547da0d575
Contrary to popular belief, the OCI Runtime specification does not specify the command-line API for runtimes. Looking at containerd's architecture from the lens of the OCI Runtime spec, the _shim_ is the OCI Runtime and runC is "just" an implementation detail of the io.containerd.runc.v2 runtime. When one configures a non-default runtime in Docker, what they're really doing is instructing Docker to create containers using the io.containerd.runc.v2 runtime with a configuration option telling the runtime that the runC binary is at some non-default path. Consequently, only OCI runtimes which are compatible with the io.containerd.runc.v2 shim, such as crun, can be used in this manner. Other OCI runtimes, including kata-containers v2, come with their own containerd shim and are not compatible with io.containerd.runc.v2. As Docker has not historically provided a way to select a non-default runtime which requires its own shim, runtimes such as kata-containers v2 could not be used with Docker. Allow other containerd shims to be used with Docker; no daemon configuration required. If the daemon is instructed to create a container with a runtime name which does not match any of the configured or stock runtimes, it passes the name along to containerd verbatim. A user can start a container with the kata-containers runtime, for example, simply by calling docker run --runtime io.containerd.kata.v2 Runtime names which containerd would interpret as a path to an arbitrary binary are disallowed. While handy for development and testing it is not strictly necessary and would allow anyone with Engine API access to trivially execute any binary on the host as root, so we have decided it would be safest for our users if it was not allowed. It is not yet possible to set an alternative containerd shim as the default runtime; it can only be configured per-container. Signed-off-by: Cory Snider <csnider@mirantis.com>
131 lines
3.1 KiB
Go
131 lines
3.1 KiB
Go
package daemon
|
|
|
|
import (
|
|
"os/user"
|
|
|
|
"github.com/docker/docker/testutil/environment"
|
|
)
|
|
|
|
// Option is used to configure a daemon.
|
|
type Option func(*Daemon)
|
|
|
|
// WithContainerdSocket sets the --containerd option on the daemon.
|
|
// Use an empty string to remove the option.
|
|
//
|
|
// If unset the --containerd option will be used with a default value.
|
|
func WithContainerdSocket(socket string) Option {
|
|
return func(d *Daemon) {
|
|
d.containerdSocket = socket
|
|
}
|
|
}
|
|
|
|
// WithDefaultCgroupNamespaceMode sets the default cgroup namespace mode for the daemon
|
|
func WithDefaultCgroupNamespaceMode(mode string) Option {
|
|
return func(d *Daemon) {
|
|
d.defaultCgroupNamespaceMode = mode
|
|
}
|
|
}
|
|
|
|
// WithTestLogger causes the daemon to log certain actions to the provided test.
|
|
func WithTestLogger(t LogT) Option {
|
|
return func(d *Daemon) {
|
|
d.log = t
|
|
}
|
|
}
|
|
|
|
// WithExperimental sets the daemon in experimental mode
|
|
func WithExperimental() Option {
|
|
return func(d *Daemon) {
|
|
d.experimental = true
|
|
}
|
|
}
|
|
|
|
// WithInit sets the daemon init
|
|
func WithInit() Option {
|
|
return func(d *Daemon) {
|
|
d.init = true
|
|
}
|
|
}
|
|
|
|
// WithDockerdBinary sets the dockerd binary to the specified one
|
|
func WithDockerdBinary(dockerdBinary string) Option {
|
|
return func(d *Daemon) {
|
|
d.dockerdBinary = dockerdBinary
|
|
}
|
|
}
|
|
|
|
// WithSwarmPort sets the swarm port to use for swarm mode
|
|
func WithSwarmPort(port int) Option {
|
|
return func(d *Daemon) {
|
|
d.SwarmPort = port
|
|
}
|
|
}
|
|
|
|
// WithSwarmListenAddr sets the swarm listen addr to use for swarm mode
|
|
func WithSwarmListenAddr(listenAddr string) Option {
|
|
return func(d *Daemon) {
|
|
d.swarmListenAddr = listenAddr
|
|
}
|
|
}
|
|
|
|
// WithSwarmDefaultAddrPool sets the swarm default address pool to use for swarm mode
|
|
func WithSwarmDefaultAddrPool(defaultAddrPool []string) Option {
|
|
return func(d *Daemon) {
|
|
d.DefaultAddrPool = defaultAddrPool
|
|
}
|
|
}
|
|
|
|
// WithSwarmDefaultAddrPoolSubnetSize sets the subnet length mask of swarm default address pool to use for swarm mode
|
|
func WithSwarmDefaultAddrPoolSubnetSize(subnetSize uint32) Option {
|
|
return func(d *Daemon) {
|
|
d.SubnetSize = subnetSize
|
|
}
|
|
}
|
|
|
|
// WithSwarmDataPathPort sets the swarm datapath port to use for swarm mode
|
|
func WithSwarmDataPathPort(datapathPort uint32) Option {
|
|
return func(d *Daemon) {
|
|
d.DataPathPort = datapathPort
|
|
}
|
|
}
|
|
|
|
// WithEnvironment sets options from testutil/environment.Execution struct
|
|
func WithEnvironment(e environment.Execution) Option {
|
|
return func(d *Daemon) {
|
|
if e.DaemonInfo.ExperimentalBuild {
|
|
d.experimental = true
|
|
}
|
|
}
|
|
}
|
|
|
|
// WithStorageDriver sets store driver option
|
|
func WithStorageDriver(driver string) Option {
|
|
return func(d *Daemon) {
|
|
d.storageDriver = driver
|
|
}
|
|
}
|
|
|
|
// WithRootlessUser sets the daemon to be rootless
|
|
func WithRootlessUser(username string) Option {
|
|
return func(d *Daemon) {
|
|
u, err := user.Lookup(username)
|
|
if err != nil {
|
|
panic(err)
|
|
}
|
|
d.rootlessUser = u
|
|
}
|
|
}
|
|
|
|
// WithOOMScoreAdjust sets OOM score for the daemon
|
|
func WithOOMScoreAdjust(score int) Option {
|
|
return func(d *Daemon) {
|
|
d.OOMScoreAdjust = score
|
|
}
|
|
}
|
|
|
|
// WithEnvVars sets additional environment variables for the daemon
|
|
func WithEnvVars(vars ...string) Option {
|
|
return func(d *Daemon) {
|
|
d.extraEnv = append(d.extraEnv, vars...)
|
|
}
|
|
}
|