daemon.go 21 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707
  1. package main
  2. import (
  3. "context"
  4. "crypto/tls"
  5. "fmt"
  6. "os"
  7. "path/filepath"
  8. "runtime"
  9. "strings"
  10. "time"
  11. containerddefaults "github.com/containerd/containerd/defaults"
  12. "github.com/docker/distribution/uuid"
  13. "github.com/docker/docker/api"
  14. apiserver "github.com/docker/docker/api/server"
  15. buildbackend "github.com/docker/docker/api/server/backend/build"
  16. "github.com/docker/docker/api/server/middleware"
  17. "github.com/docker/docker/api/server/router"
  18. "github.com/docker/docker/api/server/router/build"
  19. checkpointrouter "github.com/docker/docker/api/server/router/checkpoint"
  20. "github.com/docker/docker/api/server/router/container"
  21. distributionrouter "github.com/docker/docker/api/server/router/distribution"
  22. grpcrouter "github.com/docker/docker/api/server/router/grpc"
  23. "github.com/docker/docker/api/server/router/image"
  24. "github.com/docker/docker/api/server/router/network"
  25. pluginrouter "github.com/docker/docker/api/server/router/plugin"
  26. sessionrouter "github.com/docker/docker/api/server/router/session"
  27. swarmrouter "github.com/docker/docker/api/server/router/swarm"
  28. systemrouter "github.com/docker/docker/api/server/router/system"
  29. "github.com/docker/docker/api/server/router/volume"
  30. buildkit "github.com/docker/docker/builder/builder-next"
  31. "github.com/docker/docker/builder/dockerfile"
  32. "github.com/docker/docker/builder/fscache"
  33. "github.com/docker/docker/cli/debug"
  34. "github.com/docker/docker/daemon"
  35. "github.com/docker/docker/daemon/cluster"
  36. "github.com/docker/docker/daemon/config"
  37. "github.com/docker/docker/daemon/listeners"
  38. "github.com/docker/docker/dockerversion"
  39. "github.com/docker/docker/libcontainerd/supervisor"
  40. dopts "github.com/docker/docker/opts"
  41. "github.com/docker/docker/pkg/authorization"
  42. "github.com/docker/docker/pkg/homedir"
  43. "github.com/docker/docker/pkg/jsonmessage"
  44. "github.com/docker/docker/pkg/pidfile"
  45. "github.com/docker/docker/pkg/plugingetter"
  46. "github.com/docker/docker/pkg/signal"
  47. "github.com/docker/docker/pkg/system"
  48. "github.com/docker/docker/plugin"
  49. "github.com/docker/docker/rootless"
  50. "github.com/docker/docker/runconfig"
  51. "github.com/docker/go-connections/tlsconfig"
  52. swarmapi "github.com/docker/swarmkit/api"
  53. "github.com/moby/buildkit/session"
  54. "github.com/pkg/errors"
  55. "github.com/sirupsen/logrus"
  56. "github.com/spf13/pflag"
  57. )
  58. // DaemonCli represents the daemon CLI.
  59. type DaemonCli struct {
  60. *config.Config
  61. configFile *string
  62. flags *pflag.FlagSet
  63. api *apiserver.Server
  64. d *daemon.Daemon
  65. authzMiddleware *authorization.Middleware // authzMiddleware enables to dynamically reload the authorization plugins
  66. }
  67. // NewDaemonCli returns a daemon CLI
  68. func NewDaemonCli() *DaemonCli {
  69. return &DaemonCli{}
  70. }
  71. func (cli *DaemonCli) start(opts *daemonOptions) (err error) {
  72. stopc := make(chan bool)
  73. defer close(stopc)
  74. // warn from uuid package when running the daemon
  75. uuid.Loggerf = logrus.Warnf
  76. opts.SetDefaultOptions(opts.flags)
  77. if cli.Config, err = loadDaemonCliConfig(opts); err != nil {
  78. return err
  79. }
  80. if err := configureDaemonLogs(cli.Config); err != nil {
  81. return err
  82. }
  83. cli.configFile = &opts.configFile
  84. cli.flags = opts.flags
  85. if cli.Config.Debug {
  86. debug.Enable()
  87. }
  88. if cli.Config.Experimental {
  89. logrus.Warn("Running experimental build")
  90. if cli.Config.IsRootless() {
  91. logrus.Warn("Running in rootless mode. Cgroups, AppArmor, and CRIU are disabled.")
  92. }
  93. if rootless.RunningWithRootlessKit() {
  94. logrus.Info("Running with RootlessKit integration")
  95. if !cli.Config.IsRootless() {
  96. return fmt.Errorf("rootless mode needs to be enabled for running with RootlessKit")
  97. }
  98. }
  99. } else {
  100. if cli.Config.IsRootless() {
  101. return fmt.Errorf("rootless mode is supported only when running in experimental mode")
  102. }
  103. }
  104. // return human-friendly error before creating files
  105. if runtime.GOOS == "linux" && os.Geteuid() != 0 {
  106. return fmt.Errorf("dockerd needs to be started with root. To see how to run dockerd in rootless mode with unprivileged user, see the documentation")
  107. }
  108. system.InitLCOW(cli.Config.Experimental)
  109. if err := setDefaultUmask(); err != nil {
  110. return err
  111. }
  112. // Create the daemon root before we create ANY other files (PID, or migrate keys)
  113. // to ensure the appropriate ACL is set (particularly relevant on Windows)
  114. if err := daemon.CreateDaemonRoot(cli.Config); err != nil {
  115. return err
  116. }
  117. if err := system.MkdirAll(cli.Config.ExecRoot, 0700, ""); err != nil {
  118. return err
  119. }
  120. potentiallyUnderRuntimeDir := []string{cli.Config.ExecRoot}
  121. if cli.Pidfile != "" {
  122. pf, err := pidfile.New(cli.Pidfile)
  123. if err != nil {
  124. return errors.Wrap(err, "failed to start daemon")
  125. }
  126. potentiallyUnderRuntimeDir = append(potentiallyUnderRuntimeDir, cli.Pidfile)
  127. defer func() {
  128. if err := pf.Remove(); err != nil {
  129. logrus.Error(err)
  130. }
  131. }()
  132. }
  133. if cli.Config.IsRootless() {
  134. // Set sticky bit if XDG_RUNTIME_DIR is set && the file is actually under XDG_RUNTIME_DIR
  135. if _, err := homedir.StickRuntimeDirContents(potentiallyUnderRuntimeDir); err != nil {
  136. // StickRuntimeDirContents returns nil error if XDG_RUNTIME_DIR is just unset
  137. logrus.WithError(err).Warn("cannot set sticky bit on files under XDG_RUNTIME_DIR")
  138. }
  139. }
  140. serverConfig, err := newAPIServerConfig(cli)
  141. if err != nil {
  142. return errors.Wrap(err, "failed to create API server")
  143. }
  144. cli.api = apiserver.New(serverConfig)
  145. hosts, err := loadListeners(cli, serverConfig)
  146. if err != nil {
  147. return errors.Wrap(err, "failed to load listeners")
  148. }
  149. ctx, cancel := context.WithCancel(context.Background())
  150. waitForContainerDShutdown, err := cli.initContainerD(ctx)
  151. if waitForContainerDShutdown != nil {
  152. defer waitForContainerDShutdown(10 * time.Second)
  153. }
  154. if err != nil {
  155. cancel()
  156. return err
  157. }
  158. defer cancel()
  159. signal.Trap(func() {
  160. cli.stop()
  161. <-stopc // wait for daemonCli.start() to return
  162. }, logrus.StandardLogger())
  163. // Notify that the API is active, but before daemon is set up.
  164. preNotifySystem()
  165. pluginStore := plugin.NewStore()
  166. if err := cli.initMiddlewares(cli.api, serverConfig, pluginStore); err != nil {
  167. logrus.Fatalf("Error creating middlewares: %v", err)
  168. }
  169. d, err := daemon.NewDaemon(ctx, cli.Config, pluginStore)
  170. if err != nil {
  171. return errors.Wrap(err, "failed to start daemon")
  172. }
  173. d.StoreHosts(hosts)
  174. // validate after NewDaemon has restored enabled plugins. Don't change order.
  175. if err := validateAuthzPlugins(cli.Config.AuthorizationPlugins, pluginStore); err != nil {
  176. return errors.Wrap(err, "failed to validate authorization plugin")
  177. }
  178. // TODO: move into startMetricsServer()
  179. if cli.Config.MetricsAddress != "" {
  180. if !d.HasExperimental() {
  181. return errors.Wrap(err, "metrics-addr is only supported when experimental is enabled")
  182. }
  183. if err := startMetricsServer(cli.Config.MetricsAddress); err != nil {
  184. return err
  185. }
  186. }
  187. c, err := createAndStartCluster(cli, d)
  188. if err != nil {
  189. logrus.Fatalf("Error starting cluster component: %v", err)
  190. }
  191. // Restart all autostart containers which has a swarm endpoint
  192. // and is not yet running now that we have successfully
  193. // initialized the cluster.
  194. d.RestartSwarmContainers()
  195. logrus.Info("Daemon has completed initialization")
  196. cli.d = d
  197. routerOptions, err := newRouterOptions(cli.Config, d)
  198. if err != nil {
  199. return err
  200. }
  201. routerOptions.api = cli.api
  202. routerOptions.cluster = c
  203. initRouter(routerOptions)
  204. go d.ProcessClusterNotifications(ctx, c.GetWatchStream())
  205. cli.setupConfigReloadTrap()
  206. // The serve API routine never exits unless an error occurs
  207. // We need to start it as a goroutine and wait on it so
  208. // daemon doesn't exit
  209. serveAPIWait := make(chan error)
  210. go cli.api.Wait(serveAPIWait)
  211. // after the daemon is done setting up we can notify systemd api
  212. notifySystem()
  213. // Daemon is fully initialized and handling API traffic
  214. // Wait for serve API to complete
  215. errAPI := <-serveAPIWait
  216. c.Cleanup()
  217. shutdownDaemon(d)
  218. // Stop notification processing and any background processes
  219. cancel()
  220. if errAPI != nil {
  221. return errors.Wrap(errAPI, "shutting down due to ServeAPI error")
  222. }
  223. return nil
  224. }
  225. type routerOptions struct {
  226. sessionManager *session.Manager
  227. buildBackend *buildbackend.Backend
  228. buildCache *fscache.FSCache // legacy
  229. features *map[string]bool
  230. buildkit *buildkit.Builder
  231. daemon *daemon.Daemon
  232. api *apiserver.Server
  233. cluster *cluster.Cluster
  234. }
  235. func newRouterOptions(config *config.Config, d *daemon.Daemon) (routerOptions, error) {
  236. opts := routerOptions{}
  237. sm, err := session.NewManager()
  238. if err != nil {
  239. return opts, errors.Wrap(err, "failed to create sessionmanager")
  240. }
  241. builderStateDir := filepath.Join(config.Root, "builder")
  242. buildCache, err := fscache.NewFSCache(fscache.Opt{
  243. Backend: fscache.NewNaiveCacheBackend(builderStateDir),
  244. Root: builderStateDir,
  245. GCPolicy: fscache.GCPolicy{ // TODO: expose this in config
  246. MaxSize: 1024 * 1024 * 512, // 512MB
  247. MaxKeepDuration: 7 * 24 * time.Hour, // 1 week
  248. },
  249. })
  250. if err != nil {
  251. return opts, errors.Wrap(err, "failed to create fscache")
  252. }
  253. manager, err := dockerfile.NewBuildManager(d.BuilderBackend(), sm, buildCache, d.IdentityMapping())
  254. if err != nil {
  255. return opts, err
  256. }
  257. cgroupParent := newCgroupParent(config)
  258. bk, err := buildkit.New(buildkit.Opt{
  259. SessionManager: sm,
  260. Root: filepath.Join(config.Root, "buildkit"),
  261. Dist: d.DistributionServices(),
  262. NetworkController: d.NetworkController(),
  263. DefaultCgroupParent: cgroupParent,
  264. ResolverOpt: d.NewResolveOptionsFunc(),
  265. BuilderConfig: config.Builder,
  266. Rootless: d.Rootless(),
  267. })
  268. if err != nil {
  269. return opts, err
  270. }
  271. bb, err := buildbackend.NewBackend(d.ImageService(), manager, buildCache, bk)
  272. if err != nil {
  273. return opts, errors.Wrap(err, "failed to create buildmanager")
  274. }
  275. return routerOptions{
  276. sessionManager: sm,
  277. buildBackend: bb,
  278. buildCache: buildCache,
  279. buildkit: bk,
  280. features: d.Features(),
  281. daemon: d,
  282. }, nil
  283. }
  284. func (cli *DaemonCli) reloadConfig() {
  285. reload := func(c *config.Config) {
  286. // Revalidate and reload the authorization plugins
  287. if err := validateAuthzPlugins(c.AuthorizationPlugins, cli.d.PluginStore); err != nil {
  288. logrus.Fatalf("Error validating authorization plugin: %v", err)
  289. return
  290. }
  291. cli.authzMiddleware.SetPlugins(c.AuthorizationPlugins)
  292. // The namespaces com.docker.*, io.docker.*, org.dockerproject.* have been documented
  293. // to be reserved for Docker's internal use, but this was never enforced. Allowing
  294. // configured labels to use these namespaces are deprecated for 18.05.
  295. //
  296. // The following will check the usage of such labels, and report a warning for deprecation.
  297. //
  298. // TODO: At the next stable release, the validation should be folded into the other
  299. // configuration validation functions and an error will be returned instead, and this
  300. // block should be deleted.
  301. if err := config.ValidateReservedNamespaceLabels(c.Labels); err != nil {
  302. logrus.Warnf("Configured labels using reserved namespaces is deprecated: %s", err)
  303. }
  304. if err := cli.d.Reload(c); err != nil {
  305. logrus.Errorf("Error reconfiguring the daemon: %v", err)
  306. return
  307. }
  308. if c.IsValueSet("debug") {
  309. debugEnabled := debug.IsEnabled()
  310. switch {
  311. case debugEnabled && !c.Debug: // disable debug
  312. debug.Disable()
  313. case c.Debug && !debugEnabled: // enable debug
  314. debug.Enable()
  315. }
  316. }
  317. }
  318. if err := config.Reload(*cli.configFile, cli.flags, reload); err != nil {
  319. logrus.Error(err)
  320. }
  321. }
  322. func (cli *DaemonCli) stop() {
  323. cli.api.Close()
  324. }
  325. // shutdownDaemon just wraps daemon.Shutdown() to handle a timeout in case
  326. // d.Shutdown() is waiting too long to kill container or worst it's
  327. // blocked there
  328. func shutdownDaemon(d *daemon.Daemon) {
  329. shutdownTimeout := d.ShutdownTimeout()
  330. ch := make(chan struct{})
  331. go func() {
  332. d.Shutdown()
  333. close(ch)
  334. }()
  335. if shutdownTimeout < 0 {
  336. <-ch
  337. logrus.Debug("Clean shutdown succeeded")
  338. return
  339. }
  340. select {
  341. case <-ch:
  342. logrus.Debug("Clean shutdown succeeded")
  343. case <-time.After(time.Duration(shutdownTimeout) * time.Second):
  344. logrus.Error("Force shutdown daemon")
  345. }
  346. }
  347. func loadDaemonCliConfig(opts *daemonOptions) (*config.Config, error) {
  348. conf := opts.daemonConfig
  349. flags := opts.flags
  350. conf.Debug = opts.Debug
  351. conf.Hosts = opts.Hosts
  352. conf.LogLevel = opts.LogLevel
  353. conf.TLS = opts.TLS
  354. conf.TLSVerify = opts.TLSVerify
  355. conf.CommonTLSOptions = config.CommonTLSOptions{}
  356. if opts.TLSOptions != nil {
  357. conf.CommonTLSOptions.CAFile = opts.TLSOptions.CAFile
  358. conf.CommonTLSOptions.CertFile = opts.TLSOptions.CertFile
  359. conf.CommonTLSOptions.KeyFile = opts.TLSOptions.KeyFile
  360. }
  361. if flags.Changed("graph") && flags.Changed("data-root") {
  362. return nil, errors.New(`cannot specify both "--graph" and "--data-root" option`)
  363. }
  364. if opts.configFile != "" {
  365. c, err := config.MergeDaemonConfigurations(conf, flags, opts.configFile)
  366. if err != nil {
  367. if flags.Changed("config-file") || !os.IsNotExist(err) {
  368. return nil, errors.Wrapf(err, "unable to configure the Docker daemon with file %s", opts.configFile)
  369. }
  370. }
  371. // the merged configuration can be nil if the config file didn't exist.
  372. // leave the current configuration as it is if when that happens.
  373. if c != nil {
  374. conf = c
  375. }
  376. }
  377. if err := config.Validate(conf); err != nil {
  378. return nil, err
  379. }
  380. if flags.Changed("graph") {
  381. logrus.Warnf(`The "-g / --graph" flag is deprecated. Please use "--data-root" instead`)
  382. }
  383. // Check if duplicate label-keys with different values are found
  384. newLabels, err := config.GetConflictFreeLabels(conf.Labels)
  385. if err != nil {
  386. return nil, err
  387. }
  388. // The namespaces com.docker.*, io.docker.*, org.dockerproject.* have been documented
  389. // to be reserved for Docker's internal use, but this was never enforced. Allowing
  390. // configured labels to use these namespaces are deprecated for 18.05.
  391. //
  392. // The following will check the usage of such labels, and report a warning for deprecation.
  393. //
  394. // TODO: At the next stable release, the validation should be folded into the other
  395. // configuration validation functions and an error will be returned instead, and this
  396. // block should be deleted.
  397. if err := config.ValidateReservedNamespaceLabels(newLabels); err != nil {
  398. logrus.Warnf("Configured labels using reserved namespaces is deprecated: %s", err)
  399. }
  400. conf.Labels = newLabels
  401. // Regardless of whether the user sets it to true or false, if they
  402. // specify TLSVerify at all then we need to turn on TLS
  403. if conf.IsValueSet(FlagTLSVerify) {
  404. conf.TLS = true
  405. }
  406. return conf, nil
  407. }
  408. func initRouter(opts routerOptions) {
  409. decoder := runconfig.ContainerDecoder{}
  410. routers := []router.Router{
  411. // we need to add the checkpoint router before the container router or the DELETE gets masked
  412. checkpointrouter.NewRouter(opts.daemon, decoder),
  413. container.NewRouter(opts.daemon, decoder),
  414. image.NewRouter(opts.daemon.ImageService()),
  415. systemrouter.NewRouter(opts.daemon, opts.cluster, opts.buildCache, opts.buildkit, opts.features),
  416. volume.NewRouter(opts.daemon.VolumesService()),
  417. build.NewRouter(opts.buildBackend, opts.daemon, opts.features),
  418. sessionrouter.NewRouter(opts.sessionManager),
  419. swarmrouter.NewRouter(opts.cluster),
  420. pluginrouter.NewRouter(opts.daemon.PluginManager()),
  421. distributionrouter.NewRouter(opts.daemon.ImageService()),
  422. }
  423. grpcBackends := []grpcrouter.Backend{}
  424. for _, b := range []interface{}{opts.daemon, opts.buildBackend} {
  425. if b, ok := b.(grpcrouter.Backend); ok {
  426. grpcBackends = append(grpcBackends, b)
  427. }
  428. }
  429. if len(grpcBackends) > 0 {
  430. routers = append(routers, grpcrouter.NewRouter(grpcBackends...))
  431. }
  432. if opts.daemon.NetworkControllerEnabled() {
  433. routers = append(routers, network.NewRouter(opts.daemon, opts.cluster))
  434. }
  435. if opts.daemon.HasExperimental() {
  436. for _, r := range routers {
  437. for _, route := range r.Routes() {
  438. if experimental, ok := route.(router.ExperimentalRoute); ok {
  439. experimental.Enable()
  440. }
  441. }
  442. }
  443. }
  444. opts.api.InitRouter(routers...)
  445. }
  446. // TODO: remove this from cli and return the authzMiddleware
  447. func (cli *DaemonCli) initMiddlewares(s *apiserver.Server, cfg *apiserver.Config, pluginStore plugingetter.PluginGetter) error {
  448. v := cfg.Version
  449. exp := middleware.NewExperimentalMiddleware(cli.Config.Experimental)
  450. s.UseMiddleware(exp)
  451. vm := middleware.NewVersionMiddleware(v, api.DefaultVersion, api.MinVersion)
  452. s.UseMiddleware(vm)
  453. if cfg.CorsHeaders != "" {
  454. c := middleware.NewCORSMiddleware(cfg.CorsHeaders)
  455. s.UseMiddleware(c)
  456. }
  457. cli.authzMiddleware = authorization.NewMiddleware(cli.Config.AuthorizationPlugins, pluginStore)
  458. cli.Config.AuthzMiddleware = cli.authzMiddleware
  459. s.UseMiddleware(cli.authzMiddleware)
  460. return nil
  461. }
  462. func (cli *DaemonCli) getContainerdDaemonOpts() ([]supervisor.DaemonOpt, error) {
  463. opts, err := cli.getPlatformContainerdDaemonOpts()
  464. if err != nil {
  465. return nil, err
  466. }
  467. if cli.Config.Debug {
  468. opts = append(opts, supervisor.WithLogLevel("debug"))
  469. } else if cli.Config.LogLevel != "" {
  470. opts = append(opts, supervisor.WithLogLevel(cli.Config.LogLevel))
  471. }
  472. if !cli.Config.CriContainerd {
  473. opts = append(opts, supervisor.WithPlugin("cri", nil))
  474. }
  475. return opts, nil
  476. }
  477. func newAPIServerConfig(cli *DaemonCli) (*apiserver.Config, error) {
  478. serverConfig := &apiserver.Config{
  479. Logging: true,
  480. SocketGroup: cli.Config.SocketGroup,
  481. Version: dockerversion.Version,
  482. CorsHeaders: cli.Config.CorsHeaders,
  483. }
  484. if cli.Config.TLS {
  485. tlsOptions := tlsconfig.Options{
  486. CAFile: cli.Config.CommonTLSOptions.CAFile,
  487. CertFile: cli.Config.CommonTLSOptions.CertFile,
  488. KeyFile: cli.Config.CommonTLSOptions.KeyFile,
  489. ExclusiveRootPools: true,
  490. }
  491. if cli.Config.TLSVerify {
  492. // server requires and verifies client's certificate
  493. tlsOptions.ClientAuth = tls.RequireAndVerifyClientCert
  494. }
  495. tlsConfig, err := tlsconfig.Server(tlsOptions)
  496. if err != nil {
  497. return nil, err
  498. }
  499. serverConfig.TLSConfig = tlsConfig
  500. }
  501. if len(cli.Config.Hosts) == 0 {
  502. cli.Config.Hosts = make([]string, 1)
  503. }
  504. return serverConfig, nil
  505. }
  506. func loadListeners(cli *DaemonCli, serverConfig *apiserver.Config) ([]string, error) {
  507. var hosts []string
  508. for i := 0; i < len(cli.Config.Hosts); i++ {
  509. var err error
  510. if cli.Config.Hosts[i], err = dopts.ParseHost(cli.Config.TLS, honorXDG, cli.Config.Hosts[i]); err != nil {
  511. return nil, errors.Wrapf(err, "error parsing -H %s", cli.Config.Hosts[i])
  512. }
  513. protoAddr := cli.Config.Hosts[i]
  514. protoAddrParts := strings.SplitN(protoAddr, "://", 2)
  515. if len(protoAddrParts) != 2 {
  516. return nil, fmt.Errorf("bad format %s, expected PROTO://ADDR", protoAddr)
  517. }
  518. proto := protoAddrParts[0]
  519. addr := protoAddrParts[1]
  520. // It's a bad idea to bind to TCP without tlsverify.
  521. if proto == "tcp" && (serverConfig.TLSConfig == nil || serverConfig.TLSConfig.ClientAuth != tls.RequireAndVerifyClientCert) {
  522. logrus.Warn("[!] DON'T BIND ON ANY IP ADDRESS WITHOUT setting --tlsverify IF YOU DON'T KNOW WHAT YOU'RE DOING [!]")
  523. }
  524. ls, err := listeners.Init(proto, addr, serverConfig.SocketGroup, serverConfig.TLSConfig)
  525. if err != nil {
  526. return nil, err
  527. }
  528. ls = wrapListeners(proto, ls)
  529. // If we're binding to a TCP port, make sure that a container doesn't try to use it.
  530. if proto == "tcp" {
  531. if err := allocateDaemonPort(addr); err != nil {
  532. return nil, err
  533. }
  534. }
  535. logrus.Debugf("Listener created for HTTP on %s (%s)", proto, addr)
  536. hosts = append(hosts, protoAddrParts[1])
  537. cli.api.Accept(addr, ls...)
  538. }
  539. return hosts, nil
  540. }
  541. func createAndStartCluster(cli *DaemonCli, d *daemon.Daemon) (*cluster.Cluster, error) {
  542. name, _ := os.Hostname()
  543. // Use a buffered channel to pass changes from store watch API to daemon
  544. // A buffer allows store watch API and daemon processing to not wait for each other
  545. watchStream := make(chan *swarmapi.WatchMessage, 32)
  546. c, err := cluster.New(cluster.Config{
  547. Root: cli.Config.Root,
  548. Name: name,
  549. Backend: d,
  550. VolumeBackend: d.VolumesService(),
  551. ImageBackend: d.ImageService(),
  552. PluginBackend: d.PluginManager(),
  553. NetworkSubnetsProvider: d,
  554. DefaultAdvertiseAddr: cli.Config.SwarmDefaultAdvertiseAddr,
  555. RaftHeartbeatTick: cli.Config.SwarmRaftHeartbeatTick,
  556. RaftElectionTick: cli.Config.SwarmRaftElectionTick,
  557. RuntimeRoot: cli.getSwarmRunRoot(),
  558. WatchStream: watchStream,
  559. })
  560. if err != nil {
  561. return nil, err
  562. }
  563. d.SetCluster(c)
  564. err = c.Start()
  565. return c, err
  566. }
  567. // validates that the plugins requested with the --authorization-plugin flag are valid AuthzDriver
  568. // plugins present on the host and available to the daemon
  569. func validateAuthzPlugins(requestedPlugins []string, pg plugingetter.PluginGetter) error {
  570. for _, reqPlugin := range requestedPlugins {
  571. if _, err := pg.Get(reqPlugin, authorization.AuthZApiImplements, plugingetter.Lookup); err != nil {
  572. return err
  573. }
  574. }
  575. return nil
  576. }
  577. func systemContainerdRunning(honorXDG bool) (string, bool, error) {
  578. addr := containerddefaults.DefaultAddress
  579. if honorXDG {
  580. runtimeDir, err := homedir.GetRuntimeDir()
  581. if err != nil {
  582. return "", false, err
  583. }
  584. addr = filepath.Join(runtimeDir, "containerd", "containerd.sock")
  585. }
  586. _, err := os.Lstat(addr)
  587. return addr, err == nil, nil
  588. }
  589. // configureDaemonLogs sets the logrus logging level and formatting
  590. func configureDaemonLogs(conf *config.Config) error {
  591. if conf.LogLevel != "" {
  592. lvl, err := logrus.ParseLevel(conf.LogLevel)
  593. if err != nil {
  594. return fmt.Errorf("unable to parse logging level: %s", conf.LogLevel)
  595. }
  596. logrus.SetLevel(lvl)
  597. } else {
  598. logrus.SetLevel(logrus.InfoLevel)
  599. }
  600. logrus.SetFormatter(&logrus.TextFormatter{
  601. TimestampFormat: jsonmessage.RFC3339NanoFixed,
  602. DisableColors: conf.RawLogs,
  603. FullTimestamp: true,
  604. })
  605. return nil
  606. }