beenull/moby
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Merge pull request #316 from thaJeztah/19.03_backport_buildkit_userns_remap_take2

Browse source 
[19.03 backport] builder-next: userns remap support and honor daemon's DNS config
This commit is contained in:
Andrew Hsu 2019-08-08 13:35:34 -07:00 committed by GitHub
commit 305b2416ea
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
26 changed files with 247 additions and 22 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

14
builder/builder-next/adapters/snapshot/snapshot.go
View file

@ -26,9 +26,10 @@ var keySize = []byte("size")
// Opt defines options for creating the snapshotter
type Opt struct {
GraphDriver graphdriver.Driver
LayerStore layer.Store
Root string
GraphDriver graphdriver.Driver
LayerStore layer.Store
Root string
IdentityMapping *idtools.IdentityMapping
}
type graphIDRegistrar interface {
@ -79,7 +80,7 @@ func (s *snapshotter) Name() string {
}
func (s *snapshotter) IdentityMapping() *idtools.IdentityMapping {
return nil
return s.opt.IdentityMapping
}
func (s *snapshotter) Prepare(ctx context.Context, key, parent string, opts ...snapshots.Opt) error {
@ -253,6 +254,7 @@ func (s *snapshotter) Mounts(ctx context.Context, key string) (snapshot.Mountabl
id := identity.NewID()
var rwlayer layer.RWLayer
return &mountable{
idmap: s.opt.IdentityMapping,
acquire: func() ([]mount.Mount, error) {
rwlayer, err = s.opt.LayerStore.CreateRWLayer(id, l.ChainID(), nil)
if err != nil {
@ -278,6 +280,7 @@ func (s *snapshotter) Mounts(ctx context.Context, key string) (snapshot.Mountabl
id, _ := s.getGraphDriverID(key)
return &mountable{
idmap: s.opt.IdentityMapping,
acquire: func() ([]mount.Mount, error) {
rootfs, err := s.opt.GraphDriver.Get(id, "")
if err != nil {
@ -440,6 +443,7 @@ type mountable struct {
acquire func() ([]mount.Mount, error)
release func() error
refCount int
idmap *idtools.IdentityMapping
}
func (m *mountable) Mount() ([]mount.Mount, error) {
@ -480,5 +484,5 @@ func (m *mountable) Release() error {
}
func (m *mountable) IdentityMapping() *idtools.IdentityMapping {
return nil
return m.idmap
}

7
builder/builder-next/builder.go
View file

@ -17,6 +17,7 @@ import (
"github.com/docker/docker/builder"
"github.com/docker/docker/daemon/config"
"github.com/docker/docker/daemon/images"
"github.com/docker/docker/pkg/idtools"
"github.com/docker/docker/pkg/streamformatter"
"github.com/docker/docker/pkg/system"
"github.com/docker/libnetwork"
@ -73,6 +74,8 @@ type Opt struct {
ResolverOpt resolver.ResolveOptionsFunc
BuilderConfig config.BuilderConfig
Rootless bool
IdentityMapping *idtools.IdentityMapping
DNSConfig config.DNSConfig
}
// Builder can build using BuildKit backend
@ -88,6 +91,10 @@ type Builder struct {
func New(opt Opt) (*Builder, error) {
reqHandler := newReqBodyHandler(tracing.DefaultTransport)
if opt.IdentityMapping != nil && opt.IdentityMapping.Empty() {
opt.IdentityMapping = nil
}
c, err := newController(reqHandler, opt)
if err != nil {
return nil, err

13
builder/builder-next/controller.go
View file

@ -38,7 +38,7 @@ import (
)
func newController(rt http.RoundTripper, opt Opt) (*control.Controller, error) {
if err := os.MkdirAll(opt.Root, 0700); err != nil {
if err := os.MkdirAll(opt.Root, 0711); err != nil {
return nil, err
}
@ -55,9 +55,10 @@ func newController(rt http.RoundTripper, opt Opt) (*control.Controller, error) {
}
sbase, err := snapshot.NewSnapshotter(snapshot.Opt{
GraphDriver: driver,
LayerStore: dist.LayerStore,
Root: root,
GraphDriver: driver,
LayerStore: dist.LayerStore,
Root: root,
IdentityMapping: opt.IdentityMapping,
})
if err != nil {
return nil, err
@ -112,7 +113,9 @@ func newController(rt http.RoundTripper, opt Opt) (*control.Controller, error) {
return nil, err
}
exec, err := newExecutor(root, opt.DefaultCgroupParent, opt.NetworkController, opt.Rootless)
dns := getDNSConfig(opt.DNSConfig)
exec, err := newExecutor(root, opt.DefaultCgroupParent, opt.NetworkController, dns, opt.Rootless, opt.IdentityMapping)
if err != nil {
return nil, err
}

18
builder/builder-next/executor_unix.go
View file

@ -8,8 +8,11 @@ import (
"strconv"
"sync"
"github.com/docker/docker/daemon/config"
"github.com/docker/docker/pkg/idtools"
"github.com/docker/libnetwork"
"github.com/moby/buildkit/executor"
"github.com/moby/buildkit/executor/oci"
"github.com/moby/buildkit/executor/runcexecutor"
"github.com/moby/buildkit/identity"
"github.com/moby/buildkit/solver/pb"
@ -20,7 +23,7 @@ import (
const networkName = "bridge"
func newExecutor(root, cgroupParent string, net libnetwork.NetworkController, rootless bool) (executor.Executor, error) {
func newExecutor(root, cgroupParent string, net libnetwork.NetworkController, dnsConfig *oci.DNSConfig, rootless bool, idmap *idtools.IdentityMapping) (executor.Executor, error) {
networkProviders := map[pb.NetMode]network.Provider{
pb.NetMode_UNSET: &bridgeProvider{NetworkController: net, Root: filepath.Join(root, "net")},
pb.NetMode_HOST: network.NewHostProvider(),
@ -32,6 +35,8 @@ func newExecutor(root, cgroupParent string, net libnetwork.NetworkController, ro
DefaultCgroupParent: cgroupParent,
Rootless: rootless,
NoPivot: os.Getenv("DOCKER_RAMDISK") != "",
IdentityMapping: idmap,
DNS: dnsConfig,
}, networkProviders)
}
@ -115,3 +120,14 @@ func (iface *lnInterface) Close() error {
}
return iface.err
}
func getDNSConfig(cfg config.DNSConfig) *oci.DNSConfig {
if cfg.DNS != nil || cfg.DNSSearch != nil || cfg.DNSOptions != nil {
return &oci.DNSConfig{
Nameservers: cfg.DNS,
SearchDomains: cfg.DNSSearch,
Options: cfg.DNSOptions,
}
}
return nil
}

9
builder/builder-next/executor_windows.go
View file

@ -5,12 +5,15 @@ import (
"errors"
"io"
"github.com/docker/docker/daemon/config"
"github.com/docker/docker/pkg/idtools"
"github.com/docker/libnetwork"
"github.com/moby/buildkit/cache"
"github.com/moby/buildkit/executor"
"github.com/moby/buildkit/executor/oci"
)
func newExecutor(_, _ string, _ libnetwork.NetworkController, _ bool) (executor.Executor, error) {
func newExecutor(_, _ string, _ libnetwork.NetworkController, _ *oci.DNSConfig, _ bool, _ *idtools.IdentityMapping) (executor.Executor, error) {
return &winExecutor{}, nil
}
@ -20,3 +23,7 @@ type winExecutor struct {
func (e *winExecutor) Exec(ctx context.Context, meta executor.Meta, rootfs cache.Mountable, mounts []executor.Mount, stdin io.ReadCloser, stdout, stderr io.WriteCloser) error {
return errors.New("buildkit executor not implemented for windows")
}
func getDNSConfig(config.DNSConfig) *oci.DNSConfig {
return nil
}

2
cmd/dockerd/daemon.go
View file

@ -318,6 +318,8 @@ func newRouterOptions(config *config.Config, d *daemon.Daemon) (routerOptions, e
ResolverOpt: d.NewResolveOptionsFunc(),
BuilderConfig: config.Builder,
Rootless: d.Rootless(),
IdentityMapping: d.IdentityMapping(),
DNSConfig: config.DNSConfig,
})
if err != nil {
return opts, err

11
daemon/config/config.go
View file

@ -109,6 +109,13 @@ type CommonTLSOptions struct {
KeyFile string `json:"tlskey,omitempty"`
}
// DNSConfig defines the DNS configurations.
type DNSConfig struct {
DNS []string `json:"dns,omitempty"`
DNSOptions []string `json:"dns-opts,omitempty"`
DNSSearch []string `json:"dns-search,omitempty"`
}
// CommonConfig defines the configuration of a docker daemon which is
// common across platforms.
// It includes json tags to deserialize configuration from a file
@ -119,9 +126,6 @@ type CommonConfig struct {
AutoRestart bool `json:"-"`
Context map[string][]string `json:"-"`
DisableBridge bool `json:"-"`
DNS []string `json:"dns,omitempty"`
DNSOptions []string `json:"dns-opts,omitempty"`
DNSSearch []string `json:"dns-search,omitempty"`
ExecOptions []string `json:"exec-opts,omitempty"`
GraphDriver string `json:"storage-driver,omitempty"`
GraphOptions []string `json:"storage-opts,omitempty"`
@ -200,6 +204,7 @@ type CommonConfig struct {
MetricsAddress string `json:"metrics-addr"`
DNSConfig
LogConfig
BridgeConfig // bridgeConfig holds bridge network specific configuration.
NetworkConfig

24
daemon/config/config_test.go
View file

@ -244,28 +244,36 @@ func TestValidateConfigurationErrors(t *testing.T) {
{
config: &Config{
CommonConfig: CommonConfig{
DNS: []string{"1.1.1.1o"},
DNSConfig: DNSConfig{
DNS: []string{"1.1.1.1o"},
},
},
},
},
{
config: &Config{
CommonConfig: CommonConfig{
DNS: []string{"2.2.2.2", "1.1.1.1o"},
DNSConfig: DNSConfig{
DNS: []string{"2.2.2.2", "1.1.1.1o"},
},
},
},
},
{
config: &Config{
CommonConfig: CommonConfig{
DNSSearch: []string{"123456"},
DNSConfig: DNSConfig{
DNSSearch: []string{"123456"},
},
},
},
},
{
config: &Config{
CommonConfig: CommonConfig{
DNSSearch: []string{"a.b.c", "123456"},
DNSConfig: DNSConfig{
DNSSearch: []string{"a.b.c", "123456"},
},
},
},
},
@ -329,14 +337,18 @@ func TestValidateConfiguration(t *testing.T) {
{
config: &Config{
CommonConfig: CommonConfig{
DNS: []string{"1.1.1.1"},
DNSConfig: DNSConfig{
DNS: []string{"1.1.1.1"},
},
},
},
},
{
config: &Config{
CommonConfig: CommonConfig{
DNSSearch: []string{"a.b.c"},
DNSConfig: DNSConfig{
DNSSearch: []string{"a.b.c"},
},
},
},
},

2
hack/dockerfile/install/vndr.installer
View file

@ -1,6 +1,6 @@
#!/bin/sh
VNDR_COMMIT=81cb8916aad3c8d06193f008dba3e16f82851f52
VNDR_COMMIT=f5ab8fc5fb64d66b5c6e55a0bcb58b2e92362fa0
install_vndr() {
echo "Install vndr version $VNDR_COMMIT"

5
vendor/github.com/gogo/googleapis/go.mod generated vendored Normal file
View file

@ -0,0 +1,5 @@
module github.com/gogo/googleapis
go 1.12
require github.com/gogo/protobuf v1.2.1

3
vendor/github.com/gogo/protobuf/go.mod generated vendored Normal file
View file

@ -0,0 +1,3 @@
module github.com/gogo/protobuf
require github.com/kisielk/errcheck v1.1.0 // indirect

1
vendor/github.com/google/uuid/go.mod generated vendored Normal file
View file

@ -0,0 +1 @@
module github.com/google/uuid

1
vendor/github.com/gorilla/mux/go.mod generated vendored Normal file
View file

@ -0,0 +1 @@
module github.com/gorilla/mux

1
vendor/github.com/hashicorp/golang-lru/go.mod generated vendored Normal file
View file

@ -0,0 +1 @@
module github.com/hashicorp/golang-lru

1
vendor/github.com/konsorten/go-windows-terminal-sequences/go.mod generated vendored Normal file
View file

@ -0,0 +1 @@
module github.com/konsorten/go-windows-terminal-sequences

1
vendor/github.com/kr/pty/go.mod generated vendored Normal file
View file

@ -0,0 +1 @@
module github.com/kr/pty

1
vendor/github.com/mattn/go-shellwords/go.mod generated vendored Normal file
View file

@ -0,0 +1 @@
module github.com/mattn/go-shellwords

77
vendor/github.com/moby/buildkit/go.mod generated vendored Normal file
View file

@ -0,0 +1,77 @@
module github.com/moby/buildkit
go 1.11
require (
github.com/BurntSushi/toml v0.3.1
github.com/Microsoft/go-winio v0.4.13-0.20190408173621-84b4ab48a507
github.com/apache/thrift v0.0.0-20161221203622-b2a4d4ae21c7 // indirect
github.com/codahale/hdrhistogram v0.0.0-20160425231609-f8ad88b59a58 // indirect
github.com/containerd/cgroups v0.0.0-20190226200435-dbea6f2bd416 // indirect
github.com/containerd/console v0.0.0-20181022165439-0650fd9eeb50
github.com/containerd/containerd v1.3.0-0.20190507210959-7c1e88399ec0
github.com/containerd/continuity v0.0.0-20190426062206-aaeac12a7ffc
github.com/containerd/fifo v0.0.0-20180307165137-3d5202aec260 // indirect
github.com/containerd/go-cni v0.0.0-20190610170741-5a4663dad645
github.com/containerd/go-runc v0.0.0-20180907222934-5a6d9f37cfa3
github.com/containerd/ttrpc v0.0.0-20190411181408-699c4e40d1e7 // indirect
github.com/containerd/typeurl v0.0.0-20180627222232-a93fcdb778cd // indirect
github.com/containernetworking/cni v0.6.1-0.20180218032124-142cde0c766c // indirect
github.com/coreos/go-systemd v0.0.0-20190321100706-95778dfbb74e
github.com/docker/cli v0.0.0-20190321234815-f40f9c240ab0
github.com/docker/distribution v2.7.1-0.20190205005809-0d3efadf0154+incompatible
github.com/docker/docker v1.14.0-0.20190319215453-e7b5f7dbe98c
github.com/docker/docker-credential-helpers v0.6.0 // indirect
github.com/docker/go-connections v0.3.0
github.com/docker/go-events v0.0.0-20170721190031-9461782956ad // indirect
github.com/docker/libnetwork v0.8.0-dev.2.0.20190604151032-3c26b4e7495e
github.com/godbus/dbus v4.1.0+incompatible // indirect
github.com/gofrs/flock v0.7.0
github.com/gogo/googleapis v1.1.0
github.com/gogo/protobuf v1.2.0
github.com/golang/protobuf v1.2.0
github.com/google/go-cmp v0.2.0
github.com/google/shlex v0.0.0-20150127133951-6f45313302b9
github.com/grpc-ecosystem/grpc-opentracing v0.0.0-20180507213350-8e809c8a8645
github.com/hashicorp/go-immutable-radix v1.0.0
github.com/hashicorp/golang-lru v0.0.0-20160207214719-a0d98a5f2880
github.com/hashicorp/uuid v0.0.0-20160311170451-ebb0a03e909c // indirect
github.com/ishidawataru/sctp v0.0.0-20180213033435-07191f837fed // indirect
github.com/jaguilar/vt100 v0.0.0-20150826170717-2703a27b14ea
github.com/kr/pretty v0.1.0 // indirect
github.com/mitchellh/hashstructure v0.0.0-20170609045927-2bca23e0e452
github.com/morikuni/aec v0.0.0-20170113033406-39771216ff4c
github.com/opencontainers/go-digest v1.0.0-rc1
github.com/opencontainers/image-spec v1.0.1
github.com/opencontainers/runc v1.0.0-rc8
github.com/opencontainers/runtime-spec v0.0.0-20180909173843-eba862dc2470
github.com/opentracing-contrib/go-stdlib v0.0.0-20171029140428-b1a47cfbdd75
github.com/opentracing/opentracing-go v0.0.0-20171003133519-1361b9cd60be
github.com/pkg/errors v0.8.1
github.com/pkg/profile v1.2.1
github.com/serialx/hashring v0.0.0-20190422032157-8b2912629002
github.com/sirupsen/logrus v1.3.0
github.com/stretchr/testify v1.3.0
github.com/syndtr/gocapability v0.0.0-20180916011248-d98352740cb2 // indirect
github.com/tonistiigi/fsutil v0.0.0-20190327153851-3bbb99cdbd76
github.com/tonistiigi/units v0.0.0-20180711220420-6950e57a87ea
github.com/uber/jaeger-client-go v0.0.0-20180103221425-e02c85f9069e
github.com/uber/jaeger-lib v1.2.1 // indirect
github.com/urfave/cli v0.0.0-20171014202726-7bc6a0acffa5
github.com/vishvananda/netlink v1.0.0 // indirect
github.com/vishvananda/netns v0.0.0-20180720170159-13995c7128cc // indirect
go.etcd.io/bbolt v1.3.2
golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2
golang.org/x/net v0.0.0-20190311183353-d8887717615a
golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f
golang.org/x/sys v0.0.0-20190303122642-d455e41777fc
golang.org/x/time v0.0.0-20161028155119-f51c12702a4d
google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8
google.golang.org/grpc v1.20.1
gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127 // indirect
gotest.tools v2.2.0+incompatible
)
replace github.com/hashicorp/go-immutable-radix => github.com/tonistiigi/go-immutable-radix v0.0.0-20170803185627-826af9ccf0fe
replace github.com/jaguilar/vt100 => github.com/tonistiigi/vt100 v0.0.0-20190402012908-ad4c4a574305

10
vendor/github.com/sirupsen/logrus/go.mod generated vendored Normal file
View file

@ -0,0 +1,10 @@
module github.com/sirupsen/logrus
require (
github.com/davecgh/go-spew v1.1.1 // indirect
github.com/konsorten/go-windows-terminal-sequences v1.0.1
github.com/pmezard/go-difflib v1.0.0 // indirect
github.com/stretchr/objx v0.1.1 // indirect
github.com/stretchr/testify v1.2.2
golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33
)

28
vendor/github.com/tonistiigi/fsutil/go.mod generated vendored Normal file
View file

@ -0,0 +1,28 @@
module github.com/tonistiigi/fsutil
require (
github.com/Microsoft/go-winio v0.4.11 // indirect
github.com/Microsoft/hcsshim v0.8.5 // indirect
github.com/containerd/containerd v1.2.4
github.com/containerd/continuity v0.0.0-20181001140422-bd77b46c8352
github.com/davecgh/go-spew v1.1.1 // indirect
github.com/docker/docker v0.0.0-20180531152204-71cd53e4a197
github.com/docker/go-units v0.3.1 // indirect
github.com/gogo/protobuf v1.0.0
github.com/google/go-cmp v0.2.0 // indirect
github.com/gotestyourself/gotestyourself v2.2.0+incompatible // indirect
github.com/onsi/ginkgo v1.7.0 // indirect
github.com/onsi/gomega v1.4.3 // indirect
github.com/opencontainers/go-digest v1.0.0-rc1
github.com/opencontainers/image-spec v1.0.1 // indirect
github.com/opencontainers/runc v1.0.0-rc6 // indirect
github.com/pkg/errors v0.8.1
github.com/sirupsen/logrus v1.0.3 // indirect
github.com/stretchr/testify v1.3.0
golang.org/x/crypto v0.0.0-20190129210102-0709b304e793 // indirect
golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f
golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e
gopkg.in/airbrake/gobrake.v2 v2.0.9 // indirect
gopkg.in/gemnasium/logrus-airbrake-hook.v2 v2.1.2 // indirect
gotest.tools v2.1.0+incompatible // indirect
)

3
vendor/golang.org/x/crypto/go.mod generated vendored Normal file
View file

@ -0,0 +1,3 @@
module golang.org/x/crypto
require golang.org/x/sys v0.0.0-20190403152447-81d4e9dc473e

6
vendor/golang.org/x/net/go.mod generated vendored Normal file
View file

@ -0,0 +1,6 @@
module golang.org/x/net
require (
golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2
golang.org/x/text v0.3.0
)

1
vendor/golang.org/x/sync/go.mod generated vendored Normal file
View file

@ -0,0 +1 @@
module golang.org/x/sync

3
vendor/golang.org/x/sys/go.mod generated vendored Normal file
View file

@ -0,0 +1,3 @@
module golang.org/x/sys
go 1.12

19
vendor/google.golang.org/grpc/go.mod generated vendored Normal file
View file

@ -0,0 +1,19 @@
module google.golang.org/grpc
require (
cloud.google.com/go v0.26.0 // indirect
github.com/BurntSushi/toml v0.3.1 // indirect
github.com/client9/misspell v0.3.4
github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b
github.com/golang/mock v1.1.1
github.com/golang/protobuf v1.2.0
golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3
golang.org/x/net v0.0.0-20190311183353-d8887717615a
golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be
golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f // indirect
golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a
golang.org/x/tools v0.0.0-20190311212946-11955173bddd
google.golang.org/appengine v1.1.0 // indirect
google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8
honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099
)

8
vendor/gotest.tools/go.mod vendored Normal file
View file

@ -0,0 +1,8 @@
module gotest.tools
require (
github.com/google/go-cmp v0.2.0
github.com/pkg/errors v0.8.0
github.com/spf13/pflag v1.0.3
golang.org/x/tools v0.0.0-20180810170437-e96c4e24768d
)