summaryrefslogtreecommitdiff
path: root/cmd/kpod
diff options
context:
space:
mode:
authorDaniel J Walsh <dwalsh@redhat.com>2017-11-22 11:00:50 -0500
committerAtomic Bot <atomic-devel@projectatomic.io>2017-11-22 16:46:53 +0000
commitbd4e106de3d890bd2b0520083c9ad7d314b61487 (patch)
treeafe04f2de5f9571fe3712d62a33ae7da4317419b /cmd/kpod
parent2a3934f1dae43589c50df8fa545d20405f64d7af (diff)
downloadpodman-bd4e106de3d890bd2b0520083c9ad7d314b61487.tar.gz
podman-bd4e106de3d890bd2b0520083c9ad7d314b61487.tar.bz2
podman-bd4e106de3d890bd2b0520083c9ad7d314b61487.zip
Add support for pid ns
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com> Closes: #54 Approved by: umohnani8
Diffstat (limited to 'cmd/kpod')
-rw-r--r--cmd/kpod/create.go15
-rw-r--r--cmd/kpod/spec.go27
2 files changed, 38 insertions, 4 deletions
diff --git a/cmd/kpod/create.go b/cmd/kpod/create.go
index 73959ed02..d609d011e 100644
--- a/cmd/kpod/create.go
+++ b/cmd/kpod/create.go
@@ -6,6 +6,7 @@ import (
"strconv"
"strings"
+ "github.com/docker/docker/api/types/container"
"github.com/docker/go-units"
"github.com/opencontainers/selinux/go-selinux/label"
"github.com/pkg/errors"
@@ -61,6 +62,7 @@ type createResourceConfig struct {
}
type createConfig struct {
+ runtime *libpod.Runtime
args []string
capAdd []string // cap-add
capDrop []string // cap-drop
@@ -90,8 +92,8 @@ type createConfig struct {
network string //network
networkAlias []string //network-alias
nsIPC string // ipc
- nsNet string //net
- nsPID string //pid
+ nsNET string //net
+ pidMode container.PidMode //pid
nsUser string
pod string //pod
privileged bool //privileged
@@ -329,8 +331,13 @@ func parseCreateOpts(c *cli.Context, runtime *libpod.Runtime) (*createConfig, er
if !c.Bool("detach") && !tty {
tty = true
}
+ pidMode := container.PidMode(c.String("pid"))
+ if !pidMode.Valid() {
+ return nil, errors.Errorf("--pid %q is not valid", c.String("pid"))
+ }
config := &createConfig{
+ runtime: runtime,
capAdd: c.StringSlice("cap-add"),
capDrop: c.StringSlice("cap-drop"),
cgroupParent: c.String("cgroup-parent"),
@@ -357,8 +364,8 @@ func parseCreateOpts(c *cli.Context, runtime *libpod.Runtime) (*createConfig, er
network: c.String("network"),
networkAlias: c.StringSlice("network-alias"),
nsIPC: c.String("ipc"),
- nsNet: c.String("net"),
- nsPID: c.String("pid"),
+ nsNET: c.String("net"),
+ pidMode: pidMode,
pod: c.String("pod"),
privileged: c.Bool("privileged"),
publish: c.StringSlice("publish"),
diff --git a/cmd/kpod/spec.go b/cmd/kpod/spec.go
index 581be5241..752827669 100644
--- a/cmd/kpod/spec.go
+++ b/cmd/kpod/spec.go
@@ -2,6 +2,7 @@ package main
import (
"encoding/json"
+ "fmt"
"io/ioutil"
"strings"
@@ -44,6 +45,28 @@ func blockAccessToKernelFilesystems(config *createConfig, g *generate.Generator)
}
}
+func addPidNS(config *createConfig, g *generate.Generator) error {
+ pidMode := config.pidMode
+ if pidMode.IsHost() {
+ return g.RemoveLinuxNamespace("pid")
+ }
+ if pidMode.IsContainer() {
+ ctr, err := config.runtime.LookupContainer(pidMode.Container())
+ if err != nil {
+ return errors.Wrapf(err, "container %q not found", pidMode.Container())
+ }
+ pid, err := ctr.PID()
+ if err != nil {
+ return errors.Wrapf(err, "Failed to get pid of container %q", pidMode.Container())
+ }
+ pidNsPath := fmt.Sprintf("/proc/%d/ns/pid", pid)
+ if err := g.AddOrReplaceLinuxNamespace(libpod.PIDNamespace, pidNsPath); err != nil {
+ return err
+ }
+ }
+ return nil
+}
+
func addRlimits(config *createConfig, g *generate.Generator) error {
var (
ul *units.Ulimit
@@ -182,6 +205,10 @@ func createConfigToOCISpec(config *createConfig) (*spec.Spec, error) {
return nil, err
}
+ if err := addPidNS(config, &g); err != nil {
+ return nil, err
+ }
+
configSpec := g.Spec()
if config.seccompProfilePath != "" && config.seccompProfilePath != "unconfined" {