overlay.go 16 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500
  1. // +build linux
  2. package overlay
  3. import (
  4. "bufio"
  5. "fmt"
  6. "io"
  7. "io/ioutil"
  8. "os"
  9. "os/exec"
  10. "path"
  11. "path/filepath"
  12. "strconv"
  13. "github.com/docker/docker/daemon/graphdriver"
  14. "github.com/docker/docker/daemon/graphdriver/copy"
  15. "github.com/docker/docker/daemon/graphdriver/overlayutils"
  16. "github.com/docker/docker/pkg/archive"
  17. "github.com/docker/docker/pkg/containerfs"
  18. "github.com/docker/docker/pkg/fsutils"
  19. "github.com/docker/docker/pkg/idtools"
  20. "github.com/docker/docker/pkg/locker"
  21. "github.com/docker/docker/pkg/mount"
  22. "github.com/docker/docker/pkg/system"
  23. "github.com/opencontainers/selinux/go-selinux/label"
  24. "github.com/sirupsen/logrus"
  25. "golang.org/x/sys/unix"
  26. )
  27. // This is a small wrapper over the NaiveDiffWriter that lets us have a custom
  28. // implementation of ApplyDiff()
  29. var (
  30. // ErrApplyDiffFallback is returned to indicate that a normal ApplyDiff is applied as a fallback from Naive diff writer.
  31. ErrApplyDiffFallback = fmt.Errorf("Fall back to normal ApplyDiff")
  32. backingFs = "<unknown>"
  33. )
  34. // ApplyDiffProtoDriver wraps the ProtoDriver by extending the interface with ApplyDiff method.
  35. type ApplyDiffProtoDriver interface {
  36. graphdriver.ProtoDriver
  37. // ApplyDiff writes the diff to the archive for the given id and parent id.
  38. // It returns the size in bytes written if successful, an error ErrApplyDiffFallback is returned otherwise.
  39. ApplyDiff(id, parent string, diff io.Reader) (size int64, err error)
  40. }
  41. type naiveDiffDriverWithApply struct {
  42. graphdriver.Driver
  43. applyDiff ApplyDiffProtoDriver
  44. }
  45. // NaiveDiffDriverWithApply returns a NaiveDiff driver with custom ApplyDiff.
  46. func NaiveDiffDriverWithApply(driver ApplyDiffProtoDriver, uidMaps, gidMaps []idtools.IDMap) graphdriver.Driver {
  47. return &naiveDiffDriverWithApply{
  48. Driver: graphdriver.NewNaiveDiffDriver(driver, uidMaps, gidMaps),
  49. applyDiff: driver,
  50. }
  51. }
  52. // ApplyDiff creates a diff layer with either the NaiveDiffDriver or with a fallback.
  53. func (d *naiveDiffDriverWithApply) ApplyDiff(id, parent string, diff io.Reader) (int64, error) {
  54. b, err := d.applyDiff.ApplyDiff(id, parent, diff)
  55. if err == ErrApplyDiffFallback {
  56. return d.Driver.ApplyDiff(id, parent, diff)
  57. }
  58. return b, err
  59. }
  60. // This backend uses the overlay union filesystem for containers
  61. // plus hard link file sharing for images.
  62. // Each container/image can have a "root" subdirectory which is a plain
  63. // filesystem hierarchy, or they can use overlay.
  64. // If they use overlay there is a "upper" directory and a "lower-id"
  65. // file, as well as "merged" and "work" directories. The "upper"
  66. // directory has the upper layer of the overlay, and "lower-id" contains
  67. // the id of the parent whose "root" directory shall be used as the lower
  68. // layer in the overlay. The overlay itself is mounted in the "merged"
  69. // directory, and the "work" dir is needed for overlay to work.
  70. // When an overlay layer is created there are two cases, either the
  71. // parent has a "root" dir, then we start out with an empty "upper"
  72. // directory overlaid on the parents root. This is typically the
  73. // case with the init layer of a container which is based on an image.
  74. // If there is no "root" in the parent, we inherit the lower-id from
  75. // the parent and start by making a copy in the parent's "upper" dir.
  76. // This is typically the case for a container layer which copies
  77. // its parent -init upper layer.
  78. // Additionally we also have a custom implementation of ApplyLayer
  79. // which makes a recursive copy of the parent "root" layer using
  80. // hardlinks to share file data, and then applies the layer on top
  81. // of that. This means all child images share file (but not directory)
  82. // data with the parent.
  83. // Driver contains information about the home directory and the list of active mounts that are created using this driver.
  84. type Driver struct {
  85. home string
  86. uidMaps []idtools.IDMap
  87. gidMaps []idtools.IDMap
  88. ctr *graphdriver.RefCounter
  89. supportsDType bool
  90. locker *locker.Locker
  91. }
  92. func init() {
  93. graphdriver.Register("overlay", Init)
  94. }
  95. // Init returns the NaiveDiffDriver, a native diff driver for overlay filesystem.
  96. // If overlay filesystem is not supported on the host, the error
  97. // graphdriver.ErrNotSupported is returned.
  98. // If an overlay filesystem is not supported over an existing filesystem then
  99. // error graphdriver.ErrIncompatibleFS is returned.
  100. func Init(home string, options []string, uidMaps, gidMaps []idtools.IDMap) (graphdriver.Driver, error) {
  101. if err := supportsOverlay(); err != nil {
  102. return nil, graphdriver.ErrNotSupported
  103. }
  104. // Perform feature detection on /var/lib/docker/overlay if it's an existing directory.
  105. // This covers situations where /var/lib/docker/overlay is a mount, and on a different
  106. // filesystem than /var/lib/docker.
  107. // If the path does not exist, fall back to using /var/lib/docker for feature detection.
  108. testdir := home
  109. if _, err := os.Stat(testdir); os.IsNotExist(err) {
  110. testdir = filepath.Dir(testdir)
  111. }
  112. fsMagic, err := graphdriver.GetFSMagic(testdir)
  113. if err != nil {
  114. return nil, err
  115. }
  116. if fsName, ok := graphdriver.FsNames[fsMagic]; ok {
  117. backingFs = fsName
  118. }
  119. switch fsMagic {
  120. case graphdriver.FsMagicAufs, graphdriver.FsMagicBtrfs, graphdriver.FsMagicEcryptfs, graphdriver.FsMagicNfsFs, graphdriver.FsMagicOverlay, graphdriver.FsMagicZfs:
  121. logrus.Errorf("'overlay' is not supported over %s", backingFs)
  122. return nil, graphdriver.ErrIncompatibleFS
  123. }
  124. supportsDType, err := fsutils.SupportsDType(testdir)
  125. if err != nil {
  126. return nil, err
  127. }
  128. if !supportsDType {
  129. if !graphdriver.IsInitialized(home) {
  130. return nil, overlayutils.ErrDTypeNotSupported("overlay", backingFs)
  131. }
  132. // allow running without d_type only for existing setups (#27443)
  133. logrus.Warn(overlayutils.ErrDTypeNotSupported("overlay", backingFs))
  134. }
  135. rootUID, rootGID, err := idtools.GetRootUIDGID(uidMaps, gidMaps)
  136. if err != nil {
  137. return nil, err
  138. }
  139. // Create the driver home dir
  140. if err := idtools.MkdirAllAndChown(home, 0700, idtools.IDPair{rootUID, rootGID}); err != nil {
  141. return nil, err
  142. }
  143. if err := mount.MakePrivate(home); err != nil {
  144. return nil, err
  145. }
  146. d := &Driver{
  147. home: home,
  148. uidMaps: uidMaps,
  149. gidMaps: gidMaps,
  150. ctr: graphdriver.NewRefCounter(graphdriver.NewFsChecker(graphdriver.FsMagicOverlay)),
  151. supportsDType: supportsDType,
  152. locker: locker.New(),
  153. }
  154. return NaiveDiffDriverWithApply(d, uidMaps, gidMaps), nil
  155. }
  156. func supportsOverlay() error {
  157. // We can try to modprobe overlay first before looking at
  158. // proc/filesystems for when overlay is supported
  159. exec.Command("modprobe", "overlay").Run()
  160. f, err := os.Open("/proc/filesystems")
  161. if err != nil {
  162. return err
  163. }
  164. defer f.Close()
  165. s := bufio.NewScanner(f)
  166. for s.Scan() {
  167. if s.Text() == "nodev\toverlay" {
  168. return nil
  169. }
  170. }
  171. logrus.Error("'overlay' not found as a supported filesystem on this host. Please ensure kernel is new enough and has overlay support loaded.")
  172. return graphdriver.ErrNotSupported
  173. }
  174. func (d *Driver) String() string {
  175. return "overlay"
  176. }
  177. // Status returns current driver information in a two dimensional string array.
  178. // Output contains "Backing Filesystem" used in this implementation.
  179. func (d *Driver) Status() [][2]string {
  180. return [][2]string{
  181. {"Backing Filesystem", backingFs},
  182. {"Supports d_type", strconv.FormatBool(d.supportsDType)},
  183. }
  184. }
  185. // GetMetadata returns metadata about the overlay driver such as root,
  186. // LowerDir, UpperDir, WorkDir and MergeDir used to store data.
  187. func (d *Driver) GetMetadata(id string) (map[string]string, error) {
  188. dir := d.dir(id)
  189. if _, err := os.Stat(dir); err != nil {
  190. return nil, err
  191. }
  192. metadata := make(map[string]string)
  193. // If id has a root, it is an image
  194. rootDir := path.Join(dir, "root")
  195. if _, err := os.Stat(rootDir); err == nil {
  196. metadata["RootDir"] = rootDir
  197. return metadata, nil
  198. }
  199. lowerID, err := ioutil.ReadFile(path.Join(dir, "lower-id"))
  200. if err != nil {
  201. return nil, err
  202. }
  203. metadata["LowerDir"] = path.Join(d.dir(string(lowerID)), "root")
  204. metadata["UpperDir"] = path.Join(dir, "upper")
  205. metadata["WorkDir"] = path.Join(dir, "work")
  206. metadata["MergedDir"] = path.Join(dir, "merged")
  207. return metadata, nil
  208. }
  209. // Cleanup any state created by overlay which should be cleaned when daemon
  210. // is being shutdown. For now, we just have to unmount the bind mounted
  211. // we had created.
  212. func (d *Driver) Cleanup() error {
  213. return mount.Unmount(d.home)
  214. }
  215. // CreateReadWrite creates a layer that is writable for use as a container
  216. // file system.
  217. func (d *Driver) CreateReadWrite(id, parent string, opts *graphdriver.CreateOpts) error {
  218. return d.Create(id, parent, opts)
  219. }
  220. // Create is used to create the upper, lower, and merge directories required for overlay fs for a given id.
  221. // The parent filesystem is used to configure these directories for the overlay.
  222. func (d *Driver) Create(id, parent string, opts *graphdriver.CreateOpts) (retErr error) {
  223. if opts != nil && len(opts.StorageOpt) != 0 {
  224. return fmt.Errorf("--storage-opt is not supported for overlay")
  225. }
  226. dir := d.dir(id)
  227. rootUID, rootGID, err := idtools.GetRootUIDGID(d.uidMaps, d.gidMaps)
  228. if err != nil {
  229. return err
  230. }
  231. root := idtools.IDPair{UID: rootUID, GID: rootGID}
  232. if err := idtools.MkdirAllAndChown(path.Dir(dir), 0700, root); err != nil {
  233. return err
  234. }
  235. if err := idtools.MkdirAndChown(dir, 0700, root); err != nil {
  236. return err
  237. }
  238. defer func() {
  239. // Clean up on failure
  240. if retErr != nil {
  241. os.RemoveAll(dir)
  242. }
  243. }()
  244. // Toplevel images are just a "root" dir
  245. if parent == "" {
  246. return idtools.MkdirAndChown(path.Join(dir, "root"), 0755, root)
  247. }
  248. parentDir := d.dir(parent)
  249. // Ensure parent exists
  250. if _, err := os.Lstat(parentDir); err != nil {
  251. return err
  252. }
  253. // If parent has a root, just do an overlay to it
  254. parentRoot := path.Join(parentDir, "root")
  255. if s, err := os.Lstat(parentRoot); err == nil {
  256. if err := idtools.MkdirAndChown(path.Join(dir, "upper"), s.Mode(), root); err != nil {
  257. return err
  258. }
  259. if err := idtools.MkdirAndChown(path.Join(dir, "work"), 0700, root); err != nil {
  260. return err
  261. }
  262. return ioutil.WriteFile(path.Join(dir, "lower-id"), []byte(parent), 0666)
  263. }
  264. // Otherwise, copy the upper and the lower-id from the parent
  265. lowerID, err := ioutil.ReadFile(path.Join(parentDir, "lower-id"))
  266. if err != nil {
  267. return err
  268. }
  269. if err := ioutil.WriteFile(path.Join(dir, "lower-id"), lowerID, 0666); err != nil {
  270. return err
  271. }
  272. parentUpperDir := path.Join(parentDir, "upper")
  273. s, err := os.Lstat(parentUpperDir)
  274. if err != nil {
  275. return err
  276. }
  277. upperDir := path.Join(dir, "upper")
  278. if err := idtools.MkdirAndChown(upperDir, s.Mode(), root); err != nil {
  279. return err
  280. }
  281. if err := idtools.MkdirAndChown(path.Join(dir, "work"), 0700, root); err != nil {
  282. return err
  283. }
  284. return copy.DirCopy(parentUpperDir, upperDir, copy.Content, true)
  285. }
  286. func (d *Driver) dir(id string) string {
  287. return path.Join(d.home, id)
  288. }
  289. // Remove cleans the directories that are created for this id.
  290. func (d *Driver) Remove(id string) error {
  291. d.locker.Lock(id)
  292. defer d.locker.Unlock(id)
  293. return system.EnsureRemoveAll(d.dir(id))
  294. }
  295. // Get creates and mounts the required file system for the given id and returns the mount path.
  296. func (d *Driver) Get(id, mountLabel string) (_ containerfs.ContainerFS, err error) {
  297. d.locker.Lock(id)
  298. defer d.locker.Unlock(id)
  299. dir := d.dir(id)
  300. if _, err := os.Stat(dir); err != nil {
  301. return nil, err
  302. }
  303. // If id has a root, just return it
  304. rootDir := path.Join(dir, "root")
  305. if _, err := os.Stat(rootDir); err == nil {
  306. return containerfs.NewLocalContainerFS(rootDir), nil
  307. }
  308. mergedDir := path.Join(dir, "merged")
  309. if count := d.ctr.Increment(mergedDir); count > 1 {
  310. return containerfs.NewLocalContainerFS(mergedDir), nil
  311. }
  312. defer func() {
  313. if err != nil {
  314. if c := d.ctr.Decrement(mergedDir); c <= 0 {
  315. if mntErr := unix.Unmount(mergedDir, 0); mntErr != nil {
  316. logrus.Debugf("Failed to unmount %s: %v: %v", id, mntErr, err)
  317. }
  318. // Cleanup the created merged directory; see the comment in Put's rmdir
  319. if rmErr := unix.Rmdir(mergedDir); rmErr != nil && !os.IsNotExist(rmErr) {
  320. logrus.Warnf("Failed to remove %s: %v: %v", id, rmErr, err)
  321. }
  322. }
  323. }
  324. }()
  325. lowerID, err := ioutil.ReadFile(path.Join(dir, "lower-id"))
  326. if err != nil {
  327. return nil, err
  328. }
  329. rootUID, rootGID, err := idtools.GetRootUIDGID(d.uidMaps, d.gidMaps)
  330. if err != nil {
  331. return nil, err
  332. }
  333. if err := idtools.MkdirAndChown(mergedDir, 0700, idtools.IDPair{rootUID, rootGID}); err != nil {
  334. return nil, err
  335. }
  336. var (
  337. lowerDir = path.Join(d.dir(string(lowerID)), "root")
  338. upperDir = path.Join(dir, "upper")
  339. workDir = path.Join(dir, "work")
  340. opts = fmt.Sprintf("lowerdir=%s,upperdir=%s,workdir=%s", lowerDir, upperDir, workDir)
  341. )
  342. if err := unix.Mount("overlay", mergedDir, "overlay", 0, label.FormatMountLabel(opts, mountLabel)); err != nil {
  343. return nil, fmt.Errorf("error creating overlay mount to %s: %v", mergedDir, err)
  344. }
  345. // chown "workdir/work" to the remapped root UID/GID. Overlay fs inside a
  346. // user namespace requires this to move a directory from lower to upper.
  347. if err := os.Chown(path.Join(workDir, "work"), rootUID, rootGID); err != nil {
  348. return nil, err
  349. }
  350. return containerfs.NewLocalContainerFS(mergedDir), nil
  351. }
  352. // Put unmounts the mount path created for the give id.
  353. // It also removes the 'merged' directory to force the kernel to unmount the
  354. // overlay mount in other namespaces.
  355. func (d *Driver) Put(id string) error {
  356. d.locker.Lock(id)
  357. defer d.locker.Unlock(id)
  358. // If id has a root, just return
  359. if _, err := os.Stat(path.Join(d.dir(id), "root")); err == nil {
  360. return nil
  361. }
  362. mountpoint := path.Join(d.dir(id), "merged")
  363. if count := d.ctr.Decrement(mountpoint); count > 0 {
  364. return nil
  365. }
  366. if err := unix.Unmount(mountpoint, unix.MNT_DETACH); err != nil {
  367. logrus.Debugf("Failed to unmount %s overlay: %v", id, err)
  368. }
  369. // Remove the mountpoint here. Removing the mountpoint (in newer kernels)
  370. // will cause all other instances of this mount in other mount namespaces
  371. // to be unmounted. This is necessary to avoid cases where an overlay mount
  372. // that is present in another namespace will cause subsequent mounts
  373. // operations to fail with ebusy. We ignore any errors here because this may
  374. // fail on older kernels which don't have
  375. // torvalds/linux@8ed936b5671bfb33d89bc60bdcc7cf0470ba52fe applied.
  376. if err := unix.Rmdir(mountpoint); err != nil {
  377. logrus.Debugf("Failed to remove %s overlay: %v", id, err)
  378. }
  379. return nil
  380. }
  381. // ApplyDiff applies the new layer on top of the root, if parent does not exist with will return an ErrApplyDiffFallback error.
  382. func (d *Driver) ApplyDiff(id string, parent string, diff io.Reader) (size int64, err error) {
  383. dir := d.dir(id)
  384. if parent == "" {
  385. return 0, ErrApplyDiffFallback
  386. }
  387. parentRootDir := path.Join(d.dir(parent), "root")
  388. if _, err := os.Stat(parentRootDir); err != nil {
  389. return 0, ErrApplyDiffFallback
  390. }
  391. // We now know there is a parent, and it has a "root" directory containing
  392. // the full root filesystem. We can just hardlink it and apply the
  393. // layer. This relies on two things:
  394. // 1) ApplyDiff is only run once on a clean (no writes to upper layer) container
  395. // 2) ApplyDiff doesn't do any in-place writes to files (would break hardlinks)
  396. // These are all currently true and are not expected to break
  397. tmpRootDir, err := ioutil.TempDir(dir, "tmproot")
  398. if err != nil {
  399. return 0, err
  400. }
  401. defer func() {
  402. if err != nil {
  403. os.RemoveAll(tmpRootDir)
  404. } else {
  405. os.RemoveAll(path.Join(dir, "upper"))
  406. os.RemoveAll(path.Join(dir, "work"))
  407. os.RemoveAll(path.Join(dir, "merged"))
  408. os.RemoveAll(path.Join(dir, "lower-id"))
  409. }
  410. }()
  411. if err = copy.DirCopy(parentRootDir, tmpRootDir, copy.Hardlink, true); err != nil {
  412. return 0, err
  413. }
  414. options := &archive.TarOptions{UIDMaps: d.uidMaps, GIDMaps: d.gidMaps}
  415. if size, err = graphdriver.ApplyUncompressedLayer(tmpRootDir, diff, options); err != nil {
  416. return 0, err
  417. }
  418. rootDir := path.Join(dir, "root")
  419. if err := os.Rename(tmpRootDir, rootDir); err != nil {
  420. return 0, err
  421. }
  422. return
  423. }
  424. // Exists checks to see if the id is already mounted.
  425. func (d *Driver) Exists(id string) bool {
  426. _, err := os.Stat(d.dir(id))
  427. return err == nil
  428. }