summaryrefslogtreecommitdiff
path: root/pkg/api/handlers
diff options
context:
space:
mode:
authorDaniel J Walsh <dwalsh@redhat.com>2021-03-30 06:39:49 -0400
committerDaniel J Walsh <dwalsh@redhat.com>2021-04-02 09:19:03 -0400
commit052732857aa163f5f9d1dd65f9936f2787a953c6 (patch)
treefc60ac9ea3cdc5c03dd2f08de453d2a3d9bcfa44 /pkg/api/handlers
parent1db9053add6501f2c234a6f63bb1e74b5eb89cb0 (diff)
downloadpodman-052732857aa163f5f9d1dd65f9936f2787a953c6.tar.gz
podman-052732857aa163f5f9d1dd65f9936f2787a953c6.tar.bz2
podman-052732857aa163f5f9d1dd65f9936f2787a953c6.zip
Fix missing podman-remote build options
Fix handling of SecurityOpts LabelOpts SeccompProfilePath ApparmorProfile Fix Ulimits Fixes: https://github.com/containers/podman/issues/9869 Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
Diffstat (limited to 'pkg/api/handlers')
-rw-r--r--pkg/api/handlers/compat/images_build.go202
1 files changed, 138 insertions, 64 deletions
diff --git a/pkg/api/handlers/compat/images_build.go b/pkg/api/handlers/compat/images_build.go
index 6dac789d6..ab92434b1 100644
--- a/pkg/api/handlers/compat/images_build.go
+++ b/pkg/api/handlers/compat/images_build.go
@@ -10,6 +10,7 @@ import (
"os"
"path/filepath"
"strconv"
+ "strings"
"time"
"github.com/containers/buildah"
@@ -63,52 +64,55 @@ func BuildImage(w http.ResponseWriter, r *http.Request) {
}()
query := struct {
- AddHosts string `schema:"extrahosts"`
- AdditionalCapabilities string `schema:"addcaps"`
- Annotations string `schema:"annotations"`
- BuildArgs string `schema:"buildargs"`
- CacheFrom string `schema:"cachefrom"`
- Compression uint64 `schema:"compression"`
- ConfigureNetwork string `schema:"networkmode"`
- CpuPeriod uint64 `schema:"cpuperiod"` // nolint
- CpuQuota int64 `schema:"cpuquota"` // nolint
- CpuSetCpus string `schema:"cpusetcpus"` // nolint
- CpuShares uint64 `schema:"cpushares"` // nolint
- Devices string `schema:"devices"`
- Dockerfile string `schema:"dockerfile"`
- DropCapabilities string `schema:"dropcaps"`
- DNSServers string `schema:"dnsservers"`
- DNSOptions string `schema:"dnsoptions"`
- DNSSearch string `schema:"dnssearch"`
- Excludes string `schema:"excludes"`
- ForceRm bool `schema:"forcerm"`
- From string `schema:"from"`
- HTTPProxy bool `schema:"httpproxy"`
- Isolation string `schema:"isolation"`
- Ignore bool `schema:"ignore"`
- Jobs int `schema:"jobs"` // nolint
- Labels string `schema:"labels"`
- Layers bool `schema:"layers"`
- LogRusage bool `schema:"rusage"`
- Manifest string `schema:"manifest"`
- MemSwap int64 `schema:"memswap"`
- Memory int64 `schema:"memory"`
- NamespaceOptions string `schema:"nsoptions"`
- NoCache bool `schema:"nocache"`
- OutputFormat string `schema:"outputformat"`
- Platform string `schema:"platform"`
- Pull bool `schema:"pull"`
- PullPolicy string `schema:"pullpolicy"`
- Quiet bool `schema:"q"`
- Registry string `schema:"registry"`
- Rm bool `schema:"rm"`
- //FIXME SecurityOpt in remote API is not handled
- SecurityOpt string `schema:"securityopt"`
- ShmSize int `schema:"shmsize"`
- Squash bool `schema:"squash"`
- Tag []string `schema:"t"`
- Target string `schema:"target"`
- Timestamp int64 `schema:"timestamp"`
+ AddHosts string `schema:"extrahosts"`
+ AdditionalCapabilities string `schema:"addcaps"`
+ Annotations string `schema:"annotations"`
+ AppArmor string `schema:"apparmor"`
+ BuildArgs string `schema:"buildargs"`
+ CacheFrom string `schema:"cachefrom"`
+ Compression uint64 `schema:"compression"`
+ ConfigureNetwork string `schema:"networkmode"`
+ CpuPeriod uint64 `schema:"cpuperiod"` // nolint
+ CpuQuota int64 `schema:"cpuquota"` // nolint
+ CpuSetCpus string `schema:"cpusetcpus"` // nolint
+ CpuShares uint64 `schema:"cpushares"` // nolint
+ DNSOptions string `schema:"dnsoptions"`
+ DNSSearch string `schema:"dnssearch"`
+ DNSServers string `schema:"dnsservers"`
+ Devices string `schema:"devices"`
+ Dockerfile string `schema:"dockerfile"`
+ DropCapabilities string `schema:"dropcaps"`
+ Excludes string `schema:"excludes"`
+ ForceRm bool `schema:"forcerm"`
+ From string `schema:"from"`
+ HTTPProxy bool `schema:"httpproxy"`
+ Ignore bool `schema:"ignore"`
+ Isolation string `schema:"isolation"`
+ Jobs int `schema:"jobs"` // nolint
+ LabelOpts string `schema:"labelopts"`
+ Labels string `schema:"labels"`
+ Layers bool `schema:"layers"`
+ LogRusage bool `schema:"rusage"`
+ Manifest string `schema:"manifest"`
+ MemSwap int64 `schema:"memswap"`
+ Memory int64 `schema:"memory"`
+ NamespaceOptions string `schema:"nsoptions"`
+ NoCache bool `schema:"nocache"`
+ OutputFormat string `schema:"outputformat"`
+ Platform string `schema:"platform"`
+ Pull bool `schema:"pull"`
+ PullPolicy string `schema:"pullpolicy"`
+ Quiet bool `schema:"q"`
+ Registry string `schema:"registry"`
+ Rm bool `schema:"rm"`
+ Seccomp string `schema:"seccomp"`
+ SecurityOpt string `schema:"securityopt"`
+ ShmSize int `schema:"shmsize"`
+ Squash bool `schema:"squash"`
+ Tag []string `schema:"t"`
+ Target string `schema:"target"`
+ Timestamp int64 `schema:"timestamp"`
+ Ulimits string `schema:"ulimits"`
}{
Dockerfile: "Dockerfile",
Registry: "docker.io",
@@ -123,7 +127,7 @@ func BuildImage(w http.ResponseWriter, r *http.Request) {
return
}
- // convert label formats
+ // convert addcaps formats
var addCaps = []string{}
if _, found := r.URL.Query()["addcaps"]; found {
var m = []string{}
@@ -133,6 +137,7 @@ func BuildImage(w http.ResponseWriter, r *http.Request) {
}
addCaps = m
}
+
addhosts := []string{}
if _, found := r.URL.Query()["extrahosts"]; found {
if err := json.Unmarshal([]byte(query.AddHosts), &addhosts); err != nil {
@@ -142,7 +147,8 @@ func BuildImage(w http.ResponseWriter, r *http.Request) {
}
compression := archive.Compression(query.Compression)
- // convert label formats
+
+ // convert dropcaps formats
var dropCaps = []string{}
if _, found := r.URL.Query()["dropcaps"]; found {
var m = []string{}
@@ -153,7 +159,7 @@ func BuildImage(w http.ResponseWriter, r *http.Request) {
dropCaps = m
}
- // convert label formats
+ // convert devices formats
var devices = []string{}
if _, found := r.URL.Query()["devices"]; found {
var m = []string{}
@@ -233,7 +239,7 @@ func BuildImage(w http.ResponseWriter, r *http.Request) {
}
}
- // convert label formats
+ // convert annotations formats
var annotations = []string{}
if _, found := r.URL.Query()["annotations"]; found {
if err := json.Unmarshal([]byte(query.Annotations), &annotations); err != nil {
@@ -242,7 +248,7 @@ func BuildImage(w http.ResponseWriter, r *http.Request) {
}
}
- // convert label formats
+ // convert nsoptions formats
nsoptions := buildah.NamespaceOptions{}
if _, found := r.URL.Query()["nsoptions"]; found {
if err := json.Unmarshal([]byte(query.NamespaceOptions), &nsoptions); err != nil {
@@ -271,11 +277,75 @@ func BuildImage(w http.ResponseWriter, r *http.Request) {
}
}
}
+
jobs := 1
if _, found := r.URL.Query()["jobs"]; found {
jobs = query.Jobs
}
+ var (
+ labelOpts = []string{}
+ seccomp string
+ apparmor string
+ )
+
+ if utils.IsLibpodRequest(r) {
+ seccomp = query.Seccomp
+ apparmor = query.AppArmor
+ // convert labelopts formats
+ if _, found := r.URL.Query()["labelopts"]; found {
+ var m = []string{}
+ if err := json.Unmarshal([]byte(query.LabelOpts), &m); err != nil {
+ utils.BadRequest(w, "labelopts", query.LabelOpts, err)
+ return
+ }
+ labelOpts = m
+ }
+ } else {
+ // handle security-opt
+ if _, found := r.URL.Query()["securityopt"]; found {
+ var securityOpts = []string{}
+ if err := json.Unmarshal([]byte(query.SecurityOpt), &securityOpts); err != nil {
+ utils.BadRequest(w, "securityopt", query.SecurityOpt, err)
+ return
+ }
+ for _, opt := range securityOpts {
+ if opt == "no-new-privileges" {
+ utils.BadRequest(w, "securityopt", query.SecurityOpt, errors.New("no-new-privileges is not supported"))
+ return
+ }
+ con := strings.SplitN(opt, "=", 2)
+ if len(con) != 2 {
+ utils.BadRequest(w, "securityopt", query.SecurityOpt, errors.Errorf("Invalid --security-opt name=value pair: %q", opt))
+ return
+ }
+
+ switch con[0] {
+ case "label":
+ labelOpts = append(labelOpts, con[1])
+ case "apparmor":
+ apparmor = con[1]
+ case "seccomp":
+ seccomp = con[1]
+ default:
+ utils.BadRequest(w, "securityopt", query.SecurityOpt, errors.Errorf("Invalid --security-opt 2: %q", opt))
+ return
+ }
+ }
+ }
+ }
+
+ // convert ulimits formats
+ var ulimits = []string{}
+ if _, found := r.URL.Query()["ulimits"]; found {
+ var m = []string{}
+ if err := json.Unmarshal([]byte(query.Ulimits), &m); err != nil {
+ utils.BadRequest(w, "ulimits", query.Ulimits, err)
+ return
+ }
+ ulimits = m
+ }
+
pullPolicy := buildahDefine.PullIfMissing
if utils.IsLibpodRequest(r) {
pullPolicy = buildahDefine.PolicyMap[query.PullPolicy]
@@ -320,18 +390,22 @@ func BuildImage(w http.ResponseWriter, r *http.Request) {
Annotations: annotations,
Args: buildArgs,
CommonBuildOpts: &buildah.CommonBuildOptions{
- AddHost: addhosts,
- CPUPeriod: query.CpuPeriod,
- CPUQuota: query.CpuQuota,
- CPUShares: query.CpuShares,
- CPUSetCPUs: query.CpuSetCpus,
- DNSServers: dnsservers,
- DNSOptions: dnsoptions,
- DNSSearch: dnssearch,
- HTTPProxy: query.HTTPProxy,
- Memory: query.Memory,
- MemorySwap: query.MemSwap,
- ShmSize: strconv.Itoa(query.ShmSize),
+ AddHost: addhosts,
+ ApparmorProfile: apparmor,
+ CPUPeriod: query.CpuPeriod,
+ CPUQuota: query.CpuQuota,
+ CPUSetCPUs: query.CpuSetCpus,
+ CPUShares: query.CpuShares,
+ DNSOptions: dnsoptions,
+ DNSSearch: dnssearch,
+ DNSServers: dnsservers,
+ HTTPProxy: query.HTTPProxy,
+ LabelOpts: labelOpts,
+ Memory: query.Memory,
+ MemorySwap: query.MemSwap,
+ SeccompProfilePath: seccomp,
+ ShmSize: strconv.Itoa(query.ShmSize),
+ Ulimit: ulimits,
},
CNIConfigDir: rtc.Network.CNIPluginDirs[0],
CNIPluginPath: util.DefaultCNIPluginPath,
@@ -364,11 +438,11 @@ func BuildImage(w http.ResponseWriter, r *http.Request) {
RemoveIntermediateCtrs: query.Rm,
ReportWriter: reporter,
Squash: query.Squash,
+ Target: query.Target,
SystemContext: &types.SystemContext{
AuthFilePath: authfile,
DockerAuthConfig: creds,
},
- Target: query.Target,
}
if _, found := r.URL.Query()["timestamp"]; found {