20833b06a0
Signed-off-by: John Howard <jhoward@microsoft.com> Also fixes https://github.com/moby/moby/issues/22874 This commit is a pre-requisite to moving moby/moby on Windows to using Containerd for its runtime. The reason for this is that the interface between moby and containerd for the runtime is an OCI spec which must be unambigious. It is the responsibility of the runtime (runhcs in the case of containerd on Windows) to ensure that arguments are escaped prior to calling into HCS and onwards to the Win32 CreateProcess call. Previously, the builder was always escaping arguments which has led to several bugs in moby. Because the local runtime in libcontainerd had context of whether or not arguments were escaped, it was possible to hack around in daemon/oci_windows.go with knowledge of the context of the call (from builder or not). With a remote runtime, this is not possible as there's rightly no context of the caller passed across in the OCI spec. Put another way, as I put above, the OCI spec must be unambigious. The other previous limitation (which leads to various subtle bugs) is that moby is coded entirely from a Linux-centric point of view. Unfortunately, Windows != Linux. Windows CreateProcess uses a command line, not an array of arguments. And it has very specific rules about how to escape a command line. Some interesting reading links about this are: https://blogs.msdn.microsoft.com/twistylittlepassagesallalike/2011/04/23/everyone-quotes-command-line-arguments-the-wrong-way/ https://stackoverflow.com/questions/31838469/how-do-i-convert-argv-to-lpcommandline-parameter-of-createprocess https://docs.microsoft.com/en-us/cpp/cpp/parsing-cpp-command-line-arguments?view=vs-2017 For this reason, the OCI spec has recently been updated to cater for more natural syntax by including a CommandLine option in Process. What does this commit do? Primary objective is to ensure that the built OCI spec is unambigious. It changes the builder so that `ArgsEscaped` as commited in a layer is only controlled by the use of CMD or ENTRYPOINT. Subsequently, when calling in to create a container from the builder, if follows a different path to both `docker run` and `docker create` using the added `ContainerCreateIgnoreImagesArgsEscaped`. This allows a RUN from the builder to control how to escape in the OCI spec. It changes the builder so that when shell form is used for RUN, CMD or ENTRYPOINT, it builds (for WCOW) a more natural command line using the original as put by the user in the dockerfile, not the parsed version as a set of args which loses fidelity. This command line is put into args[0] and `ArgsEscaped` is set to true for CMD or ENTRYPOINT. A RUN statement does not commit `ArgsEscaped` to the commited layer regardless or whether shell or exec form were used.
115 lines
4.1 KiB
Go
115 lines
4.1 KiB
Go
// Package builder defines interfaces for any Docker builder to implement.
|
|
//
|
|
// Historically, only server-side Dockerfile interpreters existed.
|
|
// This package allows for other implementations of Docker builders.
|
|
package builder // import "github.com/docker/docker/builder"
|
|
|
|
import (
|
|
"context"
|
|
"io"
|
|
|
|
"github.com/docker/docker/api/types"
|
|
"github.com/docker/docker/api/types/backend"
|
|
"github.com/docker/docker/api/types/container"
|
|
containerpkg "github.com/docker/docker/container"
|
|
"github.com/docker/docker/image"
|
|
"github.com/docker/docker/layer"
|
|
"github.com/docker/docker/pkg/containerfs"
|
|
)
|
|
|
|
const (
|
|
// DefaultDockerfileName is the Default filename with Docker commands, read by docker build
|
|
DefaultDockerfileName = "Dockerfile"
|
|
)
|
|
|
|
// Source defines a location that can be used as a source for the ADD/COPY
|
|
// instructions in the builder.
|
|
type Source interface {
|
|
// Root returns root path for accessing source
|
|
Root() containerfs.ContainerFS
|
|
// Close allows to signal that the filesystem tree won't be used anymore.
|
|
// For Context implementations using a temporary directory, it is recommended to
|
|
// delete the temporary directory in Close().
|
|
Close() error
|
|
// Hash returns a checksum for a file
|
|
Hash(path string) (string, error)
|
|
}
|
|
|
|
// Backend abstracts calls to a Docker Daemon.
|
|
type Backend interface {
|
|
ImageBackend
|
|
ExecBackend
|
|
|
|
// CommitBuildStep creates a new Docker image from the config generated by
|
|
// a build step.
|
|
CommitBuildStep(backend.CommitConfig) (image.ID, error)
|
|
// ContainerCreateWorkdir creates the workdir
|
|
ContainerCreateWorkdir(containerID string) error
|
|
|
|
CreateImage(config []byte, parent string) (Image, error)
|
|
|
|
ImageCacheBuilder
|
|
}
|
|
|
|
// ImageBackend are the interface methods required from an image component
|
|
type ImageBackend interface {
|
|
GetImageAndReleasableLayer(ctx context.Context, refOrID string, opts backend.GetImageAndLayerOptions) (Image, ROLayer, error)
|
|
}
|
|
|
|
// ExecBackend contains the interface methods required for executing containers
|
|
type ExecBackend interface {
|
|
// ContainerAttachRaw attaches to container.
|
|
ContainerAttachRaw(cID string, stdin io.ReadCloser, stdout, stderr io.Writer, stream bool, attached chan struct{}) error
|
|
// ContainerCreateIgnoreImagesArgsEscaped creates a new Docker container and returns potential warnings
|
|
ContainerCreateIgnoreImagesArgsEscaped(config types.ContainerCreateConfig) (container.ContainerCreateCreatedBody, error)
|
|
// ContainerRm removes a container specified by `id`.
|
|
ContainerRm(name string, config *types.ContainerRmConfig) error
|
|
// ContainerKill stops the container execution abruptly.
|
|
ContainerKill(containerID string, sig uint64) error
|
|
// ContainerStart starts a new container
|
|
ContainerStart(containerID string, hostConfig *container.HostConfig, checkpoint string, checkpointDir string) error
|
|
// ContainerWait stops processing until the given container is stopped.
|
|
ContainerWait(ctx context.Context, name string, condition containerpkg.WaitCondition) (<-chan containerpkg.StateStatus, error)
|
|
}
|
|
|
|
// Result is the output produced by a Builder
|
|
type Result struct {
|
|
ImageID string
|
|
FromImage Image
|
|
}
|
|
|
|
// ImageCacheBuilder represents a generator for stateful image cache.
|
|
type ImageCacheBuilder interface {
|
|
// MakeImageCache creates a stateful image cache.
|
|
MakeImageCache(cacheFrom []string) ImageCache
|
|
}
|
|
|
|
// ImageCache abstracts an image cache.
|
|
// (parent image, child runconfig) -> child image
|
|
type ImageCache interface {
|
|
// GetCache returns a reference to a cached image whose parent equals `parent`
|
|
// and runconfig equals `cfg`. A cache miss is expected to return an empty ID and a nil error.
|
|
GetCache(parentID string, cfg *container.Config) (imageID string, err error)
|
|
}
|
|
|
|
// Image represents a Docker image used by the builder.
|
|
type Image interface {
|
|
ImageID() string
|
|
RunConfig() *container.Config
|
|
MarshalJSON() ([]byte, error)
|
|
OperatingSystem() string
|
|
}
|
|
|
|
// ROLayer is a reference to image rootfs layer
|
|
type ROLayer interface {
|
|
Release() error
|
|
NewRWLayer() (RWLayer, error)
|
|
DiffID() layer.DiffID
|
|
}
|
|
|
|
// RWLayer is active layer that can be read/modified
|
|
type RWLayer interface {
|
|
Release() error
|
|
Root() containerfs.ContainerFS
|
|
Commit() (ROLayer, error)
|
|
}
|