moby/testutil/daemon/ops.go
Cory Snider 6de52a29a8
daemon: support other containerd runtimes (MVP)
Contrary to popular belief, the OCI Runtime specification does not
specify the command-line API for runtimes. Looking at containerd's
architecture from the lens of the OCI Runtime spec, the _shim_ is the
OCI Runtime and runC is "just" an implementation detail of the
io.containerd.runc.v2 runtime. When one configures a non-default runtime
in Docker, what they're really doing is instructing Docker to create
containers using the io.containerd.runc.v2 runtime with a configuration
option telling the runtime that the runC binary is at some non-default
path. Consequently, only OCI runtimes which are compatible with the
io.containerd.runc.v2 shim, such as crun, can be used in this manner.
Other OCI runtimes, including kata-containers v2, come with their own
containerd shim and are not compatible with io.containerd.runc.v2.
As Docker has not historically provided a way to select a non-default
runtime which requires its own shim, runtimes such as kata-containers v2
could not be used with Docker.

Allow other containerd shims to be used with Docker; no daemon
configuration required. If the daemon is instructed to create a
container with a runtime name which does not match any of the configured
or stock runtimes, it passes the name along to containerd verbatim. A
user can start a container with the kata-containers runtime, for
example, simply by calling

    docker run --runtime io.containerd.kata.v2

Runtime names which containerd would interpret as a path to an arbitrary
binary are disallowed. While handy for development and testing it is not
strictly necessary and would allow anyone with Engine API access to
trivially execute any binary on the host as root, so we have decided it
would be safest for our users if it was not allowed.

It is not yet possible to set an alternative containerd shim as the
default runtime; it can only be configured per-container.

Signed-off-by: Cory Snider <csnider@mirantis.com>
(cherry picked from commit 547da0d575)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2022-07-29 20:36:50 +02:00

131 lines
3.1 KiB
Go

package daemon
import (
"os/user"
"github.com/docker/docker/testutil/environment"
)
// Option is used to configure a daemon.
type Option func(*Daemon)
// WithContainerdSocket sets the --containerd option on the daemon.
// Use an empty string to remove the option.
//
// If unset the --containerd option will be used with a default value.
func WithContainerdSocket(socket string) Option {
return func(d *Daemon) {
d.containerdSocket = socket
}
}
// WithDefaultCgroupNamespaceMode sets the default cgroup namespace mode for the daemon
func WithDefaultCgroupNamespaceMode(mode string) Option {
return func(d *Daemon) {
d.defaultCgroupNamespaceMode = mode
}
}
// WithTestLogger causes the daemon to log certain actions to the provided test.
func WithTestLogger(t LogT) Option {
return func(d *Daemon) {
d.log = t
}
}
// WithExperimental sets the daemon in experimental mode
func WithExperimental() Option {
return func(d *Daemon) {
d.experimental = true
}
}
// WithInit sets the daemon init
func WithInit() Option {
return func(d *Daemon) {
d.init = true
}
}
// WithDockerdBinary sets the dockerd binary to the specified one
func WithDockerdBinary(dockerdBinary string) Option {
return func(d *Daemon) {
d.dockerdBinary = dockerdBinary
}
}
// WithSwarmPort sets the swarm port to use for swarm mode
func WithSwarmPort(port int) Option {
return func(d *Daemon) {
d.SwarmPort = port
}
}
// WithSwarmListenAddr sets the swarm listen addr to use for swarm mode
func WithSwarmListenAddr(listenAddr string) Option {
return func(d *Daemon) {
d.swarmListenAddr = listenAddr
}
}
// WithSwarmDefaultAddrPool sets the swarm default address pool to use for swarm mode
func WithSwarmDefaultAddrPool(defaultAddrPool []string) Option {
return func(d *Daemon) {
d.DefaultAddrPool = defaultAddrPool
}
}
// WithSwarmDefaultAddrPoolSubnetSize sets the subnet length mask of swarm default address pool to use for swarm mode
func WithSwarmDefaultAddrPoolSubnetSize(subnetSize uint32) Option {
return func(d *Daemon) {
d.SubnetSize = subnetSize
}
}
// WithSwarmDataPathPort sets the swarm datapath port to use for swarm mode
func WithSwarmDataPathPort(datapathPort uint32) Option {
return func(d *Daemon) {
d.DataPathPort = datapathPort
}
}
// WithEnvironment sets options from testutil/environment.Execution struct
func WithEnvironment(e environment.Execution) Option {
return func(d *Daemon) {
if e.DaemonInfo.ExperimentalBuild {
d.experimental = true
}
}
}
// WithStorageDriver sets store driver option
func WithStorageDriver(driver string) Option {
return func(d *Daemon) {
d.storageDriver = driver
}
}
// WithRootlessUser sets the daemon to be rootless
func WithRootlessUser(username string) Option {
return func(d *Daemon) {
u, err := user.Lookup(username)
if err != nil {
panic(err)
}
d.rootlessUser = u
}
}
// WithOOMScoreAdjust sets OOM score for the daemon
func WithOOMScoreAdjust(score int) Option {
return func(d *Daemon) {
d.OOMScoreAdjust = score
}
}
// WithEnvVars sets additional environment variables for the daemon
func WithEnvVars(vars ...string) Option {
return func(d *Daemon) {
d.extraEnv = append(d.extraEnv, vars...)
}
}