container_operations_unix.go 12 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411
  1. // +build linux freebsd
  2. package daemon // import "github.com/docker/docker/daemon"
  3. import (
  4. "context"
  5. "fmt"
  6. "io/ioutil"
  7. "os"
  8. "path/filepath"
  9. "strconv"
  10. "time"
  11. "github.com/docker/docker/container"
  12. "github.com/docker/docker/daemon/links"
  13. "github.com/docker/docker/errdefs"
  14. "github.com/docker/docker/pkg/idtools"
  15. "github.com/docker/docker/pkg/mount"
  16. "github.com/docker/docker/pkg/stringid"
  17. "github.com/docker/docker/runconfig"
  18. "github.com/docker/libnetwork"
  19. "github.com/opencontainers/selinux/go-selinux/label"
  20. "github.com/pkg/errors"
  21. "github.com/sirupsen/logrus"
  22. "golang.org/x/sys/unix"
  23. )
  24. func (daemon *Daemon) setupLinkedContainers(container *container.Container) ([]string, error) {
  25. var env []string
  26. children := daemon.children(container)
  27. bridgeSettings := container.NetworkSettings.Networks[runconfig.DefaultDaemonNetworkMode().NetworkName()]
  28. if bridgeSettings == nil || bridgeSettings.EndpointSettings == nil {
  29. return nil, nil
  30. }
  31. for linkAlias, child := range children {
  32. if !child.IsRunning() {
  33. return nil, fmt.Errorf("Cannot link to a non running container: %s AS %s", child.Name, linkAlias)
  34. }
  35. childBridgeSettings := child.NetworkSettings.Networks[runconfig.DefaultDaemonNetworkMode().NetworkName()]
  36. if childBridgeSettings == nil || childBridgeSettings.EndpointSettings == nil {
  37. return nil, fmt.Errorf("container %s not attached to default bridge network", child.ID)
  38. }
  39. link := links.NewLink(
  40. bridgeSettings.IPAddress,
  41. childBridgeSettings.IPAddress,
  42. linkAlias,
  43. child.Config.Env,
  44. child.Config.ExposedPorts,
  45. )
  46. env = append(env, link.ToEnv()...)
  47. }
  48. return env, nil
  49. }
  50. func (daemon *Daemon) getIpcContainer(id string) (*container.Container, error) {
  51. errMsg := "can't join IPC of container " + id
  52. // Check the container exists
  53. container, err := daemon.GetContainer(id)
  54. if err != nil {
  55. return nil, errors.Wrap(err, errMsg)
  56. }
  57. // Check the container is running and not restarting
  58. if err := daemon.checkContainer(container, containerIsRunning, containerIsNotRestarting); err != nil {
  59. return nil, errors.Wrap(err, errMsg)
  60. }
  61. // Check the container ipc is shareable
  62. if st, err := os.Stat(container.ShmPath); err != nil || !st.IsDir() {
  63. if err == nil || os.IsNotExist(err) {
  64. return nil, errors.New(errMsg + ": non-shareable IPC")
  65. }
  66. // stat() failed?
  67. return nil, errors.Wrap(err, errMsg+": unexpected error from stat "+container.ShmPath)
  68. }
  69. return container, nil
  70. }
  71. func (daemon *Daemon) getPidContainer(container *container.Container) (*container.Container, error) {
  72. containerID := container.HostConfig.PidMode.Container()
  73. container, err := daemon.GetContainer(containerID)
  74. if err != nil {
  75. return nil, errors.Wrapf(err, "cannot join PID of a non running container: %s", containerID)
  76. }
  77. return container, daemon.checkContainer(container, containerIsRunning, containerIsNotRestarting)
  78. }
  79. func containerIsRunning(c *container.Container) error {
  80. if !c.IsRunning() {
  81. return errdefs.Conflict(errors.Errorf("container %s is not running", c.ID))
  82. }
  83. return nil
  84. }
  85. func containerIsNotRestarting(c *container.Container) error {
  86. if c.IsRestarting() {
  87. return errContainerIsRestarting(c.ID)
  88. }
  89. return nil
  90. }
  91. func (daemon *Daemon) setupIpcDirs(c *container.Container) error {
  92. ipcMode := c.HostConfig.IpcMode
  93. switch {
  94. case ipcMode.IsContainer():
  95. ic, err := daemon.getIpcContainer(ipcMode.Container())
  96. if err != nil {
  97. return err
  98. }
  99. c.ShmPath = ic.ShmPath
  100. case ipcMode.IsHost():
  101. if _, err := os.Stat("/dev/shm"); err != nil {
  102. return fmt.Errorf("/dev/shm is not mounted, but must be for --ipc=host")
  103. }
  104. c.ShmPath = "/dev/shm"
  105. case ipcMode.IsPrivate(), ipcMode.IsNone():
  106. // c.ShmPath will/should not be used, so make it empty.
  107. // Container's /dev/shm mount comes from OCI spec.
  108. c.ShmPath = ""
  109. case ipcMode.IsEmpty():
  110. // A container was created by an older version of the daemon.
  111. // The default behavior used to be what is now called "shareable".
  112. fallthrough
  113. case ipcMode.IsShareable():
  114. rootIDs := daemon.idMappings.RootPair()
  115. if !c.HasMountFor("/dev/shm") {
  116. shmPath, err := c.ShmResourcePath()
  117. if err != nil {
  118. return err
  119. }
  120. if err := idtools.MkdirAllAndChown(shmPath, 0700, rootIDs); err != nil {
  121. return err
  122. }
  123. shmproperty := "mode=1777,size=" + strconv.FormatInt(c.HostConfig.ShmSize, 10)
  124. if err := unix.Mount("shm", shmPath, "tmpfs", uintptr(unix.MS_NOEXEC|unix.MS_NOSUID|unix.MS_NODEV), label.FormatMountLabel(shmproperty, c.GetMountLabel())); err != nil {
  125. return fmt.Errorf("mounting shm tmpfs: %s", err)
  126. }
  127. if err := os.Chown(shmPath, rootIDs.UID, rootIDs.GID); err != nil {
  128. return err
  129. }
  130. c.ShmPath = shmPath
  131. }
  132. default:
  133. return fmt.Errorf("invalid IPC mode: %v", ipcMode)
  134. }
  135. return nil
  136. }
  137. func (daemon *Daemon) setupSecretDir(c *container.Container) (setupErr error) {
  138. if len(c.SecretReferences) == 0 && len(c.ConfigReferences) == 0 {
  139. return nil
  140. }
  141. if err := daemon.createSecretsDir(c); err != nil {
  142. return err
  143. }
  144. defer func() {
  145. if setupErr != nil {
  146. daemon.cleanupSecretDir(c)
  147. }
  148. }()
  149. if c.DependencyStore == nil {
  150. return fmt.Errorf("secret store is not initialized")
  151. }
  152. // retrieve possible remapped range start for root UID, GID
  153. rootIDs := daemon.idMappings.RootPair()
  154. for _, s := range c.SecretReferences {
  155. // TODO (ehazlett): use type switch when more are supported
  156. if s.File == nil {
  157. logrus.Error("secret target type is not a file target")
  158. continue
  159. }
  160. // secrets are created in the SecretMountPath on the host, at a
  161. // single level
  162. fPath, err := c.SecretFilePath(*s)
  163. if err != nil {
  164. return errors.Wrap(err, "error getting secret file path")
  165. }
  166. if err := idtools.MkdirAllAndChown(filepath.Dir(fPath), 0700, rootIDs); err != nil {
  167. return errors.Wrap(err, "error creating secret mount path")
  168. }
  169. logrus.WithFields(logrus.Fields{
  170. "name": s.File.Name,
  171. "path": fPath,
  172. }).Debug("injecting secret")
  173. secret, err := c.DependencyStore.Secrets().Get(s.SecretID)
  174. if err != nil {
  175. return errors.Wrap(err, "unable to get secret from secret store")
  176. }
  177. if err := ioutil.WriteFile(fPath, secret.Spec.Data, s.File.Mode); err != nil {
  178. return errors.Wrap(err, "error injecting secret")
  179. }
  180. uid, err := strconv.Atoi(s.File.UID)
  181. if err != nil {
  182. return err
  183. }
  184. gid, err := strconv.Atoi(s.File.GID)
  185. if err != nil {
  186. return err
  187. }
  188. if err := os.Chown(fPath, rootIDs.UID+uid, rootIDs.GID+gid); err != nil {
  189. return errors.Wrap(err, "error setting ownership for secret")
  190. }
  191. if err := os.Chmod(fPath, s.File.Mode); err != nil {
  192. return errors.Wrap(err, "error setting file mode for secret")
  193. }
  194. }
  195. for _, ref := range c.ConfigReferences {
  196. // TODO (ehazlett): use type switch when more are supported
  197. if ref.File == nil {
  198. logrus.Error("config target type is not a file target")
  199. continue
  200. }
  201. fPath, err := c.ConfigFilePath(*ref)
  202. if err != nil {
  203. return errors.Wrap(err, "error getting config file path for container")
  204. }
  205. if err := idtools.MkdirAllAndChown(filepath.Dir(fPath), 0700, rootIDs); err != nil {
  206. return errors.Wrap(err, "error creating config mount path")
  207. }
  208. logrus.WithFields(logrus.Fields{
  209. "name": ref.File.Name,
  210. "path": fPath,
  211. }).Debug("injecting config")
  212. config, err := c.DependencyStore.Configs().Get(ref.ConfigID)
  213. if err != nil {
  214. return errors.Wrap(err, "unable to get config from config store")
  215. }
  216. if err := ioutil.WriteFile(fPath, config.Spec.Data, ref.File.Mode); err != nil {
  217. return errors.Wrap(err, "error injecting config")
  218. }
  219. uid, err := strconv.Atoi(ref.File.UID)
  220. if err != nil {
  221. return err
  222. }
  223. gid, err := strconv.Atoi(ref.File.GID)
  224. if err != nil {
  225. return err
  226. }
  227. if err := os.Chown(fPath, rootIDs.UID+uid, rootIDs.GID+gid); err != nil {
  228. return errors.Wrap(err, "error setting ownership for config")
  229. }
  230. if err := os.Chmod(fPath, ref.File.Mode); err != nil {
  231. return errors.Wrap(err, "error setting file mode for config")
  232. }
  233. }
  234. return daemon.remountSecretDir(c)
  235. }
  236. // createSecretsDir is used to create a dir suitable for storing container secrets.
  237. // In practice this is using a tmpfs mount and is used for both "configs" and "secrets"
  238. func (daemon *Daemon) createSecretsDir(c *container.Container) error {
  239. // retrieve possible remapped range start for root UID, GID
  240. rootIDs := daemon.idMappings.RootPair()
  241. dir, err := c.SecretMountPath()
  242. if err != nil {
  243. return errors.Wrap(err, "error getting container secrets dir")
  244. }
  245. // create tmpfs
  246. if err := idtools.MkdirAllAndChown(dir, 0700, rootIDs); err != nil {
  247. return errors.Wrap(err, "error creating secret local mount path")
  248. }
  249. tmpfsOwnership := fmt.Sprintf("uid=%d,gid=%d", rootIDs.UID, rootIDs.GID)
  250. if err := mount.Mount("tmpfs", dir, "tmpfs", "nodev,nosuid,noexec,"+tmpfsOwnership); err != nil {
  251. return errors.Wrap(err, "unable to setup secret mount")
  252. }
  253. return nil
  254. }
  255. func (daemon *Daemon) remountSecretDir(c *container.Container) error {
  256. dir, err := c.SecretMountPath()
  257. if err != nil {
  258. return errors.Wrap(err, "error getting container secrets path")
  259. }
  260. if err := label.Relabel(dir, c.MountLabel, false); err != nil {
  261. logrus.WithError(err).WithField("dir", dir).Warn("Error while attempting to set selinux label")
  262. }
  263. rootIDs := daemon.idMappings.RootPair()
  264. tmpfsOwnership := fmt.Sprintf("uid=%d,gid=%d", rootIDs.UID, rootIDs.GID)
  265. // remount secrets ro
  266. if err := mount.Mount("tmpfs", dir, "tmpfs", "remount,ro,"+tmpfsOwnership); err != nil {
  267. return errors.Wrap(err, "unable to remount dir as readonly")
  268. }
  269. return nil
  270. }
  271. func (daemon *Daemon) cleanupSecretDir(c *container.Container) {
  272. dir, err := c.SecretMountPath()
  273. if err != nil {
  274. logrus.WithError(err).WithField("container", c.ID).Warn("error getting secrets mount path for container")
  275. }
  276. if err := mount.RecursiveUnmount(dir); err != nil {
  277. logrus.WithField("dir", dir).WithError(err).Warn("Error while attempting to unmount dir, this may prevent removal of container.")
  278. }
  279. if err := os.RemoveAll(dir); err != nil && !os.IsNotExist(err) {
  280. logrus.WithField("dir", dir).WithError(err).Error("Error removing dir.")
  281. }
  282. }
  283. func killProcessDirectly(cntr *container.Container) error {
  284. ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
  285. defer cancel()
  286. // Block until the container to stops or timeout.
  287. status := <-cntr.Wait(ctx, container.WaitConditionNotRunning)
  288. if status.Err() != nil {
  289. // Ensure that we don't kill ourselves
  290. if pid := cntr.GetPID(); pid != 0 {
  291. logrus.Infof("Container %s failed to exit within 10 seconds of kill - trying direct SIGKILL", stringid.TruncateID(cntr.ID))
  292. if err := unix.Kill(pid, 9); err != nil {
  293. if err != unix.ESRCH {
  294. return err
  295. }
  296. e := errNoSuchProcess{pid, 9}
  297. logrus.Debug(e)
  298. return e
  299. }
  300. }
  301. }
  302. return nil
  303. }
  304. func detachMounted(path string) error {
  305. return unix.Unmount(path, unix.MNT_DETACH)
  306. }
  307. func isLinkable(child *container.Container) bool {
  308. // A container is linkable only if it belongs to the default network
  309. _, ok := child.NetworkSettings.Networks[runconfig.DefaultDaemonNetworkMode().NetworkName()]
  310. return ok
  311. }
  312. func enableIPOnPredefinedNetwork() bool {
  313. return false
  314. }
  315. func (daemon *Daemon) isNetworkHotPluggable() bool {
  316. return true
  317. }
  318. func (daemon *Daemon) setupPathsAndSandboxOptions(container *container.Container, sboxOptions *[]libnetwork.SandboxOption) error {
  319. var err error
  320. if container.HostConfig.NetworkMode.IsHost() {
  321. // Point to the host files, so that will be copied into the container running in host mode
  322. *sboxOptions = append(*sboxOptions, libnetwork.OptionOriginHostsPath("/etc/hosts"))
  323. *sboxOptions = append(*sboxOptions, libnetwork.OptionOriginResolvConfPath("/etc/resolv.conf"))
  324. } else {
  325. *sboxOptions = append(*sboxOptions, libnetwork.OptionOriginResolvConfPath(daemon.configStore.GetResolvConf()))
  326. }
  327. container.HostsPath, err = container.GetRootResourcePath("hosts")
  328. if err != nil {
  329. return err
  330. }
  331. *sboxOptions = append(*sboxOptions, libnetwork.OptionHostsPath(container.HostsPath))
  332. container.ResolvConfPath, err = container.GetRootResourcePath("resolv.conf")
  333. if err != nil {
  334. return err
  335. }
  336. *sboxOptions = append(*sboxOptions, libnetwork.OptionResolvConfPath(container.ResolvConfPath))
  337. return nil
  338. }
  339. func (daemon *Daemon) initializeNetworkingPaths(container *container.Container, nc *container.Container) error {
  340. container.HostnamePath = nc.HostnamePath
  341. container.HostsPath = nc.HostsPath
  342. container.ResolvConfPath = nc.ResolvConfPath
  343. return nil
  344. }
  345. func (daemon *Daemon) setupContainerMountsRoot(c *container.Container) error {
  346. // get the root mount path so we can make it unbindable
  347. p, err := c.MountsResourcePath("")
  348. if err != nil {
  349. return err
  350. }
  351. return idtools.MkdirAllAndChown(p, 0700, daemon.idMappings.RootPair())
  352. }