fc14d8f932
Partially reverts0046b16"daemon: set libnetwork sandbox key w/o OCI hook" Running SetKey to store the OCI Sandbox key after task creation, rather than from the OCI prestart hook, meant it happened after sysctl settings were applied by the runtime - which was the intention, we wanted to complete Sandbox configuration after IPv6 had been disabled by a sysctl if that was going to happen. But, it meant '--sysctl' options for a specfic network interface caused container task creation to fail, because the interface is only moved into the network namespace during SetKey. This change restores the SetKey prestart hook, and regenerates config files that depend on the container's support for IPv6 after the task has been created. It also adds a regression test that makes sure it's possible to set an interface-specfic sysctl. Signed-off-by: Rob Murray <rob.murray@docker.com> (cherry picked from commitfde80fe2e7) Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
27 lines
933 B
Go
27 lines
933 B
Go
package daemon // import "github.com/docker/docker/daemon"
|
|
|
|
import (
|
|
"context"
|
|
|
|
"github.com/docker/docker/container"
|
|
"github.com/docker/docker/errdefs"
|
|
"github.com/docker/docker/libcontainerd/types"
|
|
"github.com/docker/docker/oci"
|
|
specs "github.com/opencontainers/runtime-spec/specs-go"
|
|
)
|
|
|
|
// initializeCreatedTask performs any initialization that needs to be done to
|
|
// prepare a freshly-created task to be started.
|
|
func (daemon *Daemon) initializeCreatedTask(ctx context.Context, tsk types.Task, container *container.Container, spec *specs.Spec) error {
|
|
if !container.Config.NetworkDisabled {
|
|
nspath, ok := oci.NamespacePath(spec, specs.NetworkNamespace)
|
|
if ok && nspath == "" { // the runtime has been instructed to create a new network namespace for tsk.
|
|
sb, err := daemon.netController.GetSandbox(container.ID)
|
|
if err != nil {
|
|
return errdefs.System(err)
|
|
}
|
|
return sb.FinishConfig()
|
|
}
|
|
}
|
|
return nil
|
|
}
|