diff options
Diffstat (limited to 'libpod')
| -rw-r--r-- | libpod/container.go | 140 | ||||
| -rw-r--r-- | libpod/oci.go | 5 | ||||
| -rw-r--r-- | libpod/options.go | 19 | ||||
| -rw-r--r-- | libpod/runtime_ctr.go | 13 | ||||
| -rw-r--r-- | libpod/sql_state.go | 11 | ||||
| -rw-r--r-- | libpod/sql_state_internal.go | 14 |
6 files changed, 152 insertions, 50 deletions
diff --git a/libpod/container.go b/libpod/container.go index e69037353..31fbbbcc5 100644 --- a/libpod/container.go +++ b/libpod/container.go @@ -7,19 +7,25 @@ import ( "io/ioutil" "os" "path/filepath" + "strconv" "sync" + "syscall" "time" "github.com/containers/storage" "github.com/containers/storage/pkg/archive" + "github.com/docker/docker/pkg/mount" "github.com/docker/docker/pkg/namesgenerator" "github.com/docker/docker/pkg/stringid" "github.com/docker/docker/pkg/term" spec "github.com/opencontainers/runtime-spec/specs-go" + "github.com/opencontainers/runtime-tools/generate" + "github.com/opencontainers/selinux/go-selinux/label" "github.com/pkg/errors" crioAnnotations "github.com/projectatomic/libpod/pkg/annotations" "github.com/sirupsen/logrus" "github.com/ulule/deepcopier" + "golang.org/x/sys/unix" "k8s.io/apimachinery/pkg/util/wait" "k8s.io/client-go/tools/remotecommand" ) @@ -86,7 +92,6 @@ type containerRuntimeInfo struct { OOMKilled bool `json:"oomKilled,omitempty"` // PID is the PID of a running container PID int `json:"pid,omitempty"` - // TODO: Save information about image used in container if one is used } @@ -101,8 +106,12 @@ type ContainerConfig struct { RootfsImageID string `json:"rootfsImageID,omitempty"` RootfsImageName string `json:"rootfsImageName,omitempty"` UseImageConfig bool `json:"useImageConfig"` + // SELinux process label for container + ProcessLabel string `json:"ProcessLabel,omitempty"` // SELinux mount label for root filesystem MountLabel string `json:"MountLabel,omitempty"` + // Src path to be mounted on /dev/shm in container + ShmDir string `json:"ShmDir,omitempty"` // Static directory for container content that will persist across // reboot StaticDir string `json:"staticDir"` @@ -113,6 +122,8 @@ type ContainerConfig struct { // Labels is a set of key-value pairs providing additional information // about a container Labels map[string]string `json:"labels,omitempty"` + // Mounts list contains all additional mounts by the container runtime. + Mounts []string // StopSignal is the signal that will be used to stop the container StopSignal uint `json:"stopSignal,omitempty"` // Shared namespaces with container @@ -120,7 +131,6 @@ type ContainerConfig struct { SharedNamespaceMap map[string]string `json:"sharedNamespaces"` // Time container was created CreatedTime time.Time `json:"createdTime"` - // TODO save log location here and pass into OCI code // TODO allow overriding of log path } @@ -155,6 +165,16 @@ func (c *Container) Name() string { return c.config.Name } +// ShmDir returns the sources path to be mounted on /dev/shm in container +func (c *Container) ShmDir() string { + return c.config.ShmDir +} + +// ProcessLabel returns the selinux ProcessLabel of the container +func (c *Container) ProcessLabel() string { + return c.config.ProcessLabel +} + // Spec returns the container's OCI runtime spec // The spec returned is the one used to create the container. The running // spec may differ slightly as mounts are added based on the image @@ -307,7 +327,7 @@ func (c *Container) syncContainer() error { if err := c.runtime.ociRuntime.updateContainerStatus(c); err != nil { return err } - if err := c.runtime.state.SaveContainer(c); err != nil { + if err := c.save(); err != nil { return err } } @@ -376,13 +396,8 @@ func (c *Container) teardownStorage() error { return errors.Wrapf(ErrCtrStateInvalid, "cannot remove storage for container %s as it is running or paused", c.ID()) } - if c.state.Mounted { - if err := c.runtime.storageService.StopContainer(c.ID()); err != nil { - return errors.Wrapf(err, "error unmounting container %s root filesystem", c.ID()) - } - - c.state.Mounted = false - c.state.Mountpoint = "" + if err := c.cleanupStorage(); err != nil { + return errors.Wrapf(err, "failed to cleanup container %s storage", c.ID()) } if err := c.runtime.storageService.DeleteContainer(c.ID()); err != nil { @@ -426,8 +441,10 @@ func (c *Container) Init() (err error) { }() // Make the OCI runtime spec we will use - c.runningSpec = new(spec.Spec) - deepcopier.Copy(c.config.Spec).To(c.runningSpec) + g := generate.NewFromSpec(c.config.Spec) + // Mount ShmDir from host into container + g.AddBindMount(c.config.ShmDir, "/dev/shm", []string{"rw"}) + c.runningSpec = g.Spec() c.runningSpec.Root.Path = c.state.Mountpoint c.runningSpec.Annotations[crioAnnotations.Created] = c.config.CreatedTime.Format(time.RFC3339Nano) c.runningSpec.Annotations["org.opencontainers.image.stopSignal"] = fmt.Sprintf("%d", c.config.StopSignal) @@ -455,11 +472,7 @@ func (c *Container) Init() (err error) { c.state.State = ContainerStateCreated - if err := c.runtime.state.SaveContainer(c); err != nil { - return errors.Wrapf(err, "error saving container %s state", c.ID()) - } - - return nil + return c.save() } // Start starts a container @@ -471,6 +484,19 @@ func (c *Container) Start() error { return err } + mounted, err := mount.Mounted(c.config.ShmDir) + if err != nil { + return errors.Wrapf(err, "unable to determine if %q is mounted", c.config.ShmDir) + } + + if !mounted { + shmOptions := "mode=1777,size=" + strconv.Itoa(DefaultShmSize) + if err := unix.Mount("shm", c.config.ShmDir, "tmpfs", unix.MS_NOEXEC|unix.MS_NOSUID|unix.MS_NODEV, + label.FormatMountLabel(shmOptions, c.config.MountLabel)); err != nil { + return errors.Wrapf(err, "failed to mount shm tmpfs %q", c.config.ShmDir) + } + } + // Container must be created or stopped to be started if !(c.state.State == ContainerStateCreated || c.state.State == ContainerStateStopped) { return errors.Wrapf(ErrCtrStateInvalid, "container %s must be in Created or Stopped state to be started", c.ID()) @@ -510,11 +536,7 @@ func (c *Container) Start() error { return err } - if err := c.runtime.state.SaveContainer(c); err != nil { - return errors.Wrapf(err, "error saving container %s state", c.ID()) - } - - return nil + return c.save() } // Stop uses the container's stop signal (or SIGTERM if no signal was specified) @@ -544,18 +566,7 @@ func (c *Container) Stop(timeout int64) error { return err } - // Also unmount storage - if err := c.runtime.storageService.StopContainer(c.ID()); err != nil { - return errors.Wrapf(err, "error unmounting container %s root filesystem", c.ID()) - } - c.state.Mountpoint = "" - c.state.Mounted = false - - if err := c.runtime.state.SaveContainer(c); err != nil { - return errors.Wrapf(err, "error saving container %s state", c.ID()) - } - - return nil + return c.cleanupStorage() } // Kill sends a signal to a container @@ -638,8 +649,8 @@ func (c *Container) Mount(label string) (string, error) { c.state.Mounted = true c.config.MountLabel = mountLabel - if err := c.runtime.state.SaveContainer(c); err != nil { - return "", errors.Wrapf(err, "error saving container %s state", c.ID()) + if err := c.save(); err != nil { + return "", err } return mountPoint, nil @@ -669,7 +680,7 @@ func (c *Container) Unmount() error { c.state.Mountpoint = "" c.state.Mounted = false - return c.runtime.state.SaveContainer(c) + return c.save() } // Pause pauses a container @@ -698,10 +709,7 @@ func (c *Container) Pause() error { return err } - if err := c.runtime.state.SaveContainer(c); err != nil { - return errors.Wrapf(err, "error saving container %s state", c.ID()) - } - return nil + return c.save() } // Unpause unpauses a container @@ -727,10 +735,7 @@ func (c *Container) Unpause() error { return err } - if err := c.runtime.state.SaveContainer(c); err != nil { - return errors.Wrapf(err, "error saving container %s state", c.ID()) - } - return nil + return c.save() } // Export exports a container's root filesystem as a tar archive @@ -809,3 +814,48 @@ func (c *Container) isStopped() (bool, error) { } return c.state.State == ContainerStateStopped, nil } + +// nil container state to the database +func (c *Container) save() error { + if err := c.runtime.state.SaveContainer(c); err != nil { + return errors.Wrapf(err, "error saving container %s state", c.ID()) + } + return nil +} + +// CleanupStorage unmounts all mount points in container and cleans up container storage +func (c *Container) CleanupStorage() error { + c.lock.Lock() + defer c.lock.Unlock() + if err := c.syncContainer(); err != nil { + return err + } + return c.cleanupStorage() +} + +func (c *Container) cleanupStorage() error { + + if c.state.Mounted { + for _, mount := range c.config.Mounts { + if err := unix.Unmount(mount, unix.MNT_DETACH); err != nil { + if err != syscall.EINVAL { + logrus.Warnf("container %s failed to unmount %s : %v", c.ID(), mount, err) + } + } + } + c.config.Mounts = []string{} + + // Also unmount storage + if err := c.runtime.storageService.StopContainer(c.ID()); err != nil { + return errors.Wrapf(err, "error unmounting container %s root filesystem", c.ID()) + } + } + + c.state.Mountpoint = "" + c.state.Mounted = false + + if err := c.runtime.state.SaveContainer(c); err != nil { + return errors.Wrapf(err, "error saving container %s state", c.ID()) + } + return nil +} diff --git a/libpod/oci.go b/libpod/oci.go index 4abbc5122..6ea6bb64f 100644 --- a/libpod/oci.go +++ b/libpod/oci.go @@ -37,6 +37,11 @@ const ( // Timeout before declaring that runc has failed to kill a given container killContainerTimeout = 5 * time.Second + // DefaultShmSize is the default shm size + DefaultShmSize = 64 * 1024 * 1024 + // NsRunDir is the default directory in which running network namespaces + // are stored + NsRunDir = "/var/run/netns" ) // OCIRuntime represents an OCI-compatible runtime that libpod can call into diff --git a/libpod/options.go b/libpod/options.go index 59141115d..07c25faf9 100644 --- a/libpod/options.go +++ b/libpod/options.go @@ -21,7 +21,7 @@ const ( // MountNamespace represents the mount namespace MountNamespace = "mount" // NetNamespace represents the network namespace - NetNamespace = "net" + NetNamespace = "network" // PIDNamespace represents the PID namespace PIDNamespace = "pid" // UserNamespace represents the user namespace @@ -252,13 +252,26 @@ func WithNoPivotRoot(noPivot bool) RuntimeOption { // Container Creation Options -// WithSELinuxMountLabel sets the mount label for SELinux -func WithSELinuxMountLabel(mountLabel string) CtrCreateOption { +// WithShmDir sets the directory that should be mounted on /dev/shm +func WithShmDir(dir string) CtrCreateOption { return func(ctr *Container) error { if ctr.valid { return ErrCtrFinalized } + ctr.config.ShmDir = dir + return nil + } +} + +// WithSELinuxLabels sets the mount label for SELinux +func WithSELinuxLabels(processLabel, mountLabel string) CtrCreateOption { + return func(ctr *Container) error { + if ctr.valid { + return ErrCtrFinalized + } + + ctr.config.ProcessLabel = processLabel ctr.config.MountLabel = mountLabel return nil } diff --git a/libpod/runtime_ctr.go b/libpod/runtime_ctr.go index 58074cc43..5fb29abb5 100644 --- a/libpod/runtime_ctr.go +++ b/libpod/runtime_ctr.go @@ -1,6 +1,9 @@ package libpod import ( + "os" + "path/filepath" + spec "github.com/opencontainers/runtime-spec/specs-go" "github.com/pkg/errors" "github.com/sirupsen/logrus" @@ -54,6 +57,16 @@ func (r *Runtime) NewContainer(spec *spec.Spec, options ...CtrCreateOption) (c * } }() + if ctr.config.ShmDir == "" { + ctr.config.ShmDir = filepath.Join(ctr.bundlePath(), "shm") + if err := os.MkdirAll(ctr.config.ShmDir, 0700); err != nil { + if !os.IsExist(err) { + return nil, errors.Wrapf(err, "unable to create shm %q dir", ctr.config.ShmDir) + } + } + ctr.config.Mounts = append(ctr.config.Mounts, ctr.config.ShmDir) + } + // If the container is in a pod, add it to the pod if ctr.pod != nil { if err := ctr.pod.addContainer(ctr); err != nil { diff --git a/libpod/sql_state.go b/libpod/sql_state.go index 7c2061fca..fb6be85d7 100644 --- a/libpod/sql_state.go +++ b/libpod/sql_state.go @@ -16,7 +16,7 @@ import ( // DBSchema is the current DB schema version // Increments every time a change is made to the database's tables -const DBSchema = 1 +const DBSchema = 2 // SQLState is a state implementation backed by a persistent SQLite3 database type SQLState struct { @@ -230,7 +230,7 @@ func (s *SQLState) HasContainer(id string) (bool, error) { func (s *SQLState) AddContainer(ctr *Container) (err error) { const ( addCtr = `INSERT INTO containers VALUES ( - ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ? + ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ? );` addCtrState = `INSERT INTO containerState VALUES ( ?, ?, ?, ?, ?, ?, ?, ?, ?, ? @@ -265,11 +265,18 @@ func (s *SQLState) AddContainer(ctr *Container) (err error) { } }() + mounts, err := json.Marshal(ctr.config.Mounts) + if err != nil { + return errors.Wrapf(err, "error marshaling container %s monunts to JSON", ctr.ID()) + } // Add static container information _, err = tx.Exec(addCtr, ctr.ID(), ctr.Name(), + ctr.config.ProcessLabel, ctr.config.MountLabel, + string(mounts), + ctr.config.ShmDir, ctr.config.StaticDir, boolToSQL(ctr.config.Stdin), string(labelsJSON), diff --git a/libpod/sql_state_internal.go b/libpod/sql_state_internal.go index 6e0142b9b..3aee8f638 100644 --- a/libpod/sql_state_internal.go +++ b/libpod/sql_state_internal.go @@ -166,7 +166,10 @@ func prepareDB(db *sql.DB) (err error) { CREATE TABLE IF NOT EXISTS containers( Id TEXT NOT NULL PRIMARY KEY, Name TEXT NOT NULL UNIQUE, + ProcessLabel TEXT NOT NULL, MountLabel TEXT NOT NULL, + Mounts TEXT NOT NULL, + ShmDir TEXT NOT NULL, StaticDir TEXT NOT NULL, Stdin INTEGER NOT NULL, LabelsJSON TEXT NOT NULL, @@ -267,7 +270,10 @@ func ctrFromScannable(row scannable, runtime *Runtime, specsDir string) (*Contai var ( id string name string + processLabel string mountLabel string + mounts string + shmDir string staticDir string stdin int labelsJSON string @@ -290,7 +296,10 @@ func ctrFromScannable(row scannable, runtime *Runtime, specsDir string) (*Contai err := row.Scan( &id, &name, + &processLabel, &mountLabel, + &mounts, + &shmDir, &staticDir, &stdin, &labelsJSON, @@ -325,7 +334,12 @@ func ctrFromScannable(row scannable, runtime *Runtime, specsDir string) (*Contai ctr.config.RootfsImageID = rootfsImageID ctr.config.RootfsImageName = rootfsImageName ctr.config.UseImageConfig = boolFromSQL(useImageConfig) + ctr.config.ProcessLabel = processLabel ctr.config.MountLabel = mountLabel + if err := json.Unmarshal([]byte(mounts), &ctr.config.Mounts); err != nil { + return nil, errors.Wrapf(err, "error parsing container %s mounts JSON", id) + } + ctr.config.ShmDir = shmDir ctr.config.StaticDir = staticDir ctr.config.Stdin = boolFromSQL(stdin) ctr.config.StopSignal = stopSignal |