beenull/moby
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

vendor buildkit 396bfe20b590914cd77945ef0d70d976a0ed093c

Browse source 
Signed-off-by: Tibor Vass <tibor@docker.com>
This commit is contained in:
Tibor Vass 2021-01-27 18:19:29 +00:00
parent 67de83e70b
commit b96fb8837b
4 changed files with 51 additions and 10 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
vendor.conf
View file

@ -26,7 +26,7 @@ github.com/imdario/mergo 7c29201646fa3de8506f70121347
golang.org/x/sync e225da77a7e68af35c70ccbf71af2b83e6acac3c
# buildkit
github.com/moby/buildkit df89d4dcf73ce414cd76837bfb0e9a0cc0ef3386 # v0.6.4-32-gdf89d4dc
github.com/moby/buildkit 396bfe20b590914cd77945ef0d70d976a0ed093c # docker-19.03 branch
github.com/tonistiigi/fsutil 6c909ab392c173a4264ae1bfcbc0450b9aac0c7d
github.com/grpc-ecosystem/grpc-opentracing 8e809c8a86450a29b90dcc9efbf062d0fe6d9746
github.com/opentracing/opentracing-go 1361b9cd60be79c4c3a7fa9841b3c132e40066a7

47
vendor/github.com/moby/buildkit/executor/oci/spec_unix.go generated vendored
View file

@ -22,6 +22,8 @@ import (
"github.com/moby/buildkit/util/network"
"github.com/moby/buildkit/util/system"
specs "github.com/opencontainers/runtime-spec/specs-go"
"github.com/opencontainers/selinux/go-selinux"
"github.com/opencontainers/selinux/go-selinux/label"
"github.com/pkg/errors"
)
@ -29,7 +31,7 @@ import (
// GenerateSpec generates spec using containerd functionality.
// opts are ignored for s.Process, s.Hostname, and s.Mounts .
func GenerateSpec(ctx context.Context, meta executor.Meta, mounts []executor.Mount, id, resolvConf, hostsFile string, namespace network.Namespace, processMode ProcessMode, idmap *idtools.IdentityMapping, opts ...oci.SpecOpts) (*specs.Spec, func(), error) {
func GenerateSpec(ctx context.Context, meta executor.Meta, mounts []executor.Mount, id, resolvConf, hostsFile string, namespace network.Namespace, processMode ProcessMode, idmap *idtools.IdentityMapping, apparmorProfile string, opts ...oci.SpecOpts) (*specs.Spec, func(), error) {
c := &containers.Container{
ID: id,
}
@ -37,10 +39,11 @@ func GenerateSpec(ctx context.Context, meta executor.Meta, mounts []executor.Mou
if !ok {
ctx = namespaces.WithNamespace(ctx, "buildkit")
}
if meta.SecurityMode == pb.SecurityMode_INSECURE {
opts = append(opts, entitlements.WithInsecureSpec())
} else if system.SeccompSupported() && meta.SecurityMode == pb.SecurityMode_SANDBOX {
opts = append(opts, seccomp.WithDefaultProfile())
if securityOpts, err := generateSecurityOpts(meta.SecurityMode, apparmorProfile); err == nil {
opts = append(opts, securityOpts...)
} else {
return nil, nil, err
}
switch processMode {
@ -125,6 +128,9 @@ func GenerateSpec(ctx context.Context, meta executor.Meta, mounts []executor.Mou
for _, f := range releasers {
f()
}
if s.Process.SelinuxLabel != "" {
selinux.ReleaseLabel(s.Process.SelinuxLabel)
}
}
for _, m := range mounts {
@ -165,6 +171,37 @@ type mountRef struct {
unmount func() error
}
// generateSecurityOpts may affect mounts, so must be called after generateMountOpts
func generateSecurityOpts(mode pb.SecurityMode, apparmorProfile string) (opts []oci.SpecOpts, _ error) {
switch mode {
case pb.SecurityMode_INSECURE:
return []oci.SpecOpts{
entitlements.WithInsecureSpec(),
oci.WithWriteableCgroupfs,
oci.WithWriteableSysfs,
func(_ context.Context, _ oci.Client, _ *containers.Container, s *oci.Spec) error {
var err error
s.Process.SelinuxLabel, s.Linux.MountLabel, err = label.InitLabels([]string{"disable"})
return err
},
}, nil
case pb.SecurityMode_SANDBOX:
if system.SeccompSupported() {
opts = append(opts, seccomp.WithDefaultProfile())
}
if apparmorProfile != "" {
opts = append(opts, oci.WithApparmorProfile(apparmorProfile))
}
opts = append(opts, func(_ context.Context, _ oci.Client, _ *containers.Container, s *oci.Spec) error {
var err error
s.Process.SelinuxLabel, s.Linux.MountLabel, err = label.InitLabels(nil)
return err
})
return opts, nil
}
return nil, nil
}
type submounts struct {
m map[uint64]mountRef
}

11
vendor/github.com/moby/buildkit/executor/runcexecutor/executor.go generated vendored
View file

@ -39,9 +39,10 @@ type Opt struct {
ProcessMode oci.ProcessMode
IdentityMapping *idtools.IdentityMapping
// runc run --no-pivot (unrecommended)
NoPivot bool
DNS *oci.DNSConfig
OOMScoreAdj *int
NoPivot bool
DNS *oci.DNSConfig
OOMScoreAdj *int
ApparmorProfile string
}
var defaultCommandCandidates = []string{"buildkit-runc", "runc"}
@ -58,6 +59,7 @@ type runcExecutor struct {
noPivot bool
dns *oci.DNSConfig
oomScoreAdj *int
apparmorProfile string
}
func New(opt Opt, networkProviders map[pb.NetMode]network.Provider) (executor.Executor, error) {
@ -118,6 +120,7 @@ func New(opt Opt, networkProviders map[pb.NetMode]network.Provider) (executor.Ex
noPivot: opt.NoPivot,
dns: opt.DNS,
oomScoreAdj: opt.OOMScoreAdj,
apparmorProfile: opt.ApparmorProfile,
}
return w, nil
}
@ -223,7 +226,7 @@ func (w *runcExecutor) Exec(ctx context.Context, meta executor.Meta, root cache.
}
opts = append(opts, containerdoci.WithCgroup(cgroupsPath))
}
spec, cleanup, err := oci.GenerateSpec(ctx, meta, mounts, id, resolvConf, hostsFile, namespace, w.processMode, w.idmap, opts...)
spec, cleanup, err := oci.GenerateSpec(ctx, meta, mounts, id, resolvConf, hostsFile, namespace, w.processMode, w.idmap, w.apparmorProfile, opts...)
if err != nil {
return err
}

1
vendor/github.com/moby/buildkit/go.mod generated vendored
View file

@ -46,6 +46,7 @@ require (
github.com/opencontainers/image-spec v1.0.1
github.com/opencontainers/runc v1.0.0-rc8
github.com/opencontainers/runtime-spec v0.0.0-20180909173843-eba862dc2470
github.com/opencontainers/selinux v1.0.0-rc1.0.20180628160156-b6fa367ed7f5
github.com/opentracing-contrib/go-stdlib v0.0.0-20171029140428-b1a47cfbdd75
github.com/opentracing/opentracing-go v0.0.0-20171003133519-1361b9cd60be
github.com/pkg/errors v0.8.1