summaryrefslogtreecommitdiff
path: root/cmd/podman
diff options
context:
space:
mode:
authorGiuseppe Scrivano <gscrivan@redhat.com>2019-07-08 13:11:18 +0200
committerGiuseppe Scrivano <gscrivan@redhat.com>2019-07-18 10:32:25 +0200
commit0b57e77d7c1c54706611c9ca15e352425adb05e5 (patch)
tree6ae9a85fd1f16fb410ccfbd4ea88d5c6ef79004c /cmd/podman
parent7488ed6d9a619d86333dc1880d4df034fbb371b9 (diff)
downloadpodman-0b57e77d7c1c54706611c9ca15e352425adb05e5.tar.gz
podman-0b57e77d7c1c54706611c9ca15e352425adb05e5.tar.bz2
podman-0b57e77d7c1c54706611c9ca15e352425adb05e5.zip
libpod: support for cgroup namespace
allow a container to run in a new cgroup namespace. When running in a new cgroup namespace, the current cgroup appears to be the root, so that there is no way for the container to access cgroups outside of its own subtree. By default it uses --cgroup=host to keep the previous behavior. To create a new namespace, --cgroup=private must be provided. Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
Diffstat (limited to 'cmd/podman')
-rw-r--r--cmd/podman/common.go4
-rw-r--r--cmd/podman/shared/create.go18
-rw-r--r--cmd/podman/shared/intermediate.go1
3 files changed, 18 insertions, 5 deletions
diff --git a/cmd/podman/common.go b/cmd/podman/common.go
index 15f753d55..1e9092bd6 100644
--- a/cmd/podman/common.go
+++ b/cmd/podman/common.go
@@ -130,6 +130,10 @@ func getCreateFlags(c *cliconfig.PodmanCommand) {
"Drop capabilities from the container",
)
createFlags.String(
+ "cgroupns", "host",
+ "cgroup namespace to use",
+ )
+ createFlags.String(
"cgroup-parent", "",
"Optional parent cgroup for the container",
)
diff --git a/cmd/podman/shared/create.go b/cmd/podman/shared/create.go
index 5c37a1875..b14ce431d 100644
--- a/cmd/podman/shared/create.go
+++ b/cmd/podman/shared/create.go
@@ -400,11 +400,12 @@ func ParseCreateOpts(ctx context.Context, c *GenericCLIResults, runtime *libpod.
namespaceNet = c.String("net")
}
namespaces = map[string]string{
- "pid": c.String("pid"),
- "net": namespaceNet,
- "ipc": c.String("ipc"),
- "user": c.String("userns"),
- "uts": c.String("uts"),
+ "cgroup": c.String("cgroupns"),
+ "pid": c.String("pid"),
+ "net": namespaceNet,
+ "ipc": c.String("ipc"),
+ "user": c.String("userns"),
+ "uts": c.String("uts"),
}
originalPodName := c.String("pod")
@@ -462,6 +463,11 @@ func ParseCreateOpts(ctx context.Context, c *GenericCLIResults, runtime *libpod.
return nil, errors.Errorf("--uts %q is not valid", namespaces["uts"])
}
+ cgroupMode := ns.CgroupMode(namespaces["cgroup"])
+ if !cgroupMode.Valid() {
+ return nil, errors.Errorf("--cgroup %q is not valid", namespaces["cgroup"])
+ }
+
ipcMode := ns.IpcMode(namespaces["ipc"])
if !cc.Valid(string(ipcMode), ipcMode) {
return nil, errors.Errorf("--ipc %q is not valid", ipcMode)
@@ -652,6 +658,7 @@ func ParseCreateOpts(ctx context.Context, c *GenericCLIResults, runtime *libpod.
CapAdd: c.StringSlice("cap-add"),
CapDrop: c.StringSlice("cap-drop"),
CidFile: c.String("cidfile"),
+ Cgroupns: c.String("cgroupns"),
CgroupParent: c.String("cgroup-parent"),
Command: command,
Detach: c.Bool("detach"),
@@ -687,6 +694,7 @@ func ParseCreateOpts(ctx context.Context, c *GenericCLIResults, runtime *libpod.
NetMode: netMode,
UtsMode: utsMode,
PidMode: pidMode,
+ CgroupMode: cgroupMode,
Pod: podName,
Privileged: c.Bool("privileged"),
Publish: c.StringSlice("publish"),
diff --git a/cmd/podman/shared/intermediate.go b/cmd/podman/shared/intermediate.go
index 8337dc647..4062ac48a 100644
--- a/cmd/podman/shared/intermediate.go
+++ b/cmd/podman/shared/intermediate.go
@@ -370,6 +370,7 @@ func NewIntermediateLayer(c *cliconfig.PodmanCommand, remote bool) GenericCLIRes
m["blkio-weight-device"] = newCRStringSlice(c, "blkio-weight-device")
m["cap-add"] = newCRStringSlice(c, "cap-add")
m["cap-drop"] = newCRStringSlice(c, "cap-drop")
+ m["cgroupns"] = newCRString(c, "cgroupns")
m["cgroup-parent"] = newCRString(c, "cgroup-parent")
m["cidfile"] = newCRString(c, "cidfile")
m["conmon-pidfile"] = newCRString(c, "conmon-pidfile")