daemon_unix.go 54 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798991001011021031041051061071081091101111121131141151161171181191201211221231241251261271281291301311321331341351361371381391401411421431441451461471481491501511521531541551561571581591601611621631641651661671681691701711721731741751761771781791801811821831841851861871881891901911921931941951961971981992002012022032042052062072082092102112122132142152162172182192202212222232242252262272282292302312322332342352362372382392402412422432442452462472482492502512522532542552562572582592602612622632642652662672682692702712722732742752762772782792802812822832842852862872882892902912922932942952962972982993003013023033043053063073083093103113123133143153163173183193203213223233243253263273283293303313323333343353363373383393403413423433443453463473483493503513523533543553563573583593603613623633643653663673683693703713723733743753763773783793803813823833843853863873883893903913923933943953963973983994004014024034044054064074084094104114124134144154164174184194204214224234244254264274284294304314324334344354364374384394404414424434444454464474484494504514524534544554564574584594604614624634644654664674684694704714724734744754764774784794804814824834844854864874884894904914924934944954964974984995005015025035045055065075085095105115125135145155165175185195205215225235245255265275285295305315325335345355365375385395405415425435445455465475485495505515525535545555565575585595605615625635645655665675685695705715725735745755765775785795805815825835845855865875885895905915925935945955965975985996006016026036046056066076086096106116126136146156166176186196206216226236246256266276286296306316326336346356366376386396406416426436446456466476486496506516526536546556566576586596606616626636646656666676686696706716726736746756766776786796806816826836846856866876886896906916926936946956966976986997007017027037047057067077087097107117127137147157167177187197207217227237247257267277287297307317327337347357367377387397407417427437447457467477487497507517527537547557567577587597607617627637647657667677687697707717727737747757767777787797807817827837847857867877887897907917927937947957967977987998008018028038048058068078088098108118128138148158168178188198208218228238248258268278288298308318328338348358368378388398408418428438448458468478488498508518528538548558568578588598608618628638648658668678688698708718728738748758768778788798808818828838848858868878888898908918928938948958968978988999009019029039049059069079089099109119129139149159169179189199209219229239249259269279289299309319329339349359369379389399409419429439449459469479489499509519529539549559569579589599609619629639649659669679689699709719729739749759769779789799809819829839849859869879889899909919929939949959969979989991000100110021003100410051006100710081009101010111012101310141015101610171018101910201021102210231024102510261027102810291030103110321033103410351036103710381039104010411042104310441045104610471048104910501051105210531054105510561057105810591060106110621063106410651066106710681069107010711072107310741075107610771078107910801081108210831084108510861087108810891090109110921093109410951096109710981099110011011102110311041105110611071108110911101111111211131114111511161117111811191120112111221123112411251126112711281129113011311132113311341135113611371138113911401141114211431144114511461147114811491150115111521153115411551156115711581159116011611162116311641165116611671168116911701171117211731174117511761177117811791180118111821183118411851186118711881189119011911192119311941195119611971198119912001201120212031204120512061207120812091210121112121213121412151216121712181219122012211222122312241225122612271228122912301231123212331234123512361237123812391240124112421243124412451246124712481249125012511252125312541255125612571258125912601261126212631264126512661267126812691270127112721273127412751276127712781279128012811282128312841285128612871288128912901291129212931294129512961297129812991300130113021303130413051306130713081309131013111312131313141315131613171318131913201321132213231324132513261327132813291330133113321333133413351336133713381339134013411342134313441345134613471348134913501351135213531354135513561357135813591360136113621363136413651366136713681369137013711372137313741375137613771378137913801381138213831384138513861387138813891390139113921393139413951396139713981399140014011402140314041405140614071408140914101411141214131414141514161417141814191420142114221423142414251426142714281429143014311432143314341435143614371438143914401441144214431444144514461447144814491450145114521453145414551456145714581459146014611462146314641465146614671468146914701471147214731474147514761477147814791480148114821483148414851486148714881489
  1. // +build linux freebsd
  2. package daemon // import "github.com/docker/docker/daemon"
  3. import (
  4. "bufio"
  5. "context"
  6. "fmt"
  7. "io/ioutil"
  8. "net"
  9. "os"
  10. "path/filepath"
  11. "runtime"
  12. "runtime/debug"
  13. "strconv"
  14. "strings"
  15. "time"
  16. containerd_cgroups "github.com/containerd/cgroups"
  17. "github.com/docker/docker/api/types"
  18. "github.com/docker/docker/api/types/blkiodev"
  19. pblkiodev "github.com/docker/docker/api/types/blkiodev"
  20. containertypes "github.com/docker/docker/api/types/container"
  21. "github.com/docker/docker/container"
  22. "github.com/docker/docker/daemon/config"
  23. "github.com/docker/docker/daemon/initlayer"
  24. "github.com/docker/docker/image"
  25. "github.com/docker/docker/opts"
  26. "github.com/docker/docker/pkg/containerfs"
  27. "github.com/docker/docker/pkg/idtools"
  28. "github.com/docker/docker/pkg/ioutils"
  29. "github.com/docker/docker/pkg/mount"
  30. "github.com/docker/docker/pkg/parsers"
  31. "github.com/docker/docker/pkg/parsers/kernel"
  32. "github.com/docker/docker/pkg/sysinfo"
  33. "github.com/docker/docker/runconfig"
  34. "github.com/docker/docker/volume"
  35. "github.com/docker/libnetwork"
  36. nwconfig "github.com/docker/libnetwork/config"
  37. "github.com/docker/libnetwork/drivers/bridge"
  38. "github.com/docker/libnetwork/netlabel"
  39. "github.com/docker/libnetwork/netutils"
  40. "github.com/docker/libnetwork/options"
  41. lntypes "github.com/docker/libnetwork/types"
  42. "github.com/opencontainers/runc/libcontainer/cgroups"
  43. rsystem "github.com/opencontainers/runc/libcontainer/system"
  44. specs "github.com/opencontainers/runtime-spec/specs-go"
  45. "github.com/opencontainers/selinux/go-selinux/label"
  46. "github.com/pkg/errors"
  47. "github.com/sirupsen/logrus"
  48. "github.com/vishvananda/netlink"
  49. "golang.org/x/sys/unix"
  50. )
  51. const (
  52. // DefaultShimBinary is the default shim to be used by containerd if none
  53. // is specified
  54. DefaultShimBinary = "docker-containerd-shim"
  55. // DefaultRuntimeBinary is the default runtime to be used by
  56. // containerd if none is specified
  57. DefaultRuntimeBinary = "docker-runc"
  58. // See https://git.kernel.org/cgit/linux/kernel/git/tip/tip.git/tree/kernel/sched/sched.h?id=8cd9234c64c584432f6992fe944ca9e46ca8ea76#n269
  59. linuxMinCPUShares = 2
  60. linuxMaxCPUShares = 262144
  61. platformSupported = true
  62. // It's not kernel limit, we want this 4M limit to supply a reasonable functional container
  63. linuxMinMemory = 4194304
  64. // constants for remapped root settings
  65. defaultIDSpecifier string = "default"
  66. defaultRemappedID string = "dockremap"
  67. // constant for cgroup drivers
  68. cgroupFsDriver = "cgroupfs"
  69. cgroupSystemdDriver = "systemd"
  70. // DefaultRuntimeName is the default runtime to be used by
  71. // containerd if none is specified
  72. DefaultRuntimeName = "docker-runc"
  73. )
  74. type containerGetter interface {
  75. GetContainer(string) (*container.Container, error)
  76. }
  77. func getMemoryResources(config containertypes.Resources) *specs.LinuxMemory {
  78. memory := specs.LinuxMemory{}
  79. if config.Memory > 0 {
  80. memory.Limit = &config.Memory
  81. }
  82. if config.MemoryReservation > 0 {
  83. memory.Reservation = &config.MemoryReservation
  84. }
  85. if config.MemorySwap > 0 {
  86. memory.Swap = &config.MemorySwap
  87. }
  88. if config.MemorySwappiness != nil {
  89. swappiness := uint64(*config.MemorySwappiness)
  90. memory.Swappiness = &swappiness
  91. }
  92. if config.OomKillDisable != nil {
  93. memory.DisableOOMKiller = config.OomKillDisable
  94. }
  95. if config.KernelMemory != 0 {
  96. memory.Kernel = &config.KernelMemory
  97. }
  98. return &memory
  99. }
  100. func getCPUResources(config containertypes.Resources) (*specs.LinuxCPU, error) {
  101. cpu := specs.LinuxCPU{}
  102. if config.CPUShares < 0 {
  103. return nil, fmt.Errorf("shares: invalid argument")
  104. }
  105. if config.CPUShares >= 0 {
  106. shares := uint64(config.CPUShares)
  107. cpu.Shares = &shares
  108. }
  109. if config.CpusetCpus != "" {
  110. cpu.Cpus = config.CpusetCpus
  111. }
  112. if config.CpusetMems != "" {
  113. cpu.Mems = config.CpusetMems
  114. }
  115. if config.NanoCPUs > 0 {
  116. // https://www.kernel.org/doc/Documentation/scheduler/sched-bwc.txt
  117. period := uint64(100 * time.Millisecond / time.Microsecond)
  118. quota := config.NanoCPUs * int64(period) / 1e9
  119. cpu.Period = &period
  120. cpu.Quota = &quota
  121. }
  122. if config.CPUPeriod != 0 {
  123. period := uint64(config.CPUPeriod)
  124. cpu.Period = &period
  125. }
  126. if config.CPUQuota != 0 {
  127. q := config.CPUQuota
  128. cpu.Quota = &q
  129. }
  130. if config.CPURealtimePeriod != 0 {
  131. period := uint64(config.CPURealtimePeriod)
  132. cpu.RealtimePeriod = &period
  133. }
  134. if config.CPURealtimeRuntime != 0 {
  135. c := config.CPURealtimeRuntime
  136. cpu.RealtimeRuntime = &c
  137. }
  138. return &cpu, nil
  139. }
  140. func getBlkioWeightDevices(config containertypes.Resources) ([]specs.LinuxWeightDevice, error) {
  141. var stat unix.Stat_t
  142. var blkioWeightDevices []specs.LinuxWeightDevice
  143. for _, weightDevice := range config.BlkioWeightDevice {
  144. if err := unix.Stat(weightDevice.Path, &stat); err != nil {
  145. return nil, err
  146. }
  147. weight := weightDevice.Weight
  148. d := specs.LinuxWeightDevice{Weight: &weight}
  149. d.Major = int64(stat.Rdev / 256)
  150. d.Minor = int64(stat.Rdev % 256)
  151. blkioWeightDevices = append(blkioWeightDevices, d)
  152. }
  153. return blkioWeightDevices, nil
  154. }
  155. func (daemon *Daemon) parseSecurityOpt(container *container.Container, hostConfig *containertypes.HostConfig) error {
  156. container.NoNewPrivileges = daemon.configStore.NoNewPrivileges
  157. return parseSecurityOpt(container, hostConfig)
  158. }
  159. func parseSecurityOpt(container *container.Container, config *containertypes.HostConfig) error {
  160. var (
  161. labelOpts []string
  162. err error
  163. )
  164. for _, opt := range config.SecurityOpt {
  165. if opt == "no-new-privileges" {
  166. container.NoNewPrivileges = true
  167. continue
  168. }
  169. if opt == "disable" {
  170. labelOpts = append(labelOpts, "disable")
  171. continue
  172. }
  173. var con []string
  174. if strings.Contains(opt, "=") {
  175. con = strings.SplitN(opt, "=", 2)
  176. } else if strings.Contains(opt, ":") {
  177. con = strings.SplitN(opt, ":", 2)
  178. logrus.Warn("Security options with `:` as a separator are deprecated and will be completely unsupported in 17.04, use `=` instead.")
  179. }
  180. if len(con) != 2 {
  181. return fmt.Errorf("invalid --security-opt 1: %q", opt)
  182. }
  183. switch con[0] {
  184. case "label":
  185. labelOpts = append(labelOpts, con[1])
  186. case "apparmor":
  187. container.AppArmorProfile = con[1]
  188. case "seccomp":
  189. container.SeccompProfile = con[1]
  190. case "no-new-privileges":
  191. noNewPrivileges, err := strconv.ParseBool(con[1])
  192. if err != nil {
  193. return fmt.Errorf("invalid --security-opt 2: %q", opt)
  194. }
  195. container.NoNewPrivileges = noNewPrivileges
  196. default:
  197. return fmt.Errorf("invalid --security-opt 2: %q", opt)
  198. }
  199. }
  200. container.ProcessLabel, container.MountLabel, err = label.InitLabels(labelOpts)
  201. return err
  202. }
  203. func getBlkioThrottleDevices(devs []*blkiodev.ThrottleDevice) ([]specs.LinuxThrottleDevice, error) {
  204. var throttleDevices []specs.LinuxThrottleDevice
  205. var stat unix.Stat_t
  206. for _, d := range devs {
  207. if err := unix.Stat(d.Path, &stat); err != nil {
  208. return nil, err
  209. }
  210. d := specs.LinuxThrottleDevice{Rate: d.Rate}
  211. d.Major = int64(stat.Rdev / 256)
  212. d.Minor = int64(stat.Rdev % 256)
  213. throttleDevices = append(throttleDevices, d)
  214. }
  215. return throttleDevices, nil
  216. }
  217. func checkKernel() error {
  218. // Check for unsupported kernel versions
  219. // FIXME: it would be cleaner to not test for specific versions, but rather
  220. // test for specific functionalities.
  221. // Unfortunately we can't test for the feature "does not cause a kernel panic"
  222. // without actually causing a kernel panic, so we need this workaround until
  223. // the circumstances of pre-3.10 crashes are clearer.
  224. // For details see https://github.com/docker/docker/issues/407
  225. // Docker 1.11 and above doesn't actually run on kernels older than 3.4,
  226. // due to containerd-shim usage of PR_SET_CHILD_SUBREAPER (introduced in 3.4).
  227. if !kernel.CheckKernelVersion(3, 10, 0) {
  228. v, _ := kernel.GetKernelVersion()
  229. if os.Getenv("DOCKER_NOWARN_KERNEL_VERSION") == "" {
  230. logrus.Fatalf("Your Linux kernel version %s is not supported for running docker. Please upgrade your kernel to 3.10.0 or newer.", v.String())
  231. }
  232. }
  233. return nil
  234. }
  235. // adaptContainerSettings is called during container creation to modify any
  236. // settings necessary in the HostConfig structure.
  237. func (daemon *Daemon) adaptContainerSettings(hostConfig *containertypes.HostConfig, adjustCPUShares bool) error {
  238. if adjustCPUShares && hostConfig.CPUShares > 0 {
  239. // Handle unsupported CPUShares
  240. if hostConfig.CPUShares < linuxMinCPUShares {
  241. logrus.Warnf("Changing requested CPUShares of %d to minimum allowed of %d", hostConfig.CPUShares, linuxMinCPUShares)
  242. hostConfig.CPUShares = linuxMinCPUShares
  243. } else if hostConfig.CPUShares > linuxMaxCPUShares {
  244. logrus.Warnf("Changing requested CPUShares of %d to maximum allowed of %d", hostConfig.CPUShares, linuxMaxCPUShares)
  245. hostConfig.CPUShares = linuxMaxCPUShares
  246. }
  247. }
  248. if hostConfig.Memory > 0 && hostConfig.MemorySwap == 0 {
  249. // By default, MemorySwap is set to twice the size of Memory.
  250. hostConfig.MemorySwap = hostConfig.Memory * 2
  251. }
  252. if hostConfig.ShmSize == 0 {
  253. hostConfig.ShmSize = config.DefaultShmSize
  254. if daemon.configStore != nil {
  255. hostConfig.ShmSize = int64(daemon.configStore.ShmSize)
  256. }
  257. }
  258. // Set default IPC mode, if unset for container
  259. if hostConfig.IpcMode.IsEmpty() {
  260. m := config.DefaultIpcMode
  261. if daemon.configStore != nil {
  262. m = daemon.configStore.IpcMode
  263. }
  264. hostConfig.IpcMode = containertypes.IpcMode(m)
  265. }
  266. adaptSharedNamespaceContainer(daemon, hostConfig)
  267. var err error
  268. opts, err := daemon.generateSecurityOpt(hostConfig)
  269. if err != nil {
  270. return err
  271. }
  272. hostConfig.SecurityOpt = append(hostConfig.SecurityOpt, opts...)
  273. if hostConfig.OomKillDisable == nil {
  274. defaultOomKillDisable := false
  275. hostConfig.OomKillDisable = &defaultOomKillDisable
  276. }
  277. return nil
  278. }
  279. // adaptSharedNamespaceContainer replaces container name with its ID in hostConfig.
  280. // To be more precisely, it modifies `container:name` to `container:ID` of PidMode, IpcMode
  281. // and NetworkMode.
  282. //
  283. // When a container shares its namespace with another container, use ID can keep the namespace
  284. // sharing connection between the two containers even the another container is renamed.
  285. func adaptSharedNamespaceContainer(daemon containerGetter, hostConfig *containertypes.HostConfig) {
  286. containerPrefix := "container:"
  287. if hostConfig.PidMode.IsContainer() {
  288. pidContainer := hostConfig.PidMode.Container()
  289. // if there is any error returned here, we just ignore it and leave it to be
  290. // handled in the following logic
  291. if c, err := daemon.GetContainer(pidContainer); err == nil {
  292. hostConfig.PidMode = containertypes.PidMode(containerPrefix + c.ID)
  293. }
  294. }
  295. if hostConfig.IpcMode.IsContainer() {
  296. ipcContainer := hostConfig.IpcMode.Container()
  297. if c, err := daemon.GetContainer(ipcContainer); err == nil {
  298. hostConfig.IpcMode = containertypes.IpcMode(containerPrefix + c.ID)
  299. }
  300. }
  301. if hostConfig.NetworkMode.IsContainer() {
  302. netContainer := hostConfig.NetworkMode.ConnectedContainer()
  303. if c, err := daemon.GetContainer(netContainer); err == nil {
  304. hostConfig.NetworkMode = containertypes.NetworkMode(containerPrefix + c.ID)
  305. }
  306. }
  307. }
  308. func verifyContainerResources(resources *containertypes.Resources, sysInfo *sysinfo.SysInfo, update bool) ([]string, error) {
  309. warnings := []string{}
  310. fixMemorySwappiness(resources)
  311. // memory subsystem checks and adjustments
  312. if resources.Memory != 0 && resources.Memory < linuxMinMemory {
  313. return warnings, fmt.Errorf("Minimum memory limit allowed is 4MB")
  314. }
  315. if resources.Memory > 0 && !sysInfo.MemoryLimit {
  316. warnings = append(warnings, "Your kernel does not support memory limit capabilities or the cgroup is not mounted. Limitation discarded.")
  317. logrus.Warn("Your kernel does not support memory limit capabilities or the cgroup is not mounted. Limitation discarded.")
  318. resources.Memory = 0
  319. resources.MemorySwap = -1
  320. }
  321. if resources.Memory > 0 && resources.MemorySwap != -1 && !sysInfo.SwapLimit {
  322. warnings = append(warnings, "Your kernel does not support swap limit capabilities or the cgroup is not mounted. Memory limited without swap.")
  323. logrus.Warn("Your kernel does not support swap limit capabilities,or the cgroup is not mounted. Memory limited without swap.")
  324. resources.MemorySwap = -1
  325. }
  326. if resources.Memory > 0 && resources.MemorySwap > 0 && resources.MemorySwap < resources.Memory {
  327. return warnings, fmt.Errorf("Minimum memoryswap limit should be larger than memory limit, see usage")
  328. }
  329. if resources.Memory == 0 && resources.MemorySwap > 0 && !update {
  330. return warnings, fmt.Errorf("You should always set the Memory limit when using Memoryswap limit, see usage")
  331. }
  332. if resources.MemorySwappiness != nil && !sysInfo.MemorySwappiness {
  333. warnings = append(warnings, "Your kernel does not support memory swappiness capabilities or the cgroup is not mounted. Memory swappiness discarded.")
  334. logrus.Warn("Your kernel does not support memory swappiness capabilities, or the cgroup is not mounted. Memory swappiness discarded.")
  335. resources.MemorySwappiness = nil
  336. }
  337. if resources.MemorySwappiness != nil {
  338. swappiness := *resources.MemorySwappiness
  339. if swappiness < 0 || swappiness > 100 {
  340. return warnings, fmt.Errorf("Invalid value: %v, valid memory swappiness range is 0-100", swappiness)
  341. }
  342. }
  343. if resources.MemoryReservation > 0 && !sysInfo.MemoryReservation {
  344. warnings = append(warnings, "Your kernel does not support memory soft limit capabilities or the cgroup is not mounted. Limitation discarded.")
  345. logrus.Warn("Your kernel does not support memory soft limit capabilities or the cgroup is not mounted. Limitation discarded.")
  346. resources.MemoryReservation = 0
  347. }
  348. if resources.MemoryReservation > 0 && resources.MemoryReservation < linuxMinMemory {
  349. return warnings, fmt.Errorf("Minimum memory reservation allowed is 4MB")
  350. }
  351. if resources.Memory > 0 && resources.MemoryReservation > 0 && resources.Memory < resources.MemoryReservation {
  352. return warnings, fmt.Errorf("Minimum memory limit can not be less than memory reservation limit, see usage")
  353. }
  354. if resources.KernelMemory > 0 && !sysInfo.KernelMemory {
  355. warnings = append(warnings, "Your kernel does not support kernel memory limit capabilities or the cgroup is not mounted. Limitation discarded.")
  356. logrus.Warn("Your kernel does not support kernel memory limit capabilities or the cgroup is not mounted. Limitation discarded.")
  357. resources.KernelMemory = 0
  358. }
  359. if resources.KernelMemory > 0 && resources.KernelMemory < linuxMinMemory {
  360. return warnings, fmt.Errorf("Minimum kernel memory limit allowed is 4MB")
  361. }
  362. if resources.KernelMemory > 0 && !kernel.CheckKernelVersion(4, 0, 0) {
  363. warnings = append(warnings, "You specified a kernel memory limit on a kernel older than 4.0. Kernel memory limits are experimental on older kernels, it won't work as expected and can cause your system to be unstable.")
  364. logrus.Warn("You specified a kernel memory limit on a kernel older than 4.0. Kernel memory limits are experimental on older kernels, it won't work as expected and can cause your system to be unstable.")
  365. }
  366. if resources.OomKillDisable != nil && !sysInfo.OomKillDisable {
  367. // only produce warnings if the setting wasn't to *disable* the OOM Kill; no point
  368. // warning the caller if they already wanted the feature to be off
  369. if *resources.OomKillDisable {
  370. warnings = append(warnings, "Your kernel does not support OomKillDisable. OomKillDisable discarded.")
  371. logrus.Warn("Your kernel does not support OomKillDisable. OomKillDisable discarded.")
  372. }
  373. resources.OomKillDisable = nil
  374. }
  375. if resources.PidsLimit != 0 && !sysInfo.PidsLimit {
  376. warnings = append(warnings, "Your kernel does not support pids limit capabilities or the cgroup is not mounted. PIDs limit discarded.")
  377. logrus.Warn("Your kernel does not support pids limit capabilities or the cgroup is not mounted. PIDs limit discarded.")
  378. resources.PidsLimit = 0
  379. }
  380. // cpu subsystem checks and adjustments
  381. if resources.NanoCPUs > 0 && resources.CPUPeriod > 0 {
  382. return warnings, fmt.Errorf("Conflicting options: Nano CPUs and CPU Period cannot both be set")
  383. }
  384. if resources.NanoCPUs > 0 && resources.CPUQuota > 0 {
  385. return warnings, fmt.Errorf("Conflicting options: Nano CPUs and CPU Quota cannot both be set")
  386. }
  387. if resources.NanoCPUs > 0 && (!sysInfo.CPUCfsPeriod || !sysInfo.CPUCfsQuota) {
  388. return warnings, fmt.Errorf("NanoCPUs can not be set, as your kernel does not support CPU cfs period/quota or the cgroup is not mounted")
  389. }
  390. // The highest precision we could get on Linux is 0.001, by setting
  391. // cpu.cfs_period_us=1000ms
  392. // cpu.cfs_quota=1ms
  393. // See the following link for details:
  394. // https://www.kernel.org/doc/Documentation/scheduler/sched-bwc.txt
  395. // Here we don't set the lower limit and it is up to the underlying platform (e.g., Linux) to return an error.
  396. // The error message is 0.01 so that this is consistent with Windows
  397. if resources.NanoCPUs < 0 || resources.NanoCPUs > int64(sysinfo.NumCPU())*1e9 {
  398. return warnings, fmt.Errorf("Range of CPUs is from 0.01 to %d.00, as there are only %d CPUs available", sysinfo.NumCPU(), sysinfo.NumCPU())
  399. }
  400. if resources.CPUShares > 0 && !sysInfo.CPUShares {
  401. warnings = append(warnings, "Your kernel does not support CPU shares or the cgroup is not mounted. Shares discarded.")
  402. logrus.Warn("Your kernel does not support CPU shares or the cgroup is not mounted. Shares discarded.")
  403. resources.CPUShares = 0
  404. }
  405. if resources.CPUPeriod > 0 && !sysInfo.CPUCfsPeriod {
  406. warnings = append(warnings, "Your kernel does not support CPU cfs period or the cgroup is not mounted. Period discarded.")
  407. logrus.Warn("Your kernel does not support CPU cfs period or the cgroup is not mounted. Period discarded.")
  408. resources.CPUPeriod = 0
  409. }
  410. if resources.CPUPeriod != 0 && (resources.CPUPeriod < 1000 || resources.CPUPeriod > 1000000) {
  411. return warnings, fmt.Errorf("CPU cfs period can not be less than 1ms (i.e. 1000) or larger than 1s (i.e. 1000000)")
  412. }
  413. if resources.CPUQuota > 0 && !sysInfo.CPUCfsQuota {
  414. warnings = append(warnings, "Your kernel does not support CPU cfs quota or the cgroup is not mounted. Quota discarded.")
  415. logrus.Warn("Your kernel does not support CPU cfs quota or the cgroup is not mounted. Quota discarded.")
  416. resources.CPUQuota = 0
  417. }
  418. if resources.CPUQuota > 0 && resources.CPUQuota < 1000 {
  419. return warnings, fmt.Errorf("CPU cfs quota can not be less than 1ms (i.e. 1000)")
  420. }
  421. if resources.CPUPercent > 0 {
  422. warnings = append(warnings, fmt.Sprintf("%s does not support CPU percent. Percent discarded.", runtime.GOOS))
  423. logrus.Warnf("%s does not support CPU percent. Percent discarded.", runtime.GOOS)
  424. resources.CPUPercent = 0
  425. }
  426. // cpuset subsystem checks and adjustments
  427. if (resources.CpusetCpus != "" || resources.CpusetMems != "") && !sysInfo.Cpuset {
  428. warnings = append(warnings, "Your kernel does not support cpuset or the cgroup is not mounted. Cpuset discarded.")
  429. logrus.Warn("Your kernel does not support cpuset or the cgroup is not mounted. Cpuset discarded.")
  430. resources.CpusetCpus = ""
  431. resources.CpusetMems = ""
  432. }
  433. cpusAvailable, err := sysInfo.IsCpusetCpusAvailable(resources.CpusetCpus)
  434. if err != nil {
  435. return warnings, fmt.Errorf("Invalid value %s for cpuset cpus", resources.CpusetCpus)
  436. }
  437. if !cpusAvailable {
  438. return warnings, fmt.Errorf("Requested CPUs are not available - requested %s, available: %s", resources.CpusetCpus, sysInfo.Cpus)
  439. }
  440. memsAvailable, err := sysInfo.IsCpusetMemsAvailable(resources.CpusetMems)
  441. if err != nil {
  442. return warnings, fmt.Errorf("Invalid value %s for cpuset mems", resources.CpusetMems)
  443. }
  444. if !memsAvailable {
  445. return warnings, fmt.Errorf("Requested memory nodes are not available - requested %s, available: %s", resources.CpusetMems, sysInfo.Mems)
  446. }
  447. // blkio subsystem checks and adjustments
  448. if resources.BlkioWeight > 0 && !sysInfo.BlkioWeight {
  449. warnings = append(warnings, "Your kernel does not support Block I/O weight or the cgroup is not mounted. Weight discarded.")
  450. logrus.Warn("Your kernel does not support Block I/O weight or the cgroup is not mounted. Weight discarded.")
  451. resources.BlkioWeight = 0
  452. }
  453. if resources.BlkioWeight > 0 && (resources.BlkioWeight < 10 || resources.BlkioWeight > 1000) {
  454. return warnings, fmt.Errorf("Range of blkio weight is from 10 to 1000")
  455. }
  456. if resources.IOMaximumBandwidth != 0 || resources.IOMaximumIOps != 0 {
  457. return warnings, fmt.Errorf("Invalid QoS settings: %s does not support Maximum IO Bandwidth or Maximum IO IOps", runtime.GOOS)
  458. }
  459. if len(resources.BlkioWeightDevice) > 0 && !sysInfo.BlkioWeightDevice {
  460. warnings = append(warnings, "Your kernel does not support Block I/O weight_device or the cgroup is not mounted. Weight-device discarded.")
  461. logrus.Warn("Your kernel does not support Block I/O weight_device or the cgroup is not mounted. Weight-device discarded.")
  462. resources.BlkioWeightDevice = []*pblkiodev.WeightDevice{}
  463. }
  464. if len(resources.BlkioDeviceReadBps) > 0 && !sysInfo.BlkioReadBpsDevice {
  465. warnings = append(warnings, "Your kernel does not support BPS Block I/O read limit or the cgroup is not mounted. Block I/O BPS read limit discarded.")
  466. logrus.Warn("Your kernel does not support BPS Block I/O read limit or the cgroup is not mounted. Block I/O BPS read limit discarded")
  467. resources.BlkioDeviceReadBps = []*pblkiodev.ThrottleDevice{}
  468. }
  469. if len(resources.BlkioDeviceWriteBps) > 0 && !sysInfo.BlkioWriteBpsDevice {
  470. warnings = append(warnings, "Your kernel does not support BPS Block I/O write limit or the cgroup is not mounted. Block I/O BPS write limit discarded.")
  471. logrus.Warn("Your kernel does not support BPS Block I/O write limit or the cgroup is not mounted. Block I/O BPS write limit discarded.")
  472. resources.BlkioDeviceWriteBps = []*pblkiodev.ThrottleDevice{}
  473. }
  474. if len(resources.BlkioDeviceReadIOps) > 0 && !sysInfo.BlkioReadIOpsDevice {
  475. warnings = append(warnings, "Your kernel does not support IOPS Block read limit or the cgroup is not mounted. Block I/O IOPS read limit discarded.")
  476. logrus.Warn("Your kernel does not support IOPS Block I/O read limit in IO or the cgroup is not mounted. Block I/O IOPS read limit discarded.")
  477. resources.BlkioDeviceReadIOps = []*pblkiodev.ThrottleDevice{}
  478. }
  479. if len(resources.BlkioDeviceWriteIOps) > 0 && !sysInfo.BlkioWriteIOpsDevice {
  480. warnings = append(warnings, "Your kernel does not support IOPS Block write limit or the cgroup is not mounted. Block I/O IOPS write limit discarded.")
  481. logrus.Warn("Your kernel does not support IOPS Block I/O write limit or the cgroup is not mounted. Block I/O IOPS write limit discarded.")
  482. resources.BlkioDeviceWriteIOps = []*pblkiodev.ThrottleDevice{}
  483. }
  484. return warnings, nil
  485. }
  486. func (daemon *Daemon) getCgroupDriver() string {
  487. cgroupDriver := cgroupFsDriver
  488. if UsingSystemd(daemon.configStore) {
  489. cgroupDriver = cgroupSystemdDriver
  490. }
  491. return cgroupDriver
  492. }
  493. // getCD gets the raw value of the native.cgroupdriver option, if set.
  494. func getCD(config *config.Config) string {
  495. for _, option := range config.ExecOptions {
  496. key, val, err := parsers.ParseKeyValueOpt(option)
  497. if err != nil || !strings.EqualFold(key, "native.cgroupdriver") {
  498. continue
  499. }
  500. return val
  501. }
  502. return ""
  503. }
  504. // VerifyCgroupDriver validates native.cgroupdriver
  505. func VerifyCgroupDriver(config *config.Config) error {
  506. cd := getCD(config)
  507. if cd == "" || cd == cgroupFsDriver || cd == cgroupSystemdDriver {
  508. return nil
  509. }
  510. return fmt.Errorf("native.cgroupdriver option %s not supported", cd)
  511. }
  512. // UsingSystemd returns true if cli option includes native.cgroupdriver=systemd
  513. func UsingSystemd(config *config.Config) bool {
  514. return getCD(config) == cgroupSystemdDriver
  515. }
  516. // verifyPlatformContainerSettings performs platform-specific validation of the
  517. // hostconfig and config structures.
  518. func verifyPlatformContainerSettings(daemon *Daemon, hostConfig *containertypes.HostConfig, config *containertypes.Config, update bool) ([]string, error) {
  519. var warnings []string
  520. sysInfo := sysinfo.New(true)
  521. w, err := verifyContainerResources(&hostConfig.Resources, sysInfo, update)
  522. // no matter err is nil or not, w could have data in itself.
  523. warnings = append(warnings, w...)
  524. if err != nil {
  525. return warnings, err
  526. }
  527. if hostConfig.ShmSize < 0 {
  528. return warnings, fmt.Errorf("SHM size can not be less than 0")
  529. }
  530. if hostConfig.OomScoreAdj < -1000 || hostConfig.OomScoreAdj > 1000 {
  531. return warnings, fmt.Errorf("Invalid value %d, range for oom score adj is [-1000, 1000]", hostConfig.OomScoreAdj)
  532. }
  533. // ip-forwarding does not affect container with '--net=host' (or '--net=none')
  534. if sysInfo.IPv4ForwardingDisabled && !(hostConfig.NetworkMode.IsHost() || hostConfig.NetworkMode.IsNone()) {
  535. warnings = append(warnings, "IPv4 forwarding is disabled. Networking will not work.")
  536. logrus.Warn("IPv4 forwarding is disabled. Networking will not work")
  537. }
  538. // check for various conflicting options with user namespaces
  539. if daemon.configStore.RemappedRoot != "" && hostConfig.UsernsMode.IsPrivate() {
  540. if hostConfig.Privileged {
  541. return warnings, fmt.Errorf("privileged mode is incompatible with user namespaces. You must run the container in the host namespace when running privileged mode")
  542. }
  543. if hostConfig.NetworkMode.IsHost() && !hostConfig.UsernsMode.IsHost() {
  544. return warnings, fmt.Errorf("cannot share the host's network namespace when user namespaces are enabled")
  545. }
  546. if hostConfig.PidMode.IsHost() && !hostConfig.UsernsMode.IsHost() {
  547. return warnings, fmt.Errorf("cannot share the host PID namespace when user namespaces are enabled")
  548. }
  549. }
  550. if hostConfig.CgroupParent != "" && UsingSystemd(daemon.configStore) {
  551. // CgroupParent for systemd cgroup should be named as "xxx.slice"
  552. if len(hostConfig.CgroupParent) <= 6 || !strings.HasSuffix(hostConfig.CgroupParent, ".slice") {
  553. return warnings, fmt.Errorf("cgroup-parent for systemd cgroup should be a valid slice named as \"xxx.slice\"")
  554. }
  555. }
  556. if hostConfig.Runtime == "" {
  557. hostConfig.Runtime = daemon.configStore.GetDefaultRuntimeName()
  558. }
  559. if rt := daemon.configStore.GetRuntime(hostConfig.Runtime); rt == nil {
  560. return warnings, fmt.Errorf("Unknown runtime specified %s", hostConfig.Runtime)
  561. }
  562. parser := volume.NewParser(runtime.GOOS)
  563. for dest := range hostConfig.Tmpfs {
  564. if err := parser.ValidateTmpfsMountDestination(dest); err != nil {
  565. return warnings, err
  566. }
  567. }
  568. return warnings, nil
  569. }
  570. func (daemon *Daemon) loadRuntimes() error {
  571. return daemon.initRuntimes(daemon.configStore.Runtimes)
  572. }
  573. func (daemon *Daemon) initRuntimes(runtimes map[string]types.Runtime) (err error) {
  574. runtimeDir := filepath.Join(daemon.configStore.Root, "runtimes")
  575. // Remove old temp directory if any
  576. os.RemoveAll(runtimeDir + "-old")
  577. tmpDir, err := ioutils.TempDir(daemon.configStore.Root, "gen-runtimes")
  578. if err != nil {
  579. return errors.Wrapf(err, "failed to get temp dir to generate runtime scripts")
  580. }
  581. defer func() {
  582. if err != nil {
  583. if err1 := os.RemoveAll(tmpDir); err1 != nil {
  584. logrus.WithError(err1).WithField("dir", tmpDir).
  585. Warnf("failed to remove tmp dir")
  586. }
  587. return
  588. }
  589. if err = os.Rename(runtimeDir, runtimeDir+"-old"); err != nil {
  590. return
  591. }
  592. if err = os.Rename(tmpDir, runtimeDir); err != nil {
  593. err = errors.Wrapf(err, "failed to setup runtimes dir, new containers may not start")
  594. return
  595. }
  596. if err = os.RemoveAll(runtimeDir + "-old"); err != nil {
  597. logrus.WithError(err).WithField("dir", tmpDir).
  598. Warnf("failed to remove old runtimes dir")
  599. }
  600. }()
  601. for name, rt := range runtimes {
  602. if len(rt.Args) == 0 {
  603. continue
  604. }
  605. script := filepath.Join(tmpDir, name)
  606. content := fmt.Sprintf("#!/bin/sh\n%s %s $@\n", rt.Path, strings.Join(rt.Args, " "))
  607. if err := ioutil.WriteFile(script, []byte(content), 0700); err != nil {
  608. return err
  609. }
  610. }
  611. return nil
  612. }
  613. // verifyDaemonSettings performs validation of daemon config struct
  614. func verifyDaemonSettings(conf *config.Config) error {
  615. // Check for mutually incompatible config options
  616. if conf.BridgeConfig.Iface != "" && conf.BridgeConfig.IP != "" {
  617. return fmt.Errorf("You specified -b & --bip, mutually exclusive options. Please specify only one")
  618. }
  619. if !conf.BridgeConfig.EnableIPTables && !conf.BridgeConfig.InterContainerCommunication {
  620. return fmt.Errorf("You specified --iptables=false with --icc=false. ICC=false uses iptables to function. Please set --icc or --iptables to true")
  621. }
  622. if !conf.BridgeConfig.EnableIPTables && conf.BridgeConfig.EnableIPMasq {
  623. conf.BridgeConfig.EnableIPMasq = false
  624. }
  625. if err := VerifyCgroupDriver(conf); err != nil {
  626. return err
  627. }
  628. if conf.CgroupParent != "" && UsingSystemd(conf) {
  629. if len(conf.CgroupParent) <= 6 || !strings.HasSuffix(conf.CgroupParent, ".slice") {
  630. return fmt.Errorf("cgroup-parent for systemd cgroup should be a valid slice named as \"xxx.slice\"")
  631. }
  632. }
  633. if conf.DefaultRuntime == "" {
  634. conf.DefaultRuntime = config.StockRuntimeName
  635. }
  636. if conf.Runtimes == nil {
  637. conf.Runtimes = make(map[string]types.Runtime)
  638. }
  639. conf.Runtimes[config.StockRuntimeName] = types.Runtime{Path: DefaultRuntimeName}
  640. return nil
  641. }
  642. // checkSystem validates platform-specific requirements
  643. func checkSystem() error {
  644. if os.Geteuid() != 0 {
  645. return fmt.Errorf("The Docker daemon needs to be run as root")
  646. }
  647. return checkKernel()
  648. }
  649. // configureMaxThreads sets the Go runtime max threads threshold
  650. // which is 90% of the kernel setting from /proc/sys/kernel/threads-max
  651. func configureMaxThreads(config *config.Config) error {
  652. mt, err := ioutil.ReadFile("/proc/sys/kernel/threads-max")
  653. if err != nil {
  654. return err
  655. }
  656. mtint, err := strconv.Atoi(strings.TrimSpace(string(mt)))
  657. if err != nil {
  658. return err
  659. }
  660. maxThreads := (mtint / 100) * 90
  661. debug.SetMaxThreads(maxThreads)
  662. logrus.Debugf("Golang's threads limit set to %d", maxThreads)
  663. return nil
  664. }
  665. func overlaySupportsSelinux() (bool, error) {
  666. f, err := os.Open("/proc/kallsyms")
  667. if err != nil {
  668. if os.IsNotExist(err) {
  669. return false, nil
  670. }
  671. return false, err
  672. }
  673. defer f.Close()
  674. var symAddr, symType, symName, text string
  675. s := bufio.NewScanner(f)
  676. for s.Scan() {
  677. if err := s.Err(); err != nil {
  678. return false, err
  679. }
  680. text = s.Text()
  681. if _, err := fmt.Sscanf(text, "%s %s %s", &symAddr, &symType, &symName); err != nil {
  682. return false, fmt.Errorf("Scanning '%s' failed: %s", text, err)
  683. }
  684. // Check for presence of symbol security_inode_copy_up.
  685. if symName == "security_inode_copy_up" {
  686. return true, nil
  687. }
  688. }
  689. return false, nil
  690. }
  691. // configureKernelSecuritySupport configures and validates security support for the kernel
  692. func configureKernelSecuritySupport(config *config.Config, driverName string) error {
  693. if config.EnableSelinuxSupport {
  694. if !selinuxEnabled() {
  695. logrus.Warn("Docker could not enable SELinux on the host system")
  696. return nil
  697. }
  698. if driverName == "overlay" || driverName == "overlay2" {
  699. // If driver is overlay or overlay2, make sure kernel
  700. // supports selinux with overlay.
  701. supported, err := overlaySupportsSelinux()
  702. if err != nil {
  703. return err
  704. }
  705. if !supported {
  706. logrus.Warnf("SELinux is not supported with the %v graph driver on this kernel", driverName)
  707. }
  708. }
  709. } else {
  710. selinuxSetDisabled()
  711. }
  712. return nil
  713. }
  714. func (daemon *Daemon) initNetworkController(config *config.Config, activeSandboxes map[string]interface{}) (libnetwork.NetworkController, error) {
  715. netOptions, err := daemon.networkOptions(config, daemon.PluginStore, activeSandboxes)
  716. if err != nil {
  717. return nil, err
  718. }
  719. controller, err := libnetwork.New(netOptions...)
  720. if err != nil {
  721. return nil, fmt.Errorf("error obtaining controller instance: %v", err)
  722. }
  723. if len(activeSandboxes) > 0 {
  724. logrus.Info("There are old running containers, the network config will not take affect")
  725. return controller, nil
  726. }
  727. // Initialize default network on "null"
  728. if n, _ := controller.NetworkByName("none"); n == nil {
  729. if _, err := controller.NewNetwork("null", "none", "", libnetwork.NetworkOptionPersist(true)); err != nil {
  730. return nil, fmt.Errorf("Error creating default \"null\" network: %v", err)
  731. }
  732. }
  733. // Initialize default network on "host"
  734. if n, _ := controller.NetworkByName("host"); n == nil {
  735. if _, err := controller.NewNetwork("host", "host", "", libnetwork.NetworkOptionPersist(true)); err != nil {
  736. return nil, fmt.Errorf("Error creating default \"host\" network: %v", err)
  737. }
  738. }
  739. // Clear stale bridge network
  740. if n, err := controller.NetworkByName("bridge"); err == nil {
  741. if err = n.Delete(); err != nil {
  742. return nil, fmt.Errorf("could not delete the default bridge network: %v", err)
  743. }
  744. }
  745. if !config.DisableBridge {
  746. // Initialize default driver "bridge"
  747. if err := initBridgeDriver(controller, config); err != nil {
  748. return nil, err
  749. }
  750. } else {
  751. removeDefaultBridgeInterface()
  752. }
  753. return controller, nil
  754. }
  755. func driverOptions(config *config.Config) []nwconfig.Option {
  756. bridgeConfig := options.Generic{
  757. "EnableIPForwarding": config.BridgeConfig.EnableIPForward,
  758. "EnableIPTables": config.BridgeConfig.EnableIPTables,
  759. "EnableUserlandProxy": config.BridgeConfig.EnableUserlandProxy,
  760. "UserlandProxyPath": config.BridgeConfig.UserlandProxyPath}
  761. bridgeOption := options.Generic{netlabel.GenericData: bridgeConfig}
  762. dOptions := []nwconfig.Option{}
  763. dOptions = append(dOptions, nwconfig.OptionDriverConfig("bridge", bridgeOption))
  764. return dOptions
  765. }
  766. func initBridgeDriver(controller libnetwork.NetworkController, config *config.Config) error {
  767. bridgeName := bridge.DefaultBridgeName
  768. if config.BridgeConfig.Iface != "" {
  769. bridgeName = config.BridgeConfig.Iface
  770. }
  771. netOption := map[string]string{
  772. bridge.BridgeName: bridgeName,
  773. bridge.DefaultBridge: strconv.FormatBool(true),
  774. netlabel.DriverMTU: strconv.Itoa(config.Mtu),
  775. bridge.EnableIPMasquerade: strconv.FormatBool(config.BridgeConfig.EnableIPMasq),
  776. bridge.EnableICC: strconv.FormatBool(config.BridgeConfig.InterContainerCommunication),
  777. }
  778. // --ip processing
  779. if config.BridgeConfig.DefaultIP != nil {
  780. netOption[bridge.DefaultBindingIP] = config.BridgeConfig.DefaultIP.String()
  781. }
  782. var (
  783. ipamV4Conf *libnetwork.IpamConf
  784. ipamV6Conf *libnetwork.IpamConf
  785. )
  786. ipamV4Conf = &libnetwork.IpamConf{AuxAddresses: make(map[string]string)}
  787. nwList, nw6List, err := netutils.ElectInterfaceAddresses(bridgeName)
  788. if err != nil {
  789. return errors.Wrap(err, "list bridge addresses failed")
  790. }
  791. nw := nwList[0]
  792. if len(nwList) > 1 && config.BridgeConfig.FixedCIDR != "" {
  793. _, fCIDR, err := net.ParseCIDR(config.BridgeConfig.FixedCIDR)
  794. if err != nil {
  795. return errors.Wrap(err, "parse CIDR failed")
  796. }
  797. // Iterate through in case there are multiple addresses for the bridge
  798. for _, entry := range nwList {
  799. if fCIDR.Contains(entry.IP) {
  800. nw = entry
  801. break
  802. }
  803. }
  804. }
  805. ipamV4Conf.PreferredPool = lntypes.GetIPNetCanonical(nw).String()
  806. hip, _ := lntypes.GetHostPartIP(nw.IP, nw.Mask)
  807. if hip.IsGlobalUnicast() {
  808. ipamV4Conf.Gateway = nw.IP.String()
  809. }
  810. if config.BridgeConfig.IP != "" {
  811. ipamV4Conf.PreferredPool = config.BridgeConfig.IP
  812. ip, _, err := net.ParseCIDR(config.BridgeConfig.IP)
  813. if err != nil {
  814. return err
  815. }
  816. ipamV4Conf.Gateway = ip.String()
  817. } else if bridgeName == bridge.DefaultBridgeName && ipamV4Conf.PreferredPool != "" {
  818. logrus.Infof("Default bridge (%s) is assigned with an IP address %s. Daemon option --bip can be used to set a preferred IP address", bridgeName, ipamV4Conf.PreferredPool)
  819. }
  820. if config.BridgeConfig.FixedCIDR != "" {
  821. _, fCIDR, err := net.ParseCIDR(config.BridgeConfig.FixedCIDR)
  822. if err != nil {
  823. return err
  824. }
  825. ipamV4Conf.SubPool = fCIDR.String()
  826. }
  827. if config.BridgeConfig.DefaultGatewayIPv4 != nil {
  828. ipamV4Conf.AuxAddresses["DefaultGatewayIPv4"] = config.BridgeConfig.DefaultGatewayIPv4.String()
  829. }
  830. var deferIPv6Alloc bool
  831. if config.BridgeConfig.FixedCIDRv6 != "" {
  832. _, fCIDRv6, err := net.ParseCIDR(config.BridgeConfig.FixedCIDRv6)
  833. if err != nil {
  834. return err
  835. }
  836. // In case user has specified the daemon flag --fixed-cidr-v6 and the passed network has
  837. // at least 48 host bits, we need to guarantee the current behavior where the containers'
  838. // IPv6 addresses will be constructed based on the containers' interface MAC address.
  839. // We do so by telling libnetwork to defer the IPv6 address allocation for the endpoints
  840. // on this network until after the driver has created the endpoint and returned the
  841. // constructed address. Libnetwork will then reserve this address with the ipam driver.
  842. ones, _ := fCIDRv6.Mask.Size()
  843. deferIPv6Alloc = ones <= 80
  844. if ipamV6Conf == nil {
  845. ipamV6Conf = &libnetwork.IpamConf{AuxAddresses: make(map[string]string)}
  846. }
  847. ipamV6Conf.PreferredPool = fCIDRv6.String()
  848. // In case the --fixed-cidr-v6 is specified and the current docker0 bridge IPv6
  849. // address belongs to the same network, we need to inform libnetwork about it, so
  850. // that it can be reserved with IPAM and it will not be given away to somebody else
  851. for _, nw6 := range nw6List {
  852. if fCIDRv6.Contains(nw6.IP) {
  853. ipamV6Conf.Gateway = nw6.IP.String()
  854. break
  855. }
  856. }
  857. }
  858. if config.BridgeConfig.DefaultGatewayIPv6 != nil {
  859. if ipamV6Conf == nil {
  860. ipamV6Conf = &libnetwork.IpamConf{AuxAddresses: make(map[string]string)}
  861. }
  862. ipamV6Conf.AuxAddresses["DefaultGatewayIPv6"] = config.BridgeConfig.DefaultGatewayIPv6.String()
  863. }
  864. v4Conf := []*libnetwork.IpamConf{ipamV4Conf}
  865. v6Conf := []*libnetwork.IpamConf{}
  866. if ipamV6Conf != nil {
  867. v6Conf = append(v6Conf, ipamV6Conf)
  868. }
  869. // Initialize default network on "bridge" with the same name
  870. _, err = controller.NewNetwork("bridge", "bridge", "",
  871. libnetwork.NetworkOptionEnableIPv6(config.BridgeConfig.EnableIPv6),
  872. libnetwork.NetworkOptionDriverOpts(netOption),
  873. libnetwork.NetworkOptionIpam("default", "", v4Conf, v6Conf, nil),
  874. libnetwork.NetworkOptionDeferIPv6Alloc(deferIPv6Alloc))
  875. if err != nil {
  876. return fmt.Errorf("Error creating default \"bridge\" network: %v", err)
  877. }
  878. return nil
  879. }
  880. // Remove default bridge interface if present (--bridge=none use case)
  881. func removeDefaultBridgeInterface() {
  882. if lnk, err := netlink.LinkByName(bridge.DefaultBridgeName); err == nil {
  883. if err := netlink.LinkDel(lnk); err != nil {
  884. logrus.Warnf("Failed to remove bridge interface (%s): %v", bridge.DefaultBridgeName, err)
  885. }
  886. }
  887. }
  888. func setupInitLayer(idMappings *idtools.IDMappings) func(containerfs.ContainerFS) error {
  889. return func(initPath containerfs.ContainerFS) error {
  890. return initlayer.Setup(initPath, idMappings.RootPair())
  891. }
  892. }
  893. // Parse the remapped root (user namespace) option, which can be one of:
  894. // username - valid username from /etc/passwd
  895. // username:groupname - valid username; valid groupname from /etc/group
  896. // uid - 32-bit unsigned int valid Linux UID value
  897. // uid:gid - uid value; 32-bit unsigned int Linux GID value
  898. //
  899. // If no groupname is specified, and a username is specified, an attempt
  900. // will be made to lookup a gid for that username as a groupname
  901. //
  902. // If names are used, they are verified to exist in passwd/group
  903. func parseRemappedRoot(usergrp string) (string, string, error) {
  904. var (
  905. userID, groupID int
  906. username, groupname string
  907. )
  908. idparts := strings.Split(usergrp, ":")
  909. if len(idparts) > 2 {
  910. return "", "", fmt.Errorf("Invalid user/group specification in --userns-remap: %q", usergrp)
  911. }
  912. if uid, err := strconv.ParseInt(idparts[0], 10, 32); err == nil {
  913. // must be a uid; take it as valid
  914. userID = int(uid)
  915. luser, err := idtools.LookupUID(userID)
  916. if err != nil {
  917. return "", "", fmt.Errorf("Uid %d has no entry in /etc/passwd: %v", userID, err)
  918. }
  919. username = luser.Name
  920. if len(idparts) == 1 {
  921. // if the uid was numeric and no gid was specified, take the uid as the gid
  922. groupID = userID
  923. lgrp, err := idtools.LookupGID(groupID)
  924. if err != nil {
  925. return "", "", fmt.Errorf("Gid %d has no entry in /etc/group: %v", groupID, err)
  926. }
  927. groupname = lgrp.Name
  928. }
  929. } else {
  930. lookupName := idparts[0]
  931. // special case: if the user specified "default", they want Docker to create or
  932. // use (after creation) the "dockremap" user/group for root remapping
  933. if lookupName == defaultIDSpecifier {
  934. lookupName = defaultRemappedID
  935. }
  936. luser, err := idtools.LookupUser(lookupName)
  937. if err != nil && idparts[0] != defaultIDSpecifier {
  938. // error if the name requested isn't the special "dockremap" ID
  939. return "", "", fmt.Errorf("Error during uid lookup for %q: %v", lookupName, err)
  940. } else if err != nil {
  941. // special case-- if the username == "default", then we have been asked
  942. // to create a new entry pair in /etc/{passwd,group} for which the /etc/sub{uid,gid}
  943. // ranges will be used for the user and group mappings in user namespaced containers
  944. _, _, err := idtools.AddNamespaceRangesUser(defaultRemappedID)
  945. if err == nil {
  946. return defaultRemappedID, defaultRemappedID, nil
  947. }
  948. return "", "", fmt.Errorf("Error during %q user creation: %v", defaultRemappedID, err)
  949. }
  950. username = luser.Name
  951. if len(idparts) == 1 {
  952. // we only have a string username, and no group specified; look up gid from username as group
  953. group, err := idtools.LookupGroup(lookupName)
  954. if err != nil {
  955. return "", "", fmt.Errorf("Error during gid lookup for %q: %v", lookupName, err)
  956. }
  957. groupname = group.Name
  958. }
  959. }
  960. if len(idparts) == 2 {
  961. // groupname or gid is separately specified and must be resolved
  962. // to an unsigned 32-bit gid
  963. if gid, err := strconv.ParseInt(idparts[1], 10, 32); err == nil {
  964. // must be a gid, take it as valid
  965. groupID = int(gid)
  966. lgrp, err := idtools.LookupGID(groupID)
  967. if err != nil {
  968. return "", "", fmt.Errorf("Gid %d has no entry in /etc/passwd: %v", groupID, err)
  969. }
  970. groupname = lgrp.Name
  971. } else {
  972. // not a number; attempt a lookup
  973. if _, err := idtools.LookupGroup(idparts[1]); err != nil {
  974. return "", "", fmt.Errorf("Error during groupname lookup for %q: %v", idparts[1], err)
  975. }
  976. groupname = idparts[1]
  977. }
  978. }
  979. return username, groupname, nil
  980. }
  981. func setupRemappedRoot(config *config.Config) (*idtools.IDMappings, error) {
  982. if runtime.GOOS != "linux" && config.RemappedRoot != "" {
  983. return nil, fmt.Errorf("User namespaces are only supported on Linux")
  984. }
  985. // if the daemon was started with remapped root option, parse
  986. // the config option to the int uid,gid values
  987. if config.RemappedRoot != "" {
  988. username, groupname, err := parseRemappedRoot(config.RemappedRoot)
  989. if err != nil {
  990. return nil, err
  991. }
  992. if username == "root" {
  993. // Cannot setup user namespaces with a 1-to-1 mapping; "--root=0:0" is a no-op
  994. // effectively
  995. logrus.Warn("User namespaces: root cannot be remapped with itself; user namespaces are OFF")
  996. return &idtools.IDMappings{}, nil
  997. }
  998. logrus.Infof("User namespaces: ID ranges will be mapped to subuid/subgid ranges of: %s:%s", username, groupname)
  999. // update remapped root setting now that we have resolved them to actual names
  1000. config.RemappedRoot = fmt.Sprintf("%s:%s", username, groupname)
  1001. mappings, err := idtools.NewIDMappings(username, groupname)
  1002. if err != nil {
  1003. return nil, errors.Wrapf(err, "Can't create ID mappings: %v")
  1004. }
  1005. return mappings, nil
  1006. }
  1007. return &idtools.IDMappings{}, nil
  1008. }
  1009. func setupDaemonRoot(config *config.Config, rootDir string, rootIDs idtools.IDPair) error {
  1010. config.Root = rootDir
  1011. // the docker root metadata directory needs to have execute permissions for all users (g+x,o+x)
  1012. // so that syscalls executing as non-root, operating on subdirectories of the graph root
  1013. // (e.g. mounted layers of a container) can traverse this path.
  1014. // The user namespace support will create subdirectories for the remapped root host uid:gid
  1015. // pair owned by that same uid:gid pair for proper write access to those needed metadata and
  1016. // layer content subtrees.
  1017. if _, err := os.Stat(rootDir); err == nil {
  1018. // root current exists; verify the access bits are correct by setting them
  1019. if err = os.Chmod(rootDir, 0711); err != nil {
  1020. return err
  1021. }
  1022. } else if os.IsNotExist(err) {
  1023. // no root exists yet, create it 0711 with root:root ownership
  1024. if err := os.MkdirAll(rootDir, 0711); err != nil {
  1025. return err
  1026. }
  1027. }
  1028. // if user namespaces are enabled we will create a subtree underneath the specified root
  1029. // with any/all specified remapped root uid/gid options on the daemon creating
  1030. // a new subdirectory with ownership set to the remapped uid/gid (so as to allow
  1031. // `chdir()` to work for containers namespaced to that uid/gid)
  1032. if config.RemappedRoot != "" {
  1033. config.Root = filepath.Join(rootDir, fmt.Sprintf("%d.%d", rootIDs.UID, rootIDs.GID))
  1034. logrus.Debugf("Creating user namespaced daemon root: %s", config.Root)
  1035. // Create the root directory if it doesn't exist
  1036. if err := idtools.MkdirAllAndChown(config.Root, 0700, rootIDs); err != nil {
  1037. return fmt.Errorf("Cannot create daemon root: %s: %v", config.Root, err)
  1038. }
  1039. // we also need to verify that any pre-existing directories in the path to
  1040. // the graphroot won't block access to remapped root--if any pre-existing directory
  1041. // has strict permissions that don't allow "x", container start will fail, so
  1042. // better to warn and fail now
  1043. dirPath := config.Root
  1044. for {
  1045. dirPath = filepath.Dir(dirPath)
  1046. if dirPath == "/" {
  1047. break
  1048. }
  1049. if !idtools.CanAccess(dirPath, rootIDs) {
  1050. return fmt.Errorf("a subdirectory in your graphroot path (%s) restricts access to the remapped root uid/gid; please fix by allowing 'o+x' permissions on existing directories", config.Root)
  1051. }
  1052. }
  1053. }
  1054. if err := ensureSharedOrSlave(config.Root); err != nil {
  1055. if err := mount.MakeShared(config.Root); err != nil {
  1056. logrus.WithError(err).WithField("dir", config.Root).Warn("Could not set daemon root propagation to shared, this is not generally critical but may cause some functionality to not work or fallback to less desirable behavior")
  1057. }
  1058. }
  1059. return nil
  1060. }
  1061. // registerLinks writes the links to a file.
  1062. func (daemon *Daemon) registerLinks(container *container.Container, hostConfig *containertypes.HostConfig) error {
  1063. if hostConfig == nil || hostConfig.NetworkMode.IsUserDefined() {
  1064. return nil
  1065. }
  1066. for _, l := range hostConfig.Links {
  1067. name, alias, err := opts.ParseLink(l)
  1068. if err != nil {
  1069. return err
  1070. }
  1071. child, err := daemon.GetContainer(name)
  1072. if err != nil {
  1073. return errors.Wrapf(err, "could not get container for %s", name)
  1074. }
  1075. for child.HostConfig.NetworkMode.IsContainer() {
  1076. parts := strings.SplitN(string(child.HostConfig.NetworkMode), ":", 2)
  1077. child, err = daemon.GetContainer(parts[1])
  1078. if err != nil {
  1079. return errors.Wrapf(err, "Could not get container for %s", parts[1])
  1080. }
  1081. }
  1082. if child.HostConfig.NetworkMode.IsHost() {
  1083. return runconfig.ErrConflictHostNetworkAndLinks
  1084. }
  1085. if err := daemon.registerLink(container, child, alias); err != nil {
  1086. return err
  1087. }
  1088. }
  1089. // After we load all the links into the daemon
  1090. // set them to nil on the hostconfig
  1091. _, err := container.WriteHostConfig()
  1092. return err
  1093. }
  1094. // conditionalMountOnStart is a platform specific helper function during the
  1095. // container start to call mount.
  1096. func (daemon *Daemon) conditionalMountOnStart(container *container.Container) error {
  1097. return daemon.Mount(container)
  1098. }
  1099. // conditionalUnmountOnCleanup is a platform specific helper function called
  1100. // during the cleanup of a container to unmount.
  1101. func (daemon *Daemon) conditionalUnmountOnCleanup(container *container.Container) error {
  1102. return daemon.Unmount(container)
  1103. }
  1104. func copyBlkioEntry(entries []*containerd_cgroups.BlkIOEntry) []types.BlkioStatEntry {
  1105. out := make([]types.BlkioStatEntry, len(entries))
  1106. for i, re := range entries {
  1107. out[i] = types.BlkioStatEntry{
  1108. Major: re.Major,
  1109. Minor: re.Minor,
  1110. Op: re.Op,
  1111. Value: re.Value,
  1112. }
  1113. }
  1114. return out
  1115. }
  1116. func (daemon *Daemon) stats(c *container.Container) (*types.StatsJSON, error) {
  1117. if !c.IsRunning() {
  1118. return nil, errNotRunning(c.ID)
  1119. }
  1120. cs, err := daemon.containerd.Stats(context.Background(), c.ID)
  1121. if err != nil {
  1122. if strings.Contains(err.Error(), "container not found") {
  1123. return nil, containerNotFound(c.ID)
  1124. }
  1125. return nil, err
  1126. }
  1127. s := &types.StatsJSON{}
  1128. s.Read = cs.Read
  1129. stats := cs.Metrics
  1130. if stats.Blkio != nil {
  1131. s.BlkioStats = types.BlkioStats{
  1132. IoServiceBytesRecursive: copyBlkioEntry(stats.Blkio.IoServiceBytesRecursive),
  1133. IoServicedRecursive: copyBlkioEntry(stats.Blkio.IoServicedRecursive),
  1134. IoQueuedRecursive: copyBlkioEntry(stats.Blkio.IoQueuedRecursive),
  1135. IoServiceTimeRecursive: copyBlkioEntry(stats.Blkio.IoServiceTimeRecursive),
  1136. IoWaitTimeRecursive: copyBlkioEntry(stats.Blkio.IoWaitTimeRecursive),
  1137. IoMergedRecursive: copyBlkioEntry(stats.Blkio.IoMergedRecursive),
  1138. IoTimeRecursive: copyBlkioEntry(stats.Blkio.IoTimeRecursive),
  1139. SectorsRecursive: copyBlkioEntry(stats.Blkio.SectorsRecursive),
  1140. }
  1141. }
  1142. if stats.CPU != nil {
  1143. s.CPUStats = types.CPUStats{
  1144. CPUUsage: types.CPUUsage{
  1145. TotalUsage: stats.CPU.Usage.Total,
  1146. PercpuUsage: stats.CPU.Usage.PerCPU,
  1147. UsageInKernelmode: stats.CPU.Usage.Kernel,
  1148. UsageInUsermode: stats.CPU.Usage.User,
  1149. },
  1150. ThrottlingData: types.ThrottlingData{
  1151. Periods: stats.CPU.Throttling.Periods,
  1152. ThrottledPeriods: stats.CPU.Throttling.ThrottledPeriods,
  1153. ThrottledTime: stats.CPU.Throttling.ThrottledTime,
  1154. },
  1155. }
  1156. }
  1157. if stats.Memory != nil {
  1158. raw := make(map[string]uint64)
  1159. raw["cache"] = stats.Memory.Cache
  1160. raw["rss"] = stats.Memory.RSS
  1161. raw["rss_huge"] = stats.Memory.RSSHuge
  1162. raw["mapped_file"] = stats.Memory.MappedFile
  1163. raw["dirty"] = stats.Memory.Dirty
  1164. raw["writeback"] = stats.Memory.Writeback
  1165. raw["pgpgin"] = stats.Memory.PgPgIn
  1166. raw["pgpgout"] = stats.Memory.PgPgOut
  1167. raw["pgfault"] = stats.Memory.PgFault
  1168. raw["pgmajfault"] = stats.Memory.PgMajFault
  1169. raw["inactive_anon"] = stats.Memory.InactiveAnon
  1170. raw["active_anon"] = stats.Memory.ActiveAnon
  1171. raw["inactive_file"] = stats.Memory.InactiveFile
  1172. raw["active_file"] = stats.Memory.ActiveFile
  1173. raw["unevictable"] = stats.Memory.Unevictable
  1174. raw["hierarchical_memory_limit"] = stats.Memory.HierarchicalMemoryLimit
  1175. raw["hierarchical_memsw_limit"] = stats.Memory.HierarchicalSwapLimit
  1176. raw["total_cache"] = stats.Memory.TotalCache
  1177. raw["total_rss"] = stats.Memory.TotalRSS
  1178. raw["total_rss_huge"] = stats.Memory.TotalRSSHuge
  1179. raw["total_mapped_file"] = stats.Memory.TotalMappedFile
  1180. raw["total_dirty"] = stats.Memory.TotalDirty
  1181. raw["total_writeback"] = stats.Memory.TotalWriteback
  1182. raw["total_pgpgin"] = stats.Memory.TotalPgPgIn
  1183. raw["total_pgpgout"] = stats.Memory.TotalPgPgOut
  1184. raw["total_pgfault"] = stats.Memory.TotalPgFault
  1185. raw["total_pgmajfault"] = stats.Memory.TotalPgMajFault
  1186. raw["total_inactive_anon"] = stats.Memory.TotalInactiveAnon
  1187. raw["total_active_anon"] = stats.Memory.TotalActiveAnon
  1188. raw["total_inactive_file"] = stats.Memory.TotalInactiveFile
  1189. raw["total_active_file"] = stats.Memory.TotalActiveFile
  1190. raw["total_unevictable"] = stats.Memory.TotalUnevictable
  1191. if stats.Memory.Usage != nil {
  1192. s.MemoryStats = types.MemoryStats{
  1193. Stats: raw,
  1194. Usage: stats.Memory.Usage.Usage,
  1195. MaxUsage: stats.Memory.Usage.Max,
  1196. Limit: stats.Memory.Usage.Limit,
  1197. Failcnt: stats.Memory.Usage.Failcnt,
  1198. }
  1199. } else {
  1200. s.MemoryStats = types.MemoryStats{
  1201. Stats: raw,
  1202. }
  1203. }
  1204. // if the container does not set memory limit, use the machineMemory
  1205. if s.MemoryStats.Limit > daemon.machineMemory && daemon.machineMemory > 0 {
  1206. s.MemoryStats.Limit = daemon.machineMemory
  1207. }
  1208. }
  1209. if stats.Pids != nil {
  1210. s.PidsStats = types.PidsStats{
  1211. Current: stats.Pids.Current,
  1212. Limit: stats.Pids.Limit,
  1213. }
  1214. }
  1215. return s, nil
  1216. }
  1217. // setDefaultIsolation determines the default isolation mode for the
  1218. // daemon to run in. This is only applicable on Windows
  1219. func (daemon *Daemon) setDefaultIsolation() error {
  1220. return nil
  1221. }
  1222. func rootFSToAPIType(rootfs *image.RootFS) types.RootFS {
  1223. var layers []string
  1224. for _, l := range rootfs.DiffIDs {
  1225. layers = append(layers, l.String())
  1226. }
  1227. return types.RootFS{
  1228. Type: rootfs.Type,
  1229. Layers: layers,
  1230. }
  1231. }
  1232. // setupDaemonProcess sets various settings for the daemon's process
  1233. func setupDaemonProcess(config *config.Config) error {
  1234. // setup the daemons oom_score_adj
  1235. if err := setupOOMScoreAdj(config.OOMScoreAdjust); err != nil {
  1236. return err
  1237. }
  1238. if err := setMayDetachMounts(); err != nil {
  1239. logrus.WithError(err).Warn("Could not set may_detach_mounts kernel parameter")
  1240. }
  1241. return nil
  1242. }
  1243. // This is used to allow removal of mountpoints that may be mounted in other
  1244. // namespaces on RHEL based kernels starting from RHEL 7.4.
  1245. // Without this setting, removals on these RHEL based kernels may fail with
  1246. // "device or resource busy".
  1247. // This setting is not available in upstream kernels as it is not configurable,
  1248. // but has been in the upstream kernels since 3.15.
  1249. func setMayDetachMounts() error {
  1250. f, err := os.OpenFile("/proc/sys/fs/may_detach_mounts", os.O_WRONLY, 0)
  1251. if err != nil {
  1252. if os.IsNotExist(err) {
  1253. return nil
  1254. }
  1255. return errors.Wrap(err, "error opening may_detach_mounts kernel config file")
  1256. }
  1257. defer f.Close()
  1258. _, err = f.WriteString("1")
  1259. if os.IsPermission(err) {
  1260. // Setting may_detach_mounts does not work in an
  1261. // unprivileged container. Ignore the error, but log
  1262. // it if we appear not to be in that situation.
  1263. if !rsystem.RunningInUserNS() {
  1264. logrus.Debugf("Permission denied writing %q to /proc/sys/fs/may_detach_mounts", "1")
  1265. }
  1266. return nil
  1267. }
  1268. return err
  1269. }
  1270. func setupOOMScoreAdj(score int) error {
  1271. f, err := os.OpenFile("/proc/self/oom_score_adj", os.O_WRONLY, 0)
  1272. if err != nil {
  1273. return err
  1274. }
  1275. defer f.Close()
  1276. stringScore := strconv.Itoa(score)
  1277. _, err = f.WriteString(stringScore)
  1278. if os.IsPermission(err) {
  1279. // Setting oom_score_adj does not work in an
  1280. // unprivileged container. Ignore the error, but log
  1281. // it if we appear not to be in that situation.
  1282. if !rsystem.RunningInUserNS() {
  1283. logrus.Debugf("Permission denied writing %q to /proc/self/oom_score_adj", stringScore)
  1284. }
  1285. return nil
  1286. }
  1287. return err
  1288. }
  1289. func (daemon *Daemon) initCgroupsPath(path string) error {
  1290. if path == "/" || path == "." {
  1291. return nil
  1292. }
  1293. if daemon.configStore.CPURealtimePeriod == 0 && daemon.configStore.CPURealtimeRuntime == 0 {
  1294. return nil
  1295. }
  1296. // Recursively create cgroup to ensure that the system and all parent cgroups have values set
  1297. // for the period and runtime as this limits what the children can be set to.
  1298. daemon.initCgroupsPath(filepath.Dir(path))
  1299. mnt, root, err := cgroups.FindCgroupMountpointAndRoot("cpu")
  1300. if err != nil {
  1301. return err
  1302. }
  1303. // When docker is run inside docker, the root is based of the host cgroup.
  1304. // Should this be handled in runc/libcontainer/cgroups ?
  1305. if strings.HasPrefix(root, "/docker/") {
  1306. root = "/"
  1307. }
  1308. path = filepath.Join(mnt, root, path)
  1309. sysinfo := sysinfo.New(true)
  1310. if err := maybeCreateCPURealTimeFile(sysinfo.CPURealtimePeriod, daemon.configStore.CPURealtimePeriod, "cpu.rt_period_us", path); err != nil {
  1311. return err
  1312. }
  1313. return maybeCreateCPURealTimeFile(sysinfo.CPURealtimeRuntime, daemon.configStore.CPURealtimeRuntime, "cpu.rt_runtime_us", path)
  1314. }
  1315. func maybeCreateCPURealTimeFile(sysinfoPresent bool, configValue int64, file string, path string) error {
  1316. if sysinfoPresent && configValue != 0 {
  1317. if err := os.MkdirAll(path, 0755); err != nil {
  1318. return err
  1319. }
  1320. if err := ioutil.WriteFile(filepath.Join(path, file), []byte(strconv.FormatInt(configValue, 10)), 0700); err != nil {
  1321. return err
  1322. }
  1323. }
  1324. return nil
  1325. }
  1326. func (daemon *Daemon) setupSeccompProfile() error {
  1327. if daemon.configStore.SeccompProfile != "" {
  1328. daemon.seccompProfilePath = daemon.configStore.SeccompProfile
  1329. b, err := ioutil.ReadFile(daemon.configStore.SeccompProfile)
  1330. if err != nil {
  1331. return fmt.Errorf("opening seccomp profile (%s) failed: %v", daemon.configStore.SeccompProfile, err)
  1332. }
  1333. daemon.seccompProfile = b
  1334. }
  1335. return nil
  1336. }