create.go 5.9 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224
  1. // +build linux,cgo
  2. package native
  3. import (
  4. "fmt"
  5. "os"
  6. "os/exec"
  7. "path/filepath"
  8. "github.com/docker/docker/daemon/execdriver"
  9. "github.com/docker/docker/daemon/execdriver/native/template"
  10. "github.com/docker/libcontainer"
  11. "github.com/docker/libcontainer/apparmor"
  12. "github.com/docker/libcontainer/devices"
  13. "github.com/docker/libcontainer/mount"
  14. "github.com/docker/libcontainer/security/capabilities"
  15. )
  16. // createContainer populates and configures the container type with the
  17. // data provided by the execdriver.Command
  18. func (d *driver) createContainer(c *execdriver.Command) (*libcontainer.Config, error) {
  19. container := template.New()
  20. container.Hostname = getEnv("HOSTNAME", c.ProcessConfig.Env)
  21. container.Tty = c.ProcessConfig.Tty
  22. container.User = c.ProcessConfig.User
  23. container.WorkingDir = c.WorkingDir
  24. container.Env = c.ProcessConfig.Env
  25. container.Cgroups.Name = c.ID
  26. container.Cgroups.AllowedDevices = c.AllowedDevices
  27. container.MountConfig.DeviceNodes = c.AutoCreatedDevices
  28. container.RootFs = c.Rootfs
  29. container.MountConfig.ReadonlyFs = c.ReadonlyRootfs
  30. // check to see if we are running in ramdisk to disable pivot root
  31. container.MountConfig.NoPivotRoot = os.Getenv("DOCKER_RAMDISK") != ""
  32. container.RestrictSys = true
  33. if err := d.createIpc(container, c); err != nil {
  34. return nil, err
  35. }
  36. if err := d.createPid(container, c); err != nil {
  37. return nil, err
  38. }
  39. if err := d.createNetwork(container, c); err != nil {
  40. return nil, err
  41. }
  42. if c.ProcessConfig.Privileged {
  43. if err := d.setPrivileged(container); err != nil {
  44. return nil, err
  45. }
  46. } else {
  47. if err := d.setCapabilities(container, c); err != nil {
  48. return nil, err
  49. }
  50. }
  51. if c.AppArmorProfile != "" {
  52. container.AppArmorProfile = c.AppArmorProfile
  53. }
  54. if err := d.setupCgroups(container, c); err != nil {
  55. return nil, err
  56. }
  57. if err := d.setupMounts(container, c); err != nil {
  58. return nil, err
  59. }
  60. if err := d.setupLabels(container, c); err != nil {
  61. return nil, err
  62. }
  63. cmds := make(map[string]*exec.Cmd)
  64. d.Lock()
  65. for k, v := range d.activeContainers {
  66. cmds[k] = v.cmd
  67. }
  68. d.Unlock()
  69. return container, nil
  70. }
  71. func (d *driver) createNetwork(container *libcontainer.Config, c *execdriver.Command) error {
  72. if c.Network.HostNetworking {
  73. container.Namespaces.Remove(libcontainer.NEWNET)
  74. return nil
  75. }
  76. container.Networks = []*libcontainer.Network{
  77. {
  78. Mtu: c.Network.Mtu,
  79. Address: fmt.Sprintf("%s/%d", "127.0.0.1", 0),
  80. Gateway: "localhost",
  81. Type: "loopback",
  82. },
  83. }
  84. if c.Network.Interface != nil {
  85. vethNetwork := libcontainer.Network{
  86. Mtu: c.Network.Mtu,
  87. Address: fmt.Sprintf("%s/%d", c.Network.Interface.IPAddress, c.Network.Interface.IPPrefixLen),
  88. MacAddress: c.Network.Interface.MacAddress,
  89. Gateway: c.Network.Interface.Gateway,
  90. Type: "veth",
  91. Bridge: c.Network.Interface.Bridge,
  92. VethPrefix: "veth",
  93. }
  94. if c.Network.Interface.GlobalIPv6Address != "" {
  95. vethNetwork.IPv6Address = fmt.Sprintf("%s/%d", c.Network.Interface.GlobalIPv6Address, c.Network.Interface.GlobalIPv6PrefixLen)
  96. vethNetwork.IPv6Gateway = c.Network.Interface.IPv6Gateway
  97. }
  98. container.Networks = append(container.Networks, &vethNetwork)
  99. }
  100. if c.Network.ContainerID != "" {
  101. d.Lock()
  102. active := d.activeContainers[c.Network.ContainerID]
  103. d.Unlock()
  104. if active == nil || active.cmd.Process == nil {
  105. return fmt.Errorf("%s is not a valid running container to join", c.Network.ContainerID)
  106. }
  107. cmd := active.cmd
  108. nspath := filepath.Join("/proc", fmt.Sprint(cmd.Process.Pid), "ns", "net")
  109. container.Namespaces.Add(libcontainer.NEWNET, nspath)
  110. }
  111. return nil
  112. }
  113. func (d *driver) createIpc(container *libcontainer.Config, c *execdriver.Command) error {
  114. if c.Ipc.HostIpc {
  115. container.Namespaces.Remove(libcontainer.NEWIPC)
  116. return nil
  117. }
  118. if c.Ipc.ContainerID != "" {
  119. d.Lock()
  120. active := d.activeContainers[c.Ipc.ContainerID]
  121. d.Unlock()
  122. if active == nil || active.cmd.Process == nil {
  123. return fmt.Errorf("%s is not a valid running container to join", c.Ipc.ContainerID)
  124. }
  125. cmd := active.cmd
  126. container.Namespaces.Add(libcontainer.NEWIPC, filepath.Join("/proc", fmt.Sprint(cmd.Process.Pid), "ns", "ipc"))
  127. }
  128. return nil
  129. }
  130. func (d *driver) createPid(container *libcontainer.Config, c *execdriver.Command) error {
  131. if c.Pid.HostPid {
  132. container.Namespaces.Remove(libcontainer.NEWPID)
  133. return nil
  134. }
  135. return nil
  136. }
  137. func (d *driver) setPrivileged(container *libcontainer.Config) (err error) {
  138. container.Capabilities = capabilities.GetAllCapabilities()
  139. container.Cgroups.AllowAllDevices = true
  140. hostDeviceNodes, err := devices.GetHostDeviceNodes()
  141. if err != nil {
  142. return err
  143. }
  144. container.MountConfig.DeviceNodes = hostDeviceNodes
  145. container.RestrictSys = false
  146. if apparmor.IsEnabled() {
  147. container.AppArmorProfile = "unconfined"
  148. }
  149. return nil
  150. }
  151. func (d *driver) setCapabilities(container *libcontainer.Config, c *execdriver.Command) (err error) {
  152. container.Capabilities, err = execdriver.TweakCapabilities(container.Capabilities, c.CapAdd, c.CapDrop)
  153. return err
  154. }
  155. func (d *driver) setupCgroups(container *libcontainer.Config, c *execdriver.Command) error {
  156. if c.Resources != nil {
  157. container.Cgroups.CpuShares = c.Resources.CpuShares
  158. container.Cgroups.Memory = c.Resources.Memory
  159. container.Cgroups.MemoryReservation = c.Resources.Memory
  160. container.Cgroups.MemorySwap = c.Resources.MemorySwap
  161. container.Cgroups.CpusetCpus = c.Resources.Cpuset
  162. }
  163. return nil
  164. }
  165. func (d *driver) setupMounts(container *libcontainer.Config, c *execdriver.Command) error {
  166. for _, m := range c.Mounts {
  167. container.MountConfig.Mounts = append(container.MountConfig.Mounts, &mount.Mount{
  168. Type: "bind",
  169. Source: m.Source,
  170. Destination: m.Destination,
  171. Writable: m.Writable,
  172. Private: m.Private,
  173. Slave: m.Slave,
  174. })
  175. }
  176. return nil
  177. }
  178. func (d *driver) setupLabels(container *libcontainer.Config, c *execdriver.Command) error {
  179. container.ProcessLabel = c.ProcessLabel
  180. container.MountConfig.MountLabel = c.MountLabel
  181. return nil
  182. }