From 57b59f876e909f07a057846ee5518ed15563fba7 Mon Sep 17 00:00:00 2001 From: Akihiro Suda Date: Mon, 3 Jun 2019 00:03:27 +0900 Subject: [PATCH 1/2] info: report cgroup driver as "none" when running rootless Previously `docker info` had reported "cgroupfs" as the cgroup driver but the driver wasn't actually used at all. This PR reports "none" as the cgroup driver so as to avoid confusion. e.g. kubeadm/kubelet will detect cgroupless-ness by checking this docker info field. https://github.com/rootless-containers/usernetes/pull/97 Note that user still cannot specify `native.cgroupdriver=none` manually. Signed-off-by: Akihiro Suda (cherry picked from commit 153466ba0ac21d6971ca05cdaef19c33bae4204c) Signed-off-by: Sebastiaan van Stijn --- daemon/daemon_unix.go | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/daemon/daemon_unix.go b/daemon/daemon_unix.go index 3d0c38bec6..df64de6edf 100644 --- a/daemon/daemon_unix.go +++ b/daemon/daemon_unix.go @@ -73,6 +73,7 @@ const ( // constant for cgroup drivers cgroupFsDriver = "cgroupfs" cgroupSystemdDriver = "systemd" + cgroupNoneDriver = "none" // DefaultRuntimeName is the default runtime to be used by // containerd if none is specified @@ -575,6 +576,9 @@ func verifyPlatformContainerResources(resources *containertypes.Resources, sysIn } func (daemon *Daemon) getCgroupDriver() string { + if daemon.Rootless() { + return cgroupNoneDriver + } cgroupDriver := cgroupFsDriver if UsingSystemd(daemon.configStore) { @@ -601,6 +605,9 @@ func VerifyCgroupDriver(config *config.Config) error { if cd == "" || cd == cgroupFsDriver || cd == cgroupSystemdDriver { return nil } + if cd == cgroupNoneDriver { + return fmt.Errorf("native.cgroupdriver option %s is internally used and cannot be specified manually", cd) + } return fmt.Errorf("native.cgroupdriver option %s not supported", cd) } From d575af39ac3a8f99dda4622ba4c63d22f36b0a22 Mon Sep 17 00:00:00 2001 From: Akihiro Suda Date: Mon, 3 Jun 2019 19:41:50 +0900 Subject: [PATCH 2/2] rootless: update `docker info` docs Signed-off-by: Akihiro Suda (cherry picked from commit ca5aab19b482f27629374cdde4df26b5676e39cb) Signed-off-by: Sebastiaan van Stijn --- api/swagger.yaml | 5 +++-- docs/api/version-history.md | 5 +++++ docs/rootless.md | 2 ++ 3 files changed, 10 insertions(+), 2 deletions(-) diff --git a/api/swagger.yaml b/api/swagger.yaml index fb980dd787..b191969015 100644 --- a/api/swagger.yaml +++ b/api/swagger.yaml @@ -3805,7 +3805,7 @@ definitions: description: | The driver to use for managing cgroups. type: "string" - enum: ["cgroupfs", "systemd"] + enum: ["cgroupfs", "systemd", "none"] default: "cgroupfs" example: "cgroupfs" NEventsListener: @@ -4040,7 +4040,7 @@ definitions: SecurityOptions: description: | List of security features that are enabled on the daemon, such as - apparmor, seccomp, SELinux, and user-namespaces (userns). + apparmor, seccomp, SELinux, user-namespaces (userns), and rootless. Additional configuration options for each security feature may be present, and are included as a comma-separated list of key/value @@ -4053,6 +4053,7 @@ definitions: - "name=seccomp,profile=default" - "name=selinux" - "name=userns" + - "name=rootless" ProductLicense: description: | Reports a summary of the product license on the daemon. diff --git a/docs/api/version-history.md b/docs/api/version-history.md index 1c5a4f5d38..30f2bb4b67 100644 --- a/docs/api/version-history.md +++ b/docs/api/version-history.md @@ -49,6 +49,11 @@ keywords: "API, Docker, rcli, REST, documentation" * `GET /info` now returns information about `DataPathPort` that is currently used in swarm * `GET /info` now returns `PidsLimit` boolean to indicate if the host kernel has PID limit support enabled. +* `GET /info` now includes `name=rootless` in `SecurityOptions` when the daemon is running in + rootless mode. This change is not versioned, and affects all API versions if the daemon has + this patch. +* `GET /info` now returns `none` as `CgroupDriver` when the daemon is running in rootless mode. + This change is not versioned, and affects all API versions if the daemon has this patch. * `POST /containers/create` now accepts `DeviceRequests` as part of `HostConfig`. Can be used to set Nvidia GPUs. * `GET /swarm` endpoint now returns DataPathPort info diff --git a/docs/rootless.md b/docs/rootless.md index 9cf6dd7def..f8e27a2c6d 100644 --- a/docs/rootless.md +++ b/docs/rootless.md @@ -64,6 +64,8 @@ Remarks: * The exec dir is set to `$XDG_RUNTIME_DIR/docker` by default. * The daemon config dir is set to `~/.config/docker` (not `~/.docker`, which is used by the client) by default. * The `dockerd-rootless.sh` script executes `dockerd` in its own user, mount, and network namespaces. You can enter the namespaces by running `nsenter -U --preserve-credentials -n -m -t $(cat $XDG_RUNTIME_DIR/docker.pid)`. +* `docker info` shows `rootless` in `SecurityOptions` +* `docker info` shows `none` as `Cgroup Driver` ### Client