container_operations.go 31 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968969970971972973974975976977978979980981982983984985986987988989990991992993994995996997998999100010011002100310041005100610071008100910101011101210131014101510161017101810191020102110221023102410251026102710281029103010311032103310341035103610371038103910401041104210431044104510461047104810491050105110521053105410551056105710581059106010611062106310641065106610671068106910701071107210731074107510761077107810791080
  1. package daemon
  2. import (
  3. "errors"
  4. "fmt"
  5. "net"
  6. "os"
  7. "path"
  8. "runtime"
  9. "strings"
  10. "time"
  11. "github.com/Sirupsen/logrus"
  12. derr "github.com/docker/docker/api/errors"
  13. containertypes "github.com/docker/docker/api/types/container"
  14. networktypes "github.com/docker/docker/api/types/network"
  15. "github.com/docker/docker/container"
  16. "github.com/docker/docker/daemon/network"
  17. "github.com/docker/docker/opts"
  18. "github.com/docker/docker/pkg/stringid"
  19. "github.com/docker/docker/runconfig"
  20. "github.com/docker/go-connections/nat"
  21. "github.com/docker/libnetwork"
  22. "github.com/docker/libnetwork/netlabel"
  23. "github.com/docker/libnetwork/options"
  24. "github.com/docker/libnetwork/types"
  25. )
  26. var (
  27. // ErrRootFSReadOnly is returned when a container
  28. // rootfs is marked readonly.
  29. ErrRootFSReadOnly = errors.New("container rootfs is marked read-only")
  30. getPortMapInfo = container.GetSandboxPortMapInfo
  31. )
  32. func (daemon *Daemon) getDNSSearchSettings(container *container.Container) []string {
  33. if len(container.HostConfig.DNSSearch) > 0 {
  34. return container.HostConfig.DNSSearch
  35. }
  36. if len(daemon.configStore.DNSSearch) > 0 {
  37. return daemon.configStore.DNSSearch
  38. }
  39. return nil
  40. }
  41. func (daemon *Daemon) buildSandboxOptions(container *container.Container) ([]libnetwork.SandboxOption, error) {
  42. var (
  43. sboxOptions []libnetwork.SandboxOption
  44. err error
  45. dns []string
  46. dnsOptions []string
  47. bindings = make(nat.PortMap)
  48. pbList []types.PortBinding
  49. exposeList []types.TransportPort
  50. )
  51. defaultNetName := runconfig.DefaultDaemonNetworkMode().NetworkName()
  52. sboxOptions = append(sboxOptions, libnetwork.OptionHostname(container.Config.Hostname),
  53. libnetwork.OptionDomainname(container.Config.Domainname))
  54. if container.HostConfig.NetworkMode.IsHost() {
  55. sboxOptions = append(sboxOptions, libnetwork.OptionUseDefaultSandbox())
  56. if len(container.HostConfig.ExtraHosts) == 0 {
  57. sboxOptions = append(sboxOptions, libnetwork.OptionOriginHostsPath("/etc/hosts"))
  58. }
  59. if len(container.HostConfig.DNS) == 0 && len(daemon.configStore.DNS) == 0 &&
  60. len(container.HostConfig.DNSSearch) == 0 && len(daemon.configStore.DNSSearch) == 0 &&
  61. len(container.HostConfig.DNSOptions) == 0 && len(daemon.configStore.DNSOptions) == 0 {
  62. sboxOptions = append(sboxOptions, libnetwork.OptionOriginResolvConfPath("/etc/resolv.conf"))
  63. }
  64. } else {
  65. // OptionUseExternalKey is mandatory for userns support.
  66. // But optional for non-userns support
  67. sboxOptions = append(sboxOptions, libnetwork.OptionUseExternalKey())
  68. }
  69. if err = setupPathsAndSandboxOptions(container, &sboxOptions); err != nil {
  70. return nil, err
  71. }
  72. if len(container.HostConfig.DNS) > 0 {
  73. dns = container.HostConfig.DNS
  74. } else if len(daemon.configStore.DNS) > 0 {
  75. dns = daemon.configStore.DNS
  76. }
  77. for _, d := range dns {
  78. sboxOptions = append(sboxOptions, libnetwork.OptionDNS(d))
  79. }
  80. dnsSearch := daemon.getDNSSearchSettings(container)
  81. for _, ds := range dnsSearch {
  82. sboxOptions = append(sboxOptions, libnetwork.OptionDNSSearch(ds))
  83. }
  84. if len(container.HostConfig.DNSOptions) > 0 {
  85. dnsOptions = container.HostConfig.DNSOptions
  86. } else if len(daemon.configStore.DNSOptions) > 0 {
  87. dnsOptions = daemon.configStore.DNSOptions
  88. }
  89. for _, ds := range dnsOptions {
  90. sboxOptions = append(sboxOptions, libnetwork.OptionDNSOptions(ds))
  91. }
  92. if container.NetworkSettings.SecondaryIPAddresses != nil {
  93. name := container.Config.Hostname
  94. if container.Config.Domainname != "" {
  95. name = name + "." + container.Config.Domainname
  96. }
  97. for _, a := range container.NetworkSettings.SecondaryIPAddresses {
  98. sboxOptions = append(sboxOptions, libnetwork.OptionExtraHost(name, a.Addr))
  99. }
  100. }
  101. for _, extraHost := range container.HostConfig.ExtraHosts {
  102. // allow IPv6 addresses in extra hosts; only split on first ":"
  103. if _, err := opts.ValidateExtraHost(extraHost); err != nil {
  104. return nil, err
  105. }
  106. parts := strings.SplitN(extraHost, ":", 2)
  107. sboxOptions = append(sboxOptions, libnetwork.OptionExtraHost(parts[0], parts[1]))
  108. }
  109. if container.HostConfig.PortBindings != nil {
  110. for p, b := range container.HostConfig.PortBindings {
  111. bindings[p] = []nat.PortBinding{}
  112. for _, bb := range b {
  113. bindings[p] = append(bindings[p], nat.PortBinding{
  114. HostIP: bb.HostIP,
  115. HostPort: bb.HostPort,
  116. })
  117. }
  118. }
  119. }
  120. portSpecs := container.Config.ExposedPorts
  121. ports := make([]nat.Port, len(portSpecs))
  122. var i int
  123. for p := range portSpecs {
  124. ports[i] = p
  125. i++
  126. }
  127. nat.SortPortMap(ports, bindings)
  128. for _, port := range ports {
  129. expose := types.TransportPort{}
  130. expose.Proto = types.ParseProtocol(port.Proto())
  131. expose.Port = uint16(port.Int())
  132. exposeList = append(exposeList, expose)
  133. pb := types.PortBinding{Port: expose.Port, Proto: expose.Proto}
  134. binding := bindings[port]
  135. for i := 0; i < len(binding); i++ {
  136. pbCopy := pb.GetCopy()
  137. newP, err := nat.NewPort(nat.SplitProtoPort(binding[i].HostPort))
  138. var portStart, portEnd int
  139. if err == nil {
  140. portStart, portEnd, err = newP.Range()
  141. }
  142. if err != nil {
  143. return nil, fmt.Errorf("Error parsing HostPort value(%s):%v", binding[i].HostPort, err)
  144. }
  145. pbCopy.HostPort = uint16(portStart)
  146. pbCopy.HostPortEnd = uint16(portEnd)
  147. pbCopy.HostIP = net.ParseIP(binding[i].HostIP)
  148. pbList = append(pbList, pbCopy)
  149. }
  150. if container.HostConfig.PublishAllPorts && len(binding) == 0 {
  151. pbList = append(pbList, pb)
  152. }
  153. }
  154. sboxOptions = append(sboxOptions,
  155. libnetwork.OptionPortMapping(pbList),
  156. libnetwork.OptionExposedPorts(exposeList))
  157. // Legacy Link feature is supported only for the default bridge network.
  158. // return if this call to build join options is not for default bridge network
  159. // Legacy Link is only supported by docker run --link
  160. bridgeSettings, ok := container.NetworkSettings.Networks[defaultNetName]
  161. if !ok || bridgeSettings.EndpointSettings == nil {
  162. return sboxOptions, nil
  163. }
  164. if bridgeSettings.EndpointID == "" {
  165. return sboxOptions, nil
  166. }
  167. var (
  168. childEndpoints, parentEndpoints []string
  169. cEndpointID string
  170. )
  171. children := daemon.children(container)
  172. for linkAlias, child := range children {
  173. if !isLinkable(child) {
  174. return nil, fmt.Errorf("Cannot link to %s, as it does not belong to the default network", child.Name)
  175. }
  176. _, alias := path.Split(linkAlias)
  177. // allow access to the linked container via the alias, real name, and container hostname
  178. aliasList := alias + " " + child.Config.Hostname
  179. // only add the name if alias isn't equal to the name
  180. if alias != child.Name[1:] {
  181. aliasList = aliasList + " " + child.Name[1:]
  182. }
  183. sboxOptions = append(sboxOptions, libnetwork.OptionExtraHost(aliasList, child.NetworkSettings.Networks[defaultNetName].IPAddress))
  184. cEndpointID = child.NetworkSettings.Networks[defaultNetName].EndpointID
  185. if cEndpointID != "" {
  186. childEndpoints = append(childEndpoints, cEndpointID)
  187. }
  188. }
  189. for alias, parent := range daemon.parents(container) {
  190. if daemon.configStore.DisableBridge || !container.HostConfig.NetworkMode.IsPrivate() {
  191. continue
  192. }
  193. _, alias = path.Split(alias)
  194. logrus.Debugf("Update /etc/hosts of %s for alias %s with ip %s", parent.ID, alias, bridgeSettings.IPAddress)
  195. sboxOptions = append(sboxOptions, libnetwork.OptionParentUpdate(
  196. parent.ID,
  197. alias,
  198. bridgeSettings.IPAddress,
  199. ))
  200. if cEndpointID != "" {
  201. parentEndpoints = append(parentEndpoints, cEndpointID)
  202. }
  203. }
  204. linkOptions := options.Generic{
  205. netlabel.GenericData: options.Generic{
  206. "ParentEndpoints": parentEndpoints,
  207. "ChildEndpoints": childEndpoints,
  208. },
  209. }
  210. sboxOptions = append(sboxOptions, libnetwork.OptionGeneric(linkOptions))
  211. return sboxOptions, nil
  212. }
  213. func (daemon *Daemon) updateNetworkSettings(container *container.Container, n libnetwork.Network, endpointConfig *networktypes.EndpointSettings) error {
  214. if container.NetworkSettings == nil {
  215. container.NetworkSettings = &network.Settings{Networks: make(map[string]*network.EndpointSettings)}
  216. }
  217. if !container.HostConfig.NetworkMode.IsHost() && containertypes.NetworkMode(n.Type()).IsHost() {
  218. return runconfig.ErrConflictHostNetwork
  219. }
  220. for s := range container.NetworkSettings.Networks {
  221. sn, err := daemon.FindNetwork(s)
  222. if err != nil {
  223. continue
  224. }
  225. if sn.Name() == n.Name() {
  226. // Avoid duplicate config
  227. return nil
  228. }
  229. if !containertypes.NetworkMode(sn.Type()).IsPrivate() ||
  230. !containertypes.NetworkMode(n.Type()).IsPrivate() {
  231. return runconfig.ErrConflictSharedNetwork
  232. }
  233. if containertypes.NetworkMode(sn.Name()).IsNone() ||
  234. containertypes.NetworkMode(n.Name()).IsNone() {
  235. return runconfig.ErrConflictNoNetwork
  236. }
  237. }
  238. if _, ok := container.NetworkSettings.Networks[n.Name()]; !ok {
  239. container.NetworkSettings.Networks[n.Name()] = &network.EndpointSettings{
  240. EndpointSettings: endpointConfig,
  241. }
  242. }
  243. return nil
  244. }
  245. func (daemon *Daemon) updateEndpointNetworkSettings(container *container.Container, n libnetwork.Network, ep libnetwork.Endpoint) error {
  246. if err := container.BuildEndpointInfo(n, ep); err != nil {
  247. return err
  248. }
  249. if container.HostConfig.NetworkMode == runconfig.DefaultDaemonNetworkMode() {
  250. container.NetworkSettings.Bridge = daemon.configStore.BridgeConfig.Iface
  251. }
  252. return nil
  253. }
  254. // UpdateNetwork is used to update the container's network (e.g. when linked containers
  255. // get removed/unlinked).
  256. func (daemon *Daemon) updateNetwork(container *container.Container) error {
  257. var (
  258. start = time.Now()
  259. ctrl = daemon.netController
  260. sid = container.NetworkSettings.SandboxID
  261. )
  262. sb, err := ctrl.SandboxByID(sid)
  263. if err != nil {
  264. return fmt.Errorf("error locating sandbox id %s: %v", sid, err)
  265. }
  266. // Find if container is connected to the default bridge network
  267. var n libnetwork.Network
  268. for name := range container.NetworkSettings.Networks {
  269. sn, err := daemon.FindNetwork(name)
  270. if err != nil {
  271. continue
  272. }
  273. if sn.Name() == runconfig.DefaultDaemonNetworkMode().NetworkName() {
  274. n = sn
  275. break
  276. }
  277. }
  278. if n == nil {
  279. // Not connected to the default bridge network; Nothing to do
  280. return nil
  281. }
  282. options, err := daemon.buildSandboxOptions(container)
  283. if err != nil {
  284. return fmt.Errorf("Update network failed: %v", err)
  285. }
  286. if err := sb.Refresh(options...); err != nil {
  287. return fmt.Errorf("Update network failed: Failure in refresh sandbox %s: %v", sid, err)
  288. }
  289. networkActions.WithValues("update").UpdateSince(start)
  290. return nil
  291. }
  292. func (daemon *Daemon) findAndAttachNetwork(container *container.Container, idOrName string, epConfig *networktypes.EndpointSettings) (libnetwork.Network, *networktypes.NetworkingConfig, error) {
  293. n, err := daemon.FindNetwork(idOrName)
  294. if err != nil {
  295. // We should always be able to find the network for a
  296. // managed container.
  297. if container.Managed {
  298. return nil, nil, err
  299. }
  300. }
  301. // If we found a network and if it is not dynamically created
  302. // we should never attempt to attach to that network here.
  303. if n != nil {
  304. if container.Managed || !n.Info().Dynamic() {
  305. return n, nil, nil
  306. }
  307. }
  308. var addresses []string
  309. if epConfig != nil && epConfig.IPAMConfig != nil {
  310. if epConfig.IPAMConfig.IPv4Address != "" {
  311. addresses = append(addresses, epConfig.IPAMConfig.IPv4Address)
  312. }
  313. if epConfig.IPAMConfig.IPv6Address != "" {
  314. addresses = append(addresses, epConfig.IPAMConfig.IPv6Address)
  315. }
  316. }
  317. var (
  318. config *networktypes.NetworkingConfig
  319. retryCount int
  320. )
  321. for {
  322. // In all other cases, attempt to attach to the network to
  323. // trigger attachment in the swarm cluster manager.
  324. if daemon.clusterProvider != nil {
  325. var err error
  326. config, err = daemon.clusterProvider.AttachNetwork(idOrName, container.ID, addresses)
  327. if err != nil {
  328. return nil, nil, err
  329. }
  330. }
  331. n, err = daemon.FindNetwork(idOrName)
  332. if err != nil {
  333. if daemon.clusterProvider != nil {
  334. if err := daemon.clusterProvider.DetachNetwork(idOrName, container.ID); err != nil {
  335. logrus.Warnf("Could not rollback attachment for container %s to network %s: %v", container.ID, idOrName, err)
  336. }
  337. }
  338. // Retry network attach again if we failed to
  339. // find the network after successful
  340. // attachment because the only reason that
  341. // would happen is if some other container
  342. // attached to the swarm scope network went down
  343. // and removed the network while we were in
  344. // the process of attaching.
  345. if config != nil {
  346. if _, ok := err.(libnetwork.ErrNoSuchNetwork); ok {
  347. if retryCount >= 5 {
  348. return nil, nil, fmt.Errorf("could not find network %s after successful attachment", idOrName)
  349. }
  350. retryCount++
  351. continue
  352. }
  353. }
  354. return nil, nil, err
  355. }
  356. break
  357. }
  358. // This container has attachment to a swarm scope
  359. // network. Update the container network settings accordingly.
  360. container.NetworkSettings.HasSwarmEndpoint = true
  361. return n, config, nil
  362. }
  363. // updateContainerNetworkSettings updates the network settings
  364. func (daemon *Daemon) updateContainerNetworkSettings(container *container.Container, endpointsConfig map[string]*networktypes.EndpointSettings) {
  365. var n libnetwork.Network
  366. mode := container.HostConfig.NetworkMode
  367. if container.Config.NetworkDisabled || mode.IsContainer() {
  368. return
  369. }
  370. networkName := mode.NetworkName()
  371. if mode.IsDefault() {
  372. networkName = daemon.netController.Config().Daemon.DefaultNetwork
  373. }
  374. if mode.IsUserDefined() {
  375. var err error
  376. n, err = daemon.FindNetwork(networkName)
  377. if err == nil {
  378. networkName = n.Name()
  379. }
  380. }
  381. if container.NetworkSettings == nil {
  382. container.NetworkSettings = &network.Settings{}
  383. }
  384. if len(endpointsConfig) > 0 {
  385. if container.NetworkSettings.Networks == nil {
  386. container.NetworkSettings.Networks = make(map[string]*network.EndpointSettings)
  387. }
  388. for name, epConfig := range endpointsConfig {
  389. container.NetworkSettings.Networks[name] = &network.EndpointSettings{
  390. EndpointSettings: epConfig,
  391. }
  392. }
  393. }
  394. if container.NetworkSettings.Networks == nil {
  395. container.NetworkSettings.Networks = make(map[string]*network.EndpointSettings)
  396. container.NetworkSettings.Networks[networkName] = &network.EndpointSettings{
  397. EndpointSettings: &networktypes.EndpointSettings{},
  398. }
  399. }
  400. // Convert any settings added by client in default name to
  401. // engine's default network name key
  402. if mode.IsDefault() {
  403. if nConf, ok := container.NetworkSettings.Networks[mode.NetworkName()]; ok {
  404. container.NetworkSettings.Networks[networkName] = nConf
  405. delete(container.NetworkSettings.Networks, mode.NetworkName())
  406. }
  407. }
  408. if !mode.IsUserDefined() {
  409. return
  410. }
  411. // Make sure to internally store the per network endpoint config by network name
  412. if _, ok := container.NetworkSettings.Networks[networkName]; ok {
  413. return
  414. }
  415. if n != nil {
  416. if nwConfig, ok := container.NetworkSettings.Networks[n.ID()]; ok {
  417. container.NetworkSettings.Networks[networkName] = nwConfig
  418. delete(container.NetworkSettings.Networks, n.ID())
  419. return
  420. }
  421. }
  422. }
  423. func (daemon *Daemon) allocateNetwork(container *container.Container) error {
  424. start := time.Now()
  425. controller := daemon.netController
  426. if daemon.netController == nil {
  427. return nil
  428. }
  429. // Cleanup any stale sandbox left over due to ungraceful daemon shutdown
  430. if err := controller.SandboxDestroy(container.ID); err != nil {
  431. logrus.Errorf("failed to cleanup up stale network sandbox for container %s", container.ID)
  432. }
  433. if container.Config.NetworkDisabled || container.HostConfig.NetworkMode.IsContainer() {
  434. return nil
  435. }
  436. updateSettings := false
  437. if len(container.NetworkSettings.Networks) == 0 {
  438. daemon.updateContainerNetworkSettings(container, nil)
  439. updateSettings = true
  440. }
  441. // always connect default network first since only default
  442. // network mode support link and we need do some setting
  443. // on sandbox initialize for link, but the sandbox only be initialized
  444. // on first network connecting.
  445. defaultNetName := runconfig.DefaultDaemonNetworkMode().NetworkName()
  446. if nConf, ok := container.NetworkSettings.Networks[defaultNetName]; ok {
  447. cleanOperationalData(nConf)
  448. if err := daemon.connectToNetwork(container, defaultNetName, nConf.EndpointSettings, updateSettings); err != nil {
  449. return err
  450. }
  451. }
  452. // the intermediate map is necessary because "connectToNetwork" modifies "container.NetworkSettings.Networks"
  453. networks := make(map[string]*network.EndpointSettings)
  454. for n, epConf := range container.NetworkSettings.Networks {
  455. if n == defaultNetName {
  456. continue
  457. }
  458. networks[n] = epConf
  459. }
  460. for netName, epConf := range networks {
  461. cleanOperationalData(epConf)
  462. if err := daemon.connectToNetwork(container, netName, epConf.EndpointSettings, updateSettings); err != nil {
  463. return err
  464. }
  465. }
  466. // If the container is not to be connected to any network,
  467. // create its network sandbox now if not present
  468. if len(networks) == 0 {
  469. if nil == daemon.getNetworkSandbox(container) {
  470. options, err := daemon.buildSandboxOptions(container)
  471. if err != nil {
  472. return err
  473. }
  474. sb, err := daemon.netController.NewSandbox(container.ID, options...)
  475. if err != nil {
  476. return err
  477. }
  478. container.UpdateSandboxNetworkSettings(sb)
  479. defer func() {
  480. if err != nil {
  481. sb.Delete()
  482. }
  483. }()
  484. }
  485. }
  486. if err := container.WriteHostConfig(); err != nil {
  487. return err
  488. }
  489. networkActions.WithValues("allocate").UpdateSince(start)
  490. return nil
  491. }
  492. func (daemon *Daemon) getNetworkSandbox(container *container.Container) libnetwork.Sandbox {
  493. var sb libnetwork.Sandbox
  494. daemon.netController.WalkSandboxes(func(s libnetwork.Sandbox) bool {
  495. if s.ContainerID() == container.ID {
  496. sb = s
  497. return true
  498. }
  499. return false
  500. })
  501. return sb
  502. }
  503. // hasUserDefinedIPAddress returns whether the passed endpoint configuration contains IP address configuration
  504. func hasUserDefinedIPAddress(epConfig *networktypes.EndpointSettings) bool {
  505. return epConfig != nil && epConfig.IPAMConfig != nil && (len(epConfig.IPAMConfig.IPv4Address) > 0 || len(epConfig.IPAMConfig.IPv6Address) > 0)
  506. }
  507. // User specified ip address is acceptable only for networks with user specified subnets.
  508. func validateNetworkingConfig(n libnetwork.Network, epConfig *networktypes.EndpointSettings) error {
  509. if n == nil || epConfig == nil {
  510. return nil
  511. }
  512. if !hasUserDefinedIPAddress(epConfig) {
  513. return nil
  514. }
  515. _, _, nwIPv4Configs, nwIPv6Configs := n.Info().IpamConfig()
  516. for _, s := range []struct {
  517. ipConfigured bool
  518. subnetConfigs []*libnetwork.IpamConf
  519. }{
  520. {
  521. ipConfigured: len(epConfig.IPAMConfig.IPv4Address) > 0,
  522. subnetConfigs: nwIPv4Configs,
  523. },
  524. {
  525. ipConfigured: len(epConfig.IPAMConfig.IPv6Address) > 0,
  526. subnetConfigs: nwIPv6Configs,
  527. },
  528. } {
  529. if s.ipConfigured {
  530. foundSubnet := false
  531. for _, cfg := range s.subnetConfigs {
  532. if len(cfg.PreferredPool) > 0 {
  533. foundSubnet = true
  534. break
  535. }
  536. }
  537. if !foundSubnet {
  538. return runconfig.ErrUnsupportedNetworkNoSubnetAndIP
  539. }
  540. }
  541. }
  542. return nil
  543. }
  544. // cleanOperationalData resets the operational data from the passed endpoint settings
  545. func cleanOperationalData(es *network.EndpointSettings) {
  546. es.EndpointID = ""
  547. es.Gateway = ""
  548. es.IPAddress = ""
  549. es.IPPrefixLen = 0
  550. es.IPv6Gateway = ""
  551. es.GlobalIPv6Address = ""
  552. es.GlobalIPv6PrefixLen = 0
  553. es.MacAddress = ""
  554. if es.IPAMOperational {
  555. es.IPAMConfig = nil
  556. }
  557. }
  558. func (daemon *Daemon) updateNetworkConfig(container *container.Container, n libnetwork.Network, endpointConfig *networktypes.EndpointSettings, updateSettings bool) error {
  559. if !containertypes.NetworkMode(n.Name()).IsUserDefined() {
  560. if hasUserDefinedIPAddress(endpointConfig) && !enableIPOnPredefinedNetwork() {
  561. return runconfig.ErrUnsupportedNetworkAndIP
  562. }
  563. if endpointConfig != nil && len(endpointConfig.Aliases) > 0 && !container.EnableServiceDiscoveryOnDefaultNetwork() {
  564. return runconfig.ErrUnsupportedNetworkAndAlias
  565. }
  566. } else {
  567. addShortID := true
  568. shortID := stringid.TruncateID(container.ID)
  569. for _, alias := range endpointConfig.Aliases {
  570. if alias == shortID {
  571. addShortID = false
  572. break
  573. }
  574. }
  575. if addShortID {
  576. endpointConfig.Aliases = append(endpointConfig.Aliases, shortID)
  577. }
  578. }
  579. if err := validateNetworkingConfig(n, endpointConfig); err != nil {
  580. return err
  581. }
  582. if updateSettings {
  583. if err := daemon.updateNetworkSettings(container, n, endpointConfig); err != nil {
  584. return err
  585. }
  586. }
  587. return nil
  588. }
  589. func (daemon *Daemon) connectToNetwork(container *container.Container, idOrName string, endpointConfig *networktypes.EndpointSettings, updateSettings bool) (err error) {
  590. start := time.Now()
  591. if container.HostConfig.NetworkMode.IsContainer() {
  592. return runconfig.ErrConflictSharedNetwork
  593. }
  594. if containertypes.NetworkMode(idOrName).IsBridge() &&
  595. daemon.configStore.DisableBridge {
  596. container.Config.NetworkDisabled = true
  597. return nil
  598. }
  599. if endpointConfig == nil {
  600. endpointConfig = &networktypes.EndpointSettings{}
  601. }
  602. n, config, err := daemon.findAndAttachNetwork(container, idOrName, endpointConfig)
  603. if err != nil {
  604. return err
  605. }
  606. if n == nil {
  607. return nil
  608. }
  609. var operIPAM bool
  610. if config != nil {
  611. if epConfig, ok := config.EndpointsConfig[n.Name()]; ok {
  612. if endpointConfig.IPAMConfig == nil ||
  613. (endpointConfig.IPAMConfig.IPv4Address == "" &&
  614. endpointConfig.IPAMConfig.IPv6Address == "" &&
  615. len(endpointConfig.IPAMConfig.LinkLocalIPs) == 0) {
  616. operIPAM = true
  617. }
  618. // copy IPAMConfig and NetworkID from epConfig via AttachNetwork
  619. endpointConfig.IPAMConfig = epConfig.IPAMConfig
  620. endpointConfig.NetworkID = epConfig.NetworkID
  621. }
  622. }
  623. err = daemon.updateNetworkConfig(container, n, endpointConfig, updateSettings)
  624. if err != nil {
  625. return err
  626. }
  627. controller := daemon.netController
  628. sb := daemon.getNetworkSandbox(container)
  629. createOptions, err := container.BuildCreateEndpointOptions(n, endpointConfig, sb, daemon.configStore.DNS)
  630. if err != nil {
  631. return err
  632. }
  633. endpointName := strings.TrimPrefix(container.Name, "/")
  634. ep, err := n.CreateEndpoint(endpointName, createOptions...)
  635. if err != nil {
  636. return err
  637. }
  638. defer func() {
  639. if err != nil {
  640. if e := ep.Delete(false); e != nil {
  641. logrus.Warnf("Could not rollback container connection to network %s", idOrName)
  642. }
  643. }
  644. }()
  645. container.NetworkSettings.Networks[n.Name()] = &network.EndpointSettings{
  646. EndpointSettings: endpointConfig,
  647. IPAMOperational: operIPAM,
  648. }
  649. if _, ok := container.NetworkSettings.Networks[n.ID()]; ok {
  650. delete(container.NetworkSettings.Networks, n.ID())
  651. }
  652. if err := daemon.updateEndpointNetworkSettings(container, n, ep); err != nil {
  653. return err
  654. }
  655. if sb == nil {
  656. options, err := daemon.buildSandboxOptions(container)
  657. if err != nil {
  658. return err
  659. }
  660. sb, err = controller.NewSandbox(container.ID, options...)
  661. if err != nil {
  662. return err
  663. }
  664. container.UpdateSandboxNetworkSettings(sb)
  665. }
  666. joinOptions, err := container.BuildJoinOptions(n)
  667. if err != nil {
  668. return err
  669. }
  670. if err := ep.Join(sb, joinOptions...); err != nil {
  671. return err
  672. }
  673. if !container.Managed {
  674. // add container name/alias to DNS
  675. if err := daemon.ActivateContainerServiceBinding(container.Name); err != nil {
  676. return fmt.Errorf("Activate container service binding for %s failed: %v", container.Name, err)
  677. }
  678. }
  679. if err := container.UpdateJoinInfo(n, ep); err != nil {
  680. return fmt.Errorf("Updating join info failed: %v", err)
  681. }
  682. container.NetworkSettings.Ports = getPortMapInfo(sb)
  683. daemon.LogNetworkEventWithAttributes(n, "connect", map[string]string{"container": container.ID})
  684. networkActions.WithValues("connect").UpdateSince(start)
  685. return nil
  686. }
  687. // ForceEndpointDelete deletes an endpoint from a network forcefully
  688. func (daemon *Daemon) ForceEndpointDelete(name string, networkName string) error {
  689. n, err := daemon.FindNetwork(networkName)
  690. if err != nil {
  691. return err
  692. }
  693. ep, err := n.EndpointByName(name)
  694. if err != nil {
  695. return err
  696. }
  697. return ep.Delete(true)
  698. }
  699. func (daemon *Daemon) disconnectFromNetwork(container *container.Container, n libnetwork.Network, force bool) error {
  700. var (
  701. ep libnetwork.Endpoint
  702. sbox libnetwork.Sandbox
  703. )
  704. s := func(current libnetwork.Endpoint) bool {
  705. epInfo := current.Info()
  706. if epInfo == nil {
  707. return false
  708. }
  709. if sb := epInfo.Sandbox(); sb != nil {
  710. if sb.ContainerID() == container.ID {
  711. ep = current
  712. sbox = sb
  713. return true
  714. }
  715. }
  716. return false
  717. }
  718. n.WalkEndpoints(s)
  719. if ep == nil && force {
  720. epName := strings.TrimPrefix(container.Name, "/")
  721. ep, err := n.EndpointByName(epName)
  722. if err != nil {
  723. return err
  724. }
  725. return ep.Delete(force)
  726. }
  727. if ep == nil {
  728. return fmt.Errorf("container %s is not connected to network %s", container.ID, n.Name())
  729. }
  730. if err := ep.Leave(sbox); err != nil {
  731. return fmt.Errorf("container %s failed to leave network %s: %v", container.ID, n.Name(), err)
  732. }
  733. container.NetworkSettings.Ports = getPortMapInfo(sbox)
  734. if err := ep.Delete(false); err != nil {
  735. return fmt.Errorf("endpoint delete failed for container %s on network %s: %v", container.ID, n.Name(), err)
  736. }
  737. delete(container.NetworkSettings.Networks, n.Name())
  738. daemon.tryDetachContainerFromClusterNetwork(n, container)
  739. return nil
  740. }
  741. func (daemon *Daemon) tryDetachContainerFromClusterNetwork(network libnetwork.Network, container *container.Container) {
  742. if daemon.clusterProvider != nil && network.Info().Dynamic() && !container.Managed {
  743. if err := daemon.clusterProvider.DetachNetwork(network.Name(), container.ID); err != nil {
  744. logrus.Warnf("error detaching from network %s: %v", network.Name(), err)
  745. if err := daemon.clusterProvider.DetachNetwork(network.ID(), container.ID); err != nil {
  746. logrus.Warnf("error detaching from network %s: %v", network.ID(), err)
  747. }
  748. }
  749. }
  750. attributes := map[string]string{
  751. "container": container.ID,
  752. }
  753. daemon.LogNetworkEventWithAttributes(network, "disconnect", attributes)
  754. }
  755. func (daemon *Daemon) initializeNetworking(container *container.Container) error {
  756. var err error
  757. if container.HostConfig.NetworkMode.IsContainer() {
  758. // we need to get the hosts files from the container to join
  759. nc, err := daemon.getNetworkedContainer(container.ID, container.HostConfig.NetworkMode.ConnectedContainer())
  760. if err != nil {
  761. return err
  762. }
  763. initializeNetworkingPaths(container, nc)
  764. container.Config.Hostname = nc.Config.Hostname
  765. container.Config.Domainname = nc.Config.Domainname
  766. return nil
  767. }
  768. if container.HostConfig.NetworkMode.IsHost() {
  769. if container.Config.Hostname == "" {
  770. container.Config.Hostname, err = os.Hostname()
  771. if err != nil {
  772. return err
  773. }
  774. }
  775. }
  776. if err := daemon.allocateNetwork(container); err != nil {
  777. return err
  778. }
  779. return container.BuildHostnameFile()
  780. }
  781. func (daemon *Daemon) getNetworkedContainer(containerID, connectedContainerID string) (*container.Container, error) {
  782. nc, err := daemon.GetContainer(connectedContainerID)
  783. if err != nil {
  784. return nil, err
  785. }
  786. if containerID == nc.ID {
  787. return nil, fmt.Errorf("cannot join own network")
  788. }
  789. if !nc.IsRunning() {
  790. err := fmt.Errorf("cannot join network of a non running container: %s", connectedContainerID)
  791. return nil, derr.NewRequestConflictError(err)
  792. }
  793. if nc.IsRestarting() {
  794. return nil, errContainerIsRestarting(connectedContainerID)
  795. }
  796. return nc, nil
  797. }
  798. func (daemon *Daemon) releaseNetwork(container *container.Container) {
  799. start := time.Now()
  800. if daemon.netController == nil {
  801. return
  802. }
  803. if container.HostConfig.NetworkMode.IsContainer() || container.Config.NetworkDisabled {
  804. return
  805. }
  806. sid := container.NetworkSettings.SandboxID
  807. settings := container.NetworkSettings.Networks
  808. container.NetworkSettings.Ports = nil
  809. if sid == "" {
  810. return
  811. }
  812. var networks []libnetwork.Network
  813. for n, epSettings := range settings {
  814. if nw, err := daemon.FindNetwork(n); err == nil {
  815. networks = append(networks, nw)
  816. }
  817. if epSettings.EndpointSettings == nil {
  818. continue
  819. }
  820. cleanOperationalData(epSettings)
  821. }
  822. sb, err := daemon.netController.SandboxByID(sid)
  823. if err != nil {
  824. logrus.Warnf("error locating sandbox id %s: %v", sid, err)
  825. return
  826. }
  827. if err := sb.Delete(); err != nil {
  828. logrus.Errorf("Error deleting sandbox id %s for container %s: %v", sid, container.ID, err)
  829. }
  830. for _, nw := range networks {
  831. daemon.tryDetachContainerFromClusterNetwork(nw, container)
  832. }
  833. networkActions.WithValues("release").UpdateSince(start)
  834. }
  835. func errRemovalContainer(containerID string) error {
  836. return fmt.Errorf("Container %s is marked for removal and cannot be connected or disconnected to the network", containerID)
  837. }
  838. // ConnectToNetwork connects a container to a network
  839. func (daemon *Daemon) ConnectToNetwork(container *container.Container, idOrName string, endpointConfig *networktypes.EndpointSettings) error {
  840. if endpointConfig == nil {
  841. endpointConfig = &networktypes.EndpointSettings{}
  842. }
  843. if !container.Running {
  844. if container.RemovalInProgress || container.Dead {
  845. return errRemovalContainer(container.ID)
  846. }
  847. n, err := daemon.FindNetwork(idOrName)
  848. if err == nil && n != nil {
  849. if err := daemon.updateNetworkConfig(container, n, endpointConfig, true); err != nil {
  850. return err
  851. }
  852. } else {
  853. container.NetworkSettings.Networks[idOrName] = &network.EndpointSettings{
  854. EndpointSettings: endpointConfig,
  855. }
  856. }
  857. } else if !daemon.isNetworkHotPluggable() {
  858. return fmt.Errorf(runtime.GOOS + " does not support connecting a running container to a network")
  859. } else {
  860. if err := daemon.connectToNetwork(container, idOrName, endpointConfig, true); err != nil {
  861. return err
  862. }
  863. }
  864. if err := container.ToDiskLocking(); err != nil {
  865. return fmt.Errorf("Error saving container to disk: %v", err)
  866. }
  867. return nil
  868. }
  869. // DisconnectFromNetwork disconnects container from network n.
  870. func (daemon *Daemon) DisconnectFromNetwork(container *container.Container, networkName string, force bool) error {
  871. n, err := daemon.FindNetwork(networkName)
  872. if !container.Running || (err != nil && force) {
  873. if container.RemovalInProgress || container.Dead {
  874. return errRemovalContainer(container.ID)
  875. }
  876. // In case networkName is resolved we will use n.Name()
  877. // this will cover the case where network id is passed.
  878. if n != nil {
  879. networkName = n.Name()
  880. }
  881. if _, ok := container.NetworkSettings.Networks[networkName]; !ok {
  882. return fmt.Errorf("container %s is not connected to the network %s", container.ID, networkName)
  883. }
  884. delete(container.NetworkSettings.Networks, networkName)
  885. } else if err == nil && !daemon.isNetworkHotPluggable() {
  886. return fmt.Errorf(runtime.GOOS + " does not support connecting a running container to a network")
  887. } else if err == nil {
  888. if container.HostConfig.NetworkMode.IsHost() && containertypes.NetworkMode(n.Type()).IsHost() {
  889. return runconfig.ErrConflictHostNetwork
  890. }
  891. if err := daemon.disconnectFromNetwork(container, n, false); err != nil {
  892. return err
  893. }
  894. } else {
  895. return err
  896. }
  897. if err := container.ToDiskLocking(); err != nil {
  898. return fmt.Errorf("Error saving container to disk: %v", err)
  899. }
  900. if n != nil {
  901. attributes := map[string]string{
  902. "container": container.ID,
  903. }
  904. daemon.LogNetworkEventWithAttributes(n, "disconnect", attributes)
  905. }
  906. return nil
  907. }
  908. // ActivateContainerServiceBinding puts this container into load balancer active rotation and DNS response
  909. func (daemon *Daemon) ActivateContainerServiceBinding(containerName string) error {
  910. container, err := daemon.GetContainer(containerName)
  911. if err != nil {
  912. return err
  913. }
  914. sb := daemon.getNetworkSandbox(container)
  915. if sb == nil {
  916. return fmt.Errorf("network sandbox does not exist for container %s", containerName)
  917. }
  918. return sb.EnableService()
  919. }
  920. // DeactivateContainerServiceBinding removes this container from load balancer active rotation, and DNS response
  921. func (daemon *Daemon) DeactivateContainerServiceBinding(containerName string) error {
  922. container, err := daemon.GetContainer(containerName)
  923. if err != nil {
  924. return err
  925. }
  926. sb := daemon.getNetworkSandbox(container)
  927. if sb == nil {
  928. // If the network sandbox is not found, then there is nothing to deactivate
  929. logrus.Debugf("Could not find network sandbox for container %s on service binding deactivation request", containerName)
  930. return nil
  931. }
  932. return sb.DisableService()
  933. }