Commit graph

36 commits

Author SHA1 Message Date
Liron Levin
526abc00b1 Fix authorization issue - when request is denied return forbbiden exist code (403).
- Return 403 (forbidden) when request is denied in authorization flows
(including integration test)
- Fix #22428
- Close #22431

Signed-off-by: Liron Levin <liron@twistlock.com>
2016-05-02 19:14:48 +03:00
David Calavera
a793564b25 Remove static errors from errors package.
Moving all strings to the errors package wasn't a good idea after all.

Our custom implementation of Go errors predates everything that's nice
and good about working with errors in Go. Take as an example what we
have to do to get an error message:

```go
func GetErrorMessage(err error) string {
	switch err.(type) {
	case errcode.Error:
		e, _ := err.(errcode.Error)
		return e.Message

	case errcode.ErrorCode:
		ec, _ := err.(errcode.ErrorCode)
		return ec.Message()

	default:
		return err.Error()
	}
}
```

This goes against every good practice for Go development. The language already provides a simple, intuitive and standard way to get error messages, that is calling the `Error()` method from an error. Reinventing the error interface is a mistake.

Our custom implementation also makes very hard to reason about errors, another nice thing about Go. I found several (>10) error declarations that we don't use anywhere. This is a clear sign about how little we know about the errors we return. I also found several error usages where the number of arguments was different than the parameters declared in the error, another clear example of how difficult is to reason about errors.

Moreover, our custom implementation didn't really make easier for people to return custom HTTP status code depending on the errors. Again, it's hard to reason about when to set custom codes and how. Take an example what we have to do to extract the message and status code from an error before returning a response from the API:

```go
	switch err.(type) {
	case errcode.ErrorCode:
		daError, _ := err.(errcode.ErrorCode)
		statusCode = daError.Descriptor().HTTPStatusCode
		errMsg = daError.Message()

	case errcode.Error:
		// For reference, if you're looking for a particular error
		// then you can do something like :
		//   import ( derr "github.com/docker/docker/errors" )
		//   if daError.ErrorCode() == derr.ErrorCodeNoSuchContainer { ... }

		daError, _ := err.(errcode.Error)
		statusCode = daError.ErrorCode().Descriptor().HTTPStatusCode
		errMsg = daError.Message

	default:
		// This part of will be removed once we've
		// converted everything over to use the errcode package

		// FIXME: this is brittle and should not be necessary.
		// If we need to differentiate between different possible error types,
		// we should create appropriate error types with clearly defined meaning
		errStr := strings.ToLower(err.Error())
		for keyword, status := range map[string]int{
			"not found":             http.StatusNotFound,
			"no such":               http.StatusNotFound,
			"bad parameter":         http.StatusBadRequest,
			"conflict":              http.StatusConflict,
			"impossible":            http.StatusNotAcceptable,
			"wrong login/password":  http.StatusUnauthorized,
			"hasn't been activated": http.StatusForbidden,
		} {
			if strings.Contains(errStr, keyword) {
				statusCode = status
				break
			}
		}
	}
```

You can notice two things in that code:

1. We have to explain how errors work, because our implementation goes against how easy to use Go errors are.
2. At no moment we arrived to remove that `switch` statement that was the original reason to use our custom implementation.

This change removes all our status errors from the errors package and puts them back in their specific contexts.
IT puts the messages back with their contexts. That way, we know right away when errors used and how to generate their messages.
It uses custom interfaces to reason about errors. Errors that need to response with a custom status code MUST implementent this simple interface:

```go
type errorWithStatus interface {
	HTTPErrorStatusCode() int
}
```

This interface is very straightforward to implement. It also preserves Go errors real behavior, getting the message is as simple as using the `Error()` method.

I included helper functions to generate errors that use custom status code in `errors/errors.go`.

By doing this, we remove the hard dependency we have eeverywhere to our custom errors package. Yes, you can use it as a helper to generate error, but it's still very easy to generate errors without it.

Please, read this fantastic blog post about errors in Go: http://dave.cheney.net/2014/12/24/inspecting-errors

Signed-off-by: David Calavera <david.calavera@gmail.com>
2016-02-26 15:49:09 -05:00
huqun
b96bbf26db fix docs
Signed-off-by: huqun  <huqun@zju.edu.cn>
2016-02-19 13:51:14 +08:00
Zhang Wei
3c0a91d227 Fix error for restarting container
Fix error message for `--net container:b` and `--ipc container:b`,
container `b` is a restarting container.

Signed-off-by: Zhang Wei <zhangwei555@huawei.com>
2016-02-04 20:14:50 +08:00
Alexander Morozov
28a7577a02 Merge pull request #19959 from WeiZhang555/fix-cli-print-err
Remove redundant error message
2016-02-03 10:56:19 -08:00
Zhang Wei
894266c1bb Remove redundant error message
Currently some commands including `kill`, `pause`, `restart`, `rm`,
`rmi`, `stop`, `unpause`, `udpate`, `wait` will print a lot of error
message on client side, with a lot of redundant messages, this commit is
trying to remove the unuseful and redundant information for user.

Signed-off-by: Zhang Wei <zhangwei555@huawei.com>
2016-02-03 15:45:20 +08:00
Lei Jitang
5566ccb7aa Fix docker top a restarting container
Signed-off-by: Lei Jitang <leijitang@huawei.com>
2016-02-02 21:05:01 -05:00
Zhang Wei
1d2208fed9 Forbid exec a restarting container
Currently if we exec a restarting container, client will fail silently,
and daemon will print error that container can't be found which is not a
very meaningful prompt to user.

This commit will stop user from exec a restarting container and gives
more explicit error message.

Signed-off-by: Zhang Wei <zhangwei555@huawei.com>
2016-01-27 10:05:06 +08:00
Alessandro Boch
cfa515fd9d Reject multiple networks on container creation
Signed-off-by: Alessandro Boch <aboch@docker.com>
2016-01-25 12:50:01 -08:00
Brian Goff
1a60a805bf Fix panic on starting exec more than once
Issue was caused when exec is tarted, exits, then stated again.
In this case, `Close` is called twice, which closes a channel twice.

Changes execConfig.ExitCode to a pointer so we can test if the it has
been set or not.
This allows us to return early when the exec has already been run.

Signed-off-by: Brian Goff <cpuguy83@gmail.com>
2016-01-15 11:57:23 -05:00
Lei Jitang
79d4f0f56e Add docker network connect/disconnect to non-running container
Signed-off-by: Lei Jitang <leijitang@huawei.com>
2016-01-11 20:13:39 -05:00
Brian Goff
d3eca4451d Move responsibility of ls/inspect to volume driver
Makes `docker volume ls` and `docker volume inspect` ask the volume
drivers rather than only using what is cached locally.

Previously in order to use a volume from an external driver, one would
either have to use `docker volume create` or have a container that is
already using that volume for it to be visible to the other volume
API's.

For keeping uniqueness of volume names in the daemon, names are bound to
a driver on a first come first serve basis. If two drivers have a volume
with the same name, the first one is chosen, and a warning is logged
about the second one.

Adds 2 new methods to the plugin API, `List` and `Get`.
If a plugin does not implement these endpoints, a user will not be able
to find the specified volumes as well requests go through the drivers.

Signed-off-by: Brian Goff <cpuguy83@gmail.com>
2016-01-05 16:28:38 -05:00
David Calavera
f15af1eff7 Add network events.
Signed-off-by: David Calavera <david.calavera@gmail.com>
2015-12-30 17:39:33 -05:00
David Calavera
af94f941df Remove IsPaused from backend interface.
Move connection hijacking logic to the daemon.

Signed-off-by: David Calavera <david.calavera@gmail.com>
2015-12-21 12:34:21 -05:00
Justas Brazauskas
927b334ebf Fix typos found across repository
Signed-off-by: Justas Brazauskas <brazauskasjustas@gmail.com>
2015-12-13 18:04:12 +02:00
Wen Cheng Ma
c424c8c32c Correct the message of ErrorCodeNoSuchContainer to "No such container"
Fixes issue #18424

Signed-off-by: Wen Cheng Ma <wenchma@cn.ibm.com>
2015-12-04 15:00:08 +08:00
Dan Walsh
b3e527dfd2 This patch adds --tmpfs as a option for mounting tmpfs on directories
It will Tar up contents of child directory onto tmpfs if mounted over

This patch will use the new PreMount and PostMount hooks to "tar"
up the contents of the base image on top of tmpfs mount points.

Signed-off-by: Dan Walsh <dwalsh@redhat.com>
2015-12-02 10:06:59 -05:00
Tonis Tiigi
4352da7803 Update daemon and docker core to use new content addressable storage
Add distribution package for managing pulls and pushes. This is based on
the old code in the graph package, with major changes to work with the
new image/layer model.

Add v1 migration code.

Update registry, api/*, and daemon packages to use the reference
package's types where applicable.

Update daemon package to use image/layer/tag stores instead of the graph
package

Signed-off-by: Aaron Lehmann <aaron.lehmann@docker.com>
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
2015-11-24 09:40:25 -08:00
Zhang Kun
82ba25bea9 fix doc
Signed-off-by: Zhang Kun <zkazure@gmail.com>

fix doc

Signed-off-by: Zhang Kun <zkazure@gmail.com>
2015-11-15 23:32:40 +08:00
John Howard
2ff68910e2 Typo s/contained/container
Signed-off-by: John Howard <jhoward@microsoft.com>
2015-11-08 18:29:34 -08:00
Brian Goff
f1834153de Merge pull request #17383 from Microsoft/10662-volumeerrors
Fix volume error messages
2015-11-05 21:58:03 -05:00
Sally O'Malley
41de7a18d8 Change 'docker run' exit codes to distinguish docker/contained errors
The purpose of this PR is for users to distinguish Docker errors from
contained command errors.
This PR modifies 'docker run' exit codes to follow the chroot standard
for exit codes.
Exit status:
125 if 'docker run' itself fails
126 if contained command cannot be invoked
127 if contained command cannot be found
the exit status otherwise

Signed-off-by: Sally O'Malley <somalley@redhat.com>
2015-11-04 15:18:50 -05:00
Lei Jitang
de1d611990 Add show error when attach to a paused container
Signed-off-by: Lei Jitang <leijitang@huawei.com>
2015-10-28 21:00:09 -04:00
John Howard
5f4cb33a51 Fix volume error messages
Signed-off-by: John Howard <jhoward@microsoft.com>
2015-10-28 09:23:43 -07:00
John Howard
a7e686a779 Windows: Add volume support
Signed-off-by: John Howard <jhoward@microsoft.com>
2015-10-22 10:42:53 -07:00
David Calavera
d6d60287ee Move volume name validation to the local driver.
Delegate validation tasks to the volume drivers. It's up to them
to decide whether a name is valid or not.
Restrict volume names for the local driver to prevent creating
mount points outside docker's volumes directory.

Signed-off-by: David Calavera <david.calavera@gmail.com>
2015-10-21 12:28:26 -04:00
xlgao-zju
609961ddcc validate the name of named volume
Signed-off-by: xlgao-zju <xlgao@zju.edu.cn>
2015-10-20 12:36:04 -04:00
David Calavera
eb982e7c00 Return 404 for all network operations without network controller.
This will prevent the api from trying to serve network requests in
systems where libnetwork is not enabled, returning 404 responses in any
case.

Signed-off-by: David Calavera <david.calavera@gmail.com>
2015-10-19 14:40:18 -04:00
Kun Zhang
0ff3123eba volume create error on conflict option
Signed-off-by: Kun Zhang <zkazure@gmail.com>
2015-10-12 11:16:39 +08:00
Brian Goff
2d43d93410 Make exec start return proper error codes
Exec start was sending HTTP 500 for every error.

Fixed an error where pausing a container and then calling exec start
caused the daemon to freeze.

Updated API docs which incorrectly showed that a successful exec start
was an HTTP 201, in reality it is HTTP 200.

Signed-off-by: Brian Goff <cpuguy83@gmail.com>
2015-10-02 14:40:22 -04:00
Antonio Murdaca
94464e3a5e Validate --cpuset-cpus, --cpuset-mems
Before this patch libcontainer badly errored out with `invalid
argument` or `numerical result out of range` while trying to write
to cpuset.cpus or cpuset.mems with an invalid value provided.
This patch adds validation to --cpuset-cpus and --cpuset-mems flag along with
validation based on system's available cpus/mems before starting a container.

Signed-off-by: Antonio Murdaca <runcom@linux.com>
2015-09-27 16:38:58 +02:00
Brian Goff
ebe7ef9fc2 Merge pull request #16411 from duglin/DaemonErrors
Move more 'daemon' errors to the new error package
2015-09-23 21:20:56 -04:00
Srini Brahmaroutu
da0ca83377 Adding error codes to image package
Signed-off-by: Srini Brahmaroutu <srbrahma@us.ibm.com>
2015-09-23 17:03:37 +00:00
Doug Davis
0a734182eb Move more 'daemon' errors to the new error package
Signed-off-by: Doug Davis <dug@us.ibm.com>
2015-09-23 09:51:45 -07:00
David Calavera
0fea04d27e Organize server pre-func logic in middlewares.
It defines global middlewares for every request.
This makes the server slightly more composable.

Signed-off-by: David Calavera <david.calavera@gmail.com>
2015-09-21 14:27:06 -04:00
Doug Davis
a283a30fb0 Move api/errors/ to errors/
Per @calavera's suggestion: https://github.com/docker/docker/pull/16355#issuecomment-141139220

Signed-off-by: Doug Davis <dug@us.ibm.com>
2015-09-17 11:54:14 -07:00