|
|
|
@ -153,7 +153,7 @@ func parseSecurityOpt(container *container.Container, config *containertypes.Hos
|
|
|
|
|
con = strings.SplitN(opt, "=", 2)
|
|
|
|
|
} else if strings.Contains(opt, ":") {
|
|
|
|
|
con = strings.SplitN(opt, ":", 2)
|
|
|
|
|
logrus.Warnf("Security options with `:` as a separator are deprecated and will be completely unsupported in 1.13, use `=` instead.")
|
|
|
|
|
logrus.Warn("Security options with `:` as a separator are deprecated and will be completely unsupported in 1.13, use `=` instead.")
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
if len(con) != 2 {
|
|
|
|
@ -197,7 +197,7 @@ func getBlkioThrottleDevices(devs []*blkiodev.ThrottleDevice) ([]specs.ThrottleD
|
|
|
|
|
|
|
|
|
|
func checkKernelVersion(k, major, minor int) bool {
|
|
|
|
|
if v, err := kernel.GetKernelVersion(); err != nil {
|
|
|
|
|
logrus.Warnf("%s", err)
|
|
|
|
|
logrus.Warnf("error getting kernel version: %s", err)
|
|
|
|
|
} else {
|
|
|
|
|
if kernel.CompareKernelVersion(*v, kernel.VersionInfo{Kernel: k, Major: major, Minor: minor}) < 0 {
|
|
|
|
|
return false
|
|
|
|
@ -273,13 +273,13 @@ func verifyContainerResources(resources *containertypes.Resources, sysInfo *sysi
|
|
|
|
|
}
|
|
|
|
|
if resources.Memory > 0 && !sysInfo.MemoryLimit {
|
|
|
|
|
warnings = append(warnings, "Your kernel does not support memory limit capabilities. Limitation discarded.")
|
|
|
|
|
logrus.Warnf("Your kernel does not support memory limit capabilities. Limitation discarded.")
|
|
|
|
|
logrus.Warn("Your kernel does not support memory limit capabilities. Limitation discarded.")
|
|
|
|
|
resources.Memory = 0
|
|
|
|
|
resources.MemorySwap = -1
|
|
|
|
|
}
|
|
|
|
|
if resources.Memory > 0 && resources.MemorySwap != -1 && !sysInfo.SwapLimit {
|
|
|
|
|
warnings = append(warnings, "Your kernel does not support swap limit capabilities, memory limited without swap.")
|
|
|
|
|
logrus.Warnf("Your kernel does not support swap limit capabilities, memory limited without swap.")
|
|
|
|
|
logrus.Warn("Your kernel does not support swap limit capabilities, memory limited without swap.")
|
|
|
|
|
resources.MemorySwap = -1
|
|
|
|
|
}
|
|
|
|
|
if resources.Memory > 0 && resources.MemorySwap > 0 && resources.MemorySwap < resources.Memory {
|
|
|
|
@ -290,7 +290,7 @@ func verifyContainerResources(resources *containertypes.Resources, sysInfo *sysi
|
|
|
|
|
}
|
|
|
|
|
if resources.MemorySwappiness != nil && *resources.MemorySwappiness != -1 && !sysInfo.MemorySwappiness {
|
|
|
|
|
warnings = append(warnings, "Your kernel does not support memory swappiness capabilities, memory swappiness discarded.")
|
|
|
|
|
logrus.Warnf("Your kernel does not support memory swappiness capabilities, memory swappiness discarded.")
|
|
|
|
|
logrus.Warn("Your kernel does not support memory swappiness capabilities, memory swappiness discarded.")
|
|
|
|
|
resources.MemorySwappiness = nil
|
|
|
|
|
}
|
|
|
|
|
if resources.MemorySwappiness != nil {
|
|
|
|
@ -301,7 +301,7 @@ func verifyContainerResources(resources *containertypes.Resources, sysInfo *sysi
|
|
|
|
|
}
|
|
|
|
|
if resources.MemoryReservation > 0 && !sysInfo.MemoryReservation {
|
|
|
|
|
warnings = append(warnings, "Your kernel does not support memory soft limit capabilities. Limitation discarded.")
|
|
|
|
|
logrus.Warnf("Your kernel does not support memory soft limit capabilities. Limitation discarded.")
|
|
|
|
|
logrus.Warn("Your kernel does not support memory soft limit capabilities. Limitation discarded.")
|
|
|
|
|
resources.MemoryReservation = 0
|
|
|
|
|
}
|
|
|
|
|
if resources.MemoryReservation > 0 && resources.MemoryReservation < linuxMinMemory {
|
|
|
|
@ -312,7 +312,7 @@ func verifyContainerResources(resources *containertypes.Resources, sysInfo *sysi
|
|
|
|
|
}
|
|
|
|
|
if resources.KernelMemory > 0 && !sysInfo.KernelMemory {
|
|
|
|
|
warnings = append(warnings, "Your kernel does not support kernel memory limit capabilities. Limitation discarded.")
|
|
|
|
|
logrus.Warnf("Your kernel does not support kernel memory limit capabilities. Limitation discarded.")
|
|
|
|
|
logrus.Warn("Your kernel does not support kernel memory limit capabilities. Limitation discarded.")
|
|
|
|
|
resources.KernelMemory = 0
|
|
|
|
|
}
|
|
|
|
|
if resources.KernelMemory > 0 && resources.KernelMemory < linuxMinMemory {
|
|
|
|
@ -320,33 +320,33 @@ func verifyContainerResources(resources *containertypes.Resources, sysInfo *sysi
|
|
|
|
|
}
|
|
|
|
|
if resources.KernelMemory > 0 && !checkKernelVersion(4, 0, 0) {
|
|
|
|
|
warnings = append(warnings, "You specified a kernel memory limit on a kernel older than 4.0. Kernel memory limits are experimental on older kernels, it won't work as expected and can cause your system to be unstable.")
|
|
|
|
|
logrus.Warnf("You specified a kernel memory limit on a kernel older than 4.0. Kernel memory limits are experimental on older kernels, it won't work as expected and can cause your system to be unstable.")
|
|
|
|
|
logrus.Warn("You specified a kernel memory limit on a kernel older than 4.0. Kernel memory limits are experimental on older kernels, it won't work as expected and can cause your system to be unstable.")
|
|
|
|
|
}
|
|
|
|
|
if resources.OomKillDisable != nil && !sysInfo.OomKillDisable {
|
|
|
|
|
// only produce warnings if the setting wasn't to *disable* the OOM Kill; no point
|
|
|
|
|
// warning the caller if they already wanted the feature to be off
|
|
|
|
|
if *resources.OomKillDisable {
|
|
|
|
|
warnings = append(warnings, "Your kernel does not support OomKillDisable, OomKillDisable discarded.")
|
|
|
|
|
logrus.Warnf("Your kernel does not support OomKillDisable, OomKillDisable discarded.")
|
|
|
|
|
logrus.Warn("Your kernel does not support OomKillDisable, OomKillDisable discarded.")
|
|
|
|
|
}
|
|
|
|
|
resources.OomKillDisable = nil
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
if resources.PidsLimit != 0 && !sysInfo.PidsLimit {
|
|
|
|
|
warnings = append(warnings, "Your kernel does not support pids limit capabilities, pids limit discarded.")
|
|
|
|
|
logrus.Warnf("Your kernel does not support pids limit capabilities, pids limit discarded.")
|
|
|
|
|
logrus.Warn("Your kernel does not support pids limit capabilities, pids limit discarded.")
|
|
|
|
|
resources.PidsLimit = 0
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// cpu subsystem checks and adjustments
|
|
|
|
|
if resources.CPUShares > 0 && !sysInfo.CPUShares {
|
|
|
|
|
warnings = append(warnings, "Your kernel does not support CPU shares. Shares discarded.")
|
|
|
|
|
logrus.Warnf("Your kernel does not support CPU shares. Shares discarded.")
|
|
|
|
|
logrus.Warn("Your kernel does not support CPU shares. Shares discarded.")
|
|
|
|
|
resources.CPUShares = 0
|
|
|
|
|
}
|
|
|
|
|
if resources.CPUPeriod > 0 && !sysInfo.CPUCfsPeriod {
|
|
|
|
|
warnings = append(warnings, "Your kernel does not support CPU cfs period. Period discarded.")
|
|
|
|
|
logrus.Warnf("Your kernel does not support CPU cfs period. Period discarded.")
|
|
|
|
|
logrus.Warn("Your kernel does not support CPU cfs period. Period discarded.")
|
|
|
|
|
resources.CPUPeriod = 0
|
|
|
|
|
}
|
|
|
|
|
if resources.CPUPeriod != 0 && (resources.CPUPeriod < 1000 || resources.CPUPeriod > 1000000) {
|
|
|
|
@ -354,7 +354,7 @@ func verifyContainerResources(resources *containertypes.Resources, sysInfo *sysi
|
|
|
|
|
}
|
|
|
|
|
if resources.CPUQuota > 0 && !sysInfo.CPUCfsQuota {
|
|
|
|
|
warnings = append(warnings, "Your kernel does not support CPU cfs quota. Quota discarded.")
|
|
|
|
|
logrus.Warnf("Your kernel does not support CPU cfs quota. Quota discarded.")
|
|
|
|
|
logrus.Warn("Your kernel does not support CPU cfs quota. Quota discarded.")
|
|
|
|
|
resources.CPUQuota = 0
|
|
|
|
|
}
|
|
|
|
|
if resources.CPUQuota > 0 && resources.CPUQuota < 1000 {
|
|
|
|
@ -362,14 +362,14 @@ func verifyContainerResources(resources *containertypes.Resources, sysInfo *sysi
|
|
|
|
|
}
|
|
|
|
|
if resources.CPUPercent > 0 {
|
|
|
|
|
warnings = append(warnings, "%s does not support CPU percent. Percent discarded.", runtime.GOOS)
|
|
|
|
|
logrus.Warnf("%s does not support CPU percent. Percent discarded.", runtime.GOOS)
|
|
|
|
|
logrus.Warn("%s does not support CPU percent. Percent discarded.", runtime.GOOS)
|
|
|
|
|
resources.CPUPercent = 0
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// cpuset subsystem checks and adjustments
|
|
|
|
|
if (resources.CpusetCpus != "" || resources.CpusetMems != "") && !sysInfo.Cpuset {
|
|
|
|
|
warnings = append(warnings, "Your kernel does not support cpuset. Cpuset discarded.")
|
|
|
|
|
logrus.Warnf("Your kernel does not support cpuset. Cpuset discarded.")
|
|
|
|
|
logrus.Warn("Your kernel does not support cpuset. Cpuset discarded.")
|
|
|
|
|
resources.CpusetCpus = ""
|
|
|
|
|
resources.CpusetMems = ""
|
|
|
|
|
}
|
|
|
|
@ -391,7 +391,7 @@ func verifyContainerResources(resources *containertypes.Resources, sysInfo *sysi
|
|
|
|
|
// blkio subsystem checks and adjustments
|
|
|
|
|
if resources.BlkioWeight > 0 && !sysInfo.BlkioWeight {
|
|
|
|
|
warnings = append(warnings, "Your kernel does not support Block I/O weight. Weight discarded.")
|
|
|
|
|
logrus.Warnf("Your kernel does not support Block I/O weight. Weight discarded.")
|
|
|
|
|
logrus.Warn("Your kernel does not support Block I/O weight. Weight discarded.")
|
|
|
|
|
resources.BlkioWeight = 0
|
|
|
|
|
}
|
|
|
|
|
if resources.BlkioWeight > 0 && (resources.BlkioWeight < 10 || resources.BlkioWeight > 1000) {
|
|
|
|
@ -402,27 +402,27 @@ func verifyContainerResources(resources *containertypes.Resources, sysInfo *sysi
|
|
|
|
|
}
|
|
|
|
|
if len(resources.BlkioWeightDevice) > 0 && !sysInfo.BlkioWeightDevice {
|
|
|
|
|
warnings = append(warnings, "Your kernel does not support Block I/O weight_device.")
|
|
|
|
|
logrus.Warnf("Your kernel does not support Block I/O weight_device. Weight-device discarded.")
|
|
|
|
|
logrus.Warn("Your kernel does not support Block I/O weight_device. Weight-device discarded.")
|
|
|
|
|
resources.BlkioWeightDevice = []*pblkiodev.WeightDevice{}
|
|
|
|
|
}
|
|
|
|
|
if len(resources.BlkioDeviceReadBps) > 0 && !sysInfo.BlkioReadBpsDevice {
|
|
|
|
|
warnings = append(warnings, "Your kernel does not support Block read limit in bytes per second.")
|
|
|
|
|
logrus.Warnf("Your kernel does not support Block I/O read limit in bytes per second. --device-read-bps discarded.")
|
|
|
|
|
logrus.Warn("Your kernel does not support Block I/O read limit in bytes per second. --device-read-bps discarded.")
|
|
|
|
|
resources.BlkioDeviceReadBps = []*pblkiodev.ThrottleDevice{}
|
|
|
|
|
}
|
|
|
|
|
if len(resources.BlkioDeviceWriteBps) > 0 && !sysInfo.BlkioWriteBpsDevice {
|
|
|
|
|
warnings = append(warnings, "Your kernel does not support Block write limit in bytes per second.")
|
|
|
|
|
logrus.Warnf("Your kernel does not support Block I/O write limit in bytes per second. --device-write-bps discarded.")
|
|
|
|
|
logrus.Warn("Your kernel does not support Block I/O write limit in bytes per second. --device-write-bps discarded.")
|
|
|
|
|
resources.BlkioDeviceWriteBps = []*pblkiodev.ThrottleDevice{}
|
|
|
|
|
}
|
|
|
|
|
if len(resources.BlkioDeviceReadIOps) > 0 && !sysInfo.BlkioReadIOpsDevice {
|
|
|
|
|
warnings = append(warnings, "Your kernel does not support Block read limit in IO per second.")
|
|
|
|
|
logrus.Warnf("Your kernel does not support Block I/O read limit in IO per second. -device-read-iops discarded.")
|
|
|
|
|
logrus.Warn("Your kernel does not support Block I/O read limit in IO per second. -device-read-iops discarded.")
|
|
|
|
|
resources.BlkioDeviceReadIOps = []*pblkiodev.ThrottleDevice{}
|
|
|
|
|
}
|
|
|
|
|
if len(resources.BlkioDeviceWriteIOps) > 0 && !sysInfo.BlkioWriteIOpsDevice {
|
|
|
|
|
warnings = append(warnings, "Your kernel does not support Block write limit in IO per second.")
|
|
|
|
|
logrus.Warnf("Your kernel does not support Block I/O write limit in IO per second. --device-write-iops discarded.")
|
|
|
|
|
logrus.Warn("Your kernel does not support Block I/O write limit in IO per second. --device-write-iops discarded.")
|
|
|
|
|
resources.BlkioDeviceWriteIOps = []*pblkiodev.ThrottleDevice{}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
@ -492,7 +492,7 @@ func verifyPlatformContainerSettings(daemon *Daemon, hostConfig *containertypes.
|
|
|
|
|
// ip-forwarding does not affect container with '--net=host' (or '--net=none')
|
|
|
|
|
if sysInfo.IPv4ForwardingDisabled && !(hostConfig.NetworkMode.IsHost() || hostConfig.NetworkMode.IsNone()) {
|
|
|
|
|
warnings = append(warnings, "IPv4 forwarding is disabled. Networking will not work.")
|
|
|
|
|
logrus.Warnf("IPv4 forwarding is disabled. Networking will not work")
|
|
|
|
|
logrus.Warn("IPv4 forwarding is disabled. Networking will not work")
|
|
|
|
|
}
|
|
|
|
|
// check for various conflicting options with user namespaces
|
|
|
|
|
if daemon.configStore.RemappedRoot != "" && hostConfig.UsernsMode.IsPrivate() {
|
|
|
|
@ -916,7 +916,7 @@ func setupRemappedRoot(config *Config) ([]idtools.IDMap, []idtools.IDMap, error)
|
|
|
|
|
if username == "root" {
|
|
|
|
|
// Cannot setup user namespaces with a 1-to-1 mapping; "--root=0:0" is a no-op
|
|
|
|
|
// effectively
|
|
|
|
|
logrus.Warnf("User namespaces: root cannot be remapped with itself; user namespaces are OFF")
|
|
|
|
|
logrus.Warn("User namespaces: root cannot be remapped with itself; user namespaces are OFF")
|
|
|
|
|
return uidMaps, gidMaps, nil
|
|
|
|
|
}
|
|
|
|
|
logrus.Infof("User namespaces: ID ranges will be mapped to subuid/subgid ranges of: %s:%s", username, groupname)
|
|
|
|
|