daemon_unix.go 40 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968969970971972973974975976977978979980981982983984985986987988989990991992993994995996997998999100010011002100310041005100610071008100910101011101210131014101510161017101810191020102110221023102410251026102710281029103010311032103310341035103610371038103910401041104210431044104510461047104810491050105110521053105410551056105710581059106010611062106310641065106610671068106910701071107210731074107510761077107810791080108110821083108410851086108710881089109010911092109310941095109610971098109911001101110211031104110511061107110811091110
  1. // +build linux freebsd
  2. package daemon
  3. import (
  4. "fmt"
  5. "io/ioutil"
  6. "net"
  7. "os"
  8. "path/filepath"
  9. "runtime"
  10. "runtime/debug"
  11. "strconv"
  12. "strings"
  13. "syscall"
  14. "time"
  15. "github.com/Sirupsen/logrus"
  16. "github.com/docker/docker/container"
  17. "github.com/docker/docker/image"
  18. "github.com/docker/docker/layer"
  19. "github.com/docker/docker/pkg/idtools"
  20. "github.com/docker/docker/pkg/parsers"
  21. "github.com/docker/docker/pkg/parsers/kernel"
  22. "github.com/docker/docker/pkg/sysinfo"
  23. "github.com/docker/docker/reference"
  24. "github.com/docker/docker/runconfig"
  25. runconfigopts "github.com/docker/docker/runconfig/opts"
  26. "github.com/docker/engine-api/types"
  27. pblkiodev "github.com/docker/engine-api/types/blkiodev"
  28. containertypes "github.com/docker/engine-api/types/container"
  29. "github.com/docker/libnetwork"
  30. nwconfig "github.com/docker/libnetwork/config"
  31. "github.com/docker/libnetwork/drivers/bridge"
  32. "github.com/docker/libnetwork/ipamutils"
  33. "github.com/docker/libnetwork/netlabel"
  34. "github.com/docker/libnetwork/options"
  35. lntypes "github.com/docker/libnetwork/types"
  36. "github.com/opencontainers/runc/libcontainer/label"
  37. "github.com/opencontainers/runc/libcontainer/user"
  38. "github.com/opencontainers/specs/specs-go"
  39. )
  40. const (
  41. // See https://git.kernel.org/cgit/linux/kernel/git/tip/tip.git/tree/kernel/sched/sched.h?id=8cd9234c64c584432f6992fe944ca9e46ca8ea76#n269
  42. linuxMinCPUShares = 2
  43. linuxMaxCPUShares = 262144
  44. platformSupported = true
  45. // It's not kernel limit, we want this 4M limit to supply a reasonable functional container
  46. linuxMinMemory = 4194304
  47. // constants for remapped root settings
  48. defaultIDSpecifier string = "default"
  49. defaultRemappedID string = "dockremap"
  50. // constant for cgroup drivers
  51. cgroupFsDriver = "cgroupfs"
  52. cgroupSystemdDriver = "systemd"
  53. )
  54. func getMemoryResources(config containertypes.Resources) *specs.Memory {
  55. memory := specs.Memory{}
  56. if config.Memory > 0 {
  57. limit := uint64(config.Memory)
  58. memory.Limit = &limit
  59. }
  60. if config.MemoryReservation > 0 {
  61. reservation := uint64(config.MemoryReservation)
  62. memory.Reservation = &reservation
  63. }
  64. if config.MemorySwap != 0 {
  65. swap := uint64(config.MemorySwap)
  66. memory.Swap = &swap
  67. }
  68. if config.MemorySwappiness != nil {
  69. swappiness := uint64(*config.MemorySwappiness)
  70. memory.Swappiness = &swappiness
  71. }
  72. if config.KernelMemory != 0 {
  73. kernelMemory := uint64(config.KernelMemory)
  74. memory.Kernel = &kernelMemory
  75. }
  76. return &memory
  77. }
  78. func getCPUResources(config containertypes.Resources) *specs.CPU {
  79. cpu := specs.CPU{}
  80. if config.CPUShares != 0 {
  81. shares := uint64(config.CPUShares)
  82. cpu.Shares = &shares
  83. }
  84. if config.CpusetCpus != "" {
  85. cpuset := config.CpusetCpus
  86. cpu.Cpus = &cpuset
  87. }
  88. if config.CpusetMems != "" {
  89. cpuset := config.CpusetMems
  90. cpu.Mems = &cpuset
  91. }
  92. if config.CPUPeriod != 0 {
  93. period := uint64(config.CPUPeriod)
  94. cpu.Period = &period
  95. }
  96. if config.CPUQuota != 0 {
  97. quota := uint64(config.CPUQuota)
  98. cpu.Quota = &quota
  99. }
  100. return &cpu
  101. }
  102. func getBlkioWeightDevices(config containertypes.Resources) ([]specs.WeightDevice, error) {
  103. var stat syscall.Stat_t
  104. var blkioWeightDevices []specs.WeightDevice
  105. for _, weightDevice := range config.BlkioWeightDevice {
  106. if err := syscall.Stat(weightDevice.Path, &stat); err != nil {
  107. return nil, err
  108. }
  109. weight := weightDevice.Weight
  110. d := specs.WeightDevice{Weight: &weight}
  111. d.Major = int64(stat.Rdev / 256)
  112. d.Minor = int64(stat.Rdev % 256)
  113. blkioWeightDevices = append(blkioWeightDevices, d)
  114. }
  115. return blkioWeightDevices, nil
  116. }
  117. func parseSecurityOpt(container *container.Container, config *containertypes.HostConfig) error {
  118. var (
  119. labelOpts []string
  120. err error
  121. )
  122. for _, opt := range config.SecurityOpt {
  123. if opt == "no-new-privileges" {
  124. container.NoNewPrivileges = true
  125. } else {
  126. var con []string
  127. if strings.Contains(opt, "=") {
  128. con = strings.SplitN(opt, "=", 2)
  129. } else if strings.Contains(opt, ":") {
  130. con = strings.SplitN(opt, ":", 2)
  131. logrus.Warnf("Security options with `:` as a separator are deprecated and will be completely unsupported in 1.13, use `=` instead.")
  132. }
  133. if len(con) != 2 {
  134. return fmt.Errorf("Invalid --security-opt 1: %q", opt)
  135. }
  136. switch con[0] {
  137. case "label":
  138. labelOpts = append(labelOpts, con[1])
  139. case "apparmor":
  140. container.AppArmorProfile = con[1]
  141. case "seccomp":
  142. container.SeccompProfile = con[1]
  143. default:
  144. return fmt.Errorf("Invalid --security-opt 2: %q", opt)
  145. }
  146. }
  147. }
  148. container.ProcessLabel, container.MountLabel, err = label.InitLabels(labelOpts)
  149. return err
  150. }
  151. func getBlkioReadIOpsDevices(config containertypes.Resources) ([]specs.ThrottleDevice, error) {
  152. var blkioReadIOpsDevice []specs.ThrottleDevice
  153. var stat syscall.Stat_t
  154. for _, iopsDevice := range config.BlkioDeviceReadIOps {
  155. if err := syscall.Stat(iopsDevice.Path, &stat); err != nil {
  156. return nil, err
  157. }
  158. rate := iopsDevice.Rate
  159. d := specs.ThrottleDevice{Rate: &rate}
  160. d.Major = int64(stat.Rdev / 256)
  161. d.Minor = int64(stat.Rdev % 256)
  162. blkioReadIOpsDevice = append(blkioReadIOpsDevice, d)
  163. }
  164. return blkioReadIOpsDevice, nil
  165. }
  166. func getBlkioWriteIOpsDevices(config containertypes.Resources) ([]specs.ThrottleDevice, error) {
  167. var blkioWriteIOpsDevice []specs.ThrottleDevice
  168. var stat syscall.Stat_t
  169. for _, iopsDevice := range config.BlkioDeviceWriteIOps {
  170. if err := syscall.Stat(iopsDevice.Path, &stat); err != nil {
  171. return nil, err
  172. }
  173. rate := iopsDevice.Rate
  174. d := specs.ThrottleDevice{Rate: &rate}
  175. d.Major = int64(stat.Rdev / 256)
  176. d.Minor = int64(stat.Rdev % 256)
  177. blkioWriteIOpsDevice = append(blkioWriteIOpsDevice, d)
  178. }
  179. return blkioWriteIOpsDevice, nil
  180. }
  181. func getBlkioReadBpsDevices(config containertypes.Resources) ([]specs.ThrottleDevice, error) {
  182. var blkioReadBpsDevice []specs.ThrottleDevice
  183. var stat syscall.Stat_t
  184. for _, bpsDevice := range config.BlkioDeviceReadBps {
  185. if err := syscall.Stat(bpsDevice.Path, &stat); err != nil {
  186. return nil, err
  187. }
  188. rate := bpsDevice.Rate
  189. d := specs.ThrottleDevice{Rate: &rate}
  190. d.Major = int64(stat.Rdev / 256)
  191. d.Minor = int64(stat.Rdev % 256)
  192. blkioReadBpsDevice = append(blkioReadBpsDevice, d)
  193. }
  194. return blkioReadBpsDevice, nil
  195. }
  196. func getBlkioWriteBpsDevices(config containertypes.Resources) ([]specs.ThrottleDevice, error) {
  197. var blkioWriteBpsDevice []specs.ThrottleDevice
  198. var stat syscall.Stat_t
  199. for _, bpsDevice := range config.BlkioDeviceWriteBps {
  200. if err := syscall.Stat(bpsDevice.Path, &stat); err != nil {
  201. return nil, err
  202. }
  203. rate := bpsDevice.Rate
  204. d := specs.ThrottleDevice{Rate: &rate}
  205. d.Major = int64(stat.Rdev / 256)
  206. d.Minor = int64(stat.Rdev % 256)
  207. blkioWriteBpsDevice = append(blkioWriteBpsDevice, d)
  208. }
  209. return blkioWriteBpsDevice, nil
  210. }
  211. func checkKernelVersion(k, major, minor int) bool {
  212. if v, err := kernel.GetKernelVersion(); err != nil {
  213. logrus.Warnf("%s", err)
  214. } else {
  215. if kernel.CompareKernelVersion(*v, kernel.VersionInfo{Kernel: k, Major: major, Minor: minor}) < 0 {
  216. return false
  217. }
  218. }
  219. return true
  220. }
  221. func checkKernel() error {
  222. // Check for unsupported kernel versions
  223. // FIXME: it would be cleaner to not test for specific versions, but rather
  224. // test for specific functionalities.
  225. // Unfortunately we can't test for the feature "does not cause a kernel panic"
  226. // without actually causing a kernel panic, so we need this workaround until
  227. // the circumstances of pre-3.10 crashes are clearer.
  228. // For details see https://github.com/docker/docker/issues/407
  229. if !checkKernelVersion(3, 10, 0) {
  230. v, _ := kernel.GetKernelVersion()
  231. if os.Getenv("DOCKER_NOWARN_KERNEL_VERSION") == "" {
  232. logrus.Warnf("Your Linux kernel version %s can be unstable running docker. Please upgrade your kernel to 3.10.0.", v.String())
  233. }
  234. }
  235. return nil
  236. }
  237. // adaptContainerSettings is called during container creation to modify any
  238. // settings necessary in the HostConfig structure.
  239. func (daemon *Daemon) adaptContainerSettings(hostConfig *containertypes.HostConfig, adjustCPUShares bool) error {
  240. if adjustCPUShares && hostConfig.CPUShares > 0 {
  241. // Handle unsupported CPUShares
  242. if hostConfig.CPUShares < linuxMinCPUShares {
  243. logrus.Warnf("Changing requested CPUShares of %d to minimum allowed of %d", hostConfig.CPUShares, linuxMinCPUShares)
  244. hostConfig.CPUShares = linuxMinCPUShares
  245. } else if hostConfig.CPUShares > linuxMaxCPUShares {
  246. logrus.Warnf("Changing requested CPUShares of %d to maximum allowed of %d", hostConfig.CPUShares, linuxMaxCPUShares)
  247. hostConfig.CPUShares = linuxMaxCPUShares
  248. }
  249. }
  250. if hostConfig.Memory > 0 && hostConfig.MemorySwap == 0 {
  251. // By default, MemorySwap is set to twice the size of Memory.
  252. hostConfig.MemorySwap = hostConfig.Memory * 2
  253. }
  254. if hostConfig.ShmSize == 0 {
  255. hostConfig.ShmSize = container.DefaultSHMSize
  256. }
  257. var err error
  258. if hostConfig.SecurityOpt == nil {
  259. hostConfig.SecurityOpt, err = daemon.generateSecurityOpt(hostConfig.IpcMode, hostConfig.PidMode)
  260. if err != nil {
  261. return err
  262. }
  263. }
  264. if hostConfig.MemorySwappiness == nil {
  265. defaultSwappiness := int64(-1)
  266. hostConfig.MemorySwappiness = &defaultSwappiness
  267. }
  268. if hostConfig.OomKillDisable == nil {
  269. defaultOomKillDisable := false
  270. hostConfig.OomKillDisable = &defaultOomKillDisable
  271. }
  272. return nil
  273. }
  274. func verifyContainerResources(resources *containertypes.Resources, sysInfo *sysinfo.SysInfo, update bool) ([]string, error) {
  275. warnings := []string{}
  276. // memory subsystem checks and adjustments
  277. if resources.Memory != 0 && resources.Memory < linuxMinMemory {
  278. return warnings, fmt.Errorf("Minimum memory limit allowed is 4MB")
  279. }
  280. if resources.Memory > 0 && !sysInfo.MemoryLimit {
  281. warnings = append(warnings, "Your kernel does not support memory limit capabilities. Limitation discarded.")
  282. logrus.Warnf("Your kernel does not support memory limit capabilities. Limitation discarded.")
  283. resources.Memory = 0
  284. resources.MemorySwap = -1
  285. }
  286. if resources.Memory > 0 && resources.MemorySwap != -1 && !sysInfo.SwapLimit {
  287. warnings = append(warnings, "Your kernel does not support swap limit capabilities, memory limited without swap.")
  288. logrus.Warnf("Your kernel does not support swap limit capabilities, memory limited without swap.")
  289. resources.MemorySwap = -1
  290. }
  291. if resources.Memory > 0 && resources.MemorySwap > 0 && resources.MemorySwap < resources.Memory {
  292. return warnings, fmt.Errorf("Minimum memoryswap limit should be larger than memory limit, see usage.")
  293. }
  294. if resources.Memory == 0 && resources.MemorySwap > 0 && !update {
  295. return warnings, fmt.Errorf("You should always set the Memory limit when using Memoryswap limit, see usage.")
  296. }
  297. if resources.MemorySwappiness != nil && *resources.MemorySwappiness != -1 && !sysInfo.MemorySwappiness {
  298. warnings = append(warnings, "Your kernel does not support memory swappiness capabilities, memory swappiness discarded.")
  299. logrus.Warnf("Your kernel does not support memory swappiness capabilities, memory swappiness discarded.")
  300. resources.MemorySwappiness = nil
  301. }
  302. if resources.MemorySwappiness != nil {
  303. swappiness := *resources.MemorySwappiness
  304. if swappiness < -1 || swappiness > 100 {
  305. return warnings, fmt.Errorf("Invalid value: %v, valid memory swappiness range is 0-100.", swappiness)
  306. }
  307. }
  308. if resources.MemoryReservation > 0 && !sysInfo.MemoryReservation {
  309. warnings = append(warnings, "Your kernel does not support memory soft limit capabilities. Limitation discarded.")
  310. logrus.Warnf("Your kernel does not support memory soft limit capabilities. Limitation discarded.")
  311. resources.MemoryReservation = 0
  312. }
  313. if resources.Memory > 0 && resources.MemoryReservation > 0 && resources.Memory < resources.MemoryReservation {
  314. return warnings, fmt.Errorf("Minimum memory limit should be larger than memory reservation limit, see usage.")
  315. }
  316. if resources.KernelMemory > 0 && !sysInfo.KernelMemory {
  317. warnings = append(warnings, "Your kernel does not support kernel memory limit capabilities. Limitation discarded.")
  318. logrus.Warnf("Your kernel does not support kernel memory limit capabilities. Limitation discarded.")
  319. resources.KernelMemory = 0
  320. }
  321. if resources.KernelMemory > 0 && resources.KernelMemory < linuxMinMemory {
  322. return warnings, fmt.Errorf("Minimum kernel memory limit allowed is 4MB")
  323. }
  324. if resources.KernelMemory > 0 && !checkKernelVersion(4, 0, 0) {
  325. warnings = append(warnings, "You specified a kernel memory limit on a kernel older than 4.0. Kernel memory limits are experimental on older kernels, it won't work as expected and can cause your system to be unstable.")
  326. logrus.Warnf("You specified a kernel memory limit on a kernel older than 4.0. Kernel memory limits are experimental on older kernels, it won't work as expected and can cause your system to be unstable.")
  327. }
  328. if resources.OomKillDisable != nil && !sysInfo.OomKillDisable {
  329. // only produce warnings if the setting wasn't to *disable* the OOM Kill; no point
  330. // warning the caller if they already wanted the feature to be off
  331. if *resources.OomKillDisable {
  332. warnings = append(warnings, "Your kernel does not support OomKillDisable, OomKillDisable discarded.")
  333. logrus.Warnf("Your kernel does not support OomKillDisable, OomKillDisable discarded.")
  334. }
  335. resources.OomKillDisable = nil
  336. }
  337. if resources.PidsLimit != 0 && !sysInfo.PidsLimit {
  338. warnings = append(warnings, "Your kernel does not support pids limit capabilities, pids limit discarded.")
  339. logrus.Warnf("Your kernel does not support pids limit capabilities, pids limit discarded.")
  340. resources.PidsLimit = 0
  341. }
  342. // cpu subsystem checks and adjustments
  343. if resources.CPUShares > 0 && !sysInfo.CPUShares {
  344. warnings = append(warnings, "Your kernel does not support CPU shares. Shares discarded.")
  345. logrus.Warnf("Your kernel does not support CPU shares. Shares discarded.")
  346. resources.CPUShares = 0
  347. }
  348. if resources.CPUPeriod > 0 && !sysInfo.CPUCfsPeriod {
  349. warnings = append(warnings, "Your kernel does not support CPU cfs period. Period discarded.")
  350. logrus.Warnf("Your kernel does not support CPU cfs period. Period discarded.")
  351. resources.CPUPeriod = 0
  352. }
  353. if resources.CPUQuota > 0 && !sysInfo.CPUCfsQuota {
  354. warnings = append(warnings, "Your kernel does not support CPU cfs quota. Quota discarded.")
  355. logrus.Warnf("Your kernel does not support CPU cfs quota. Quota discarded.")
  356. resources.CPUQuota = 0
  357. }
  358. // cpuset subsystem checks and adjustments
  359. if (resources.CpusetCpus != "" || resources.CpusetMems != "") && !sysInfo.Cpuset {
  360. warnings = append(warnings, "Your kernel does not support cpuset. Cpuset discarded.")
  361. logrus.Warnf("Your kernel does not support cpuset. Cpuset discarded.")
  362. resources.CpusetCpus = ""
  363. resources.CpusetMems = ""
  364. }
  365. cpusAvailable, err := sysInfo.IsCpusetCpusAvailable(resources.CpusetCpus)
  366. if err != nil {
  367. return warnings, fmt.Errorf("Invalid value %s for cpuset cpus.", resources.CpusetCpus)
  368. }
  369. if !cpusAvailable {
  370. return warnings, fmt.Errorf("Requested CPUs are not available - requested %s, available: %s.", resources.CpusetCpus, sysInfo.Cpus)
  371. }
  372. memsAvailable, err := sysInfo.IsCpusetMemsAvailable(resources.CpusetMems)
  373. if err != nil {
  374. return warnings, fmt.Errorf("Invalid value %s for cpuset mems.", resources.CpusetMems)
  375. }
  376. if !memsAvailable {
  377. return warnings, fmt.Errorf("Requested memory nodes are not available - requested %s, available: %s.", resources.CpusetMems, sysInfo.Mems)
  378. }
  379. // blkio subsystem checks and adjustments
  380. if resources.BlkioWeight > 0 && !sysInfo.BlkioWeight {
  381. warnings = append(warnings, "Your kernel does not support Block I/O weight. Weight discarded.")
  382. logrus.Warnf("Your kernel does not support Block I/O weight. Weight discarded.")
  383. resources.BlkioWeight = 0
  384. }
  385. if resources.BlkioWeight > 0 && (resources.BlkioWeight < 10 || resources.BlkioWeight > 1000) {
  386. return warnings, fmt.Errorf("Range of blkio weight is from 10 to 1000.")
  387. }
  388. if len(resources.BlkioWeightDevice) > 0 && !sysInfo.BlkioWeightDevice {
  389. warnings = append(warnings, "Your kernel does not support Block I/O weight_device.")
  390. logrus.Warnf("Your kernel does not support Block I/O weight_device. Weight-device discarded.")
  391. resources.BlkioWeightDevice = []*pblkiodev.WeightDevice{}
  392. }
  393. if len(resources.BlkioDeviceReadBps) > 0 && !sysInfo.BlkioReadBpsDevice {
  394. warnings = append(warnings, "Your kernel does not support Block read limit in bytes per second.")
  395. logrus.Warnf("Your kernel does not support Block I/O read limit in bytes per second. --device-read-bps discarded.")
  396. resources.BlkioDeviceReadBps = []*pblkiodev.ThrottleDevice{}
  397. }
  398. if len(resources.BlkioDeviceWriteBps) > 0 && !sysInfo.BlkioWriteBpsDevice {
  399. warnings = append(warnings, "Your kernel does not support Block write limit in bytes per second.")
  400. logrus.Warnf("Your kernel does not support Block I/O write limit in bytes per second. --device-write-bps discarded.")
  401. resources.BlkioDeviceWriteBps = []*pblkiodev.ThrottleDevice{}
  402. }
  403. if len(resources.BlkioDeviceReadIOps) > 0 && !sysInfo.BlkioReadIOpsDevice {
  404. warnings = append(warnings, "Your kernel does not support Block read limit in IO per second.")
  405. logrus.Warnf("Your kernel does not support Block I/O read limit in IO per second. -device-read-iops discarded.")
  406. resources.BlkioDeviceReadIOps = []*pblkiodev.ThrottleDevice{}
  407. }
  408. if len(resources.BlkioDeviceWriteIOps) > 0 && !sysInfo.BlkioWriteIOpsDevice {
  409. warnings = append(warnings, "Your kernel does not support Block write limit in IO per second.")
  410. logrus.Warnf("Your kernel does not support Block I/O write limit in IO per second. --device-write-iops discarded.")
  411. resources.BlkioDeviceWriteIOps = []*pblkiodev.ThrottleDevice{}
  412. }
  413. return warnings, nil
  414. }
  415. func (daemon *Daemon) getCgroupDriver() string {
  416. cgroupDriver := cgroupFsDriver
  417. // No other cgroup drivers are supported at the moment. Warn the
  418. // user if they tried to set one other than cgroupfs
  419. for _, option := range daemon.configStore.ExecOptions {
  420. key, val, err := parsers.ParseKeyValueOpt(option)
  421. if err != nil || !strings.EqualFold(key, "native.cgroupdriver") {
  422. continue
  423. }
  424. if val != cgroupFsDriver {
  425. logrus.Warnf("cgroupdriver '%s' is not supported", val)
  426. }
  427. }
  428. return cgroupDriver
  429. }
  430. func usingSystemd(config *Config) bool {
  431. // No support for systemd cgroup atm
  432. return false
  433. }
  434. func (daemon *Daemon) usingSystemd() bool {
  435. return daemon.getCgroupDriver() == cgroupSystemdDriver
  436. }
  437. // verifyPlatformContainerSettings performs platform-specific validation of the
  438. // hostconfig and config structures.
  439. func verifyPlatformContainerSettings(daemon *Daemon, hostConfig *containertypes.HostConfig, config *containertypes.Config, update bool) ([]string, error) {
  440. warnings := []string{}
  441. sysInfo := sysinfo.New(true)
  442. warnings, err := daemon.verifyExperimentalContainerSettings(hostConfig, config)
  443. if err != nil {
  444. return warnings, err
  445. }
  446. w, err := verifyContainerResources(&hostConfig.Resources, sysInfo, update)
  447. if err != nil {
  448. return warnings, err
  449. }
  450. warnings = append(warnings, w...)
  451. if hostConfig.ShmSize < 0 {
  452. return warnings, fmt.Errorf("SHM size must be greater then 0")
  453. }
  454. if hostConfig.OomScoreAdj < -1000 || hostConfig.OomScoreAdj > 1000 {
  455. return warnings, fmt.Errorf("Invalid value %d, range for oom score adj is [-1000, 1000].", hostConfig.OomScoreAdj)
  456. }
  457. if sysInfo.IPv4ForwardingDisabled {
  458. warnings = append(warnings, "IPv4 forwarding is disabled. Networking will not work.")
  459. logrus.Warnf("IPv4 forwarding is disabled. Networking will not work")
  460. }
  461. // check for various conflicting options with user namespaces
  462. if daemon.configStore.RemappedRoot != "" && hostConfig.UsernsMode.IsPrivate() {
  463. if hostConfig.Privileged {
  464. return warnings, fmt.Errorf("Privileged mode is incompatible with user namespaces")
  465. }
  466. if hostConfig.NetworkMode.IsHost() {
  467. return warnings, fmt.Errorf("Cannot share the host's network namespace when user namespaces are enabled")
  468. }
  469. if hostConfig.PidMode.IsHost() {
  470. return warnings, fmt.Errorf("Cannot share the host PID namespace when user namespaces are enabled")
  471. }
  472. if hostConfig.ReadonlyRootfs {
  473. return warnings, fmt.Errorf("Cannot use the --read-only option when user namespaces are enabled")
  474. }
  475. }
  476. if hostConfig.CgroupParent != "" && daemon.usingSystemd() {
  477. // CgroupParent for systemd cgroup should be named as "xxx.slice"
  478. if len(hostConfig.CgroupParent) <= 6 || !strings.HasSuffix(hostConfig.CgroupParent, ".slice") {
  479. return warnings, fmt.Errorf("cgroup-parent for systemd cgroup should be a valid slice named as \"xxx.slice\"")
  480. }
  481. }
  482. return warnings, nil
  483. }
  484. // verifyDaemonSettings performs validation of daemon config struct
  485. func verifyDaemonSettings(config *Config) error {
  486. // Check for mutually incompatible config options
  487. if config.bridgeConfig.Iface != "" && config.bridgeConfig.IP != "" {
  488. return fmt.Errorf("You specified -b & --bip, mutually exclusive options. Please specify only one")
  489. }
  490. if !config.bridgeConfig.EnableIPTables && !config.bridgeConfig.InterContainerCommunication {
  491. return fmt.Errorf("You specified --iptables=false with --icc=false. ICC=false uses iptables to function. Please set --icc or --iptables to true")
  492. }
  493. if !config.bridgeConfig.EnableIPTables && config.bridgeConfig.EnableIPMasq {
  494. config.bridgeConfig.EnableIPMasq = false
  495. }
  496. if config.CgroupParent != "" && usingSystemd(config) {
  497. if len(config.CgroupParent) <= 6 || !strings.HasSuffix(config.CgroupParent, ".slice") {
  498. return fmt.Errorf("cgroup-parent for systemd cgroup should be a valid slice named as \"xxx.slice\"")
  499. }
  500. }
  501. return nil
  502. }
  503. // checkSystem validates platform-specific requirements
  504. func checkSystem() error {
  505. if os.Geteuid() != 0 {
  506. return fmt.Errorf("The Docker daemon needs to be run as root")
  507. }
  508. return checkKernel()
  509. }
  510. // configureMaxThreads sets the Go runtime max threads threshold
  511. // which is 90% of the kernel setting from /proc/sys/kernel/threads-max
  512. func configureMaxThreads(config *Config) error {
  513. mt, err := ioutil.ReadFile("/proc/sys/kernel/threads-max")
  514. if err != nil {
  515. return err
  516. }
  517. mtint, err := strconv.Atoi(strings.TrimSpace(string(mt)))
  518. if err != nil {
  519. return err
  520. }
  521. maxThreads := (mtint / 100) * 90
  522. debug.SetMaxThreads(maxThreads)
  523. logrus.Debugf("Golang's threads limit set to %d", maxThreads)
  524. return nil
  525. }
  526. // configureKernelSecuritySupport configures and validates security support for the kernel
  527. func configureKernelSecuritySupport(config *Config, driverName string) error {
  528. if config.EnableSelinuxSupport {
  529. if selinuxEnabled() {
  530. // As Docker on overlayFS and SELinux are incompatible at present, error on overlayfs being enabled
  531. if driverName == "overlay" {
  532. return fmt.Errorf("SELinux is not supported with the %s graph driver", driverName)
  533. }
  534. logrus.Debug("SELinux enabled successfully")
  535. } else {
  536. logrus.Warn("Docker could not enable SELinux on the host system")
  537. }
  538. } else {
  539. selinuxSetDisabled()
  540. }
  541. return nil
  542. }
  543. func (daemon *Daemon) initNetworkController(config *Config) (libnetwork.NetworkController, error) {
  544. netOptions, err := daemon.networkOptions(config)
  545. if err != nil {
  546. return nil, err
  547. }
  548. controller, err := libnetwork.New(netOptions...)
  549. if err != nil {
  550. return nil, fmt.Errorf("error obtaining controller instance: %v", err)
  551. }
  552. // Initialize default network on "null"
  553. if _, err := controller.NewNetwork("null", "none", libnetwork.NetworkOptionPersist(false)); err != nil {
  554. return nil, fmt.Errorf("Error creating default \"null\" network: %v", err)
  555. }
  556. // Initialize default network on "host"
  557. if _, err := controller.NewNetwork("host", "host", libnetwork.NetworkOptionPersist(false)); err != nil {
  558. return nil, fmt.Errorf("Error creating default \"host\" network: %v", err)
  559. }
  560. if !config.DisableBridge {
  561. // Initialize default driver "bridge"
  562. if err := initBridgeDriver(controller, config); err != nil {
  563. return nil, err
  564. }
  565. }
  566. return controller, nil
  567. }
  568. func driverOptions(config *Config) []nwconfig.Option {
  569. bridgeConfig := options.Generic{
  570. "EnableIPForwarding": config.bridgeConfig.EnableIPForward,
  571. "EnableIPTables": config.bridgeConfig.EnableIPTables,
  572. "EnableUserlandProxy": config.bridgeConfig.EnableUserlandProxy}
  573. bridgeOption := options.Generic{netlabel.GenericData: bridgeConfig}
  574. dOptions := []nwconfig.Option{}
  575. dOptions = append(dOptions, nwconfig.OptionDriverConfig("bridge", bridgeOption))
  576. return dOptions
  577. }
  578. func initBridgeDriver(controller libnetwork.NetworkController, config *Config) error {
  579. if n, err := controller.NetworkByName("bridge"); err == nil {
  580. if err = n.Delete(); err != nil {
  581. return fmt.Errorf("could not delete the default bridge network: %v", err)
  582. }
  583. }
  584. bridgeName := bridge.DefaultBridgeName
  585. if config.bridgeConfig.Iface != "" {
  586. bridgeName = config.bridgeConfig.Iface
  587. }
  588. netOption := map[string]string{
  589. bridge.BridgeName: bridgeName,
  590. bridge.DefaultBridge: strconv.FormatBool(true),
  591. netlabel.DriverMTU: strconv.Itoa(config.Mtu),
  592. bridge.EnableIPMasquerade: strconv.FormatBool(config.bridgeConfig.EnableIPMasq),
  593. bridge.EnableICC: strconv.FormatBool(config.bridgeConfig.InterContainerCommunication),
  594. }
  595. // --ip processing
  596. if config.bridgeConfig.DefaultIP != nil {
  597. netOption[bridge.DefaultBindingIP] = config.bridgeConfig.DefaultIP.String()
  598. }
  599. var (
  600. ipamV4Conf *libnetwork.IpamConf
  601. ipamV6Conf *libnetwork.IpamConf
  602. )
  603. ipamV4Conf = &libnetwork.IpamConf{AuxAddresses: make(map[string]string)}
  604. nw, nw6List, err := ipamutils.ElectInterfaceAddresses(bridgeName)
  605. if err == nil {
  606. ipamV4Conf.PreferredPool = lntypes.GetIPNetCanonical(nw).String()
  607. hip, _ := lntypes.GetHostPartIP(nw.IP, nw.Mask)
  608. if hip.IsGlobalUnicast() {
  609. ipamV4Conf.Gateway = nw.IP.String()
  610. }
  611. }
  612. if config.bridgeConfig.IP != "" {
  613. ipamV4Conf.PreferredPool = config.bridgeConfig.IP
  614. ip, _, err := net.ParseCIDR(config.bridgeConfig.IP)
  615. if err != nil {
  616. return err
  617. }
  618. ipamV4Conf.Gateway = ip.String()
  619. } else if bridgeName == bridge.DefaultBridgeName && ipamV4Conf.PreferredPool != "" {
  620. logrus.Infof("Default bridge (%s) is assigned with an IP address %s. Daemon option --bip can be used to set a preferred IP address", bridgeName, ipamV4Conf.PreferredPool)
  621. }
  622. if config.bridgeConfig.FixedCIDR != "" {
  623. _, fCIDR, err := net.ParseCIDR(config.bridgeConfig.FixedCIDR)
  624. if err != nil {
  625. return err
  626. }
  627. ipamV4Conf.SubPool = fCIDR.String()
  628. }
  629. if config.bridgeConfig.DefaultGatewayIPv4 != nil {
  630. ipamV4Conf.AuxAddresses["DefaultGatewayIPv4"] = config.bridgeConfig.DefaultGatewayIPv4.String()
  631. }
  632. var deferIPv6Alloc bool
  633. if config.bridgeConfig.FixedCIDRv6 != "" {
  634. _, fCIDRv6, err := net.ParseCIDR(config.bridgeConfig.FixedCIDRv6)
  635. if err != nil {
  636. return err
  637. }
  638. // In case user has specified the daemon flag --fixed-cidr-v6 and the passed network has
  639. // at least 48 host bits, we need to guarantee the current behavior where the containers'
  640. // IPv6 addresses will be constructed based on the containers' interface MAC address.
  641. // We do so by telling libnetwork to defer the IPv6 address allocation for the endpoints
  642. // on this network until after the driver has created the endpoint and returned the
  643. // constructed address. Libnetwork will then reserve this address with the ipam driver.
  644. ones, _ := fCIDRv6.Mask.Size()
  645. deferIPv6Alloc = ones <= 80
  646. if ipamV6Conf == nil {
  647. ipamV6Conf = &libnetwork.IpamConf{AuxAddresses: make(map[string]string)}
  648. }
  649. ipamV6Conf.PreferredPool = fCIDRv6.String()
  650. // In case the --fixed-cidr-v6 is specified and the current docker0 bridge IPv6
  651. // address belongs to the same network, we need to inform libnetwork about it, so
  652. // that it can be reserved with IPAM and it will not be given away to somebody else
  653. for _, nw6 := range nw6List {
  654. if fCIDRv6.Contains(nw6.IP) {
  655. ipamV6Conf.Gateway = nw6.IP.String()
  656. break
  657. }
  658. }
  659. }
  660. if config.bridgeConfig.DefaultGatewayIPv6 != nil {
  661. if ipamV6Conf == nil {
  662. ipamV6Conf = &libnetwork.IpamConf{AuxAddresses: make(map[string]string)}
  663. }
  664. ipamV6Conf.AuxAddresses["DefaultGatewayIPv6"] = config.bridgeConfig.DefaultGatewayIPv6.String()
  665. }
  666. v4Conf := []*libnetwork.IpamConf{ipamV4Conf}
  667. v6Conf := []*libnetwork.IpamConf{}
  668. if ipamV6Conf != nil {
  669. v6Conf = append(v6Conf, ipamV6Conf)
  670. }
  671. // Initialize default network on "bridge" with the same name
  672. _, err = controller.NewNetwork("bridge", "bridge",
  673. libnetwork.NetworkOptionEnableIPv6(config.bridgeConfig.EnableIPv6),
  674. libnetwork.NetworkOptionDriverOpts(netOption),
  675. libnetwork.NetworkOptionIpam("default", "", v4Conf, v6Conf, nil),
  676. libnetwork.NetworkOptionDeferIPv6Alloc(deferIPv6Alloc))
  677. if err != nil {
  678. return fmt.Errorf("Error creating default \"bridge\" network: %v", err)
  679. }
  680. return nil
  681. }
  682. // setupInitLayer populates a directory with mountpoints suitable
  683. // for bind-mounting things into the container.
  684. //
  685. // This extra layer is used by all containers as the top-most ro layer. It protects
  686. // the container from unwanted side-effects on the rw layer.
  687. func setupInitLayer(initLayer string, rootUID, rootGID int) error {
  688. for pth, typ := range map[string]string{
  689. "/dev/pts": "dir",
  690. "/dev/shm": "dir",
  691. "/proc": "dir",
  692. "/sys": "dir",
  693. "/.dockerenv": "file",
  694. "/etc/resolv.conf": "file",
  695. "/etc/hosts": "file",
  696. "/etc/hostname": "file",
  697. "/dev/console": "file",
  698. "/etc/mtab": "/proc/mounts",
  699. } {
  700. parts := strings.Split(pth, "/")
  701. prev := "/"
  702. for _, p := range parts[1:] {
  703. prev = filepath.Join(prev, p)
  704. syscall.Unlink(filepath.Join(initLayer, prev))
  705. }
  706. if _, err := os.Stat(filepath.Join(initLayer, pth)); err != nil {
  707. if os.IsNotExist(err) {
  708. if err := idtools.MkdirAllNewAs(filepath.Join(initLayer, filepath.Dir(pth)), 0755, rootUID, rootGID); err != nil {
  709. return err
  710. }
  711. switch typ {
  712. case "dir":
  713. if err := idtools.MkdirAllNewAs(filepath.Join(initLayer, pth), 0755, rootUID, rootGID); err != nil {
  714. return err
  715. }
  716. case "file":
  717. f, err := os.OpenFile(filepath.Join(initLayer, pth), os.O_CREATE, 0755)
  718. if err != nil {
  719. return err
  720. }
  721. f.Chown(rootUID, rootGID)
  722. f.Close()
  723. default:
  724. if err := os.Symlink(typ, filepath.Join(initLayer, pth)); err != nil {
  725. return err
  726. }
  727. }
  728. } else {
  729. return err
  730. }
  731. }
  732. }
  733. // Layer is ready to use, if it wasn't before.
  734. return nil
  735. }
  736. // Parse the remapped root (user namespace) option, which can be one of:
  737. // username - valid username from /etc/passwd
  738. // username:groupname - valid username; valid groupname from /etc/group
  739. // uid - 32-bit unsigned int valid Linux UID value
  740. // uid:gid - uid value; 32-bit unsigned int Linux GID value
  741. //
  742. // If no groupname is specified, and a username is specified, an attempt
  743. // will be made to lookup a gid for that username as a groupname
  744. //
  745. // If names are used, they are verified to exist in passwd/group
  746. func parseRemappedRoot(usergrp string) (string, string, error) {
  747. var (
  748. userID, groupID int
  749. username, groupname string
  750. )
  751. idparts := strings.Split(usergrp, ":")
  752. if len(idparts) > 2 {
  753. return "", "", fmt.Errorf("Invalid user/group specification in --userns-remap: %q", usergrp)
  754. }
  755. if uid, err := strconv.ParseInt(idparts[0], 10, 32); err == nil {
  756. // must be a uid; take it as valid
  757. userID = int(uid)
  758. luser, err := user.LookupUid(userID)
  759. if err != nil {
  760. return "", "", fmt.Errorf("Uid %d has no entry in /etc/passwd: %v", userID, err)
  761. }
  762. username = luser.Name
  763. if len(idparts) == 1 {
  764. // if the uid was numeric and no gid was specified, take the uid as the gid
  765. groupID = userID
  766. lgrp, err := user.LookupGid(groupID)
  767. if err != nil {
  768. return "", "", fmt.Errorf("Gid %d has no entry in /etc/group: %v", groupID, err)
  769. }
  770. groupname = lgrp.Name
  771. }
  772. } else {
  773. lookupName := idparts[0]
  774. // special case: if the user specified "default", they want Docker to create or
  775. // use (after creation) the "dockremap" user/group for root remapping
  776. if lookupName == defaultIDSpecifier {
  777. lookupName = defaultRemappedID
  778. }
  779. luser, err := user.LookupUser(lookupName)
  780. if err != nil && idparts[0] != defaultIDSpecifier {
  781. // error if the name requested isn't the special "dockremap" ID
  782. return "", "", fmt.Errorf("Error during uid lookup for %q: %v", lookupName, err)
  783. } else if err != nil {
  784. // special case-- if the username == "default", then we have been asked
  785. // to create a new entry pair in /etc/{passwd,group} for which the /etc/sub{uid,gid}
  786. // ranges will be used for the user and group mappings in user namespaced containers
  787. _, _, err := idtools.AddNamespaceRangesUser(defaultRemappedID)
  788. if err == nil {
  789. return defaultRemappedID, defaultRemappedID, nil
  790. }
  791. return "", "", fmt.Errorf("Error during %q user creation: %v", defaultRemappedID, err)
  792. }
  793. username = luser.Name
  794. if len(idparts) == 1 {
  795. // we only have a string username, and no group specified; look up gid from username as group
  796. group, err := user.LookupGroup(lookupName)
  797. if err != nil {
  798. return "", "", fmt.Errorf("Error during gid lookup for %q: %v", lookupName, err)
  799. }
  800. groupID = group.Gid
  801. groupname = group.Name
  802. }
  803. }
  804. if len(idparts) == 2 {
  805. // groupname or gid is separately specified and must be resolved
  806. // to an unsigned 32-bit gid
  807. if gid, err := strconv.ParseInt(idparts[1], 10, 32); err == nil {
  808. // must be a gid, take it as valid
  809. groupID = int(gid)
  810. lgrp, err := user.LookupGid(groupID)
  811. if err != nil {
  812. return "", "", fmt.Errorf("Gid %d has no entry in /etc/passwd: %v", groupID, err)
  813. }
  814. groupname = lgrp.Name
  815. } else {
  816. // not a number; attempt a lookup
  817. if _, err := user.LookupGroup(idparts[1]); err != nil {
  818. return "", "", fmt.Errorf("Error during groupname lookup for %q: %v", idparts[1], err)
  819. }
  820. groupname = idparts[1]
  821. }
  822. }
  823. return username, groupname, nil
  824. }
  825. func setupRemappedRoot(config *Config) ([]idtools.IDMap, []idtools.IDMap, error) {
  826. if runtime.GOOS != "linux" && config.RemappedRoot != "" {
  827. return nil, nil, fmt.Errorf("User namespaces are only supported on Linux")
  828. }
  829. // if the daemon was started with remapped root option, parse
  830. // the config option to the int uid,gid values
  831. var (
  832. uidMaps, gidMaps []idtools.IDMap
  833. )
  834. if config.RemappedRoot != "" {
  835. username, groupname, err := parseRemappedRoot(config.RemappedRoot)
  836. if err != nil {
  837. return nil, nil, err
  838. }
  839. if username == "root" {
  840. // Cannot setup user namespaces with a 1-to-1 mapping; "--root=0:0" is a no-op
  841. // effectively
  842. logrus.Warnf("User namespaces: root cannot be remapped with itself; user namespaces are OFF")
  843. return uidMaps, gidMaps, nil
  844. }
  845. logrus.Infof("User namespaces: ID ranges will be mapped to subuid/subgid ranges of: %s:%s", username, groupname)
  846. // update remapped root setting now that we have resolved them to actual names
  847. config.RemappedRoot = fmt.Sprintf("%s:%s", username, groupname)
  848. uidMaps, gidMaps, err = idtools.CreateIDMappings(username, groupname)
  849. if err != nil {
  850. return nil, nil, fmt.Errorf("Can't create ID mappings: %v", err)
  851. }
  852. }
  853. return uidMaps, gidMaps, nil
  854. }
  855. func setupDaemonRoot(config *Config, rootDir string, rootUID, rootGID int) error {
  856. config.Root = rootDir
  857. // the docker root metadata directory needs to have execute permissions for all users (g+x,o+x)
  858. // so that syscalls executing as non-root, operating on subdirectories of the graph root
  859. // (e.g. mounted layers of a container) can traverse this path.
  860. // The user namespace support will create subdirectories for the remapped root host uid:gid
  861. // pair owned by that same uid:gid pair for proper write access to those needed metadata and
  862. // layer content subtrees.
  863. if _, err := os.Stat(rootDir); err == nil {
  864. // root current exists; verify the access bits are correct by setting them
  865. if err = os.Chmod(rootDir, 0711); err != nil {
  866. return err
  867. }
  868. } else if os.IsNotExist(err) {
  869. // no root exists yet, create it 0711 with root:root ownership
  870. if err := os.MkdirAll(rootDir, 0711); err != nil {
  871. return err
  872. }
  873. }
  874. // if user namespaces are enabled we will create a subtree underneath the specified root
  875. // with any/all specified remapped root uid/gid options on the daemon creating
  876. // a new subdirectory with ownership set to the remapped uid/gid (so as to allow
  877. // `chdir()` to work for containers namespaced to that uid/gid)
  878. if config.RemappedRoot != "" {
  879. config.Root = filepath.Join(rootDir, fmt.Sprintf("%d.%d", rootUID, rootGID))
  880. logrus.Debugf("Creating user namespaced daemon root: %s", config.Root)
  881. // Create the root directory if it doesn't exist
  882. if err := idtools.MkdirAllAs(config.Root, 0700, rootUID, rootGID); err != nil {
  883. return fmt.Errorf("Cannot create daemon root: %s: %v", config.Root, err)
  884. }
  885. }
  886. return nil
  887. }
  888. // registerLinks writes the links to a file.
  889. func (daemon *Daemon) registerLinks(container *container.Container, hostConfig *containertypes.HostConfig) error {
  890. if hostConfig == nil || hostConfig.NetworkMode.IsUserDefined() {
  891. return nil
  892. }
  893. for _, l := range hostConfig.Links {
  894. name, alias, err := runconfigopts.ParseLink(l)
  895. if err != nil {
  896. return err
  897. }
  898. child, err := daemon.GetContainer(name)
  899. if err != nil {
  900. //An error from daemon.GetContainer() means this name could not be found
  901. return fmt.Errorf("Could not get container for %s", name)
  902. }
  903. for child.HostConfig.NetworkMode.IsContainer() {
  904. parts := strings.SplitN(string(child.HostConfig.NetworkMode), ":", 2)
  905. child, err = daemon.GetContainer(parts[1])
  906. if err != nil {
  907. return fmt.Errorf("Could not get container for %s", parts[1])
  908. }
  909. }
  910. if child.HostConfig.NetworkMode.IsHost() {
  911. return runconfig.ErrConflictHostNetworkAndLinks
  912. }
  913. if err := daemon.registerLink(container, child, alias); err != nil {
  914. return err
  915. }
  916. }
  917. // After we load all the links into the daemon
  918. // set them to nil on the hostconfig
  919. return container.WriteHostConfig()
  920. }
  921. // conditionalMountOnStart is a platform specific helper function during the
  922. // container start to call mount.
  923. func (daemon *Daemon) conditionalMountOnStart(container *container.Container) error {
  924. return daemon.Mount(container)
  925. }
  926. // conditionalUnmountOnCleanup is a platform specific helper function called
  927. // during the cleanup of a container to unmount.
  928. func (daemon *Daemon) conditionalUnmountOnCleanup(container *container.Container) error {
  929. return daemon.Unmount(container)
  930. }
  931. func restoreCustomImage(is image.Store, ls layer.Store, rs reference.Store) error {
  932. // Unix has no custom images to register
  933. return nil
  934. }
  935. func (daemon *Daemon) stats(c *container.Container) (*types.StatsJSON, error) {
  936. if !c.IsRunning() {
  937. return nil, errNotRunning{c.ID}
  938. }
  939. stats, err := daemon.containerd.Stats(c.ID)
  940. if err != nil {
  941. return nil, err
  942. }
  943. s := &types.StatsJSON{}
  944. cgs := stats.CgroupStats
  945. if cgs != nil {
  946. s.BlkioStats = types.BlkioStats{
  947. IoServiceBytesRecursive: copyBlkioEntry(cgs.BlkioStats.IoServiceBytesRecursive),
  948. IoServicedRecursive: copyBlkioEntry(cgs.BlkioStats.IoServicedRecursive),
  949. IoQueuedRecursive: copyBlkioEntry(cgs.BlkioStats.IoQueuedRecursive),
  950. IoServiceTimeRecursive: copyBlkioEntry(cgs.BlkioStats.IoServiceTimeRecursive),
  951. IoWaitTimeRecursive: copyBlkioEntry(cgs.BlkioStats.IoWaitTimeRecursive),
  952. IoMergedRecursive: copyBlkioEntry(cgs.BlkioStats.IoMergedRecursive),
  953. IoTimeRecursive: copyBlkioEntry(cgs.BlkioStats.IoTimeRecursive),
  954. SectorsRecursive: copyBlkioEntry(cgs.BlkioStats.SectorsRecursive),
  955. }
  956. cpu := cgs.CpuStats
  957. s.CPUStats = types.CPUStats{
  958. CPUUsage: types.CPUUsage{
  959. TotalUsage: cpu.CpuUsage.TotalUsage,
  960. PercpuUsage: cpu.CpuUsage.PercpuUsage,
  961. UsageInKernelmode: cpu.CpuUsage.UsageInKernelmode,
  962. UsageInUsermode: cpu.CpuUsage.UsageInUsermode,
  963. },
  964. ThrottlingData: types.ThrottlingData{
  965. Periods: cpu.ThrottlingData.Periods,
  966. ThrottledPeriods: cpu.ThrottlingData.ThrottledPeriods,
  967. ThrottledTime: cpu.ThrottlingData.ThrottledTime,
  968. },
  969. }
  970. mem := cgs.MemoryStats.Usage
  971. s.MemoryStats = types.MemoryStats{
  972. Usage: mem.Usage,
  973. MaxUsage: mem.MaxUsage,
  974. Stats: cgs.MemoryStats.Stats,
  975. Failcnt: mem.Failcnt,
  976. }
  977. if cgs.PidsStats != nil {
  978. s.PidsStats = types.PidsStats{
  979. Current: cgs.PidsStats.Current,
  980. }
  981. }
  982. }
  983. s.Read = time.Unix(int64(stats.Timestamp), 0)
  984. return s, nil
  985. }
  986. // setDefaultIsolation determines the default isolation mode for the
  987. // daemon to run in. This is only applicable on Windows
  988. func (daemon *Daemon) setDefaultIsolation() error {
  989. return nil
  990. }
  991. func rootFSToAPIType(rootfs *image.RootFS) types.RootFS {
  992. var layers []string
  993. for _, l := range rootfs.DiffIDs {
  994. layers = append(layers, l.String())
  995. }
  996. return types.RootFS{
  997. Type: rootfs.Type,
  998. Layers: layers,
  999. }
  1000. }