath(deviceMapping.PathOnHost, deviceMapping.CgroupPermissions)
  126. // if there was no error, return the device
  127. if err == nil {
  128. device.Path = deviceMapping.PathInContainer
  129. return append(devs, device), nil
  130. }
  131. // if the device is not a device node
  132. // try to see if it's a directory holding many devices
  133. if err == devices.ErrNotADevice {
  134. // check if it is a directory
  135. if src, e := os.Stat(deviceMapping.PathOnHost); e == nil && src.IsDir() {
  136. // mount the internal devices recursively
  137. filepath.Walk(deviceMapping.PathOnHost, func(dpath string, f os.FileInfo, e error) error {
  138. childDevice, e := devices.DeviceFromPath(dpath, deviceMapping.CgroupPermissions)
  139. if e != nil {
  140. // ignore the device
  141. return nil
  142. }
  143. // add the device to userSpecified devices
  144. childDevice.Path = strings.Replace(dpath, deviceMapping.PathOnHost, deviceMapping.PathInContainer, 1)
  145. devs = append(devs, childDevice)
  146. return nil
  147. })
  148. }
  149. }
  150. if len(devs) > 0 {
  151. return devs, nil
  152. }
  153. return devs, derr.ErrorCodeDeviceInfo.WithArgs(deviceMapping.PathOnHost, err)
  154. }
  155. func populateCommand(c *Container, env []string) error {
  156. var en *execdriver.Network
  157. if !c.Config.NetworkDisabled {
  158. en = &execdriver.Network{}
  159. if !c.daemon.execDriver.SupportsHooks() || c.hostConfig.NetworkMode.IsHost() {
  160. en.NamespacePath = c.NetworkSettings.SandboxKey
  161. }
  162. parts := strings.SplitN(string(c.hostConfig.NetworkMode), ":", 2)
  163. if parts[0] == "container" {
  164. nc, err := c.getNetworkedContainer()
  165. if err != nil {
  166. return err
  167. }
  168. en.ContainerID = nc.ID
  169. }
  170. }
  171. ipc := &execdriver.Ipc{}
  172. var err error
  173. c.ShmPath, err = c.shmPath()
  174. if err != nil {
  175. return err
  176. }
  177. c.MqueuePath, err = c.mqueuePath()
  178. if err != nil {
  179. return err
  180. }
  181. if c.hostConfig.IpcMode.IsContainer() {
  182. ic, err := c.getIpcContainer()
  183. if err != nil {
  184. return err
  185. }
  186. ipc.ContainerID = ic.ID
  187. c.ShmPath = ic.ShmPath
  188. c.MqueuePath = ic.MqueuePath
  189. } else {
  190. ipc.HostIpc = c.hostConfig.IpcMode.IsHost()
  191. if ipc.HostIpc {
  192. c.ShmPath = "/dev/shm"
  193. c.MqueuePath = "/dev/mqueue"
  194. }
  195. }
  196. pid := &execdriver.Pid{}
  197. pid.HostPid = c.hostConfig.PidMode.IsHost()
  198. uts := &execdriver.UTS{
  199. HostUTS: c.hostConfig.UTSMode.IsHost(),
  200. }
  201. // Build lists of devices allowed and created within the container.
  202. var userSpecifiedDevices []*configs.Device
  203. for _, deviceMapping := range c.hostConfig.Devices {
  204. devs, err := getDevicesFromPath(deviceMapping)
  205. if err != nil {
  206. return err
  207. }
  208. userSpecifiedDevices = append(userSpecifiedDevices, devs...)
  209. }
  210. allowedDevices := mergeDevices(configs.DefaultAllowedDevices, userSpecifiedDevices)
  211. autoCreatedDevices := mergeDevices(configs.DefaultAutoCreatedDevices, userSpecifiedDevices)
  212. // TODO: this can be removed after lxc-conf is fully deprecated
  213. lxcConfig, err := mergeLxcConfIntoOptions(c.hostConfig)
  214. if err != nil {
  215. return err
  216. }
  217. var rlimits []*ulimit.Rlimit
  218. ulimits := c.hostConfig.Ulimits
  219. // Merge ulimits with daemon defaults
  220. ulIdx := make(map[string]*ulimit.Ulimit)
  221. for _, ul := range ulimits {
  222. ulIdx[ul.Name] = ul
  223. }
  224. for name, ul := range c.daemon.configStore.Ulimits {
  225. if _, exists := ulIdx[name]; !exists {
  226. ulimits = append(ulimits, ul)
  227. }
  228. }
  229. for _, limit := range ulimits {
  230. rl, err := limit.GetRlimit()
  231. if err != nil {
  232. return err
  233. }
  234. rlimits = append(rlimits, rl)
  235. }
  236. resources := &execdriver.Resources{
  237. Memory: c.hostConfig.Memory,
  238. MemorySwap: c.hostConfig.MemorySwap,
  239. MemoryReservation: c.hostConfig.MemoryReservation,
  240. KernelMemory: c.hostConfig.KernelMemory,
  241. CPUShares: c.hostConfig.CPUShares,
  242. CpusetCpus: c.hostConfig.CpusetCpus,
  243. CpusetMems: c.hostConfig.CpusetMems,
  244. CPUPeriod: c.hostConfig.CPUPeriod,
  245. CPUQuota: c.hostConfig.CPUQuota,
  246. BlkioWeight: c.hostConfig.BlkioWeight,
  247. Rlimits: rlimits,
  248. OomKillDisable: c.hostConfig.OomKillDisable,
  249. MemorySwappiness: -1,
  250. }
  251. if c.hostConfig.MemorySwappiness != nil {
  252. resources.MemorySwappiness = *c.hostConfig.MemorySwappiness
  253. }
  254. processConfig := execdriver.ProcessConfig{
  255. Privileged: c.hostConfig.Privileged,
  256. Entrypoint: c.Path,
  257. Arguments: c.Args,
  258. Tty: c.Config.Tty,
  259. User: c.Config.User,
  260. }
  261. processConfig.SysProcAttr = &syscall.SysProcAttr{Setsid: true}
  262. processConfig.Env = env
  263. c.command = &execdriver.Command{
  264. ID: c.ID,
  265. Rootfs: c.rootfsPath(),
  266. ReadonlyRootfs: c.hostConfig.ReadonlyRootfs,
  267. InitPath: "/.dockerinit",
  268. WorkingDir: c.Config.WorkingDir,
  269. Network: en,
  270. Ipc: ipc,
  271. Pid: pid,
  272. UTS: uts,
  273. Resources: resources,
  274. AllowedDevices: allowedDevices,
  275. AutoCreatedDevices: autoCreatedDevices,
  276. CapAdd: c.hostConfig.CapAdd.Slice(),
  277. CapDrop: c.hostConfig.CapDrop.Slice(),
  278. GroupAdd: c.hostConfig.GroupAdd,
  279. ProcessConfig: processConfig,
  280. ProcessLabel: c.getProcessLabel(),
  281. MountLabel: c.getMountLabel(),
  282. LxcConfig: lxcConfig,
  283. AppArmorProfile: c.AppArmorProfile,
  284. CgroupParent: c.hostConfig.CgroupParent,
  285. }
  286. return nil
  287. }
  288. func mergeDevices(defaultDevices, userDevices []*configs.Device) []*configs.Device {
  289. if len(userDevices) == 0 {
  290. return defaultDevices
  291. }
  292. paths := map[string]*configs.Device{}
  293. for _, d := range userDevices {
  294. paths[d.Path] = d
  295. }
  296. var devs []*configs.Device
  297. for _, d := range defaultDevices {
  298. if _, defined := paths[d.Path]; !defined {
  299. devs = append(devs, d)
  300. }
  301. }
  302. return append(devs, userDevices...)
  303. }
  304. // GetSize returns the real size & virtual size of the container.
  305. func (container *Container) getSize() (int64, int64) {
  306. var (
  307. sizeRw, sizeRootfs int64
  308. err error
  309. driver = container.daemon.driver
  310. )
  311. if err := container.Mount(); err != nil {
  312. logrus.Errorf("Failed to compute size of container rootfs %s: %s", container.ID, err)
  313. return sizeRw, sizeRootfs
  314. }
  315. defer container.Unmount()
  316. initID := fmt.Sprintf("%s-init", container.ID)
  317. sizeRw, err = driver.DiffSize(container.ID, initID)
  318. if err != nil {
  319. logrus.Errorf("Driver %s couldn't return diff size of container %s: %s", driver, container.ID, err)
  320. // FIXME: GetSize should return an error. Not changing it now in case
  321. // there is a side-effect.
  322. sizeRw = -1
  323. }
  324. if _, err = os.Stat(container.basefs); err == nil {
  325. if sizeRootfs, err = directory.Size(container.basefs); err != nil {
  326. sizeRootfs = -1
  327. }
  328. }
  329. return sizeRw, sizeRootfs
  330. }
  331. // Attempt to set the network mounts given a provided destination and
  332. // the path to use for it; return true if the given destination was a
  333. // network mount file
  334. func (container *Container) trySetNetworkMount(destination string, path string) bool {
  335. if destination == "/etc/resolv.conf" {
  336. container.ResolvConfPath = path
  337. return true
  338. }
  339. if destination == "/etc/hostname" {
  340. container.HostnamePath = path
  341. return true
  342. }
  343. if destination == "/etc/hosts" {
  344. container.HostsPath = path
  345. return true
  346. }
  347. return false
  348. }
  349. func (container *Container) buildHostnameFile() error {
  350. hostnamePath, err := container.getRootResourcePath("hostname")
  351. if err != nil {
  352. return err
  353. }
  354. container.HostnamePath = hostnamePath
  355. if container.Config.Domainname != "" {
  356. return ioutil.WriteFile(container.HostnamePath, []byte(fmt.Sprintf("%s.%s\n", container.Config.Hostname, container.Config.Domainname)), 0644)
  357. }
  358. return ioutil.WriteFile(container.HostnamePath, []byte(container.Config.Hostname+"\n"), 0644)
  359. }
  360. func (container *Container) buildSandboxOptions(n libnetwork.Network) ([]libnetwork.SandboxOption, error) {
  361. var (
  362. sboxOptions []libnetwork.SandboxOption
  363. err error
  364. dns []string
  365. dnsSearch []string
  366. dnsOptions []string
  367. )
  368. sboxOptions = append(sboxOptions, libnetwork.OptionHostname(container.Config.Hostname),
  369. libnetwork.OptionDomainname(container.Config.Domainname))
  370. if container.hostConfig.NetworkMode.IsHost() {
  371. sboxOptions = append(sboxOptions, libnetwork.OptionUseDefaultSandbox())
  372. sboxOptions = append(sboxOptions, libnetwork.OptionOriginHostsPath("/etc/hosts"))
  373. sboxOptions = append(sboxOptions, libnetwork.OptionOriginResolvConfPath("/etc/resolv.conf"))
  374. } else if container.daemon.execDriver.SupportsHooks() {
  375. // OptionUseExternalKey is mandatory for userns support.
  376. // But optional for non-userns support
  377. sboxOptions = append(sboxOptions, libnetwork.OptionUseExternalKey())
  378. }
  379. container.HostsPath, err = container.getRootResourcePath("hosts")
  380. if err != nil {
  381. return nil, err
  382. }
  383. sboxOptions = append(sboxOptions, libnetwork.OptionHostsPath(container.HostsPath))
  384. container.ResolvConfPath, err = container.getRootResourcePath("resolv.conf")
  385. if err != nil {
  386. return nil, err
  387. }
  388. sboxOptions = append(sboxOptions, libnetwork.OptionResolvConfPath(container.ResolvConfPath))
  389. if len(container.hostConfig.DNS) > 0 {
  390. dns = container.hostConfig.DNS
  391. } else if len(container.daemon.configStore.DNS) > 0 {
  392. dns = container.daemon.configStore.DNS
  393. }
  394. for _, d := range dns {
  395. sboxOptions = append(sboxOptions, libnetwork.OptionDNS(d))
  396. }
  397. if len(container.hostConfig.DNSSearch) > 0 {
  398. dnsSearch = container.hostConfig.DNSSearch
  399. } else if len(container.daemon.configStore.DNSSearch) > 0 {
  400. dnsSearch = container.daemon.configStore.DNSSearch
  401. }
  402. for _, ds := range dnsSearch {
  403. sboxOptions = append(sboxOptions, libnetwork.OptionDNSSearch(ds))
  404. }
  405. if len(container.hostConfig.DNSOptions) > 0 {
  406. dnsOptions = container.hostConfig.DNSOptions
  407. } else if len(container.daemon.configStore.DNSOptions) > 0 {
  408. dnsOptions = container.daemon.configStore.DNSOptions
  409. }
  410. for _, ds := range dnsOptions {
  411. sboxOptions = append(sboxOptions, libnetwork.OptionDNSOptions(ds))
  412. }
  413. if container.NetworkSettings.SecondaryIPAddresses != nil {
  414. name := container.Config.Hostname
  415. if container.Config.Domainname != "" {
  416. name = name + "." + container.Config.Domainname
  417. }
  418. for _, a := range container.NetworkSettings.SecondaryIPAddresses {
  419. sboxOptions = append(sboxOptions, libnetwork.OptionExtraHost(name, a.Addr))
  420. }
  421. }
  422. for _, extraHost := range container.hostConfig.ExtraHosts {
  423. // allow IPv6 addresses in extra hosts; only split on first ":"
  424. parts := strings.SplitN(extraHost, ":", 2)
  425. sboxOptions = append(sboxOptions, libnetwork.OptionExtraHost(parts[0], parts[1]))
  426. }
  427. // Link feature is supported only for the default bridge network.
  428. // return if this call to build join options is not for default bridge network
  429. if n.Name() != "bridge" {
  430. return sboxOptions, nil
  431. }
  432. ep, _ := container.getEndpointInNetwork(n)
  433. if ep == nil {
  434. return sboxOptions, nil
  435. }
  436. var childEndpoints, parentEndpoints []string
  437. children, err := container.daemon.children(container.Name)
  438. if err != nil {
  439. return nil, err
  440. }
  441. for linkAlias, child := range children {
  442. _, alias := path.Split(linkAlias)
  443. // allow access to the linked container via the alias, real name, and container hostname
  444. aliasList := alias + " " + child.Config.Hostname
  445. // only add the name if alias isn't equal to the name
  446. if alias != child.Name[1:] {
  447. aliasList = aliasList + " " + child.Name[1:]
  448. }
  449. sboxOptions = append(sboxOptions, libnetwork.OptionExtraHost(aliasList, child.NetworkSettings.IPAddress))
  450. cEndpoint, _ := child.getEndpointInNetwork(n)
  451. if cEndpoint != nil && cEndpoint.ID() != "" {
  452. childEndpoints = append(childEndpoints, cEndpoint.ID())
  453. }
  454. }
  455. refs := container.daemon.containerGraph().RefPaths(container.ID)
  456. for _, ref := range refs {
  457. if ref.ParentID == "0" {
  458. continue
  459. }
  460. c, err := container.daemon.Get(ref.ParentID)
  461. if err != nil {
  462. logrus.Error(err)
  463. }
  464. if c != nil && !container.daemon.configStore.DisableBridge && container.hostConfig.NetworkMode.IsPrivate() {
  465. logrus.Debugf("Update /etc/hosts of %s for alias %s with ip %s", c.ID, ref.Name, container.NetworkSettings.IPAddress)
  466. sboxOptions = append(sboxOptions, libnetwork.OptionParentUpdate(c.ID, ref.Name, container.NetworkSettings.IPAddress))
  467. if ep.ID() != "" {
  468. parentEndpoints = append(parentEndpoints, ep.ID())
  469. }
  470. }
  471. }
  472. linkOptions := options.Generic{
  473. netlabel.GenericData: options.Generic{
  474. "ParentEndpoints": parentEndpoints,
  475. "ChildEndpoints": childEndpoints,
  476. },
  477. }
  478. sboxOptions = append(sboxOptions, libnetwork.OptionGeneric(linkOptions))
  479. return sboxOptions, nil
  480. }
  481. func (container *Container) getEndpointInNetwork(n libnetwork.Network) (libnetwork.Endpoint, error) {
  482. endpointName := strings.TrimPrefix(container.Name, "/")
  483. return n.EndpointByName(endpointName)
  484. }
  485. func (container *Container) buildPortMapInfo(ep libnetwork.Endpoint, networkSettings *network.Settings) (*network.Settings, error) {
  486. if ep == nil {
  487. return nil, derr.ErrorCodeEmptyEndpoint
  488. }
  489. if networkSettings == nil {
  490. return nil, derr.ErrorCodeEmptyNetwork
  491. }
  492. driverInfo, err := ep.DriverInfo()
  493. if err != nil {
  494. return nil, err
  495. }
  496. if driverInfo == nil {
  497. // It is not an error for epInfo to be nil
  498. return networkSettings, nil
  499. }
  500. if mac, ok := driverInfo[netlabel.MacAddress]; ok {
  501. networkSettings.MacAddress = mac.(net.HardwareAddr).String()
  502. }
  503. networkSettings.Ports = nat.PortMap{}
  504. if expData, ok := driverInfo[netlabel.ExposedPorts]; ok {
  505. if exposedPorts, ok := expData.([]types.TransportPort); ok {
  506. for _, tp := range exposedPorts {
  507. natPort, err := nat.NewPort(tp.Proto.String(), strconv.Itoa(int(tp.Port)))
  508. if err != nil {
  509. return nil, derr.ErrorCodeParsingPort.WithArgs(tp.Port, err)
  510. }
  511. networkSettings.Ports[natPort] = nil
  512. }
  513. }
  514. }
  515. mapData, ok := driverInfo[netlabel.PortMap]
  516. if !ok {
  517. return networkSettings, nil
  518. }
  519. if portMapping, ok := mapData.([]types.PortBinding); ok {
  520. for _, pp := range portMapping {
  521. natPort, err := nat.NewPort(pp.Proto.String(), strconv.Itoa(int(pp.Port)))
  522. if err != nil {
  523. return nil, err
  524. }
  525. natBndg := nat.PortBinding{HostIP: pp.HostIP.String(), HostPort: strconv.Itoa(int(pp.HostPort))}
  526. networkSettings.Ports[natPort] = append(networkSettings.Ports[natPort], natBndg)
  527. }
  528. }
  529. return networkSettings, nil
  530. }
  531. func (container *Container) buildEndpointInfo(ep libnetwork.Endpoint, networkSettings *network.Settings) (*network.Settings, error) {
  532. if ep == nil {
  533. return nil, derr.ErrorCodeEmptyEndpoint
  534. }
  535. if networkSettings == nil {
  536. return nil, derr.ErrorCodeEmptyNetwork
  537. }
  538. epInfo := ep.Info()
  539. if epInfo == nil {
  540. // It is not an error to get an empty endpoint info
  541. return networkSettings, nil
  542. }
  543. iface := epInfo.Iface()
  544. if iface == nil {
  545. return networkSettings, nil
  546. }
  547. ones, _ := iface.Address().Mask.Size()
  548. networkSettings.IPAddress = iface.Address().IP.String()
  549. networkSettings.IPPrefixLen = ones
  550. if iface.AddressIPv6().IP.To16() != nil {
  551. onesv6, _ := iface.AddressIPv6().Mask.Size()
  552. networkSettings.GlobalIPv6Address = iface.AddressIPv6().IP.String()
  553. networkSettings.GlobalIPv6PrefixLen = onesv6
  554. }
  555. return networkSettings, nil
  556. }
  557. func (container *Container) updateJoinInfo(ep libnetwork.Endpoint) error {
  558. epInfo := ep.Info()
  559. if epInfo == nil {
  560. // It is not an error to get an empty endpoint info
  561. return nil
  562. }
  563. container.NetworkSettings.Gateway = epInfo.Gateway().String()
  564. if epInfo.GatewayIPv6().To16() != nil {
  565. container.NetworkSettings.IPv6Gateway = epInfo.GatewayIPv6().String()
  566. }
  567. return nil
  568. }
  569. func (container *Container) updateNetworkSettings(n libnetwork.Network) error {
  570. if container.NetworkSettings == nil {
  571. container.NetworkSettings = &network.Settings{Networks: []string{}}
  572. }
  573. settings := container.NetworkSettings
  574. for _, s := range settings.Networks {
  575. sn, err := container.daemon.FindNetwork(s)
  576. if err != nil {
  577. continue
  578. }
  579. if sn.Name() == n.Name() {
  580. // Avoid duplicate config
  581. return nil
  582. }
  583. if !runconfig.NetworkMode(sn.Type()).IsPrivate() ||
  584. !runconfig.NetworkMode(n.Type()).IsPrivate() {
  585. return runconfig.ErrConflictSharedNetwork
  586. }
  587. if runconfig.NetworkMode(sn.Name()).IsNone() ||
  588. runconfig.NetworkMode(n.Name()).IsNone() {
  589. return runconfig.ErrConflictNoNetwork
  590. }
  591. }
  592. settings.Networks = append(settings.Networks, n.Name())
  593. return nil
  594. }
  595. func (container *Container) updateEndpointNetworkSettings(n libnetwork.Network, ep libnetwork.Endpoint) error {
  596. networkSettings, err := container.buildPortMapInfo(ep, container.NetworkSettings)
  597. if err != nil {
  598. return err
  599. }
  600. networkSettings, err = container.buildEndpointInfo(ep, networkSettings)
  601. if err != nil {
  602. return err
  603. }
  604. if container.hostConfig.NetworkMode == runconfig.NetworkMode("bridge") {
  605. networkSettings.Bridge = container.daemon.configStore.Bridge.Iface
  606. }
  607. return nil
  608. }
  609. func (container *Container) updateSandboxNetworkSettings(sb libnetwork.Sandbox) error {
  610. container.NetworkSettings.SandboxID = sb.ID()
  611. container.NetworkSettings.SandboxKey = sb.Key()
  612. return nil
  613. }
  614. // UpdateNetwork is used to update the container's network (e.g. when linked containers
  615. // get removed/unlinked).
  616. func (container *Container) updateNetwork() error {
  617. ctrl := container.daemon.netController
  618. sid := container.NetworkSettings.SandboxID
  619. sb, err := ctrl.SandboxByID(sid)
  620. if err != nil {
  621. return derr.ErrorCodeNoSandbox.WithArgs(sid, err)
  622. }
  623. // Find if container is connected to the default bridge network
  624. var n libnetwork.Network
  625. for _, name := range container.NetworkSettings.Networks {
  626. sn, err := container.daemon.FindNetwork(name)
  627. if err != nil {
  628. continue
  629. }
  630. if sn.Name() == "bridge" {
  631. n = sn
  632. break
  633. }
  634. }
  635. if n == nil {
  636. // Not connected to the default bridge network; Nothing to do
  637. return nil
  638. }
  639. options, err := container.buildSandboxOptions(n)
  640. if err != nil {
  641. return derr.ErrorCodeNetworkUpdate.WithArgs(err)
  642. }
  643. if err := sb.Refresh(options...); err != nil {
  644. return derr.ErrorCodeNetworkRefresh.WithArgs(sid, err)
  645. }
  646. return nil
  647. }
  648. func (container *Container) buildCreateEndpointOptions() ([]libnetwork.EndpointOption, error) {
  649. var (
  650. portSpecs = make(nat.PortSet)
  651. bindings = make(nat.PortMap)
  652. pbList []types.PortBinding
  653. exposeList []types.TransportPort
  654. createOptions []libnetwork.EndpointOption
  655. )
  656. if container.Config.ExposedPorts != nil {
  657. portSpecs = container.Config.ExposedPorts
  658. }
  659. if container.hostConfig.PortBindings != nil {
  660. for p, b := range container.hostConfig.PortBindings {
  661. bindings[p] = []nat.PortBinding{}
  662. for _, bb := range b {
  663. bindings[p] = append(bindings[p], nat.PortBinding{
  664. HostIP: bb.HostIP,
  665. HostPort: bb.HostPort,
  666. })
  667. }
  668. }
  669. }
  670. ports := make([]nat.Port, len(portSpecs))
  671. var i int
  672. for p := range portSpecs {
  673. ports[i] = p
  674. i++
  675. }
  676. nat.SortPortMap(ports, bindings)
  677. for _, port := range ports {
  678. expose := types.TransportPort{}
  679. expose.Proto = types.ParseProtocol(port.Proto())
  680. expose.Port = uint16(port.Int())
  681. exposeList = append(exposeList, expose)
  682. pb := types.PortBinding{Port: expose.Port, Proto: expose.Proto}
  683. binding := bindings[port]
  684. for i := 0; i < len(binding); i++ {
  685. pbCopy := pb.GetCopy()
  686. newP, err := nat.NewPort(nat.SplitProtoPort(binding[i].HostPort))
  687. var portStart, portEnd int
  688. if err == nil {
  689. portStart, portEnd, err = newP.Range()
  690. }
  691. if err != nil {
  692. return nil, derr.ErrorCodeHostPort.WithArgs(binding[i].HostPort, err)
  693. }
  694. pbCopy.HostPort = uint16(portStart)
  695. pbCopy.HostPortEnd = uint16(portEnd)
  696. pbCopy.HostIP = net.ParseIP(binding[i].HostIP)
  697. pbList = append(pbList, pbCopy)
  698. }
  699. if container.hostConfig.PublishAllPorts && len(binding) == 0 {
  700. pbList = append(pbList, pb)
  701. }
  702. }
  703. createOptions = append(createOptions,
  704. libnetwork.CreateOptionPortMapping(pbList),
  705. libnetwork.CreateOptionExposedPorts(exposeList))
  706. if container.Config.MacAddress != "" {
  707. mac, err := net.ParseMAC(container.Config.MacAddress)
  708. if err != nil {
  709. return nil, err
  710. }
  711. genericOption := options.Generic{
  712. netlabel.MacAddress: mac,
  713. }
  714. createOptions = append(createOptions, libnetwork.EndpointOptionGeneric(genericOption))
  715. }
  716. return createOptions, nil
  717. }
  718. func createNetwork(controller libnetwork.NetworkController, dnet string, driver string) (libnetwork.Network, error) {
  719. createOptions := []libnetwork.NetworkOption{}
  720. genericOption := options.Generic{}
  721. // Bridge driver is special due to legacy reasons
  722. if runconfig.NetworkMode(driver).IsBridge() {
  723. genericOption[netlabel.GenericData] = map[string]interface{}{
  724. "BridgeName": dnet,
  725. "AllowNonDefaultBridge": "true",
  726. }
  727. networkOption := libnetwork.NetworkOptionGeneric(genericOption)
  728. createOptions = append(createOptions, networkOption)
  729. }
  730. return controller.NewNetwork(driver, dnet, createOptions...)
  731. }
  732. func (container *Container) allocateNetwork() error {
  733. settings := container.NetworkSettings.Networks
  734. updateSettings := false
  735. if settings == nil {
  736. mode := container.hostConfig.NetworkMode
  737. controller := container.daemon.netController
  738. if container.Config.NetworkDisabled || mode.IsContainer() {
  739. return nil
  740. }
  741. networkName := mode.NetworkName()
  742. if mode.IsDefault() {
  743. networkName = controller.Config().Daemon.DefaultNetwork
  744. }
  745. settings = []string{networkName}
  746. updateSettings = true
  747. }
  748. for _, n := range settings {
  749. if err := container.connectToNetwork(n, updateSettings); err != nil {
  750. if updateSettings {
  751. return err
  752. }
  753. // dont fail a container restart case if the user removed the network
  754. logrus.Warnf("Could not connect container %s : %v", container.ID, err)
  755. }
  756. }
  757. return container.writeHostConfig()
  758. }
  759. // ConnectToNetwork connects a container to a netork
  760. func (container *Container) ConnectToNetwork(idOrName string) error {
  761. if !container.Running {
  762. return derr.ErrorCodeNotRunning.WithArgs(container.ID)
  763. }
  764. return container.connectToNetwork(idOrName, true)
  765. }
  766. func (container *Container) connectToNetwork(idOrName string, updateSettings bool) error {
  767. if container.hostConfig.NetworkMode.IsContainer() {
  768. return runconfig.ErrConflictSharedNetwork
  769. }
  770. if runconfig.NetworkMode(idOrName).IsBridge() &&
  771. container.daemon.configStore.DisableBridge {
  772. container.Config.NetworkDisabled = true
  773. return nil
  774. }
  775. controller := container.daemon.netController
  776. n, err := container.daemon.FindNetwork(idOrName)
  777. if err != nil {
  778. return err
  779. }
  780. if updateSettings {
  781. if err := container.updateNetworkSettings(n); err != nil {
  782. return err
  783. }
  784. }
  785. ep, err := container.getEndpointInNetwork(n)
  786. if err != nil {
  787. if _, ok := err.(libnetwork.ErrNoSuchEndpoint); !ok {
  788. return err
  789. }
  790. createOptions, err := container.buildCreateEndpointOptions()
  791. if err != nil {
  792. return err
  793. }
  794. endpointName := strings.TrimPrefix(container.Name, "/")
  795. ep, err = n.CreateEndpoint(endpointName, createOptions...)
  796. if err != nil {
  797. return err
  798. }
  799. }
  800. if err := container.updateEndpointNetworkSettings(n, ep); err != nil {
  801. return err
  802. }
  803. var sb libnetwork.Sandbox
  804. controller.WalkSandboxes(func(s libnetwork.Sandbox) bool {
  805. if s.ContainerID() == container.ID {
  806. sb = s
  807. return true
  808. }
  809. return false
  810. })
  811. if sb == nil {
  812. options, err := container.buildSandboxOptions(n)
  813. if err != nil {
  814. return err
  815. }
  816. sb, err = controller.NewSandbox(container.ID, options...)
  817. if err != nil {
  818. return err
  819. }
  820. }
  821. container.updateSandboxNetworkSettings(sb)
  822. if err := ep.Join(sb); err != nil {
  823. return err
  824. }
  825. if err := container.updateJoinInfo(ep); err != nil {
  826. return derr.ErrorCodeJoinInfo.WithArgs(err)
  827. }
  828. return nil
  829. }
  830. func (container *Container) initializeNetworking() error {
  831. var err error
  832. if container.hostConfig.NetworkMode.IsContainer() {
  833. // we need to get the hosts files from the container to join
  834. nc, err := container.getNetworkedContainer()
  835. if err != nil {
  836. return err
  837. }
  838. container.HostnamePath = nc.HostnamePath
  839. container.HostsPath = nc.HostsPath
  840. container.ResolvConfPath = nc.ResolvConfPath
  841. container.Config.Hostname = nc.Config.Hostname
  842. container.Config.Domainname = nc.Config.Domainname
  843. return nil
  844. }
  845. if container.hostConfig.NetworkMode.IsHost() {
  846. container.Config.Hostname, err = os.Hostname()
  847. if err != nil {
  848. return err
  849. }
  850. parts := strings.SplitN(container.Config.Hostname, ".", 2)
  851. if len(parts) > 1 {
  852. container.Config.Hostname = parts[0]
  853. container.Config.Domainname = parts[1]
  854. }
  855. }
  856. if err := container.allocateNetwork(); err != nil {
  857. return err
  858. }
  859. return container.buildHostnameFile()
  860. }
  861. // called from the libcontainer pre-start hook to set the network
  862. // namespace configuration linkage to the libnetwork "sandbox" entity
  863. func (container *Container) setNetworkNamespaceKey(pid int) error {
  864. path := fmt.Sprintf("/proc/%d/ns/net", pid)
  865. var sandbox libnetwork.Sandbox
  866. search := libnetwork.SandboxContainerWalker(&sandbox, container.ID)
  867. container.daemon.netController.WalkSandboxes(search)
  868. if sandbox == nil {
  869. return derr.ErrorCodeNoSandbox.WithArgs(container.ID)
  870. }
  871. return sandbox.SetKey(path)
  872. }
  873. func (container *Container) getIpcContainer() (*Container, error) {
  874. containerID := container.hostConfig.IpcMode.Container()
  875. c, err := container.daemon.Get(containerID)
  876. if err != nil {
  877. return nil, err
  878. }
  879. if !c.IsRunning() {
  880. return nil, derr.ErrorCodeIPCRunning
  881. }
  882. return c, nil
  883. }
  884. func (container *Container) setupWorkingDirectory() error {
  885. if container.Config.WorkingDir != "" {
  886. container.Config.WorkingDir = filepath.Clean(container.Config.WorkingDir)
  887. pth, err := container.GetResourcePath(container.Config.WorkingDir)
  888. if err != nil {
  889. return err
  890. }
  891. pthInfo, err := os.Stat(pth)
  892. if err != nil {
  893. if !os.IsNotExist(err) {
  894. return err
  895. }
  896. if err := system.MkdirAll(pth, 0755); err != nil {
  897. return err
  898. }
  899. }
  900. if pthInfo != nil && !pthInfo.IsDir() {
  901. return derr.ErrorCodeNotADir.WithArgs(container.Config.WorkingDir)
  902. }
  903. }
  904. return nil
  905. }
  906. func (container *Container) getNetworkedContainer() (*Container, error) {
  907. parts := strings.SplitN(string(container.hostConfig.NetworkMode), ":", 2)
  908. switch parts[0] {
  909. case "container":
  910. if len(parts) != 2 {
  911. return nil, derr.ErrorCodeParseContainer
  912. }
  913. nc, err := container.daemon.Get(parts[1])
  914. if err != nil {
  915. return nil, err
  916. }
  917. if container == nc {
  918. return nil, derr.ErrorCodeJoinSelf
  919. }
  920. if !nc.IsRunning() {
  921. return nil, derr.ErrorCodeJoinRunning.WithArgs(parts[1])
  922. }
  923. return nc, nil
  924. default:
  925. return nil, derr.ErrorCodeModeNotContainer
  926. }
  927. }
  928. func (container *Container) releaseNetwork() {
  929. if container.hostConfig.NetworkMode.IsContainer() || container.Config.NetworkDisabled {
  930. return
  931. }
  932. sid := container.NetworkSettings.SandboxID
  933. networks := container.NetworkSettings.Networks
  934. container.NetworkSettings = &network.Settings{Networks: networks}
  935. if sid == "" || len(networks) == 0 {
  936. return
  937. }
  938. sb, err := container.daemon.netController.SandboxByID(sid)
  939. if err != nil {
  940. logrus.Errorf("error locating sandbox id %s: %v", sid, err)
  941. return
  942. }
  943. for _, ns := range networks {
  944. n, err := container.daemon.FindNetwork(ns)
  945. if err != nil {
  946. continue
  947. }
  948. container.disconnectFromNetwork(n, false)
  949. }
  950. if err := sb.Delete(); err != nil {
  951. logrus.Errorf("Error deleting sandbox id %s for container %s: %v", sid, container.ID, err)
  952. }
  953. }
  954. // DisconnectFromNetwork disconnects a container from a network
  955. func (container *Container) DisconnectFromNetwork(n libnetwork.Network) error {
  956. if !container.Running {
  957. return derr.ErrorCodeNotRunning.WithArgs(container.ID)
  958. }
  959. return container.disconnectFromNetwork(n, true)
  960. }
  961. func (container *Container) disconnectFromNetwork(n libnetwork.Network, updateSettings bool) error {
  962. var (
  963. ep libnetwork.Endpoint
  964. sbox libnetwork.Sandbox
  965. )
  966. s := func(current libnetwork.Endpoint) bool {
  967. if sb := current.Info().Sandbox(); sb != nil {
  968. if sb.ContainerID() == container.ID {
  969. ep = current
  970. sbox = sb
  971. return true
  972. }
  973. }
  974. return false
  975. }
  976. n.WalkEndpoints(s)
  977. if ep == nil {
  978. return fmt.Errorf("could not locate network endpoint for container %s", container.ID)
  979. }
  980. if err := ep.Leave(sbox); err != nil {
  981. return fmt.Errorf("container %s failed to leave network %s: %v", container.ID, n.Name(), err)
  982. }
  983. if err := ep.Delete(); err != nil {
  984. return fmt.Errorf("endpoint delete failed for container %s on network %s: %v", container.ID, n.Name(), err)
  985. }
  986. if updateSettings {
  987. networks := container.NetworkSettings.Networks
  988. for i, s := range networks {
  989. sn, err := container.daemon.FindNetwork(s)
  990. if err != nil {
  991. continue
  992. }
  993. if sn.Name() == n.Name() {
  994. networks = append(networks[:i], networks[i+1:]...)
  995. container.NetworkSettings.Networks = networks
  996. break
  997. }
  998. }
  999. }
  1000. return nil
  1001. }
  1002. func (container *Container) unmountVolumes(forceSyscall bool) error {
  1003. var volumeMounts []mountPoint
  1004. for _, mntPoint := range container.MountPoints {
  1005. dest, err := container.GetResourcePath(mntPoint.Destination)
  1006. if err != nil {
  1007. return err
  1008. }
  1009. volumeMounts = append(volumeMounts, mountPoint{Destination: dest, Volume: mntPoint.Volume})
  1010. }
  1011. for _, mnt := range container.networkMounts() {
  1012. dest, err := container.GetResourcePath(mnt.Destination)
  1013. if err != nil {
  1014. return err
  1015. }
  1016. volumeMounts = append(volumeMounts, mountPoint{Destination: dest})
  1017. }
  1018. for _, volumeMount := range volumeMounts {
  1019. if forceSyscall {
  1020. syscall.Unmount(volumeMount.Destination, 0)
  1021. }
  1022. if volumeMount.Volume != nil {
  1023. if err := volumeMount.Volume.Unmount(); err != nil {
  1024. return err
  1025. }
  1026. }
  1027. }
  1028. return nil
  1029. }
  1030. func (container *Container) networkMounts() []execdriver.Mount {
  1031. var mounts []execdriver.Mount
  1032. shared := container.hostConfig.NetworkMode.IsContainer()
  1033. if container.ResolvConfPath != "" {
  1034. label.Relabel(container.ResolvConfPath, container.MountLabel, shared)
  1035. writable := !container.hostConfig.ReadonlyRootfs
  1036. if m, exists := container.MountPoints["/etc/resolv.conf"]; exists {
  1037. writable = m.RW
  1038. }
  1039. mounts = append(mounts, execdriver.Mount{
  1040. Source: container.ResolvConfPath,
  1041. Destination: "/etc/resolv.conf",
  1042. Writable: writable,
  1043. Private: true,
  1044. })
  1045. }
  1046. if container.HostnamePath != "" {
  1047. label.Relabel(container.HostnamePath, container.MountLabel, shared)
  1048. writable := !container.hostConfig.ReadonlyRootfs
  1049. if m, exists := container.MountPoints["/etc/hostname"]; exists {
  1050. writable = m.RW
  1051. }
  1052. mounts = append(mounts, execdriver.Mount{
  1053. Source: container.HostnamePath,
  1054. Destination: "/etc/hostname",
  1055. Writable: writable,
  1056. Private: true,
  1057. })
  1058. }
  1059. if container.HostsPath != "" {
  1060. label.Relabel(container.HostsPath, container.MountLabel, shared)
  1061. writable := !container.hostConfig.ReadonlyRootfs
  1062. if m, exists := container.MountPoints["/etc/hosts"]; exists {
  1063. writable = m.RW
  1064. }
  1065. mounts = append(mounts, execdriver.Mount{
  1066. Source: container.HostsPath,
  1067. Destination: "/etc/hosts",
  1068. Writable: writable,
  1069. Private: true,
  1070. })
  1071. }
  1072. return mounts
  1073. }
  1074. func (container *Container) addBindMountPoint(name, source, destination string, rw bool) {
  1075. container.MountPoints[destination] = &mountPoint{
  1076. Name: name,
  1077. Source: source,
  1078. Destination: destination,
  1079. RW: rw,
  1080. }
  1081. }
  1082. func (container *Container) addLocalMountPoint(name, destination string, rw bool) {
  1083. container.MountPoints[destination] = &mountPoint{
  1084. Name: name,
  1085. Driver: volume.DefaultDriverName,
  1086. Destination: destination,
  1087. RW: rw,
  1088. }
  1089. }
  1090. func (container *Container) addMountPointWithVolume(destination string, vol volume.Volume, rw bool) {
  1091. container.MountPoints[destination] = &mountPoint{
  1092. Name: vol.Name(),
  1093. Driver: vol.DriverName(),
  1094. Destination: destination,
  1095. RW: rw,
  1096. Volume: vol,
  1097. }
  1098. }
  1099. func (container *Container) isDestinationMounted(destination string) bool {
  1100. return container.MountPoints[destination] != nil
  1101. }
  1102. func (container *Container) prepareMountPoints() error {
  1103. for _, config := range container.MountPoints {
  1104. if len(config.Driver) > 0 {
  1105. v, err := container.daemon.createVolume(config.Name, config.Driver, nil)
  1106. if err != nil {
  1107. return err
  1108. }
  1109. config.Volume = v
  1110. }
  1111. }
  1112. return nil
  1113. }
  1114. func (container *Container) removeMountPoints(rm bool) error {
  1115. var rmErrors []string
  1116. for _, m := range container.MountPoints {
  1117. if m.Volume == nil {
  1118. continue
  1119. }
  1120. container.daemon.volumes.Decrement(m.Volume)
  1121. if rm {
  1122. err := container.daemon.volumes.Remove(m.Volume)
  1123. // ErrVolumeInUse is ignored because having this
  1124. // volume being referenced by othe container is
  1125. // not an error, but an implementation detail.
  1126. // This prevents docker from logging "ERROR: Volume in use"
  1127. // where there is another container using the volume.
  1128. if err != nil && err != store.ErrVolumeInUse {
  1129. rmErrors = append(rmErrors, err.Error())
  1130. }
  1131. }
  1132. }
  1133. if len(rmErrors) > 0 {
  1134. return derr.ErrorCodeRemovingVolume.WithArgs(strings.Join(rmErrors, "\n"))
  1135. }
  1136. return nil
  1137. }
  1138. func (container *Container) shmPath() (string, error) {
  1139. return container.getRootResourcePath("shm")
  1140. }
  1141. func (container *Container) mqueuePath() (string, error) {
  1142. return container.getRootResourcePath("mqueue")
  1143. }
  1144. func (container *Container) hasMountFor(path string) bool {
  1145. _, exists := container.MountPoints[path]
  1146. return exists
  1147. }
  1148. func (container *Container) setupIpcDirs() error {
  1149. if !container.hasMountFor("/dev/shm") {
  1150. shmPath, err := container.shmPath()
  1151. if err != nil {
  1152. return err
  1153. }
  1154. if err := os.MkdirAll(shmPath, 0700); err != nil {
  1155. return err
  1156. }
  1157. if err := syscall.Mount("shm", shmPath, "tmpfs", uintptr(syscall.MS_NOEXEC|syscall.MS_NOSUID|syscall.MS_NODEV), label.FormatMountLabel("mode=1777,size=65536k", container.getMountLabel())); err != nil {
  1158. return fmt.Errorf("mounting shm tmpfs: %s", err)
  1159. }
  1160. }
  1161. if !container.hasMountFor("/dev/mqueue") {
  1162. mqueuePath, err := container.mqueuePath()
  1163. if err != nil {
  1164. return err
  1165. }
  1166. if err := os.MkdirAll(mqueuePath, 0700); err != nil {
  1167. return err
  1168. }
  1169. if err := syscall.Mount("mqueue", mqueuePath, "mqueue", uintptr(syscall.MS_NOEXEC|syscall.MS_NOSUID|syscall.MS_NODEV), ""); err != nil {
  1170. return fmt.Errorf("mounting mqueue mqueue : %s", err)
  1171. }
  1172. }
  1173. return nil
  1174. }
  1175. func (container *Container) unmountIpcMounts() error {
  1176. if container.hostConfig.IpcMode.IsContainer() || container.hostConfig.IpcMode.IsHost() {
  1177. return nil
  1178. }
  1179. var errors []string
  1180. if !container.hasMountFor("/dev/shm") {
  1181. shmPath, err := container.shmPath()
  1182. if err != nil {
  1183. logrus.Error(err)
  1184. errors = append(errors, err.Error())
  1185. } else {
  1186. if err := detachMounted(shmPath); err != nil {
  1187. logrus.Errorf("failed to umount %s: %v", shmPath, err)
  1188. errors = append(errors, err.Error())
  1189. }
  1190. }
  1191. }
  1192. if !container.hasMountFor("/dev/mqueue") {
  1193. mqueuePath, err := container.mqueuePath()
  1194. if err != nil {
  1195. logrus.Error(err)
  1196. errors = append(errors, err.Error())
  1197. } else {
  1198. if err := detachMounted(mqueuePath); err != nil {
  1199. logrus.Errorf("failed to umount %s: %v", mqueuePath, err)
  1200. errors = append(errors, err.Error())
  1201. }
  1202. }
  1203. }
  1204. if len(errors) > 0 {
  1205. return fmt.Errorf("failed to cleanup ipc mounts:\n%v", strings.Join(errors, "\n"))
  1206. }
  1207. return nil
  1208. }
  1209. func (container *Container) ipcMounts() []execdriver.Mount {
  1210. var mounts []execdriver.Mount
  1211. if !container.hasMountFor("/dev/shm") {
  1212. label.SetFileLabel(container.ShmPath, container.MountLabel)
  1213. mounts = append(mounts, execdriver.Mount{
  1214. Source: container.ShmPath,
  1215. Destination: "/dev/shm",
  1216. Writable: true,
  1217. Private: true,
  1218. })
  1219. }
  1220. if !container.hasMountFor("/dev/mqueue") {
  1221. label.SetFileLabel(container.MqueuePath, container.MountLabel)
  1222. mounts = append(mounts, execdriver.Mount{
  1223. Source: container.MqueuePath,
  1224. Destination: "/dev/mqueue",
  1225. Writable: true,
  1226. Private: true,
  1227. })
  1228. }
  1229. return mounts
  1230. }
  1231. func detachMounted(path string) error {
  1232. return syscall.Unmount(path, syscall.MNT_DETACH)
  1233. }