container_operations_unix.go 15 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460
  1. //go:build linux || freebsd
  2. package daemon // import "github.com/docker/docker/daemon"
  3. import (
  4. "context"
  5. "fmt"
  6. "os"
  7. "path/filepath"
  8. "strconv"
  9. "syscall"
  10. "github.com/containerd/containerd/log"
  11. "github.com/docker/docker/container"
  12. "github.com/docker/docker/daemon/config"
  13. "github.com/docker/docker/daemon/links"
  14. "github.com/docker/docker/errdefs"
  15. "github.com/docker/docker/libnetwork"
  16. "github.com/docker/docker/pkg/idtools"
  17. "github.com/docker/docker/pkg/process"
  18. "github.com/docker/docker/pkg/stringid"
  19. "github.com/docker/docker/runconfig"
  20. "github.com/moby/sys/mount"
  21. "github.com/opencontainers/selinux/go-selinux/label"
  22. "github.com/pkg/errors"
  23. "golang.org/x/sys/unix"
  24. )
  25. func (daemon *Daemon) setupLinkedContainers(container *container.Container) ([]string, error) {
  26. var env []string
  27. children := daemon.children(container)
  28. bridgeSettings := container.NetworkSettings.Networks[runconfig.DefaultDaemonNetworkMode().NetworkName()]
  29. if bridgeSettings == nil || bridgeSettings.EndpointSettings == nil {
  30. return nil, nil
  31. }
  32. for linkAlias, child := range children {
  33. if !child.IsRunning() {
  34. return nil, fmt.Errorf("Cannot link to a non running container: %s AS %s", child.Name, linkAlias)
  35. }
  36. childBridgeSettings := child.NetworkSettings.Networks[runconfig.DefaultDaemonNetworkMode().NetworkName()]
  37. if childBridgeSettings == nil || childBridgeSettings.EndpointSettings == nil {
  38. return nil, fmt.Errorf("container %s not attached to default bridge network", child.ID)
  39. }
  40. link := links.NewLink(
  41. bridgeSettings.IPAddress,
  42. childBridgeSettings.IPAddress,
  43. linkAlias,
  44. child.Config.Env,
  45. child.Config.ExposedPorts,
  46. )
  47. env = append(env, link.ToEnv()...)
  48. }
  49. return env, nil
  50. }
  51. func (daemon *Daemon) getIpcContainer(id string) (*container.Container, error) {
  52. errMsg := "can't join IPC of container " + id
  53. // Check if the container exists, is running, and not restarting
  54. ctr, err := daemon.GetContainer(id)
  55. if err != nil {
  56. return nil, errdefs.InvalidParameter(errors.Wrap(err, errMsg))
  57. }
  58. if !ctr.IsRunning() {
  59. return nil, errNotRunning(id)
  60. }
  61. if ctr.IsRestarting() {
  62. return nil, errContainerIsRestarting(id)
  63. }
  64. // Check the container ipc is shareable
  65. if st, err := os.Stat(ctr.ShmPath); err != nil || !st.IsDir() {
  66. if err == nil || os.IsNotExist(err) {
  67. return nil, errdefs.InvalidParameter(errors.New(errMsg + ": non-shareable IPC (hint: use IpcMode:shareable for the donor container)"))
  68. }
  69. // stat() failed?
  70. return nil, errdefs.System(errors.Wrap(err, errMsg+": unexpected error from stat "+ctr.ShmPath))
  71. }
  72. return ctr, nil
  73. }
  74. func (daemon *Daemon) getPIDContainer(id string) (*container.Container, error) {
  75. ctr, err := daemon.GetContainer(id)
  76. if err != nil {
  77. return nil, errdefs.InvalidParameter(err)
  78. }
  79. if !ctr.IsRunning() {
  80. return nil, errNotRunning(id)
  81. }
  82. if ctr.IsRestarting() {
  83. return nil, errContainerIsRestarting(id)
  84. }
  85. return ctr, nil
  86. }
  87. func (daemon *Daemon) setupIpcDirs(c *container.Container) error {
  88. ipcMode := c.HostConfig.IpcMode
  89. switch {
  90. case ipcMode.IsContainer():
  91. ic, err := daemon.getIpcContainer(ipcMode.Container())
  92. if err != nil {
  93. return err
  94. }
  95. c.ShmPath = ic.ShmPath
  96. case ipcMode.IsHost():
  97. if _, err := os.Stat("/dev/shm"); err != nil {
  98. return fmt.Errorf("/dev/shm is not mounted, but must be for --ipc=host")
  99. }
  100. c.ShmPath = "/dev/shm"
  101. case ipcMode.IsPrivate(), ipcMode.IsNone():
  102. // c.ShmPath will/should not be used, so make it empty.
  103. // Container's /dev/shm mount comes from OCI spec.
  104. c.ShmPath = ""
  105. case ipcMode.IsEmpty():
  106. // A container was created by an older version of the daemon.
  107. // The default behavior used to be what is now called "shareable".
  108. fallthrough
  109. case ipcMode.IsShareable():
  110. rootIDs := daemon.idMapping.RootPair()
  111. if !c.HasMountFor("/dev/shm") {
  112. shmPath, err := c.ShmResourcePath()
  113. if err != nil {
  114. return err
  115. }
  116. if err := idtools.MkdirAllAndChown(shmPath, 0o700, rootIDs); err != nil {
  117. return err
  118. }
  119. shmproperty := "mode=1777,size=" + strconv.FormatInt(c.HostConfig.ShmSize, 10)
  120. if err := unix.Mount("shm", shmPath, "tmpfs", uintptr(unix.MS_NOEXEC|unix.MS_NOSUID|unix.MS_NODEV), label.FormatMountLabel(shmproperty, c.GetMountLabel())); err != nil {
  121. return fmt.Errorf("mounting shm tmpfs: %s", err)
  122. }
  123. if err := os.Chown(shmPath, rootIDs.UID, rootIDs.GID); err != nil {
  124. return err
  125. }
  126. c.ShmPath = shmPath
  127. }
  128. default:
  129. return fmt.Errorf("invalid IPC mode: %v", ipcMode)
  130. }
  131. return nil
  132. }
  133. func (daemon *Daemon) setupSecretDir(c *container.Container) (setupErr error) {
  134. if len(c.SecretReferences) == 0 && len(c.ConfigReferences) == 0 {
  135. return nil
  136. }
  137. if err := daemon.createSecretsDir(c); err != nil {
  138. return err
  139. }
  140. defer func() {
  141. if setupErr != nil {
  142. daemon.cleanupSecretDir(c)
  143. }
  144. }()
  145. if c.DependencyStore == nil {
  146. return fmt.Errorf("secret store is not initialized")
  147. }
  148. // retrieve possible remapped range start for root UID, GID
  149. rootIDs := daemon.idMapping.RootPair()
  150. for _, s := range c.SecretReferences {
  151. // TODO (ehazlett): use type switch when more are supported
  152. if s.File == nil {
  153. log.G(context.TODO()).Error("secret target type is not a file target")
  154. continue
  155. }
  156. // secrets are created in the SecretMountPath on the host, at a
  157. // single level
  158. fPath, err := c.SecretFilePath(*s)
  159. if err != nil {
  160. return errors.Wrap(err, "error getting secret file path")
  161. }
  162. if err := idtools.MkdirAllAndChown(filepath.Dir(fPath), 0o700, rootIDs); err != nil {
  163. return errors.Wrap(err, "error creating secret mount path")
  164. }
  165. log.G(context.TODO()).WithFields(log.Fields{
  166. "name": s.File.Name,
  167. "path": fPath,
  168. }).Debug("injecting secret")
  169. secret, err := c.DependencyStore.Secrets().Get(s.SecretID)
  170. if err != nil {
  171. return errors.Wrap(err, "unable to get secret from secret store")
  172. }
  173. if err := os.WriteFile(fPath, secret.Spec.Data, s.File.Mode); err != nil {
  174. return errors.Wrap(err, "error injecting secret")
  175. }
  176. uid, err := strconv.Atoi(s.File.UID)
  177. if err != nil {
  178. return err
  179. }
  180. gid, err := strconv.Atoi(s.File.GID)
  181. if err != nil {
  182. return err
  183. }
  184. if err := os.Chown(fPath, rootIDs.UID+uid, rootIDs.GID+gid); err != nil {
  185. return errors.Wrap(err, "error setting ownership for secret")
  186. }
  187. if err := os.Chmod(fPath, s.File.Mode); err != nil {
  188. return errors.Wrap(err, "error setting file mode for secret")
  189. }
  190. }
  191. for _, configRef := range c.ConfigReferences {
  192. // TODO (ehazlett): use type switch when more are supported
  193. if configRef.File == nil {
  194. // Runtime configs are not mounted into the container, but they're
  195. // a valid type of config so we should not error when we encounter
  196. // one.
  197. if configRef.Runtime == nil {
  198. log.G(context.TODO()).Error("config target type is not a file or runtime target")
  199. }
  200. // However, in any case, this isn't a file config, so we have no
  201. // further work to do
  202. continue
  203. }
  204. fPath, err := c.ConfigFilePath(*configRef)
  205. if err != nil {
  206. return errors.Wrap(err, "error getting config file path for container")
  207. }
  208. if err := idtools.MkdirAllAndChown(filepath.Dir(fPath), 0o700, rootIDs); err != nil {
  209. return errors.Wrap(err, "error creating config mount path")
  210. }
  211. log.G(context.TODO()).WithFields(log.Fields{
  212. "name": configRef.File.Name,
  213. "path": fPath,
  214. }).Debug("injecting config")
  215. config, err := c.DependencyStore.Configs().Get(configRef.ConfigID)
  216. if err != nil {
  217. return errors.Wrap(err, "unable to get config from config store")
  218. }
  219. if err := os.WriteFile(fPath, config.Spec.Data, configRef.File.Mode); err != nil {
  220. return errors.Wrap(err, "error injecting config")
  221. }
  222. uid, err := strconv.Atoi(configRef.File.UID)
  223. if err != nil {
  224. return err
  225. }
  226. gid, err := strconv.Atoi(configRef.File.GID)
  227. if err != nil {
  228. return err
  229. }
  230. if err := os.Chown(fPath, rootIDs.UID+uid, rootIDs.GID+gid); err != nil {
  231. return errors.Wrap(err, "error setting ownership for config")
  232. }
  233. if err := os.Chmod(fPath, configRef.File.Mode); err != nil {
  234. return errors.Wrap(err, "error setting file mode for config")
  235. }
  236. }
  237. return daemon.remountSecretDir(c)
  238. }
  239. // createSecretsDir is used to create a dir suitable for storing container secrets.
  240. // In practice this is using a tmpfs mount and is used for both "configs" and "secrets"
  241. func (daemon *Daemon) createSecretsDir(c *container.Container) error {
  242. // retrieve possible remapped range start for root UID, GID
  243. rootIDs := daemon.idMapping.RootPair()
  244. dir, err := c.SecretMountPath()
  245. if err != nil {
  246. return errors.Wrap(err, "error getting container secrets dir")
  247. }
  248. // create tmpfs
  249. if err := idtools.MkdirAllAndChown(dir, 0o700, rootIDs); err != nil {
  250. return errors.Wrap(err, "error creating secret local mount path")
  251. }
  252. tmpfsOwnership := fmt.Sprintf("uid=%d,gid=%d", rootIDs.UID, rootIDs.GID)
  253. if err := mount.Mount("tmpfs", dir, "tmpfs", "nodev,nosuid,noexec,"+tmpfsOwnership); err != nil {
  254. return errors.Wrap(err, "unable to setup secret mount")
  255. }
  256. return nil
  257. }
  258. func (daemon *Daemon) remountSecretDir(c *container.Container) error {
  259. dir, err := c.SecretMountPath()
  260. if err != nil {
  261. return errors.Wrap(err, "error getting container secrets path")
  262. }
  263. if err := label.Relabel(dir, c.MountLabel, false); err != nil {
  264. log.G(context.TODO()).WithError(err).WithField("dir", dir).Warn("Error while attempting to set selinux label")
  265. }
  266. rootIDs := daemon.idMapping.RootPair()
  267. tmpfsOwnership := fmt.Sprintf("uid=%d,gid=%d", rootIDs.UID, rootIDs.GID)
  268. // remount secrets ro
  269. if err := mount.Mount("tmpfs", dir, "tmpfs", "remount,ro,"+tmpfsOwnership); err != nil {
  270. return errors.Wrap(err, "unable to remount dir as readonly")
  271. }
  272. return nil
  273. }
  274. func (daemon *Daemon) cleanupSecretDir(c *container.Container) {
  275. dir, err := c.SecretMountPath()
  276. if err != nil {
  277. log.G(context.TODO()).WithError(err).WithField("container", c.ID).Warn("error getting secrets mount path for container")
  278. }
  279. if err := mount.RecursiveUnmount(dir); err != nil {
  280. log.G(context.TODO()).WithField("dir", dir).WithError(err).Warn("Error while attempting to unmount dir, this may prevent removal of container.")
  281. }
  282. if err := os.RemoveAll(dir); err != nil {
  283. log.G(context.TODO()).WithField("dir", dir).WithError(err).Error("Error removing dir.")
  284. }
  285. }
  286. func killProcessDirectly(container *container.Container) error {
  287. pid := container.GetPID()
  288. if pid == 0 {
  289. // Ensure that we don't kill ourselves
  290. return nil
  291. }
  292. if err := unix.Kill(pid, syscall.SIGKILL); err != nil {
  293. if err != unix.ESRCH {
  294. return errdefs.System(err)
  295. }
  296. err = errNoSuchProcess{pid, syscall.SIGKILL}
  297. log.G(context.TODO()).WithError(err).WithField("container", container.ID).Debug("no such process")
  298. return err
  299. }
  300. // In case there were some exceptions(e.g., state of zombie and D)
  301. if process.Alive(pid) {
  302. // Since we can not kill a zombie pid, add zombie check here
  303. isZombie, err := process.Zombie(pid)
  304. if err != nil {
  305. log.G(context.TODO()).WithError(err).WithField("container", container.ID).Warn("Container state is invalid")
  306. return err
  307. }
  308. if isZombie {
  309. return errdefs.System(errors.Errorf("container %s PID %d is zombie and can not be killed. Use the --init option when creating containers to run an init inside the container that forwards signals and reaps processes", stringid.TruncateID(container.ID), pid))
  310. }
  311. }
  312. return nil
  313. }
  314. func isLinkable(child *container.Container) bool {
  315. // A container is linkable only if it belongs to the default network
  316. _, ok := child.NetworkSettings.Networks[runconfig.DefaultDaemonNetworkMode().NetworkName()]
  317. return ok
  318. }
  319. func enableIPOnPredefinedNetwork() bool {
  320. return false
  321. }
  322. // serviceDiscoveryOnDefaultNetwork indicates if service discovery is supported on the default network
  323. func serviceDiscoveryOnDefaultNetwork() bool {
  324. return false
  325. }
  326. func setupPathsAndSandboxOptions(container *container.Container, cfg *config.Config, sboxOptions *[]libnetwork.SandboxOption) error {
  327. var err error
  328. // Set the correct paths for /etc/hosts and /etc/resolv.conf, based on the
  329. // networking-mode of the container. Note that containers with "container"
  330. // networking are already handled in "initializeNetworking()" before we reach
  331. // this function, so do not have to be accounted for here.
  332. switch {
  333. case container.HostConfig.NetworkMode.IsHost():
  334. // In host-mode networking, the container does not have its own networking
  335. // namespace, so both `/etc/hosts` and `/etc/resolv.conf` should be the same
  336. // as on the host itself. The container gets a copy of these files.
  337. *sboxOptions = append(
  338. *sboxOptions,
  339. libnetwork.OptionOriginHostsPath("/etc/hosts"),
  340. libnetwork.OptionOriginResolvConfPath("/etc/resolv.conf"),
  341. )
  342. case container.HostConfig.NetworkMode.IsUserDefined():
  343. // The container uses a user-defined network. We use the embedded DNS
  344. // server for container name resolution and to act as a DNS forwarder
  345. // for external DNS resolution.
  346. // We parse the DNS server(s) that are defined in /etc/resolv.conf on
  347. // the host, which may be a local DNS server (for example, if DNSMasq or
  348. // systemd-resolvd are in use). The embedded DNS server forwards DNS
  349. // resolution to the DNS server configured on the host, which in itself
  350. // may act as a forwarder for external DNS servers.
  351. // If systemd-resolvd is used, the "upstream" DNS servers can be found in
  352. // /run/systemd/resolve/resolv.conf. We do not query those DNS servers
  353. // directly, as they can be dynamically reconfigured.
  354. *sboxOptions = append(
  355. *sboxOptions,
  356. libnetwork.OptionOriginResolvConfPath("/etc/resolv.conf"),
  357. )
  358. default:
  359. // For other situations, such as the default bridge network, container
  360. // discovery / name resolution is handled through /etc/hosts, and no
  361. // embedded DNS server is available. Without the embedded DNS, we
  362. // cannot use local DNS servers on the host (for example, if DNSMasq or
  363. // systemd-resolvd is used). If systemd-resolvd is used, we try to
  364. // determine the external DNS servers that are used on the host.
  365. // This situation is not ideal, because DNS servers configured in the
  366. // container are not updated after the container is created, but the
  367. // DNS servers on the host can be dynamically updated.
  368. //
  369. // Copy the host's resolv.conf for the container (/run/systemd/resolve/resolv.conf or /etc/resolv.conf)
  370. *sboxOptions = append(
  371. *sboxOptions,
  372. libnetwork.OptionOriginResolvConfPath(cfg.GetResolvConf()),
  373. )
  374. }
  375. container.HostsPath, err = container.GetRootResourcePath("hosts")
  376. if err != nil {
  377. return err
  378. }
  379. *sboxOptions = append(*sboxOptions, libnetwork.OptionHostsPath(container.HostsPath))
  380. container.ResolvConfPath, err = container.GetRootResourcePath("resolv.conf")
  381. if err != nil {
  382. return err
  383. }
  384. *sboxOptions = append(*sboxOptions, libnetwork.OptionResolvConfPath(container.ResolvConfPath))
  385. return nil
  386. }
  387. func (daemon *Daemon) initializeNetworkingPaths(container *container.Container, nc *container.Container) error {
  388. container.HostnamePath = nc.HostnamePath
  389. container.HostsPath = nc.HostsPath
  390. container.ResolvConfPath = nc.ResolvConfPath
  391. return nil
  392. }
  393. func (daemon *Daemon) setupContainerMountsRoot(c *container.Container) error {
  394. // get the root mount path so we can make it unbindable
  395. p, err := c.MountsResourcePath("")
  396. if err != nil {
  397. return err
  398. }
  399. return idtools.MkdirAllAndChown(p, 0o710, idtools.Identity{UID: idtools.CurrentIdentity().UID, GID: daemon.IdentityMapping().RootPair().GID})
  400. }