diff options
Diffstat (limited to 'libpod')
| -rw-r--r-- | libpod/container.go | 1163 | ||||
| -rw-r--r-- | libpod/container_api.go | 767 | ||||
| -rw-r--r-- | libpod/container_inspect.go | 3 | ||||
| -rw-r--r-- | libpod/container_internal.go | 515 | ||||
| -rw-r--r-- | libpod/in_memory_state.go | 215 | ||||
| -rw-r--r-- | libpod/networking.go | 1 | ||||
| -rw-r--r-- | libpod/oci.go | 3 | ||||
| -rw-r--r-- | libpod/options.go | 260 | ||||
| -rw-r--r-- | libpod/runtime.go | 32 | ||||
| -rw-r--r-- | libpod/runtime_ctr.go | 73 | ||||
| -rw-r--r-- | libpod/sql_state.go | 144 | ||||
| -rw-r--r-- | libpod/sql_state_internal.go | 105 | ||||
| -rw-r--r-- | libpod/sql_state_test.go | 569 | ||||
| -rw-r--r-- | libpod/state.go | 21 | ||||
| -rw-r--r-- | libpod/state_test.go | 622 | ||||
| -rw-r--r-- | libpod/stats.go | 6 | ||||
| -rw-r--r-- | libpod/test_common.go | 116 |
17 files changed, 2908 insertions, 1707 deletions
diff --git a/libpod/container.go b/libpod/container.go index 2c769b00b..27042de39 100644 --- a/libpod/container.go +++ b/libpod/container.go @@ -1,76 +1,99 @@ package libpod import ( - "encoding/json" "fmt" - "io" - "io/ioutil" "net" - "os" "path/filepath" - "syscall" "time" "github.com/containerd/cgroups" "github.com/containernetworking/plugins/pkg/ns" "github.com/containers/storage" - "github.com/containers/storage/pkg/archive" "github.com/cri-o/ocicni/pkg/ocicni" - "github.com/docker/docker/daemon/caps" - "github.com/docker/docker/pkg/mount" - "github.com/docker/docker/pkg/namesgenerator" - "github.com/docker/docker/pkg/stringid" - "github.com/docker/docker/pkg/term" - "github.com/mrunalp/fileutils" spec "github.com/opencontainers/runtime-spec/specs-go" - "github.com/opencontainers/runtime-tools/generate" - "github.com/opencontainers/selinux/go-selinux/label" "github.com/pkg/errors" - "github.com/projectatomic/libpod/libpod/driver" - crioAnnotations "github.com/projectatomic/libpod/pkg/annotations" - "github.com/projectatomic/libpod/pkg/chrootuser" - "github.com/sirupsen/logrus" "github.com/ulule/deepcopier" - "golang.org/x/sys/unix" - "k8s.io/apimachinery/pkg/util/wait" - "k8s.io/client-go/tools/remotecommand" ) -// ContainerState represents the current state of a container -type ContainerState int +// ContainerStatus represents the current state of a container +type ContainerStatus int const ( // ContainerStateUnknown indicates that the container is in an error // state where information about it cannot be retrieved - ContainerStateUnknown ContainerState = iota + ContainerStateUnknown ContainerStatus = iota // ContainerStateConfigured indicates that the container has had its // storage configured but it has not been created in the OCI runtime - ContainerStateConfigured ContainerState = iota + ContainerStateConfigured ContainerStatus = iota // ContainerStateCreated indicates the container has been created in // the OCI runtime but not started - ContainerStateCreated ContainerState = iota + ContainerStateCreated ContainerStatus = iota // ContainerStateRunning indicates the container is currently executing - ContainerStateRunning ContainerState = iota + ContainerStateRunning ContainerStatus = iota // ContainerStateStopped indicates that the container was running but has // exited - ContainerStateStopped ContainerState = iota + ContainerStateStopped ContainerStatus = iota // ContainerStatePaused indicates that the container has been paused - ContainerStatePaused ContainerState = iota - // name of the directory holding the artifacts - artifactsDir = "artifacts" + ContainerStatePaused ContainerStatus = iota ) // CgroupParent is the default prefix to a cgroup path in libpod var CgroupParent = "/libpod_parent" +// LinuxNS represents a Linux namespace +type LinuxNS int + +const ( + // InvalidNS is an invalid namespace + InvalidNS LinuxNS = iota + // IPCNS is the IPC namespace + IPCNS LinuxNS = iota + // MountNS is the mount namespace + MountNS LinuxNS = iota + // NetNS is the network namespace + NetNS LinuxNS = iota + // PIDNS is the PID namespace + PIDNS LinuxNS = iota + // UserNS is the user namespace + UserNS LinuxNS = iota + // UTSNS is the UTS namespace + UTSNS LinuxNS = iota + // CgroupNS is the CGroup namespace + CgroupNS LinuxNS = iota +) + +// String returns a string representation of a Linux namespace +// It is guaranteed to be the name of the namespace in /proc for valid ns types +func (ns LinuxNS) String() string { + switch ns { + case InvalidNS: + return "invalid" + case IPCNS: + return "ipc" + case MountNS: + return "mnt" + case NetNS: + return "net" + case PIDNS: + return "pid" + case UserNS: + return "user" + case UTSNS: + return "uts" + case CgroupNS: + return "cgroup" + default: + return "unknown" + } +} + // Container is a single OCI container type Container struct { config *ContainerConfig - pod *Pod runningSpec *spec.Spec - state *containerRuntimeInfo + state *containerState // Locked indicates that a container has been locked as part of a // Batch() operation @@ -85,14 +108,12 @@ type Container struct { // TODO fetch IP and Subnet Mask from networks once we have updated OCICNI // TODO enable pod support // TODO Add readonly support -// TODO add SHM size support -// TODO add shared namespace support -// containerRuntimeInfo contains the current state of the container +// containerState contains the current state of the container // It is stored on disk in a tmpfs and recreated on reboot -type containerRuntimeInfo struct { +type containerState struct { // The current state of the running container - State ContainerState `json:"state"` + State ContainerStatus `json:"state"` // The path to the JSON OCI runtime spec for this container ConfigPath string `json:"configPath,omitempty"` // RunDir is a per-boot directory for container content @@ -156,23 +177,28 @@ type ContainerConfig struct { Mounts []string `json:"mounts,omitempty"` // Security Config + // Whether the container is privileged + Privileged bool `json:"privileged"` + // Whether to set the No New Privileges flag + NoNewPrivs bool `json:"noNewPrivs"` // SELinux process label for container ProcessLabel string `json:"ProcessLabel,omitempty"` // SELinux mount label for root filesystem MountLabel string `json:"MountLabel,omitempty"` // User and group to use in the container // Can be specified by name or UID/GID - User string `json:"user"` + User string `json:"user,omitempty"` // Namespace Config // IDs of container to share namespaces with // NetNsCtr conflicts with the CreateNetNS bool - IPCNsCtr string `json:"ipcNsCtr"` - MountNsCtr string `json:"mountNsCtr"` - NetNsCtr string `json:"netNsCtr"` - PIDNsCtr string `json:"pidNsCtr"` - UserNsCtr string `json:"userNsCtr"` - UTSNsCtr string `json:"utsNsCtr"` + IPCNsCtr string `json:"ipcNsCtr,omitempty"` + MountNsCtr string `json:"mountNsCtr,omitempty"` + NetNsCtr string `json:"netNsCtr,omitempty"` + PIDNsCtr string `json:"pidNsCtr,omitempty"` + UserNsCtr string `json:"userNsCtr,omitempty"` + UTSNsCtr string `json:"utsNsCtr,omitempty"` + CgroupNsCtr string `json:"cgroupNsCtr,omitempty"` // Network Config // CreateNetNS indicates that libpod should create and configure a new @@ -183,6 +209,18 @@ type ContainerConfig struct { // namespace // These are not used unless CreateNetNS is true PortMappings []ocicni.PortMapping `json:"portMappings,omitempty"` + // DNS servers to use in container resolv.conf + // Will override servers in host resolv if set + DNSServer []net.IP `json:"dnsServer,omitempty"` + // DNS Search domains to use in container resolv.conf + // Will override search domains in host resolv if set + DNSSearch []string `json:"dnsSearch,omitempty"` + // DNS options to be set in container resolv.conf + // With override options in host resolv if set + DNSOption []string `json:"dnsOption,omitempty"` + // Hosts to add in container + // Will be appended to host's host file + HostAdd []string `json:"hostsAdd,omitempty"` // Misc Options // Whether to keep container STDIN open @@ -202,9 +240,9 @@ type ContainerConfig struct { // TODO log options - logpath for plaintext, others for log drivers } -// ContainerStater returns a string representation for users +// ContainerStatus returns a string representation for users // of a container state -func (t ContainerState) String() string { +func (t ContainerStatus) String() string { switch t { case ContainerStateUnknown: return "unknown" @@ -248,6 +286,44 @@ func (c *Container) ProcessLabel() string { return c.config.ProcessLabel } +// Dependencies gets the containers this container depends upon +func (c *Container) Dependencies() []string { + // Collect in a map first to remove dupes + dependsCtrs := map[string]bool{} + if c.config.IPCNsCtr != "" { + dependsCtrs[c.config.IPCNsCtr] = true + } + if c.config.MountNsCtr != "" { + dependsCtrs[c.config.MountNsCtr] = true + } + if c.config.NetNsCtr != "" { + dependsCtrs[c.config.NetNsCtr] = true + } + if c.config.PIDNsCtr != "" { + dependsCtrs[c.config.NetNsCtr] = true + } + if c.config.UserNsCtr != "" { + dependsCtrs[c.config.UserNsCtr] = true + } + if c.config.UTSNsCtr != "" { + dependsCtrs[c.config.UTSNsCtr] = true + } + if c.config.CgroupNsCtr != "" { + dependsCtrs[c.config.CgroupNsCtr] = true + } + + if len(dependsCtrs) == 0 { + return []string{} + } + + depends := make([]string, 0, len(dependsCtrs)) + for ctr := range dependsCtrs { + depends = append(depends, ctr) + } + + return depends +} + // Spec returns the container's OCI runtime spec // The spec returned is the one used to create the container. The running // spec may differ slightly as mounts are added based on the image @@ -280,63 +356,6 @@ func (c *Container) RuntimeName() string { return c.runtime.ociRuntime.name } -// rootFsSize gets the size of the container's root filesystem -// A container FS is split into two parts. The first is the top layer, a -// mutable layer, and the rest is the RootFS: the set of immutable layers -// that make up the image on which the container is based. -func (c *Container) rootFsSize() (int64, error) { - container, err := c.runtime.store.Container(c.ID()) - if err != nil { - return 0, err - } - - // Ignore the size of the top layer. The top layer is a mutable RW layer - // and is not considered a part of the rootfs - rwLayer, err := c.runtime.store.Layer(container.LayerID) - if err != nil { - return 0, err - } - layer, err := c.runtime.store.Layer(rwLayer.Parent) - if err != nil { - return 0, err - } - - size := int64(0) - for layer.Parent != "" { - layerSize, err := c.runtime.store.DiffSize(layer.Parent, layer.ID) - if err != nil { - return size, errors.Wrapf(err, "getting diffsize of layer %q and its parent %q", layer.ID, layer.Parent) - } - size += layerSize - layer, err = c.runtime.store.Layer(layer.Parent) - if err != nil { - return 0, err - } - } - // Get the size of the last layer. Has to be outside of the loop - // because the parent of the last layer is "", andlstore.Get("") - // will return an error. - layerSize, err := c.runtime.store.DiffSize(layer.Parent, layer.ID) - return size + layerSize, err -} - -// rwSize Gets the size of the mutable top layer of the container. -func (c *Container) rwSize() (int64, error) { - container, err := c.runtime.store.Container(c.ID()) - if err != nil { - return 0, err - } - - // Get the size of the top layer by calculating the size of the diff - // between the layer and its parent. The top layer of a container is - // the only RW layer, all others are immutable - layer, err := c.runtime.store.Layer(container.LayerID) - if err != nil { - return 0, err - } - return c.runtime.store.DiffSize(layer.Parent, layer.ID) -} - // LogPath returns the path to the container's log file // This file will only be present after Init() is called to create the container // in runc @@ -428,7 +447,7 @@ func (c *Container) FinishedTime() (time.Time, error) { } // State returns the current state of the container -func (c *Container) State() (ContainerState, error) { +func (c *Container) State() (ContainerStatus, error) { if !c.locked { c.lock.Lock() defer c.lock.Unlock() @@ -467,944 +486,56 @@ func (c *Container) MountPoint() (string, error) { return c.state.Mountpoint, nil } -// The path to the container's root filesystem - where the OCI spec will be -// placed, amongst other things -func (c *Container) bundlePath() string { - return c.config.StaticDir -} - -// The path to the container's logs file -func (c *Container) logPath() string { - return filepath.Join(c.config.StaticDir, "ctr.log") -} - -// Retrieves the path of the container's attach socket -func (c *Container) attachSocketPath() string { - return filepath.Join(c.runtime.ociRuntime.socketsDir, c.ID(), "attach") -} - -// Sync this container with on-disk state and runc status -// Should only be called with container lock held -// This function should suffice to ensure a container's state is accurate and -// it is valid for use. -func (c *Container) syncContainer() error { - if err := c.runtime.state.UpdateContainer(c); err != nil { - return err - } - // If runc knows about the container, update its status in runc - // And then save back to disk - if (c.state.State != ContainerStateUnknown) && - (c.state.State != ContainerStateConfigured) { - oldState := c.state.State - // TODO: optionally replace this with a stat for the exit file - if err := c.runtime.ociRuntime.updateContainerStatus(c); err != nil { - return err - } - // Only save back to DB if state changed - if c.state.State != oldState { - if err := c.save(); err != nil { - return err - } - } - } - - if !c.valid { - return errors.Wrapf(ErrCtrRemoved, "container %s is not valid", c.ID()) - } - - return nil -} - -// Make a new container -func newContainer(rspec *spec.Spec, lockDir string) (*Container, error) { - if rspec == nil { - return nil, errors.Wrapf(ErrInvalidArg, "must provide a valid runtime spec to create container") - } - - ctr := new(Container) - ctr.config = new(ContainerConfig) - ctr.state = new(containerRuntimeInfo) - - ctr.config.ID = stringid.GenerateNonCryptoID() - ctr.config.Name = namesgenerator.GetRandomName(0) - - ctr.config.Spec = new(spec.Spec) - deepcopier.Copy(rspec).To(ctr.config.Spec) - ctr.config.CreatedTime = time.Now() - - ctr.config.ShmSize = DefaultShmSize - ctr.config.CgroupParent = CgroupParent - - // Path our lock file will reside at - lockPath := filepath.Join(lockDir, ctr.config.ID) - // Grab a lockfile at the given path - lock, err := storage.GetLockfile(lockPath) - if err != nil { - return nil, errors.Wrapf(err, "error creating lockfile for new container") - } - ctr.lock = lock - - return ctr, nil -} - -// Create container root filesystem for use -func (c *Container) setupStorage() error { - if !c.valid { - return errors.Wrapf(ErrCtrRemoved, "container %s is not valid", c.ID()) - } - - if c.state.State != ContainerStateConfigured { - return errors.Wrapf(ErrCtrStateInvalid, "container %s must be in Configured state to have storage set up", c.ID()) - } - - // Need both an image ID and image name, plus a bool telling us whether to use the image configuration - if c.config.RootfsImageID == "" || c.config.RootfsImageName == "" { - return errors.Wrapf(ErrInvalidArg, "must provide image ID and image name to use an image") - } - - containerInfo, err := c.runtime.storageService.CreateContainerStorage(c.runtime.imageContext, c.config.RootfsImageName, c.config.RootfsImageID, c.config.Name, c.config.ID, c.config.MountLabel) - if err != nil { - return errors.Wrapf(err, "error creating container storage") - } - - c.config.StaticDir = containerInfo.Dir - c.state.RunDir = containerInfo.RunDir - - artifacts := filepath.Join(c.config.StaticDir, artifactsDir) - if err := os.MkdirAll(artifacts, 0755); err != nil { - return errors.Wrapf(err, "error creating artifacts directory %q", artifacts) - } - - return nil -} - -// Tear down a container's storage prior to removal -func (c *Container) teardownStorage() error { - if !c.valid { - return errors.Wrapf(ErrCtrRemoved, "container %s is not valid", c.ID()) - } - - if c.state.State == ContainerStateRunning || c.state.State == ContainerStatePaused { - return errors.Wrapf(ErrCtrStateInvalid, "cannot remove storage for container %s as it is running or paused", c.ID()) - } - - artifacts := filepath.Join(c.config.StaticDir, artifactsDir) - if err := os.RemoveAll(artifacts); err != nil { - return errors.Wrapf(err, "error removing artifacts %q", artifacts) - } - - if err := c.cleanupStorage(); err != nil { - return errors.Wrapf(err, "failed to cleanup container %s storage", c.ID()) - } - - if err := c.runtime.storageService.DeleteContainer(c.ID()); err != nil { - return errors.Wrapf(err, "error removing container %s root filesystem", c.ID()) - } - - return nil -} - -// Refresh refreshes the container's state after a restart -func (c *Container) refresh() error { +// NamespacePath returns the path of one of the container's namespaces +// If the container is not running, an error will be returned +func (c *Container) NamespacePath(ns LinuxNS) (string, error) { c.lock.Lock() defer c.lock.Unlock() - - if !c.valid { - return errors.Wrapf(ErrCtrRemoved, "container %s is not valid - may have been removed", c.ID()) - } - - // We need to get the container's temporary directory from c/storage - // It was lost in the reboot and must be recreated - dir, err := c.runtime.storageService.GetRunDir(c.ID()) - if err != nil { - return errors.Wrapf(err, "error retrieving temporary directory for container %s", c.ID()) - } - c.state.RunDir = dir - - if err := c.runtime.state.SaveContainer(c); err != nil { - return errors.Wrapf(err, "error refreshing state for container %s", c.ID()) - } - - return nil -} - -// Init creates a container in the OCI runtime -func (c *Container) Init() (err error) { - if !c.locked { - c.lock.Lock() - defer c.lock.Unlock() - - if err := c.syncContainer(); err != nil { - return err - } - } - - if c.state.State != ContainerStateConfigured { - return errors.Wrapf(ErrCtrExists, "container %s has already been created in runtime", c.ID()) - } - - if err := c.mountStorage(); err != nil { - return err - } - defer func() { - if err != nil { - if err2 := c.cleanupStorage(); err2 != nil { - logrus.Errorf("Error cleaning up storage for container %s: %v", c.ID(), err2) - } - } - }() - - // Make a network namespace for the container - if c.config.CreateNetNS && c.state.NetNS == nil { - if err := c.runtime.createNetNS(c); err != nil { - return err - } - } - defer func() { - if err != nil { - if err2 := c.runtime.teardownNetNS(c); err2 != nil { - logrus.Errorf("Error tearing down network namespace for container %s: %v", c.ID(), err2) - } - } - }() - - // If the OCI spec already exists, we need to replace it - // Cannot guarantee some things, e.g. network namespaces, have the same - // paths - jsonPath := filepath.Join(c.bundlePath(), "config.json") - if _, err := os.Stat(jsonPath); err != nil { - if !os.IsNotExist(err) { - return errors.Wrapf(err, "error doing stat on container %s spec", c.ID()) - } - // The spec does not exist, we're fine - } else { - // The spec exists, need to remove it - if err := os.Remove(jsonPath); err != nil { - return errors.Wrapf(err, "error replacing runtime spec for container %s", c.ID()) - } - } - - // Copy /etc/resolv.conf to the container's rundir - resolvPath := "/etc/resolv.conf" - - // Check if the host system is using system resolve and if so - // copy its resolv.conf - _, err = os.Stat("/run/systemd/resolve/resolv.conf") - if err == nil { - resolvPath = "/run/systemd/resolve/resolv.conf" - } - runDirResolv, err := c.copyHostFileToRundir(resolvPath) - if err != nil { - return errors.Wrapf(err, "unable to copy resolv.conf to ", runDirResolv) - } - // Copy /etc/hosts to the container's rundir - runDirHosts, err := c.copyHostFileToRundir("/etc/hosts") - if err != nil { - return errors.Wrapf(err, "unable to copy /etc/hosts to ", runDirHosts) - } - - // Save OCI spec to disk - g := generate.NewFromSpec(c.config.Spec) - // If network namespace was requested, add it now - if c.config.CreateNetNS { - g.AddOrReplaceLinuxNamespace(spec.NetworkNamespace, c.state.NetNS.Path()) - } - // Remove default /etc/shm mount - g.RemoveMount("/dev/shm") - // Mount ShmDir from host into container - shmMnt := spec.Mount{ - Type: "bind", - Source: c.config.ShmDir, - Destination: "/dev/shm", - Options: []string{"rw", "bind"}, - } - g.AddMount(shmMnt) - // Bind mount resolv.conf - resolvMnt := spec.Mount{ - Type: "bind", - Source: runDirResolv, - Destination: "/etc/resolv.conf", - Options: []string{"rw", "bind"}, - } - g.AddMount(resolvMnt) - // Bind mount hosts - hostsMnt := spec.Mount{ - Type: "bind", - Source: runDirHosts, - Destination: "/etc/hosts", - Options: []string{"rw", "bind"}, - } - g.AddMount(hostsMnt) - - if c.config.User != "" { - if !c.state.Mounted { - return errors.Wrapf(ErrCtrStateInvalid, "container %s must be mounted in order to translate User field", c.ID()) - } - uid, gid, err := chrootuser.GetUser(c.state.Mountpoint, c.config.User) - if err != nil { - return err - } - // User and Group must go together - g.SetProcessUID(uid) - g.SetProcessGID(gid) - } - - c.runningSpec = g.Spec() - c.runningSpec.Root.Path = c.state.Mountpoint - c.runningSpec.Annotations[crioAnnotations.Created] = c.config.CreatedTime.Format(time.RFC3339Nano) - c.runningSpec.Annotations["org.opencontainers.image.stopSignal"] = fmt.Sprintf("%d", c.config.StopSignal) - - fileJSON, err := json.Marshal(c.runningSpec) - if err != nil { - return errors.Wrapf(err, "error exporting runtime spec for container %s to JSON", c.ID()) - } - if err := ioutil.WriteFile(jsonPath, fileJSON, 0644); err != nil { - return errors.Wrapf(err, "error writing runtime spec JSON to file for container %s", c.ID()) - } - - logrus.Debugf("Created OCI spec for container %s at %s", c.ID(), jsonPath) - - c.state.ConfigPath = jsonPath - - // With the spec complete, do an OCI create - // TODO set cgroup parent in a sane fashion - if err := c.runtime.ociRuntime.createContainer(c, CgroupParent); err != nil { - return err - } - - logrus.Debugf("Created container %s in runc", c.ID()) - - c.state.State = ContainerStateCreated - - return c.save() -} - -// Start starts a container -func (c *Container) Start() error { - if !c.locked { - c.lock.Lock() - defer c.lock.Unlock() - - if err := c.syncContainer(); err != nil { - return err - } - } - - // Container must be created or stopped to be started - if !(c.state.State == ContainerStateCreated || c.state.State == ContainerStateStopped) { - return errors.Wrapf(ErrCtrStateInvalid, "container %s must be in Created or Stopped state to be started", c.ID()) - } - - // Mount storage for the container - if err := c.mountStorage(); err != nil { - return err - } - - if err := c.runtime.ociRuntime.startContainer(c); err != nil { - return err - } - - logrus.Debugf("Started container %s", c.ID()) - - // Update container's state as it should be ContainerStateRunning now - if err := c.runtime.ociRuntime.updateContainerStatus(c); err != nil { - return err - } - - return c.save() -} - -// Stop uses the container's stop signal (or SIGTERM if no signal was specified) -// to stop the container, and if it has not stopped after the given timeout (in -// seconds), uses SIGKILL to attempt to forcibly stop the container. -// If timeout is 0, SIGKILL will be used immediately -func (c *Container) Stop(timeout uint) error { - if !c.locked { - c.lock.Lock() - defer c.lock.Unlock() - - if err := c.syncContainer(); err != nil { - return err - } - } - - logrus.Debugf("Stopping ctr %s with timeout %d", c.ID(), timeout) - - if c.state.State == ContainerStateConfigured || - c.state.State == ContainerStateUnknown || - c.state.State == ContainerStatePaused { - return errors.Wrapf(ErrCtrStateInvalid, "can only stop created, running, or stopped containers") - } - - if err := c.runtime.ociRuntime.stopContainer(c, timeout); err != nil { - return err - } - - // Sync the container's state to pick up return code - if err := c.runtime.ociRuntime.updateContainerStatus(c); err != nil { - return err - } - - return c.cleanupStorage() -} - -// Kill sends a signal to a container -func (c *Container) Kill(signal uint) error { - if !c.locked { - c.lock.Lock() - defer c.lock.Unlock() - - if err := c.syncContainer(); err != nil { - return err - } + if err := c.syncContainer(); err != nil { + return "", errors.Wrapf(err, "error updating container %s state", c.ID()) } if c.state.State != ContainerStateRunning { - return errors.Wrapf(ErrCtrStateInvalid, "can only kill running containers") - } - - return c.runtime.ociRuntime.killContainer(c, signal) -} - -// Exec starts a new process inside the container -func (c *Container) Exec(tty, privileged bool, env, cmd []string, user string) error { - var capList []string - - if !c.locked { - c.lock.Lock() - defer c.lock.Unlock() - - if err := c.syncContainer(); err != nil { - return err - } - } - - conState := c.state.State - - if conState != ContainerStateRunning { - return errors.Errorf("cannot attach to container that is not running") - } - if privileged { - capList = caps.GetAllCapabilities() - } - globalOpts := runcGlobalOptions{ - log: c.LogPath(), - } - execOpts := runcExecOptions{ - capAdd: capList, - pidFile: filepath.Join(c.state.RunDir, fmt.Sprintf("%s-execpid", stringid.GenerateNonCryptoID()[:12])), - env: env, - user: user, - cwd: c.config.Spec.Process.Cwd, - tty: tty, - } - - return c.runtime.ociRuntime.execContainer(c, cmd, globalOpts, execOpts) -} - -// Attach attaches to a container -// Returns fully qualified URL of streaming server for the container -func (c *Container) Attach(noStdin bool, keys string, attached chan<- bool) error { - if !c.locked { - c.lock.Lock() - if err := c.syncContainer(); err != nil { - c.lock.Unlock() - return err - } - c.lock.Unlock() - } - - if c.state.State != ContainerStateCreated && - c.state.State != ContainerStateRunning { - return errors.Wrapf(ErrCtrStateInvalid, "can only attach to created or running containers") - } - - // Check the validity of the provided keys first - var err error - detachKeys := []byte{} - if len(keys) > 0 { - detachKeys, err = term.ToBytes(keys) - if err != nil { - return errors.Wrapf(err, "invalid detach keys") - } - } - - resize := make(chan remotecommand.TerminalSize) - defer close(resize) - - err = c.attachContainerSocket(resize, noStdin, detachKeys, attached) - return err -} - -// Mount mounts a container's filesystem on the host -// The path where the container has been mounted is returned -func (c *Container) Mount(label string) (string, error) { - if !c.locked { - c.lock.Lock() - defer c.lock.Unlock() - - if err := c.syncContainer(); err != nil { - return "", err - } - } - - // return mountpoint if container already mounted - if c.state.Mounted { - return c.state.Mountpoint, nil - } - - mountLabel := label - if label == "" { - mountLabel = c.config.MountLabel + return "", errors.Wrapf(ErrCtrStopped, "cannot get namespace path unless container %s is running", c.ID()) } - mountPoint, err := c.runtime.store.Mount(c.ID(), mountLabel) - if err != nil { - return "", err - } - c.state.Mountpoint = mountPoint - c.state.Mounted = true - c.config.MountLabel = mountLabel - - if err := c.save(); err != nil { - return "", err - } - - return mountPoint, nil -} - -// Unmount unmounts a container's filesystem on the host -func (c *Container) Unmount() error { - if !c.locked { - c.lock.Lock() - defer c.lock.Unlock() - - if err := c.syncContainer(); err != nil { - return err - } - } - - if c.state.State == ContainerStateRunning || c.state.State == ContainerStatePaused { - return errors.Wrapf(ErrCtrStateInvalid, "cannot remove storage for container %s as it is running or paused", c.ID()) - } - - return c.cleanupStorage() -} - -// Pause pauses a container -func (c *Container) Pause() error { - if !c.locked { - c.lock.Lock() - defer c.lock.Unlock() - - if err := c.syncContainer(); err != nil { - return err - } - } - - if c.state.State == ContainerStatePaused { - return errors.Wrapf(ErrCtrStateInvalid, "%q is already paused", c.ID()) - } - if c.state.State != ContainerStateRunning && c.state.State != ContainerStateCreated { - return errors.Wrapf(ErrCtrStateInvalid, "%q is not running/created, can't pause", c.state.State) - } - if err := c.runtime.ociRuntime.pauseContainer(c); err != nil { - return err - } - - logrus.Debugf("Paused container %s", c.ID()) - - // Update container's state as it should be ContainerStatePaused now - if err := c.runtime.ociRuntime.updateContainerStatus(c); err != nil { - return err - } - - return c.save() -} - -// Unpause unpauses a container -func (c *Container) Unpause() error { - if !c.locked { - c.lock.Lock() - defer c.lock.Unlock() - - if err := c.syncContainer(); err != nil { - return err - } - } - - if c.state.State != ContainerStatePaused { - return errors.Wrapf(ErrCtrStateInvalid, "%q is not paused, can't unpause", c.ID()) - } - if err := c.runtime.ociRuntime.unpauseContainer(c); err != nil { - return err - } - - logrus.Debugf("Unpaused container %s", c.ID()) - - // Update container's state as it should be ContainerStateRunning now - if err := c.runtime.ociRuntime.updateContainerStatus(c); err != nil { - return err - } - - return c.save() -} - -// Export exports a container's root filesystem as a tar archive -// The archive will be saved as a file at the given path -func (c *Container) Export(path string) error { - if !c.locked { - c.lock.Lock() - defer c.lock.Unlock() - - if err := c.syncContainer(); err != nil { - return err - } - } - - return c.export(path) -} - -func (c *Container) export(path string) error { - mountPoint := c.state.Mountpoint - if !c.state.Mounted { - mount, err := c.runtime.store.Mount(c.ID(), c.config.MountLabel) - if err != nil { - return errors.Wrapf(err, "error mounting container %q", c.ID()) - } - mountPoint = mount - defer func() { - if err := c.runtime.store.Unmount(c.ID()); err != nil { - logrus.Errorf("error unmounting container %q: %v", c.ID(), err) - } - }() - } - - input, err := archive.Tar(mountPoint, archive.Uncompressed) - if err != nil { - return errors.Wrapf(err, "error reading container directory %q", c.ID()) - } - - outFile, err := os.Create(path) - if err != nil { - return errors.Wrapf(err, "error creating file %q", path) - } - defer outFile.Close() - - _, err = io.Copy(outFile, input) - return err -} - -// AddArtifact creates and writes to an artifact file for the container -func (c *Container) AddArtifact(name string, data []byte) error { - if !c.valid { - return ErrCtrRemoved - } - - return ioutil.WriteFile(c.getArtifactPath(name), data, 0740) -} - -// GetArtifact reads the specified artifact file from the container -func (c *Container) GetArtifact(name string) ([]byte, error) { - if !c.valid { - return nil, ErrCtrRemoved - } - - return ioutil.ReadFile(c.getArtifactPath(name)) -} -// RemoveArtifact deletes the specified artifacts file -func (c *Container) RemoveArtifact(name string) error { - if !c.valid { - return ErrCtrRemoved + if ns == InvalidNS { + return "", errors.Wrapf(ErrInvalidArg, "invalid namespace requested from container %s", c.ID()) } - return os.Remove(c.getArtifactPath(name)) + return fmt.Sprintf("/proc/%d/ns/%s", c.state.PID, ns.String()), nil } -func (c *Container) getArtifactPath(name string) string { - return filepath.Join(c.config.StaticDir, artifactsDir, name) +// CGroupPath returns a cgroups "path" for a given container. +func (c *Container) CGroupPath() cgroups.Path { + return cgroups.StaticPath(filepath.Join(c.config.CgroupParent, fmt.Sprintf("libpod-conmon-%s", c.ID()))) } -// Inspect a container for low-level information -func (c *Container) Inspect(size bool) (*ContainerInspectData, error) { - if !c.locked { - c.lock.Lock() - defer c.lock.Unlock() - - if err := c.syncContainer(); err != nil { - return nil, err - } - } - - storeCtr, err := c.runtime.store.Container(c.ID()) - if err != nil { - return nil, errors.Wrapf(err, "error getting container from store %q", c.ID()) - } - layer, err := c.runtime.store.Layer(storeCtr.LayerID) - if err != nil { - return nil, errors.Wrapf(err, "error reading information about layer %q", storeCtr.LayerID) - } - driverData, err := driver.GetDriverData(c.runtime.store, layer.ID) - if err != nil { - return nil, errors.Wrapf(err, "error getting graph driver info %q", c.ID()) - } - - return c.getContainerInspectData(size, driverData) +// StopTimeout returns a stop timeout field for this container +func (c *Container) StopTimeout() uint { + return c.config.StopTimeout } -// Commit commits the changes between a container and its image, creating a new -// image -func (c *Container) Commit(pause bool, options CopyOptions) error { +// RootFsSize returns the root FS size of the container +func (c *Container) RootFsSize() (int64, error) { if !c.locked { c.lock.Lock() defer c.lock.Unlock() - if err := c.syncContainer(); err != nil { - return err + return -1, errors.Wrapf(err, "error updating container %s state", c.ID()) } } - - if c.state.State == ContainerStateRunning && pause { - if err := c.runtime.ociRuntime.pauseContainer(c); err != nil { - return errors.Wrapf(err, "error pausing container %q", c.ID()) - } - defer func() { - if err := c.runtime.ociRuntime.unpauseContainer(c); err != nil { - logrus.Errorf("error unpausing container %q: %v", c.ID(), err) - } - }() - } - - tempFile, err := ioutil.TempFile(c.runtime.config.TmpDir, "podman-commit") - if err != nil { - return errors.Wrapf(err, "error creating temp file") - } - defer os.Remove(tempFile.Name()) - defer tempFile.Close() - - if err := c.export(tempFile.Name()); err != nil { - return err - } - return c.runtime.ImportImage(tempFile.Name(), options) -} - -// Wait blocks on a container to exit and returns its exit code -func (c *Container) Wait() (int32, error) { - if !c.valid { - return -1, ErrCtrRemoved - } - - err := wait.PollImmediateInfinite(1, - func() (bool, error) { - stopped, err := c.isStopped() - if err != nil { - return false, err - } - if !stopped { - return false, nil - } else { // nolint - return true, nil // nolint - } // nolint - }, - ) - if err != nil { - return 0, err - } - exitCode := c.state.ExitCode - return exitCode, nil -} - -func (c *Container) isStopped() (bool, error) { - if !c.locked { - c.lock.Lock() - defer c.lock.Unlock() - } - err := c.syncContainer() - if err != nil { - return true, err - } - return c.state.State == ContainerStateStopped, nil -} - -// save container state to the database -func (c *Container) save() error { - if err := c.runtime.state.SaveContainer(c); err != nil { - return errors.Wrapf(err, "error saving container %s state", c.ID()) - } - return nil -} - -// mountStorage sets up the container's root filesystem -// It mounts the image and any other requested mounts -// TODO: Add ability to override mount label so we can use this for Mount() too -// TODO: Can we use this for export? Copying SHM into the export might not be -// good -func (c *Container) mountStorage() (err error) { - // Container already mounted, nothing to do - if c.state.Mounted { - return nil - } - - // TODO: generalize this mount code so it will mount every mount in ctr.config.Mounts - - mounted, err := mount.Mounted(c.config.ShmDir) - if err != nil { - return errors.Wrapf(err, "unable to determine if %q is mounted", c.config.ShmDir) - } - - if !mounted { - shmOptions := fmt.Sprintf("mode=1777,size=%d", c.config.ShmSize) - if err := unix.Mount("shm", c.config.ShmDir, "tmpfs", unix.MS_NOEXEC|unix.MS_NOSUID|unix.MS_NODEV, - label.FormatMountLabel(shmOptions, c.config.MountLabel)); err != nil { - return errors.Wrapf(err, "failed to mount shm tmpfs %q", c.config.ShmDir) - } - } - - mountPoint, err := c.runtime.storageService.MountContainerImage(c.ID()) - if err != nil { - return errors.Wrapf(err, "error mounting storage for container %s", c.ID()) - } - c.state.Mounted = true - c.state.Mountpoint = mountPoint - - logrus.Debugf("Created root filesystem for container %s at %s", c.ID(), c.state.Mountpoint) - - defer func() { - if err != nil { - if err2 := c.cleanupStorage(); err2 != nil { - logrus.Errorf("Error unmounting storage for container %s: %v", c.ID(), err) - } - } - }() - - return c.save() + return c.rootFsSize() } -// CleanupStorage unmounts all mount points in container and cleans up container storage -func (c *Container) CleanupStorage() error { +// RWSize returns the rw size of the container +func (c *Container) RWSize() (int64, error) { if !c.locked { c.lock.Lock() defer c.lock.Unlock() if err := c.syncContainer(); err != nil { - return err + return -1, errors.Wrapf(err, "error updating container %s state", c.ID()) } } - return c.cleanupStorage() -} - -// cleanupStorage unmounts and cleans up the container's root filesystem -func (c *Container) cleanupStorage() error { - if !c.state.Mounted { - // Already unmounted, do nothing - return nil - } - - for _, mount := range c.config.Mounts { - if err := unix.Unmount(mount, unix.MNT_DETACH); err != nil { - if err != syscall.EINVAL { - logrus.Warnf("container %s failed to unmount %s : %v", c.ID(), mount, err) - } - } - } - - // Also unmount storage - if err := c.runtime.storageService.UnmountContainerImage(c.ID()); err != nil { - return errors.Wrapf(err, "error unmounting container %s root filesystem", c.ID()) - } - - c.state.Mountpoint = "" - c.state.Mounted = false - - return c.save() -} - -// CGroupPath returns a cgroups "path" for a given container. -func (c *Container) CGroupPath() cgroups.Path { - return cgroups.StaticPath(filepath.Join(c.config.CgroupParent, fmt.Sprintf("libpod-conmon-%s", c.ID()))) -} - -// copyHostFileToRundir copies the provided file to the runtimedir -func (c *Container) copyHostFileToRundir(sourcePath string) (string, error) { - destFileName := filepath.Join(c.state.RunDir, filepath.Base(sourcePath)) - if err := fileutils.CopyFile(sourcePath, destFileName); err != nil { - return "", err - } - // Relabel runDirResolv for the container - if err := label.Relabel(destFileName, c.config.MountLabel, false); err != nil { - return "", err - } - return destFileName, nil -} - -// StopTimeout returns a stop timeout field for this container -func (c *Container) StopTimeout() uint { - return c.config.StopTimeout -} - -// Batch starts a batch operation on the given container -// All commands in the passed function will execute under the same lock and -// without syncronyzing state after each operation -// This will result in substantial performance benefits when running numerous -// commands on the same container -// Note that the container passed into the Batch function cannot be removed -// during batched operations. runtime.RemoveContainer can only be called outside -// of Batch -// Any error returned by the given batch function will be returned unmodified by -// Batch -// As Batch normally disables updating the current state of the container, the -// Sync() function is provided to enable container state to be updated and -// checked within Batch. -func (c *Container) Batch(batchFunc func(*Container) error) error { - c.lock.Lock() - defer c.lock.Unlock() - - if err := c.syncContainer(); err != nil { - return err - } - - newCtr := new(Container) - newCtr.config = c.config - newCtr.state = c.state - newCtr.runtime = c.runtime - newCtr.valid = true - - newCtr.locked = true - - if err := batchFunc(newCtr); err != nil { - return err - } - - newCtr.locked = false - - return c.save() -} - -// Sync updates the current state of the container, checking whether its state -// has changed -// Sync can only be used inside Batch() - otherwise, it will be done -// automatically. -// When called outside Batch(), Sync() is a no-op -func (c *Container) Sync() error { - if !c.locked { - return nil - } - - // If runc knows about the container, update its status in runc - // And then save back to disk - if (c.state.State != ContainerStateUnknown) && - (c.state.State != ContainerStateConfigured) { - oldState := c.state.State - // TODO: optionally replace this with a stat for the exit file - if err := c.runtime.ociRuntime.updateContainerStatus(c); err != nil { - return err - } - // Only save back to DB if state changed - if c.state.State != oldState { - if err := c.save(); err != nil { - return err - } - } - } - - return nil + return c.rwSize() } diff --git a/libpod/container_api.go b/libpod/container_api.go new file mode 100644 index 000000000..2b3c83eb2 --- /dev/null +++ b/libpod/container_api.go @@ -0,0 +1,767 @@ +package libpod + +import ( + "encoding/json" + "fmt" + "io/ioutil" + "os" + "path/filepath" + "time" + + "github.com/docker/docker/daemon/caps" + "github.com/docker/docker/pkg/stringid" + "github.com/docker/docker/pkg/term" + spec "github.com/opencontainers/runtime-spec/specs-go" + "github.com/opencontainers/runtime-tools/generate" + "github.com/pkg/errors" + "github.com/projectatomic/libpod/libpod/driver" + crioAnnotations "github.com/projectatomic/libpod/pkg/annotations" + "github.com/projectatomic/libpod/pkg/chrootuser" + "github.com/sirupsen/logrus" + "k8s.io/apimachinery/pkg/util/wait" + "k8s.io/client-go/tools/remotecommand" +) + +// Init creates a container in the OCI runtime +func (c *Container) Init() (err error) { + if !c.locked { + c.lock.Lock() + defer c.lock.Unlock() + + if err := c.syncContainer(); err != nil { + return err + } + } + + if c.state.State != ContainerStateConfigured { + return errors.Wrapf(ErrCtrExists, "container %s has already been created in runtime", c.ID()) + } + + if err := c.mountStorage(); err != nil { + return err + } + defer func() { + if err != nil { + if err2 := c.cleanupStorage(); err2 != nil { + logrus.Errorf("Error cleaning up storage for container %s: %v", c.ID(), err2) + } + } + }() + + // Make a network namespace for the container + if c.config.CreateNetNS && c.state.NetNS == nil { + if err := c.runtime.createNetNS(c); err != nil { + return err + } + } + defer func() { + if err != nil { + if err2 := c.runtime.teardownNetNS(c); err2 != nil { + logrus.Errorf("Error tearing down network namespace for container %s: %v", c.ID(), err2) + } + } + }() + + // If the OCI spec already exists, we need to replace it + // Cannot guarantee some things, e.g. network namespaces, have the same + // paths + jsonPath := filepath.Join(c.bundlePath(), "config.json") + if _, err := os.Stat(jsonPath); err != nil { + if !os.IsNotExist(err) { + return errors.Wrapf(err, "error doing stat on container %s spec", c.ID()) + } + // The spec does not exist, we're fine + } else { + // The spec exists, need to remove it + if err := os.Remove(jsonPath); err != nil { + return errors.Wrapf(err, "error replacing runtime spec for container %s", c.ID()) + } + } + + // Copy /etc/resolv.conf to the container's rundir + runDirResolv, err := c.generateResolvConf() + if err != nil { + return err + } + + // Copy /etc/hosts to the container's rundir + runDirHosts, err := c.generateHosts() + if err != nil { + return errors.Wrapf(err, "unable to copy /etc/hosts to container space") + } + + if c.Spec().Hostname == "" { + id := c.ID() + if len(c.ID()) > 11 { + id = c.ID()[:12] + } + c.config.Spec.Hostname = id + } + runDirHostname, err := c.generateEtcHostname(c.config.Spec.Hostname) + if err != nil { + return errors.Wrapf(err, "unable to generate hostname file for container") + } + + // Save OCI spec to disk + g := generate.NewFromSpec(c.config.Spec) + // If network namespace was requested, add it now + if c.config.CreateNetNS { + g.AddOrReplaceLinuxNamespace(spec.NetworkNamespace, c.state.NetNS.Path()) + } + // Remove default /etc/shm mount + g.RemoveMount("/dev/shm") + // Mount ShmDir from host into container + shmMnt := spec.Mount{ + Type: "bind", + Source: c.config.ShmDir, + Destination: "/dev/shm", + Options: []string{"rw", "bind"}, + } + g.AddMount(shmMnt) + // Bind mount resolv.conf + resolvMnt := spec.Mount{ + Type: "bind", + Source: runDirResolv, + Destination: "/etc/resolv.conf", + Options: []string{"rw", "bind"}, + } + g.AddMount(resolvMnt) + // Bind mount hosts + hostsMnt := spec.Mount{ + Type: "bind", + Source: runDirHosts, + Destination: "/etc/hosts", + Options: []string{"rw", "bind"}, + } + g.AddMount(hostsMnt) + // Bind hostname + hostnameMnt := spec.Mount{ + Type: "bind", + Source: runDirHostname, + Destination: "/etc/hostname", + Options: []string{"rw", "bind"}, + } + g.AddMount(hostnameMnt) + + if c.config.User != "" { + if !c.state.Mounted { + return errors.Wrapf(ErrCtrStateInvalid, "container %s must be mounted in order to translate User field", c.ID()) + } + uid, gid, err := chrootuser.GetUser(c.state.Mountpoint, c.config.User) + if err != nil { + return err + } + // User and Group must go together + g.SetProcessUID(uid) + g.SetProcessGID(gid) + } + + // Add shared namespaces from other containers + if c.config.IPCNsCtr != "" { + ipcCtr, err := c.runtime.state.Container(c.config.IPCNsCtr) + if err != nil { + return err + } + + nsPath, err := ipcCtr.NamespacePath(IPCNS) + if err != nil { + return err + } + + if err := g.AddOrReplaceLinuxNamespace(spec.IPCNamespace, nsPath); err != nil { + return err + } + } + if c.config.MountNsCtr != "" { + mountCtr, err := c.runtime.state.Container(c.config.MountNsCtr) + if err != nil { + return err + } + + nsPath, err := mountCtr.NamespacePath(MountNS) + if err != nil { + return err + } + + if err := g.AddOrReplaceLinuxNamespace(spec.MountNamespace, nsPath); err != nil { + return err + } + } + if c.config.NetNsCtr != "" { + netCtr, err := c.runtime.state.Container(c.config.NetNsCtr) + if err != nil { + return err + } + + nsPath, err := netCtr.NamespacePath(NetNS) + if err != nil { + return err + } + + if err := g.AddOrReplaceLinuxNamespace(spec.NetworkNamespace, nsPath); err != nil { + return err + } + } + if c.config.PIDNsCtr != "" { + pidCtr, err := c.runtime.state.Container(c.config.PIDNsCtr) + if err != nil { + return err + } + + nsPath, err := pidCtr.NamespacePath(PIDNS) + if err != nil { + return err + } + + if err := g.AddOrReplaceLinuxNamespace(string(spec.PIDNamespace), nsPath); err != nil { + return err + } + } + if c.config.UserNsCtr != "" { + userCtr, err := c.runtime.state.Container(c.config.UserNsCtr) + if err != nil { + return err + } + + nsPath, err := userCtr.NamespacePath(UserNS) + if err != nil { + return err + } + + if err := g.AddOrReplaceLinuxNamespace(spec.UserNamespace, nsPath); err != nil { + return err + } + } + if c.config.UTSNsCtr != "" { + utsCtr, err := c.runtime.state.Container(c.config.UTSNsCtr) + if err != nil { + return err + } + + nsPath, err := utsCtr.NamespacePath(UTSNS) + if err != nil { + return err + } + + if err := g.AddOrReplaceLinuxNamespace(spec.UTSNamespace, nsPath); err != nil { + return err + } + } + if c.config.CgroupNsCtr != "" { + cgroupCtr, err := c.runtime.state.Container(c.config.CgroupNsCtr) + if err != nil { + return err + } + + nsPath, err := cgroupCtr.NamespacePath(CgroupNS) + if err != nil { + return err + } + + if err := g.AddOrReplaceLinuxNamespace(spec.CgroupNamespace, nsPath); err != nil { + return err + } + } + + c.runningSpec = g.Spec() + c.runningSpec.Root.Path = c.state.Mountpoint + c.runningSpec.Annotations[crioAnnotations.Created] = c.config.CreatedTime.Format(time.RFC3339Nano) + c.runningSpec.Annotations["org.opencontainers.image.stopSignal"] = fmt.Sprintf("%d", c.config.StopSignal) + + fileJSON, err := json.Marshal(c.runningSpec) + if err != nil { + return errors.Wrapf(err, "error exporting runtime spec for container %s to JSON", c.ID()) + } + if err := ioutil.WriteFile(jsonPath, fileJSON, 0644); err != nil { + return errors.Wrapf(err, "error writing runtime spec JSON to file for container %s", c.ID()) + } + + logrus.Debugf("Created OCI spec for container %s at %s", c.ID(), jsonPath) + + c.state.ConfigPath = jsonPath + + // With the spec complete, do an OCI create + // TODO set cgroup parent in a sane fashion + if err := c.runtime.ociRuntime.createContainer(c, CgroupParent); err != nil { + return err + } + + logrus.Debugf("Created container %s in runc", c.ID()) + + c.state.State = ContainerStateCreated + + return c.save() +} + +// Start starts a container +func (c *Container) Start() error { + if !c.locked { + c.lock.Lock() + defer c.lock.Unlock() + + if err := c.syncContainer(); err != nil { + return err + } + } + + // Container must be created or stopped to be started + if !(c.state.State == ContainerStateCreated || c.state.State == ContainerStateStopped) { + return errors.Wrapf(ErrCtrStateInvalid, "container %s must be in Created or Stopped state to be started", c.ID()) + } + + // Mount storage for the container + if err := c.mountStorage(); err != nil { + return err + } + + if err := c.runtime.ociRuntime.startContainer(c); err != nil { + return err + } + + logrus.Debugf("Started container %s", c.ID()) + + c.state.State = ContainerStateRunning + + return c.save() +} + +// Stop uses the container's stop signal (or SIGTERM if no signal was specified) +// to stop the container, and if it has not stopped after the given timeout (in +// seconds), uses SIGKILL to attempt to forcibly stop the container. +// If timeout is 0, SIGKILL will be used immediately +func (c *Container) Stop(timeout uint) error { + if !c.locked { + c.lock.Lock() + defer c.lock.Unlock() + + if err := c.syncContainer(); err != nil { + return err + } + } + + logrus.Debugf("Stopping ctr %s with timeout %d", c.ID(), timeout) + + if c.state.State == ContainerStateConfigured || + c.state.State == ContainerStateUnknown || + c.state.State == ContainerStatePaused { + return errors.Wrapf(ErrCtrStateInvalid, "can only stop created, running, or stopped containers") + } + + if err := c.runtime.ociRuntime.stopContainer(c, timeout); err != nil { + return err + } + + // Sync the container's state to pick up return code + if err := c.runtime.ociRuntime.updateContainerStatus(c); err != nil { + return err + } + + return c.cleanupStorage() +} + +// Kill sends a signal to a container +func (c *Container) Kill(signal uint) error { + if !c.locked { + c.lock.Lock() + defer c.lock.Unlock() + + if err := c.syncContainer(); err != nil { + return err + } + } + + if c.state.State != ContainerStateRunning { + return errors.Wrapf(ErrCtrStateInvalid, "can only kill running containers") + } + + return c.runtime.ociRuntime.killContainer(c, signal) +} + +// Exec starts a new process inside the container +func (c *Container) Exec(tty, privileged bool, env, cmd []string, user string) error { + var capList []string + + if !c.locked { + c.lock.Lock() + defer c.lock.Unlock() + + if err := c.syncContainer(); err != nil { + return err + } + } + + conState := c.state.State + + if conState != ContainerStateRunning { + return errors.Errorf("cannot attach to container that is not running") + } + if privileged { + capList = caps.GetAllCapabilities() + } + globalOpts := runcGlobalOptions{ + log: c.LogPath(), + } + execOpts := runcExecOptions{ + capAdd: capList, + pidFile: filepath.Join(c.state.RunDir, fmt.Sprintf("%s-execpid", stringid.GenerateNonCryptoID()[:12])), + env: env, + user: user, + cwd: c.config.Spec.Process.Cwd, + tty: tty, + } + + return c.runtime.ociRuntime.execContainer(c, cmd, globalOpts, execOpts) +} + +// Attach attaches to a container +// Returns fully qualified URL of streaming server for the container +func (c *Container) Attach(noStdin bool, keys string, attached chan<- bool) error { + if !c.locked { + c.lock.Lock() + if err := c.syncContainer(); err != nil { + c.lock.Unlock() + return err + } + c.lock.Unlock() + } + + if c.state.State != ContainerStateCreated && + c.state.State != ContainerStateRunning { + return errors.Wrapf(ErrCtrStateInvalid, "can only attach to created or running containers") + } + + // Check the validity of the provided keys first + var err error + detachKeys := []byte{} + if len(keys) > 0 { + detachKeys, err = term.ToBytes(keys) + if err != nil { + return errors.Wrapf(err, "invalid detach keys") + } + } + + resize := make(chan remotecommand.TerminalSize) + defer close(resize) + + err = c.attachContainerSocket(resize, noStdin, detachKeys, attached) + return err +} + +// Mount mounts a container's filesystem on the host +// The path where the container has been mounted is returned +func (c *Container) Mount(label string) (string, error) { + if !c.locked { + c.lock.Lock() + defer c.lock.Unlock() + + if err := c.syncContainer(); err != nil { + return "", err + } + } + + // return mountpoint if container already mounted + if c.state.Mounted { + return c.state.Mountpoint, nil + } + + mountLabel := label + if label == "" { + mountLabel = c.config.MountLabel + } + mountPoint, err := c.runtime.store.Mount(c.ID(), mountLabel) + if err != nil { + return "", err + } + c.state.Mountpoint = mountPoint + c.state.Mounted = true + c.config.MountLabel = mountLabel + + if err := c.save(); err != nil { + return "", err + } + + return mountPoint, nil +} + +// Unmount unmounts a container's filesystem on the host +func (c *Container) Unmount() error { + if !c.locked { + c.lock.Lock() + defer c.lock.Unlock() + + if err := c.syncContainer(); err != nil { + return err + } + } + + if c.state.State == ContainerStateRunning || c.state.State == ContainerStatePaused { + return errors.Wrapf(ErrCtrStateInvalid, "cannot remove storage for container %s as it is running or paused", c.ID()) + } + + return c.cleanupStorage() +} + +// Pause pauses a container +func (c *Container) Pause() error { + if !c.locked { + c.lock.Lock() + defer c.lock.Unlock() + + if err := c.syncContainer(); err != nil { + return err + } + } + + if c.state.State == ContainerStatePaused { + return errors.Wrapf(ErrCtrStateInvalid, "%q is already paused", c.ID()) + } + if c.state.State != ContainerStateRunning && c.state.State != ContainerStateCreated { + return errors.Wrapf(ErrCtrStateInvalid, "%q is not running/created, can't pause", c.state.State) + } + if err := c.runtime.ociRuntime.pauseContainer(c); err != nil { + return err + } + + logrus.Debugf("Paused container %s", c.ID()) + + c.state.State = ContainerStatePaused + + return c.save() +} + +// Unpause unpauses a container +func (c *Container) Unpause() error { + if !c.locked { + c.lock.Lock() + defer c.lock.Unlock() + + if err := c.syncContainer(); err != nil { + return err + } + } + + if c.state.State != ContainerStatePaused { + return errors.Wrapf(ErrCtrStateInvalid, "%q is not paused, can't unpause", c.ID()) + } + if err := c.runtime.ociRuntime.unpauseContainer(c); err != nil { + return err + } + + logrus.Debugf("Unpaused container %s", c.ID()) + + c.state.State = ContainerStateRunning + + return c.save() +} + +// Export exports a container's root filesystem as a tar archive +// The archive will be saved as a file at the given path +func (c *Container) Export(path string) error { + if !c.locked { + c.lock.Lock() + defer c.lock.Unlock() + + if err := c.syncContainer(); err != nil { + return err + } + } + + return c.export(path) +} + +// AddArtifact creates and writes to an artifact file for the container +func (c *Container) AddArtifact(name string, data []byte) error { + if !c.valid { + return ErrCtrRemoved + } + + return ioutil.WriteFile(c.getArtifactPath(name), data, 0740) +} + +// GetArtifact reads the specified artifact file from the container +func (c *Container) GetArtifact(name string) ([]byte, error) { + if !c.valid { + return nil, ErrCtrRemoved + } + + return ioutil.ReadFile(c.getArtifactPath(name)) +} + +// RemoveArtifact deletes the specified artifacts file +func (c *Container) RemoveArtifact(name string) error { + if !c.valid { + return ErrCtrRemoved + } + + return os.Remove(c.getArtifactPath(name)) +} + +// Inspect a container for low-level information +func (c *Container) Inspect(size bool) (*ContainerInspectData, error) { + if !c.locked { + c.lock.Lock() + defer c.lock.Unlock() + + if err := c.syncContainer(); err != nil { + return nil, err + } + } + + storeCtr, err := c.runtime.store.Container(c.ID()) + if err != nil { + return nil, errors.Wrapf(err, "error getting container from store %q", c.ID()) + } + layer, err := c.runtime.store.Layer(storeCtr.LayerID) + if err != nil { + return nil, errors.Wrapf(err, "error reading information about layer %q", storeCtr.LayerID) + } + driverData, err := driver.GetDriverData(c.runtime.store, layer.ID) + if err != nil { + return nil, errors.Wrapf(err, "error getting graph driver info %q", c.ID()) + } + + return c.getContainerInspectData(size, driverData) +} + +// Commit commits the changes between a container and its image, creating a new +// image +func (c *Container) Commit(pause bool, options CopyOptions) error { + if !c.locked { + c.lock.Lock() + defer c.lock.Unlock() + + if err := c.syncContainer(); err != nil { + return err + } + } + + if c.state.State == ContainerStateRunning && pause { + if err := c.runtime.ociRuntime.pauseContainer(c); err != nil { + return errors.Wrapf(err, "error pausing container %q", c.ID()) + } + defer func() { + if err := c.runtime.ociRuntime.unpauseContainer(c); err != nil { + logrus.Errorf("error unpausing container %q: %v", c.ID(), err) + } + }() + } + + tempFile, err := ioutil.TempFile(c.runtime.config.TmpDir, "podman-commit") + if err != nil { + return errors.Wrapf(err, "error creating temp file") + } + defer os.Remove(tempFile.Name()) + defer tempFile.Close() + + if err := c.export(tempFile.Name()); err != nil { + return err + } + return c.runtime.ImportImage(tempFile.Name(), options) +} + +// Wait blocks on a container to exit and returns its exit code +func (c *Container) Wait() (int32, error) { + if !c.valid { + return -1, ErrCtrRemoved + } + + err := wait.PollImmediateInfinite(1, + func() (bool, error) { + stopped, err := c.isStopped() + if err != nil { + return false, err + } + if !stopped { + return false, nil + } else { // nolint + return true, nil // nolint + } // nolint + }, + ) + if err != nil { + return 0, err + } + exitCode := c.state.ExitCode + return exitCode, nil +} + +// CleanupStorage unmounts all mount points in container and cleans up container storage +func (c *Container) CleanupStorage() error { + if !c.locked { + c.lock.Lock() + defer c.lock.Unlock() + if err := c.syncContainer(); err != nil { + return err + } + } + return c.cleanupStorage() +} + +// Batch starts a batch operation on the given container +// All commands in the passed function will execute under the same lock and +// without syncronyzing state after each operation +// This will result in substantial performance benefits when running numerous +// commands on the same container +// Note that the container passed into the Batch function cannot be removed +// during batched operations. runtime.RemoveContainer can only be called outside +// of Batch +// Any error returned by the given batch function will be returned unmodified by +// Batch +// As Batch normally disables updating the current state of the container, the +// Sync() function is provided to enable container state to be updated and +// checked within Batch. +func (c *Container) Batch(batchFunc func(*Container) error) error { + c.lock.Lock() + defer c.lock.Unlock() + + if err := c.syncContainer(); err != nil { + return err + } + + newCtr := new(Container) + newCtr.config = c.config + newCtr.state = c.state + newCtr.runtime = c.runtime + newCtr.lock = c.lock + newCtr.valid = true + + newCtr.locked = true + + if err := batchFunc(newCtr); err != nil { + return err + } + + newCtr.locked = false + + return c.save() +} + +// Sync updates the current state of the container, checking whether its state +// has changed +// Sync can only be used inside Batch() - otherwise, it will be done +// automatically. +// When called outside Batch(), Sync() is a no-op +func (c *Container) Sync() error { + if !c.locked { + return nil + } + + // If runc knows about the container, update its status in runc + // And then save back to disk + if (c.state.State != ContainerStateUnknown) && + (c.state.State != ContainerStateConfigured) { + oldState := c.state.State + // TODO: optionally replace this with a stat for the exit file + if err := c.runtime.ociRuntime.updateContainerStatus(c); err != nil { + return err + } + // Only save back to DB if state changed + if c.state.State != oldState { + if err := c.save(); err != nil { + return err + } + } + } + + return nil +} diff --git a/libpod/container_inspect.go b/libpod/container_inspect.go index 0bb45cedd..78dd00c16 100644 --- a/libpod/container_inspect.go +++ b/libpod/container_inspect.go @@ -4,7 +4,6 @@ import ( "github.com/cri-o/ocicni/pkg/ocicni" "github.com/projectatomic/libpod/libpod/driver" "github.com/sirupsen/logrus" - "github.com/ulule/deepcopier" ) func (c *Container) getContainerInspectData(size bool, driverData *driver.Data) (*ContainerInspectData, error) { @@ -77,7 +76,7 @@ func (c *Container) getContainerInspectData(size bool, driverData *driver.Data) // Copy port mappings into network settings if config.PortMappings != nil { - deepcopier.Copy(config.PortMappings).To(data.NetworkSettings.Ports) + data.NetworkSettings.Ports = config.PortMappings } // Get information on the container's network namespace (if present) diff --git a/libpod/container_internal.go b/libpod/container_internal.go new file mode 100644 index 000000000..9b785bfa5 --- /dev/null +++ b/libpod/container_internal.go @@ -0,0 +1,515 @@ +package libpod + +import ( + "fmt" + "io" + "io/ioutil" + "os" + "path/filepath" + "strings" + "syscall" + "time" + + "github.com/containers/storage" + "github.com/containers/storage/pkg/archive" + "github.com/docker/docker/pkg/mount" + "github.com/docker/docker/pkg/namesgenerator" + "github.com/docker/docker/pkg/stringid" + spec "github.com/opencontainers/runtime-spec/specs-go" + "github.com/opencontainers/selinux/go-selinux/label" + "github.com/pkg/errors" + "github.com/sirupsen/logrus" + "github.com/ulule/deepcopier" + "golang.org/x/sys/unix" +) + +const ( + // name of the directory holding the artifacts + artifactsDir = "artifacts" +) + +// rootFsSize gets the size of the container's root filesystem +// A container FS is split into two parts. The first is the top layer, a +// mutable layer, and the rest is the RootFS: the set of immutable layers +// that make up the image on which the container is based. +func (c *Container) rootFsSize() (int64, error) { + container, err := c.runtime.store.Container(c.ID()) + if err != nil { + return 0, err + } + + // Ignore the size of the top layer. The top layer is a mutable RW layer + // and is not considered a part of the rootfs + rwLayer, err := c.runtime.store.Layer(container.LayerID) + if err != nil { + return 0, err + } + layer, err := c.runtime.store.Layer(rwLayer.Parent) + if err != nil { + return 0, err + } + + size := int64(0) + for layer.Parent != "" { + layerSize, err := c.runtime.store.DiffSize(layer.Parent, layer.ID) + if err != nil { + return size, errors.Wrapf(err, "getting diffsize of layer %q and its parent %q", layer.ID, layer.Parent) + } + size += layerSize + layer, err = c.runtime.store.Layer(layer.Parent) + if err != nil { + return 0, err + } + } + // Get the size of the last layer. Has to be outside of the loop + // because the parent of the last layer is "", andlstore.Get("") + // will return an error. + layerSize, err := c.runtime.store.DiffSize(layer.Parent, layer.ID) + return size + layerSize, err +} + +// rwSize Gets the size of the mutable top layer of the container. +func (c *Container) rwSize() (int64, error) { + container, err := c.runtime.store.Container(c.ID()) + if err != nil { + return 0, err + } + + // Get the size of the top layer by calculating the size of the diff + // between the layer and its parent. The top layer of a container is + // the only RW layer, all others are immutable + layer, err := c.runtime.store.Layer(container.LayerID) + if err != nil { + return 0, err + } + return c.runtime.store.DiffSize(layer.Parent, layer.ID) +} + +// The path to the container's root filesystem - where the OCI spec will be +// placed, amongst other things +func (c *Container) bundlePath() string { + return c.config.StaticDir +} + +// The path to the container's logs file +func (c *Container) logPath() string { + return filepath.Join(c.config.StaticDir, "ctr.log") +} + +// Retrieves the path of the container's attach socket +func (c *Container) attachSocketPath() string { + return filepath.Join(c.runtime.ociRuntime.socketsDir, c.ID(), "attach") +} + +// Sync this container with on-disk state and runc status +// Should only be called with container lock held +// This function should suffice to ensure a container's state is accurate and +// it is valid for use. +func (c *Container) syncContainer() error { + if err := c.runtime.state.UpdateContainer(c); err != nil { + return err + } + // If runc knows about the container, update its status in runc + // And then save back to disk + if (c.state.State != ContainerStateUnknown) && + (c.state.State != ContainerStateConfigured) { + oldState := c.state.State + // TODO: optionally replace this with a stat for the exit file + if err := c.runtime.ociRuntime.updateContainerStatus(c); err != nil { + return err + } + // Only save back to DB if state changed + if c.state.State != oldState { + if err := c.save(); err != nil { + return err + } + } + } + + if !c.valid { + return errors.Wrapf(ErrCtrRemoved, "container %s is not valid", c.ID()) + } + + return nil +} + +// Make a new container +func newContainer(rspec *spec.Spec, lockDir string) (*Container, error) { + if rspec == nil { + return nil, errors.Wrapf(ErrInvalidArg, "must provide a valid runtime spec to create container") + } + + ctr := new(Container) + ctr.config = new(ContainerConfig) + ctr.state = new(containerState) + + ctr.config.ID = stringid.GenerateNonCryptoID() + ctr.config.Name = namesgenerator.GetRandomName(0) + + ctr.config.Spec = new(spec.Spec) + deepcopier.Copy(rspec).To(ctr.config.Spec) + ctr.config.CreatedTime = time.Now() + + ctr.config.ShmSize = DefaultShmSize + ctr.config.CgroupParent = CgroupParent + + // Path our lock file will reside at + lockPath := filepath.Join(lockDir, ctr.config.ID) + // Grab a lockfile at the given path + lock, err := storage.GetLockfile(lockPath) + if err != nil { + return nil, errors.Wrapf(err, "error creating lockfile for new container") + } + ctr.lock = lock + + return ctr, nil +} + +// Create container root filesystem for use +func (c *Container) setupStorage() error { + if !c.valid { + return errors.Wrapf(ErrCtrRemoved, "container %s is not valid", c.ID()) + } + + if c.state.State != ContainerStateConfigured { + return errors.Wrapf(ErrCtrStateInvalid, "container %s must be in Configured state to have storage set up", c.ID()) + } + + // Need both an image ID and image name, plus a bool telling us whether to use the image configuration + if c.config.RootfsImageID == "" || c.config.RootfsImageName == "" { + return errors.Wrapf(ErrInvalidArg, "must provide image ID and image name to use an image") + } + + containerInfo, err := c.runtime.storageService.CreateContainerStorage(c.runtime.imageContext, c.config.RootfsImageName, c.config.RootfsImageID, c.config.Name, c.config.ID, c.config.MountLabel) + if err != nil { + return errors.Wrapf(err, "error creating container storage") + } + + c.config.StaticDir = containerInfo.Dir + c.state.RunDir = containerInfo.RunDir + + artifacts := filepath.Join(c.config.StaticDir, artifactsDir) + if err := os.MkdirAll(artifacts, 0755); err != nil { + return errors.Wrapf(err, "error creating artifacts directory %q", artifacts) + } + + return nil +} + +// Tear down a container's storage prior to removal +func (c *Container) teardownStorage() error { + if !c.valid { + return errors.Wrapf(ErrCtrRemoved, "container %s is not valid", c.ID()) + } + + if c.state.State == ContainerStateRunning || c.state.State == ContainerStatePaused { + return errors.Wrapf(ErrCtrStateInvalid, "cannot remove storage for container %s as it is running or paused", c.ID()) + } + + artifacts := filepath.Join(c.config.StaticDir, artifactsDir) + if err := os.RemoveAll(artifacts); err != nil { + return errors.Wrapf(err, "error removing artifacts %q", artifacts) + } + + if err := c.cleanupStorage(); err != nil { + return errors.Wrapf(err, "failed to cleanup container %s storage", c.ID()) + } + + if err := c.runtime.storageService.DeleteContainer(c.ID()); err != nil { + return errors.Wrapf(err, "error removing container %s root filesystem", c.ID()) + } + + return nil +} + +// Refresh refreshes the container's state after a restart +func (c *Container) refresh() error { + c.lock.Lock() + defer c.lock.Unlock() + + if !c.valid { + return errors.Wrapf(ErrCtrRemoved, "container %s is not valid - may have been removed", c.ID()) + } + + // We need to get the container's temporary directory from c/storage + // It was lost in the reboot and must be recreated + dir, err := c.runtime.storageService.GetRunDir(c.ID()) + if err != nil { + return errors.Wrapf(err, "error retrieving temporary directory for container %s", c.ID()) + } + c.state.RunDir = dir + + if err := c.runtime.state.SaveContainer(c); err != nil { + return errors.Wrapf(err, "error refreshing state for container %s", c.ID()) + } + + return nil +} + +func (c *Container) export(path string) error { + mountPoint := c.state.Mountpoint + if !c.state.Mounted { + mount, err := c.runtime.store.Mount(c.ID(), c.config.MountLabel) + if err != nil { + return errors.Wrapf(err, "error mounting container %q", c.ID()) + } + mountPoint = mount + defer func() { + if err := c.runtime.store.Unmount(c.ID()); err != nil { + logrus.Errorf("error unmounting container %q: %v", c.ID(), err) + } + }() + } + + input, err := archive.Tar(mountPoint, archive.Uncompressed) + if err != nil { + return errors.Wrapf(err, "error reading container directory %q", c.ID()) + } + + outFile, err := os.Create(path) + if err != nil { + return errors.Wrapf(err, "error creating file %q", path) + } + defer outFile.Close() + + _, err = io.Copy(outFile, input) + return err +} + +// Get path of artifact with a given name for this container +func (c *Container) getArtifactPath(name string) string { + return filepath.Join(c.config.StaticDir, artifactsDir, name) +} + +// Used with Wait() to determine if a container has exited +func (c *Container) isStopped() (bool, error) { + if !c.locked { + c.lock.Lock() + defer c.lock.Unlock() + } + err := c.syncContainer() + if err != nil { + return true, err + } + return c.state.State == ContainerStateStopped, nil +} + +// save container state to the database +func (c *Container) save() error { + if err := c.runtime.state.SaveContainer(c); err != nil { + return errors.Wrapf(err, "error saving container %s state", c.ID()) + } + return nil +} + +// mountStorage sets up the container's root filesystem +// It mounts the image and any other requested mounts +// TODO: Add ability to override mount label so we can use this for Mount() too +// TODO: Can we use this for export? Copying SHM into the export might not be +// good +func (c *Container) mountStorage() (err error) { + // Container already mounted, nothing to do + if c.state.Mounted { + return nil + } + + // TODO: generalize this mount code so it will mount every mount in ctr.config.Mounts + + mounted, err := mount.Mounted(c.config.ShmDir) + if err != nil { + return errors.Wrapf(err, "unable to determine if %q is mounted", c.config.ShmDir) + } + + if !mounted { + shmOptions := fmt.Sprintf("mode=1777,size=%d", c.config.ShmSize) + if err := unix.Mount("shm", c.config.ShmDir, "tmpfs", unix.MS_NOEXEC|unix.MS_NOSUID|unix.MS_NODEV, + label.FormatMountLabel(shmOptions, c.config.MountLabel)); err != nil { + return errors.Wrapf(err, "failed to mount shm tmpfs %q", c.config.ShmDir) + } + } + + mountPoint, err := c.runtime.storageService.MountContainerImage(c.ID()) + if err != nil { + return errors.Wrapf(err, "error mounting storage for container %s", c.ID()) + } + c.state.Mounted = true + c.state.Mountpoint = mountPoint + + logrus.Debugf("Created root filesystem for container %s at %s", c.ID(), c.state.Mountpoint) + + defer func() { + if err != nil { + if err2 := c.cleanupStorage(); err2 != nil { + logrus.Errorf("Error unmounting storage for container %s: %v", c.ID(), err) + } + } + }() + + return c.save() +} + +// cleanupStorage unmounts and cleans up the container's root filesystem +func (c *Container) cleanupStorage() error { + if !c.state.Mounted { + // Already unmounted, do nothing + return nil + } + + for _, mount := range c.config.Mounts { + if err := unix.Unmount(mount, unix.MNT_DETACH); err != nil { + if err != syscall.EINVAL { + logrus.Warnf("container %s failed to unmount %s : %v", c.ID(), mount, err) + } + } + } + + // Also unmount storage + if err := c.runtime.storageService.UnmountContainerImage(c.ID()); err != nil { + return errors.Wrapf(err, "error unmounting container %s root filesystem", c.ID()) + } + + c.state.Mountpoint = "" + c.state.Mounted = false + + return c.save() +} + +// WriteStringToRundir copies the provided file to the runtimedir +func (c *Container) WriteStringToRundir(destFile, output string) (string, error) { + destFileName := filepath.Join(c.state.RunDir, destFile) + f, err := os.Create(destFileName) + if err != nil { + return "", errors.Wrapf(err, "unable to create %s", destFileName) + } + + defer f.Close() + _, err = f.WriteString(output) + if err != nil { + return "", errors.Wrapf(err, "unable to write %s", destFileName) + } + // Relabel runDirResolv for the container + if err := label.Relabel(destFileName, c.config.MountLabel, false); err != nil { + return "", err + } + return destFileName, nil +} + +type resolv struct { + nameServers []string + searchDomains []string + options []string +} + +// generateResolvConf generates a containers resolv.conf +func (c *Container) generateResolvConf() (string, error) { + // Copy /etc/resolv.conf to the container's rundir + resolvPath := "/etc/resolv.conf" + + // Check if the host system is using system resolve and if so + // copy its resolv.conf + if _, err := os.Stat("/run/systemd/resolve/resolv.conf"); err == nil { + resolvPath = "/run/systemd/resolve/resolv.conf" + } + orig, err := ioutil.ReadFile(resolvPath) + if err != nil { + return "", errors.Wrapf(err, "unable to read %s", resolvPath) + } + if len(c.config.DNSServer) == 0 && len(c.config.DNSSearch) == 0 && len(c.config.DNSOption) == 0 { + return c.WriteStringToRundir("resolv.conf", fmt.Sprintf("%s", orig)) + } + + // Read and organize the hosts /etc/resolv.conf + resolv := createResolv(string(orig[:])) + + // Populate the resolv struct with user's dns search domains + if len(c.config.DNSSearch) > 0 { + resolv.searchDomains = nil + // The . character means the user doesnt want any search domains in the container + if !StringInSlice(".", c.config.DNSSearch) { + resolv.searchDomains = append(resolv.searchDomains, c.Config().DNSSearch...) + } + } + + // Populate the resolv struct with user's dns servers + if len(c.config.DNSServer) > 0 { + resolv.nameServers = nil + for _, i := range c.config.DNSServer { + resolv.nameServers = append(resolv.nameServers, i.String()) + } + } + + // Populate the resolve struct with the users dns options + if len(c.config.DNSOption) > 0 { + resolv.options = nil + resolv.options = append(resolv.options, c.Config().DNSOption...) + } + return c.WriteStringToRundir("resolv.conf", resolv.ToString()) +} + +// createResolv creates a resolv struct from an input string +func createResolv(input string) resolv { + var resolv resolv + for _, line := range strings.Split(input, "\n") { + if strings.HasPrefix(line, "search") { + fields := strings.Fields(line) + if len(fields) < 2 { + logrus.Debugf("invalid resolv.conf line %s", line) + continue + } + resolv.searchDomains = append(resolv.searchDomains, fields[1:]...) + } else if strings.HasPrefix(line, "nameserver") { + fields := strings.Fields(line) + if len(fields) < 2 { + logrus.Debugf("invalid resolv.conf line %s", line) + continue + } + resolv.nameServers = append(resolv.nameServers, fields[1]) + } else if strings.HasPrefix(line, "options") { + fields := strings.Fields(line) + if len(fields) < 2 { + logrus.Debugf("invalid resolv.conf line %s", line) + continue + } + resolv.options = append(resolv.options, fields[1:]...) + } + } + return resolv +} + +//ToString returns a resolv struct in the form of a resolv.conf +func (r resolv) ToString() string { + var result string + // Populate the output string with search domains + result += fmt.Sprintf("search %s\n", strings.Join(r.searchDomains, " ")) + // Populate the output string with name servers + for _, i := range r.nameServers { + result += fmt.Sprintf("nameserver %s\n", i) + } + // Populate the output string with dns options + for _, i := range r.options { + result += fmt.Sprintf("options %s\n", i) + } + return result +} + +// generateHosts creates a containers hosts file +func (c *Container) generateHosts() (string, error) { + orig, err := ioutil.ReadFile("/etc/hosts") + if err != nil { + return "", errors.Wrapf(err, "unable to read /etc/hosts") + } + hosts := string(orig) + if len(c.config.HostAdd) > 0 { + for _, host := range c.config.HostAdd { + // the host format has already been verified at this point + fields := strings.Split(host, ":") + hosts += fmt.Sprintf("%s %s\n", fields[0], fields[1]) + } + } + return c.WriteStringToRundir("hosts", hosts) +} + +// generateEtcHostname creates a containers /etc/hostname +func (c *Container) generateEtcHostname(hostname string) (string, error) { + return c.WriteStringToRundir("hostname", hostname) +} diff --git a/libpod/in_memory_state.go b/libpod/in_memory_state.go index 4e4cbb664..55162e6c8 100644 --- a/libpod/in_memory_state.go +++ b/libpod/in_memory_state.go @@ -1,6 +1,8 @@ package libpod import ( + "strings" + "github.com/docker/docker/pkg/truncindex" "github.com/pkg/errors" "github.com/projectatomic/libpod/pkg/registrar" @@ -10,6 +12,7 @@ import ( type InMemoryState struct { pods map[string]*Pod containers map[string]*Container + ctrDepends map[string][]string podNameIndex *registrar.Registrar podIDIndex *truncindex.TruncIndex ctrNameIndex *registrar.Registrar @@ -23,6 +26,8 @@ func NewInMemoryState() (State, error) { state.pods = make(map[string]*Pod) state.containers = make(map[string]*Container) + state.ctrDepends = make(map[string][]string) + state.podNameIndex = registrar.NewRegistrar() state.ctrNameIndex = registrar.NewRegistrar() @@ -101,8 +106,7 @@ func (s *InMemoryState) HasContainer(id string) (bool, error) { } // AddContainer adds a container to the state -// If the container belongs to a pod, the pod must already be present when the -// container is added, and the container must be present in the pod +// Containers in a pod cannot be added to the state func (s *InMemoryState) AddContainer(ctr *Container) error { if !ctr.valid { return errors.Wrapf(ErrCtrRemoved, "container with ID %s is not valid", ctr.ID()) @@ -113,17 +117,8 @@ func (s *InMemoryState) AddContainer(ctr *Container) error { return errors.Wrapf(ErrCtrExists, "container with ID %s already exists in state", ctr.ID()) } - if ctr.pod != nil { - if _, ok := s.pods[ctr.pod.ID()]; !ok { - return errors.Wrapf(ErrNoSuchPod, "pod %s does not exist, cannot add container %s", ctr.pod.ID(), ctr.ID()) - } - - hasCtr, err := ctr.pod.HasContainer(ctr.ID()) - if err != nil { - return errors.Wrapf(err, "error checking if container %s is present in pod %s", ctr.ID(), ctr.pod.ID()) - } else if !hasCtr { - return errors.Wrapf(ErrNoSuchCtr, "container %s is not present in pod %s", ctr.ID(), ctr.pod.ID()) - } + if ctr.config.Pod != "" { + return errors.Wrapf(ErrInvalidArg, "cannot add a container that is in a pod with AddContainer, use AddContainerToPod") } if err := s.ctrNameIndex.Reserve(ctr.Name(), ctr.ID()); err != nil { @@ -137,6 +132,12 @@ func (s *InMemoryState) AddContainer(ctr *Container) error { s.containers[ctr.ID()] = ctr + // Add containers this container depends on + depCtrs := ctr.Dependencies() + for _, depCtr := range depCtrs { + s.addCtrToDependsMap(ctr.ID(), depCtr) + } + return nil } @@ -146,6 +147,13 @@ func (s *InMemoryState) RemoveContainer(ctr *Container) error { // Almost no validity checks are performed, to ensure we can kick // misbehaving containers out of the state + // Ensure we don't remove a container which other containers depend on + deps, ok := s.ctrDepends[ctr.ID()] + if ok && len(deps) != 0 { + depsStr := strings.Join(deps, ", ") + return errors.Wrapf(ErrCtrExists, "the following containers depend on container %s: %s", ctr.ID(), depsStr) + } + if _, ok := s.containers[ctr.ID()]; !ok { return errors.Wrapf(ErrNoSuchCtr, "no container exists in state with ID %s", ctr.ID()) } @@ -156,6 +164,14 @@ func (s *InMemoryState) RemoveContainer(ctr *Container) error { delete(s.containers, ctr.ID()) s.ctrNameIndex.Release(ctr.Name()) + delete(s.ctrDepends, ctr.ID()) + + // Remove us from container dependencies + depCtrs := ctr.Dependencies() + for _, depCtr := range depCtrs { + s.removeCtrFromDependsMap(ctr.ID(), depCtr) + } + return nil } @@ -163,6 +179,17 @@ func (s *InMemoryState) RemoveContainer(ctr *Container) error { // As all state is in-memory, no update will be required // As such this is a no-op func (s *InMemoryState) UpdateContainer(ctr *Container) error { + // If the container is invalid, return error + if !ctr.valid { + return errors.Wrapf(ErrCtrRemoved, "container with ID %s is not valid", ctr.ID()) + } + + // If the container does not exist, return error + if _, ok := s.containers[ctr.ID()]; !ok { + ctr.valid = false + return errors.Wrapf(ErrNoSuchCtr, "container with ID %s not found in state", ctr.ID()) + } + return nil } @@ -171,9 +198,34 @@ func (s *InMemoryState) UpdateContainer(ctr *Container) error { // are made // As such this is a no-op func (s *InMemoryState) SaveContainer(ctr *Container) error { + // If the container is invalid, return error + if !ctr.valid { + return errors.Wrapf(ErrCtrRemoved, "container with ID %s is not valid", ctr.ID()) + } + + // If the container does not exist, return error + if _, ok := s.containers[ctr.ID()]; !ok { + ctr.valid = false + return errors.Wrapf(ErrNoSuchCtr, "container with ID %s not found in state", ctr.ID()) + } + return nil } +// ContainerInUse checks if the given container is being used by other containers +func (s *InMemoryState) ContainerInUse(ctr *Container) ([]string, error) { + if !ctr.valid { + return nil, ErrCtrRemoved + } + + arr, ok := s.ctrDepends[ctr.ID()] + if !ok { + return []string{}, nil + } + + return arr, nil +} + // AllContainers retrieves all containers from the state func (s *InMemoryState) AllContainers() ([]*Container, error) { ctrs := make([]*Container, 0, len(s.containers)) @@ -241,6 +293,20 @@ func (s *InMemoryState) HasPod(id string) (bool, error) { return ok, nil } +// PodContainers retrieves the containers from a pod given the pod's full ID +func (s *InMemoryState) PodContainers(id string) ([]*Container, error) { + if id == "" { + return nil, ErrEmptyID + } + + pod, ok := s.pods[id] + if !ok { + return nil, errors.Wrapf(ErrNoSuchPod, "no pod with ID %s found", id) + } + + return pod.GetContainers() +} + // AddPod adds a given pod to the state // Only empty pods can be added to the state func (s *InMemoryState) AddPod(pod *Pod) error { @@ -289,6 +355,89 @@ func (s *InMemoryState) RemovePod(pod *Pod) error { return nil } +// UpdatePod updates a pod's state from the backing database +// As in-memory states have no database this is a no-op +func (s *InMemoryState) UpdatePod(pod *Pod) error { + return nil +} + +// AddContainerToPod adds a container to the given pod, also adding it to the +// state +func (s *InMemoryState) AddContainerToPod(pod *Pod, ctr *Container) error { + if !pod.valid { + return errors.Wrapf(ErrPodRemoved, "pod %s is not valid and cannot be added to", pod.ID()) + } + if !ctr.valid { + return errors.Wrapf(ErrCtrRemoved, "container %s is not valid and cannot be added to the pod", ctr.ID()) + } + + if ctr.config.Pod != pod.ID() { + return errors.Wrapf(ErrInvalidArg, "container %s is not in pod %s", ctr.ID(), pod.ID()) + } + + // Add container to pod + if err := pod.addContainer(ctr); err != nil { + return err + } + + // Add container to state + _, ok := s.containers[ctr.ID()] + if ok { + return errors.Wrapf(ErrCtrExists, "container with ID %s already exists in state", ctr.ID()) + } + + if err := s.ctrNameIndex.Reserve(ctr.Name(), ctr.ID()); err != nil { + return errors.Wrapf(err, "error reserving container name %s", ctr.Name()) + } + + if err := s.ctrIDIndex.Add(ctr.ID()); err != nil { + s.ctrNameIndex.Release(ctr.Name()) + return errors.Wrapf(err, "error releasing container ID %s", ctr.ID()) + } + + s.containers[ctr.ID()] = ctr + + return nil +} + +// RemoveContainerFromPod removes the given container from the given pod +// The container is also removed from the state +func (s *InMemoryState) RemoveContainerFromPod(pod *Pod, ctr *Container) error { + if !pod.valid { + return errors.Wrapf(ErrPodRemoved, "pod %s is not valid and containers cannot be removed", pod.ID()) + } + if !ctr.valid { + return errors.Wrapf(ErrCtrRemoved, "container %s is not valid and cannot be removed from the pod", ctr.ID()) + } + + // Is the container in the pod? + exists, err := pod.HasContainer(ctr.ID()) + if err != nil { + return errors.Wrapf(err, "error checking for container %s in pod %s", ctr.ID(), pod.ID()) + } + if !exists { + return errors.Wrapf(ErrNoSuchCtr, "no container %s in pod %s", ctr.ID(), pod.ID()) + } + + // Remove container from pod + if err := pod.removeContainer(ctr); err != nil { + return err + } + + // Remove container from state + if _, ok := s.containers[ctr.ID()]; !ok { + return errors.Wrapf(ErrNoSuchCtr, "no container exists in state with ID %s", ctr.ID()) + } + + if err := s.ctrIDIndex.Delete(ctr.ID()); err != nil { + return errors.Wrapf(err, "error removing container ID from index") + } + delete(s.containers, ctr.ID()) + s.ctrNameIndex.Release(ctr.Name()) + + return nil +} + // AllPods retrieves all pods currently in the state func (s *InMemoryState) AllPods() ([]*Pod, error) { pods := make([]*Pod, 0, len(s.pods)) @@ -298,3 +447,43 @@ func (s *InMemoryState) AllPods() ([]*Pod, error) { return pods, nil } + +// Internal Functions + +// Add a container to the dependency mappings +func (s *InMemoryState) addCtrToDependsMap(ctrID, dependsID string) { + if dependsID != "" { + arr, ok := s.ctrDepends[dependsID] + if !ok { + // Do not have a mapping for that container yet + s.ctrDepends[dependsID] = []string{ctrID} + } else { + // Have a mapping for the container + arr = append(arr, ctrID) + s.ctrDepends[dependsID] = arr + } + } +} + +// Remove a container from dependency mappings +func (s *InMemoryState) removeCtrFromDependsMap(ctrID, dependsID string) { + if dependsID != "" { + arr, ok := s.ctrDepends[dependsID] + if !ok { + // Internal state seems inconsistent + // But the dependency is definitely gone + // So just return + return + } + + newArr := make([]string, 0, len(arr)) + + for _, id := range arr { + if id != ctrID { + newArr = append(newArr, id) + } + } + + s.ctrDepends[dependsID] = newArr + } +} diff --git a/libpod/networking.go b/libpod/networking.go index 41bd65d25..40756cf88 100644 --- a/libpod/networking.go +++ b/libpod/networking.go @@ -35,7 +35,6 @@ func (r *Runtime) createNetNS(ctr *Container) (err error) { }() logrus.Debugf("Made network namespace at %s for container %s", ctrNS.Path(), ctr.ID()) - podNetwork := getPodNetwork(ctr.ID(), ctr.Name(), ctrNS.Path(), ctr.config.PortMappings) _, err = r.netPlugin.SetUpPod(podNetwork) diff --git a/libpod/oci.go b/libpod/oci.go index c122071e3..155b23640 100644 --- a/libpod/oci.go +++ b/libpod/oci.go @@ -232,11 +232,8 @@ func (r *OCIRuntime) createContainer(ctr *Container, cgroupParent string) (err e if err != nil { logrus.Warnf("Failed to add conmon to cgroupfs sandbox cgroup: %v", err) } else { - // XXX: this defer does nothing as the cgroup can't be deleted cause - // it contains the conmon pid in tasks // we need to remove this defer and delete the cgroup once conmon exits // maybe need a conmon monitor? - defer control.Delete() if err := control.Add(cgroups.Process{Pid: cmd.Process.Pid}); err != nil { logrus.Warnf("Failed to add conmon to cgroupfs sandbox cgroup: %v", err) } diff --git a/libpod/options.go b/libpod/options.go index 8a9cf94b6..f82cb20c4 100644 --- a/libpod/options.go +++ b/libpod/options.go @@ -1,7 +1,7 @@ package libpod import ( - "fmt" + "net" "path/filepath" "regexp" "syscall" @@ -13,27 +13,9 @@ import ( ) var ( - ctrNotImplemented = func(c *Container) error { - return fmt.Errorf("NOT IMPLEMENTED") - } nameRegex = regexp.MustCompile("[a-zA-Z0-9_-]+") ) -const ( - // IPCNamespace represents the IPC namespace - IPCNamespace = "ipc" - // MountNamespace represents the mount namespace - MountNamespace = "mount" - // NetNamespace represents the network namespace - NetNamespace = "network" - // PIDNamespace represents the PID namespace - PIDNamespace = "pid" - // UserNamespace represents the user namespace - UserNamespace = "user" - // UTSNamespace represents the UTS namespace - UTSNamespace = "uts" -) - // Runtime Creation Options // WithStorageConfig uses the given configuration to set up container storage @@ -100,15 +82,21 @@ func WithSignaturePolicy(path string) RuntimeOption { } } -// WithInMemoryState specifies that the runtime will be backed by an in-memory -// state only, and state will not persist after the runtime is shut down -func WithInMemoryState() RuntimeOption { +// WithStateType sets the backing state implementation for libpod +// Please note that information is not portable between backing states +// As such, if this differs between two libpods running on the same system, +// they will not share containers, and unspecified behavior may occur +func WithStateType(storeType RuntimeStateStore) RuntimeOption { return func(rt *Runtime) error { if rt.valid { return ErrRuntimeFinalized } - rt.config.InMemoryState = true + if storeType == InvalidStateStore { + return errors.Wrapf(ErrInvalidArg, "must provide a valid state store type") + } + + rt.config.StateType = storeType return nil } @@ -341,15 +329,6 @@ func WithStdin() CtrCreateOption { } } -// WithSharedNamespaces sets a container to share namespaces with another -// container. If the from container belongs to a pod, the new container will -// be added to the pod. -// By default no namespaces are shared. To share a namespace, add the Namespace -// string constant to the map as a key -func WithSharedNamespaces(from *Container, namespaces map[string]string) CtrCreateOption { - return ctrNotImplemented -} - // WithPod adds the container to a pod func (r *Runtime) WithPod(pod *Pod) CtrCreateOption { return func(ctr *Container) error { @@ -362,7 +341,6 @@ func (r *Runtime) WithPod(pod *Pod) CtrCreateOption { } ctr.config.Pod = pod.ID() - ctr.pod = pod return nil } @@ -434,6 +412,164 @@ func WithStopTimeout(timeout uint) CtrCreateOption { } } +// WithIPCNSFrom indicates the the container should join the IPC namespace of +// the given container +func WithIPCNSFrom(nsCtr *Container) CtrCreateOption { + return func(ctr *Container) error { + if ctr.valid { + return ErrCtrFinalized + } + + if !nsCtr.valid { + return ErrCtrRemoved + } + + if nsCtr.ID() == ctr.ID() { + return errors.Wrapf(ErrInvalidArg, "must specify another container") + } + + ctr.config.IPCNsCtr = nsCtr.ID() + + return nil + } +} + +// WithMountNSFrom indicates the the container should join the mount namespace +// of the given container +func WithMountNSFrom(nsCtr *Container) CtrCreateOption { + return func(ctr *Container) error { + if ctr.valid { + return ErrCtrFinalized + } + + if !nsCtr.valid { + return ErrCtrRemoved + } + + if nsCtr.ID() == ctr.ID() { + return errors.Wrapf(ErrInvalidArg, "must specify another container") + } + + ctr.config.MountNsCtr = nsCtr.ID() + + return nil + } +} + +// WithNetNSFrom indicates the the container should join the network namespace +// of the given container +func WithNetNSFrom(nsCtr *Container) CtrCreateOption { + return func(ctr *Container) error { + if ctr.valid { + return ErrCtrFinalized + } + + if !nsCtr.valid { + return ErrCtrRemoved + } + + if nsCtr.ID() == ctr.ID() { + return errors.Wrapf(ErrInvalidArg, "must specify another container") + } + + if ctr.config.CreateNetNS { + return errors.Wrapf(ErrInvalidArg, "cannot join another container's net ns as we are making a new net ns") + } + + ctr.config.NetNsCtr = nsCtr.ID() + + return nil + } +} + +// WithPIDNSFrom indicates the the container should join the PID namespace of +// the given container +func WithPIDNSFrom(nsCtr *Container) CtrCreateOption { + return func(ctr *Container) error { + if ctr.valid { + return ErrCtrFinalized + } + + if !nsCtr.valid { + return ErrCtrRemoved + } + + if nsCtr.ID() == ctr.ID() { + return errors.Wrapf(ErrInvalidArg, "must specify another container") + } + + ctr.config.PIDNsCtr = nsCtr.ID() + + return nil + } +} + +// WithUserNSFrom indicates the the container should join the user namespace of +// the given container +func WithUserNSFrom(nsCtr *Container) CtrCreateOption { + return func(ctr *Container) error { + if ctr.valid { + return ErrCtrFinalized + } + + if !nsCtr.valid { + return ErrCtrRemoved + } + + if nsCtr.ID() == ctr.ID() { + return errors.Wrapf(ErrInvalidArg, "must specify another container") + } + + ctr.config.UserNsCtr = nsCtr.ID() + + return nil + } +} + +// WithUTSNSFrom indicates the the container should join the UTS namespace of +// the given container +func WithUTSNSFrom(nsCtr *Container) CtrCreateOption { + return func(ctr *Container) error { + if ctr.valid { + return ErrCtrFinalized + } + + if !nsCtr.valid { + return ErrCtrRemoved + } + + if nsCtr.ID() == ctr.ID() { + return errors.Wrapf(ErrInvalidArg, "must specify another container") + } + + ctr.config.UTSNsCtr = nsCtr.ID() + + return nil + } +} + +// WithCgroupNSFrom indicates the the container should join the CGroup namespace +// of the given container +func WithCgroupNSFrom(nsCtr *Container) CtrCreateOption { + return func(ctr *Container) error { + if ctr.valid { + return ErrCtrFinalized + } + + if !nsCtr.valid { + return ErrCtrRemoved + } + + if nsCtr.ID() == ctr.ID() { + return errors.Wrapf(ErrInvalidArg, "must specify another container") + } + + ctr.config.CgroupNsCtr = nsCtr.ID() + + return nil + } +} + // WithNetNS indicates that the container should be given a new network // namespace with a minimal configuration // An optional array of port mappings can be provided @@ -443,8 +579,12 @@ func WithNetNS(portMappings []ocicni.PortMapping) CtrCreateOption { return ErrCtrFinalized } + if ctr.config.NetNsCtr != "" { + return errors.Wrapf(ErrInvalidArg, "container is already set to join another container's net ns, cannot create a new net ns") + } + ctr.config.CreateNetNS = true - copy(ctr.config.PortMappings, portMappings) + ctr.config.PortMappings = portMappings return nil } @@ -502,3 +642,55 @@ func WithPodLabels(labels map[string]string) PodCreateOption { return nil } } + +// WithDNSSearch sets the additional search domains of a container +func WithDNSSearch(searchDomains []string) CtrCreateOption { + return func(ctr *Container) error { + if ctr.valid { + return ErrCtrFinalized + } + ctr.config.DNSSearch = searchDomains + return nil + } +} + +// WithDNS sets additional name servers for the container +func WithDNS(dnsServers []string) CtrCreateOption { + return func(ctr *Container) error { + if ctr.valid { + return ErrCtrFinalized + } + var dns []net.IP + for _, i := range dnsServers { + result := net.ParseIP(i) + if result == nil { + return errors.Wrapf(ErrInvalidArg, "invalid IP address %s", i) + } + dns = append(dns, result) + } + ctr.config.DNSServer = dns + return nil + } +} + +// WithDNSOption sets addition dns options for the container +func WithDNSOption(dnsOptions []string) CtrCreateOption { + return func(ctr *Container) error { + if ctr.valid { + return ErrCtrFinalized + } + ctr.config.DNSOption = dnsOptions + return nil + } +} + +// WithHosts sets additional host:IP for the hosts file +func WithHosts(hosts []string) CtrCreateOption { + return func(ctr *Container) error { + if ctr.valid { + return ErrCtrFinalized + } + ctr.config.HostAdd = hosts + return nil + } +} diff --git a/libpod/runtime.go b/libpod/runtime.go index 50aa97528..804f69c9e 100644 --- a/libpod/runtime.go +++ b/libpod/runtime.go @@ -14,6 +14,25 @@ import ( "github.com/ulule/deepcopier" ) +// RuntimeStateStore is a constant indicating which state store implementation +// should be used by libpod +type RuntimeStateStore int + +const ( + // InvalidStateStore is an invalid state store + InvalidStateStore RuntimeStateStore = iota + // InMemoryStateStore is an in-memory state that will not persist data + // on containers and pods between libpod instances or after system + // reboot + InMemoryStateStore RuntimeStateStore = iota + // SQLiteStateStore is a state backed by a SQLite database + SQLiteStateStore RuntimeStateStore = iota + // SeccompDefaultPath defines the default seccomp path + SeccompDefaultPath = "/usr/share/containers/seccomp.json" + // SeccompOverridePath if this exists it overrides the default seccomp path + SeccompOverridePath = "/etc/crio/seccomp.json" +) + // A RuntimeOption is a functional option which alters the Runtime created by // NewRuntime type RuntimeOption func(*Runtime) error @@ -39,7 +58,7 @@ type RuntimeConfig struct { InsecureRegistries []string Registries []string SignaturePolicyPath string - InMemoryState bool + StateType RuntimeStateStore RuntimePath string ConmonPath string ConmonEnvVars []string @@ -57,7 +76,7 @@ var ( // Leave this empty so containers/storage will use its defaults StorageConfig: storage.StoreOptions{}, ImageDefaultTransport: DefaultTransport, - InMemoryState: false, + StateType: SQLiteStateStore, RuntimePath: "/usr/bin/runc", ConmonPath: findConmonPath(), ConmonEnvVars: []string{ @@ -176,14 +195,15 @@ func NewRuntime(options ...RuntimeOption) (runtime *Runtime, err error) { runtime.netPlugin = netPlugin // Set up the state - if runtime.config.InMemoryState { + switch runtime.config.StateType { + case InMemoryStateStore: state, err := NewInMemoryState() if err != nil { return nil, err } runtime.state = state - } else { - dbPath := filepath.Join(runtime.config.StaticDir, "state.sql") + case SQLiteStateStore: + dbPath := filepath.Join(runtime.config.StaticDir, "sql_state.db") specsDir := filepath.Join(runtime.config.StaticDir, "ocispec") // Make a directory to hold JSON versions of container OCI specs @@ -200,6 +220,8 @@ func NewRuntime(options ...RuntimeOption) (runtime *Runtime, err error) { return nil, err } runtime.state = state + default: + return nil, errors.Wrapf(ErrInvalidArg, "unrecognized state type passed") } // We now need to see if the system has restarted diff --git a/libpod/runtime_ctr.go b/libpod/runtime_ctr.go index 66dcb2f95..42f3dd892 100644 --- a/libpod/runtime_ctr.go +++ b/libpod/runtime_ctr.go @@ -3,6 +3,7 @@ package libpod import ( "os" "path/filepath" + "strings" "time" spec "github.com/opencontainers/runtime-spec/specs-go" @@ -71,25 +72,22 @@ func (r *Runtime) NewContainer(rSpec *spec.Spec, options ...CtrCreateOption) (c ctr.config.Mounts = append(ctr.config.Mounts, ctr.config.ShmDir) } - // If the container is in a pod, add it to the pod - if ctr.pod != nil { - if err := ctr.pod.addContainer(ctr); err != nil { - return nil, errors.Wrapf(err, "error adding new container to pod %s", ctr.pod.ID()) - } - } - defer func() { - if err != nil && ctr.pod != nil { - if err2 := ctr.pod.removeContainer(ctr); err2 != nil { - logrus.Errorf("Error removing partially-created container from pod %s: %s", ctr.pod.ID(), err2) - } + // Add the container to the state + // TODO: May be worth looking into recovering from name/ID collisions here + if ctr.config.Pod != "" { + // Get the pod from state + pod, err := r.state.Pod(ctr.config.Pod) + if err != nil { + return nil, errors.Wrapf(err, "cannot add container %s to pod %s", ctr.ID(), ctr.config.Pod) } - }() - if err := r.state.AddContainer(ctr); err != nil { - // TODO: Might be worth making an effort to detect duplicate IDs and names - // We can recover from that by generating a new ID for the - // container - return nil, errors.Wrapf(err, "error adding new container to state") + if err := r.state.AddContainerToPod(pod, ctr); err != nil { + return nil, err + } + } else { + if err := r.state.AddContainer(ctr); err != nil { + return nil, err + } } return ctr, nil @@ -124,6 +122,16 @@ func (r *Runtime) removeContainer(c *Container, force bool) error { return errors.Wrapf(ErrCtrStateInvalid, "container %s is paused, cannot remove until unpaused", c.ID()) } + // Check that no other containers depend on the container + deps, err := r.state.ContainerInUse(c) + if err != nil { + return err + } + if len(deps) != 0 { + depsStr := strings.Join(deps, ", ") + return errors.Wrapf(ErrCtrExists, "container %s has dependent containers which must be removed before it: %s", c.ID(), depsStr) + } + // Check that the container's in a good state to be removed if c.state.State == ContainerStateRunning && force { if err := r.ociRuntime.stopContainer(c, c.StopTimeout()); err != nil { @@ -150,25 +158,34 @@ func (r *Runtime) removeContainer(c *Container, force bool) error { return err } - if err := r.state.RemoveContainer(c); err != nil { - return errors.Wrapf(err, "error removing container from state") + // Remove the container from the state + if c.config.Pod != "" { + pod, err := r.state.Pod(c.config.Pod) + if err != nil { + return errors.Wrapf(err, "container %s is in pod %s, but pod cannot be retrieved", c.ID(), pod.ID()) + } + + if err := r.state.RemoveContainerFromPod(pod, c); err != nil { + return err + } + } else { + if err := r.state.RemoveContainer(c); err != nil { + return err + } } // Delete the container - if err := r.ociRuntime.deleteContainer(c); err != nil { - return errors.Wrapf(err, "error removing container %s from runc", c.ID()) + // Only do this if we're not ContainerStateConfigured - if we are, + // we haven't been created in the runtime yet + if c.state.State == ContainerStateConfigured { + if err := r.ociRuntime.deleteContainer(c); err != nil { + return errors.Wrapf(err, "error removing container %s from runc", c.ID()) + } } // Set container as invalid so it can no longer be used c.valid = false - // Remove container from pod, if it joined one - if c.pod != nil { - if err := c.pod.removeContainer(c); err != nil { - return errors.Wrapf(err, "error removing container from pod %s", c.pod.ID()) - } - } - return nil } diff --git a/libpod/sql_state.go b/libpod/sql_state.go index fe3232e62..42f5fe11e 100644 --- a/libpod/sql_state.go +++ b/libpod/sql_state.go @@ -15,7 +15,7 @@ import ( // DBSchema is the current DB schema version // Increments every time a change is made to the database's tables -const DBSchema = 7 +const DBSchema = 8 // SQLState is a state implementation backed by a persistent SQLite3 database type SQLState struct { @@ -284,7 +284,8 @@ func (s *SQLState) AddContainer(ctr *Container) (err error) { ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, - ?, ?, ? + ?, ?, ?, ?, ?, + ?, ?, ?, ? );` addCtrState = `INSERT INTO containerState VALUES ( ?, ?, ?, ?, ?, @@ -306,9 +307,24 @@ func (s *SQLState) AddContainer(ctr *Container) (err error) { return errors.Wrapf(err, "error marshaling container %s mounts to JSON", ctr.ID()) } - portsJSON, err := json.Marshal(ctr.config.PortMappings) + dnsServerJSON, err := json.Marshal(ctr.config.DNSServer) + if err != nil { + return errors.Wrapf(err, "error marshaling container %s DNS servers to JSON", ctr.ID()) + } + + dnsSearchJSON, err := json.Marshal(ctr.config.DNSSearch) if err != nil { - return errors.Wrapf(err, "error marshaling container %s port mappings to JSON", ctr.ID()) + return errors.Wrapf(err, "error marshaling container %s DNS search domains to JSON", ctr.ID()) + } + + dnsOptionJSON, err := json.Marshal(ctr.config.DNSOption) + if err != nil { + return errors.Wrapf(err, "error marshaling container %s DNS options to JSON", ctr.ID()) + } + + hostAddJSON, err := json.Marshal(ctr.config.HostAdd) + if err != nil { + return errors.Wrapf(err, "error marshaling container %s hosts to JSON", ctr.ID()) } labelsJSON, err := json.Marshal(ctr.config.Labels) @@ -321,6 +337,19 @@ func (s *SQLState) AddContainer(ctr *Container) (err error) { netNSPath = ctr.state.NetNS.Path() } + specJSON, err := json.Marshal(ctr.config.Spec) + if err != nil { + return errors.Wrapf(err, "error marshalling container %s spec to JSON", ctr.ID()) + } + + portsJSON := []byte{} + if len(ctr.config.PortMappings) > 0 { + portsJSON, err = json.Marshal(&ctr.config.PortMappings) + if err != nil { + return errors.Wrapf(err, "error marshalling container %s port mappings to JSON", ctr.ID()) + } + } + tx, err := s.db.Begin() if err != nil { return errors.Wrapf(err, "error beginning database transaction") @@ -348,6 +377,8 @@ func (s *SQLState) AddContainer(ctr *Container) (err error) { ctr.config.StaticDir, string(mounts), + boolToSQL(ctr.config.Privileged), + boolToSQL(ctr.config.NoNewPrivs), ctr.config.ProcessLabel, ctr.config.MountLabel, ctr.config.User, @@ -358,9 +389,13 @@ func (s *SQLState) AddContainer(ctr *Container) (err error) { stringToNullString(ctr.config.PIDNsCtr), stringToNullString(ctr.config.UserNsCtr), stringToNullString(ctr.config.UTSNsCtr), + stringToNullString(ctr.config.CgroupNsCtr), boolToSQL(ctr.config.CreateNetNS), - string(portsJSON), + string(dnsServerJSON), + string(dnsSearchJSON), + string(dnsOptionJSON), + string(hostAddJSON), boolToSQL(ctr.config.Stdin), string(labelsJSON), @@ -392,10 +427,6 @@ func (s *SQLState) AddContainer(ctr *Container) (err error) { } // Save the container's runtime spec to disk - specJSON, err := json.Marshal(ctr.config.Spec) - if err != nil { - return errors.Wrapf(err, "error marshalling container %s spec to JSON", ctr.ID()) - } specPath := getSpecPath(s.specsDir, ctr.ID()) if err := ioutil.WriteFile(specPath, specJSON, 0750); err != nil { return errors.Wrapf(err, "error saving container %s spec JSON to disk", ctr.ID()) @@ -408,6 +439,21 @@ func (s *SQLState) AddContainer(ctr *Container) (err error) { } }() + // If the container has port mappings, save them to disk + if len(ctr.config.PortMappings) > 0 { + portPath := getPortsPath(s.specsDir, ctr.ID()) + if err := ioutil.WriteFile(portPath, portsJSON, 0750); err != nil { + return errors.Wrapf(err, "error saving container %s port JSON to disk", ctr.ID()) + } + defer func() { + if err != nil { + if err2 := os.Remove(portPath); err2 != nil { + logrus.Errorf("Error removing container %s JSON ports from state: %v", ctr.ID(), err2) + } + } + }() + } + if err := tx.Commit(); err != nil { return errors.Wrapf(err, "error committing transaction to add container %s", ctr.ID()) } @@ -481,8 +527,8 @@ func (s *SQLState) UpdateContainer(ctr *Container) error { return errors.Wrapf(err, "error parsing database state for container %s", ctr.ID()) } - newState := new(containerRuntimeInfo) - newState.State = ContainerState(state) + newState := new(containerState) + newState.State = ContainerStatus(state) newState.ConfigPath = configPath newState.RunDir = runDir newState.Mountpoint = mountpoint @@ -605,6 +651,8 @@ func (s *SQLState) SaveContainer(ctr *Container) error { return errors.Wrapf(err, "error retrieving number of rows modified by update of container %s", ctr.ID()) } if rows == 0 { + // Container was probably removed elsewhere + ctr.valid = false return ErrNoSuchCtr } @@ -615,6 +663,51 @@ func (s *SQLState) SaveContainer(ctr *Container) error { return nil } +// ContainerInUse checks if other containers depend on the given container +// It returns the IDs of containers which depend on the given container +func (s *SQLState) ContainerInUse(ctr *Container) ([]string, error) { + const inUseQuery = `SELECT Id FROM containers WHERE + IPCNsCtr=? OR + MountNsCtr=? OR + NetNsCtr=? OR + PIDNsCtr=? OR + UserNsCtr=? OR + UTSNsCtr=? OR + CgroupNsCtr=?;` + + if !s.valid { + return nil, ErrDBClosed + } + + if !ctr.valid { + return nil, ErrCtrRemoved + } + + id := ctr.ID() + + rows, err := s.db.Query(inUseQuery, id, id, id, id, id, id, id) + if err != nil { + return nil, errors.Wrapf(err, "error querying database for containers that depend on container %s", id) + } + defer rows.Close() + + ids := []string{} + + for rows.Next() { + var ctrID string + if err := rows.Scan(&ctrID); err != nil { + return nil, errors.Wrapf(err, "error scanning container IDs from db rows for container %s", id) + } + + ids = append(ids, ctrID) + } + if err := rows.Err(); err != nil { + return nil, errors.Wrapf(err, "error retrieving rows for container %s", id) + } + + return ids, nil +} + // RemoveContainer removes the container from the state func (s *SQLState) RemoveContainer(ctr *Container) error { const ( @@ -668,6 +761,15 @@ func (s *SQLState) RemoveContainer(ctr *Container) error { return errors.Wrapf(err, "error removing JSON spec from state for container %s", ctr.ID()) } + // Remove containers ports JSON from disk + // May not exist, so ignore os.IsNotExist + portsPath := getPortsPath(s.specsDir, ctr.ID()) + if err := os.Remove(portsPath); err != nil { + if !os.IsNotExist(err) { + return errors.Wrapf(err, "error removing JSON ports from state for container %s", ctr.ID()) + } + } + ctr.valid = false return nil @@ -736,6 +838,11 @@ func (s *SQLState) HasPod(id string) (bool, error) { return false, ErrNotImplemented } +// PodContainers returns all the containers in a pod given the pod's full ID +func (s *SQLState) PodContainers(id string) ([]*Container, error) { + return nil, ErrNotImplemented +} + // AddPod adds a pod to the state // Only empty pods can be added to the state func (s *SQLState) AddPod(pod *Pod) error { @@ -748,6 +855,21 @@ func (s *SQLState) RemovePod(pod *Pod) error { return ErrNotImplemented } +// UpdatePod updates a pod from the database +func (s *SQLState) UpdatePod(pod *Pod) error { + return ErrNotImplemented +} + +// AddContainerToPod adds a container to the given pod +func (s *SQLState) AddContainerToPod(pod *Pod, ctr *Container) error { + return ErrNotImplemented +} + +// RemoveContainerFromPod removes a container from the given pod +func (s *SQLState) RemoveContainerFromPod(pod *Pod, ctr *Container) error { + return ErrNotImplemented +} + // AllPods retrieves all pods presently in the state func (s *SQLState) AllPods() ([]*Pod, error) { return nil, ErrNotImplemented diff --git a/libpod/sql_state_internal.go b/libpod/sql_state_internal.go index ef3b6bd4e..24d5d8bd4 100644 --- a/libpod/sql_state_internal.go +++ b/libpod/sql_state_internal.go @@ -4,6 +4,7 @@ import ( "database/sql" "encoding/json" "io/ioutil" + "os" "path/filepath" "time" @@ -178,6 +179,8 @@ func prepareDB(db *sql.DB) (err error) { StaticDir TEXT NOT NULL, Mounts TEXT NOT NULL, + Privileged INTEGER NOT NULL, + NoNewPrivs INTEGER NOT NULL, ProcessLabel TEXT NOT NULL, MountLabel TEXT NOT NULL, User TEXT NOT NULL, @@ -188,9 +191,13 @@ func prepareDB(db *sql.DB) (err error) { PIDNsCtr TEXT, UserNsCtr TEXT, UTSNsCtr TEXT, + CgroupNsCtr TEXT, CreateNetNS INTEGER NOT NULL, - PortMappings TEXT NOT NULL, + DNSServer TEXT NOT NULL, + DNSSearch TEXT NOT NULL, + DNSOption TEXT NOT NULL, + HostAdd TEXT NOT NULL, Stdin INTEGER NOT NULL, LabelsJSON TEXT NOT NULL, @@ -202,16 +209,20 @@ func prepareDB(db *sql.DB) (err error) { CHECK (ImageVolumes IN (0, 1)), CHECK (ReadOnly IN (0, 1)), CHECK (SHMSize>=0), + CHECK (Privileged IN (0, 1)), + CHECK (NoNewPrivs IN (0, 1)), CHECK (CreateNetNS IN (0, 1)), CHECK (Stdin IN (0, 1)), CHECK (StopSignal>=0), - FOREIGN KEY (Pod) REFERENCES pod(Id) DEFERRABLE INITIALLY DEFERRED, - FOREIGN KEY (IPCNsCtr) REFERENCES containers(Id) DEFERRABLE INITIALLY DEFERRED, - FOREIGN KEY (MountNsCtr) REFERENCES containers(Id) DEFERRABLE INITIALLY DEFERRED, - FOREIGN KEY (NetNsCtr) REFERENCES containers(Id) DEFERRABLE INITIALLY DEFERRED, - FOREIGN KEY (PIDNsCtr) REFERENCES containers(Id) DEFERRABLE INITIALLY DEFERRED, - FOREIGN KEY (UserNsCtr) REFERENCES containers(Id) DEFERRABLE INITIALLY DEFERRED, - FOREIGN KEY (UTSNsCtr) REFERENCES containers(Id) DEFERRABLE INITIALLY DEFERRED + FOREIGN KEY (Id) REFERENCES containerState(Id) DEFERRABLE INITIALLY DEFERRED + FOREIGN KEY (Pod) REFERENCES pod(Id) DEFERRABLE INITIALLY DEFERRED, + FOREIGN KEY (IPCNsCtr) REFERENCES containers(Id) DEFERRABLE INITIALLY DEFERRED, + FOREIGN KEY (MountNsCtr) REFERENCES containers(Id) DEFERRABLE INITIALLY DEFERRED, + FOREIGN KEY (NetNsCtr) REFERENCES containers(Id) DEFERRABLE INITIALLY DEFERRED, + FOREIGN KEY (PIDNsCtr) REFERENCES containers(Id) DEFERRABLE INITIALLY DEFERRED, + FOREIGN KEY (UserNsCtr) REFERENCES containers(Id) DEFERRABLE INITIALLY DEFERRED, + FOREIGN KEY (UTSNsCtr) REFERENCES containers(Id) DEFERRABLE INITIALLY DEFERRED, + FOREIGN KEY (CgroupNsCtr) REFERENCES containers(Id) DEFERRABLE INITIALLY DEFERRED ); ` @@ -283,6 +294,11 @@ func getSpecPath(specsDir, id string) string { return filepath.Join(specsDir, id) } +// Get filename for container port mappings on disk +func getPortsPath(specsDir, id string) string { + return filepath.Join(specsDir, id+"_ports") +} + // Convert a bool into SQL-readable format func boolToSQL(b bool) int { if b { @@ -347,19 +363,25 @@ func (s *SQLState) ctrFromScannable(row scannable) (*Container, error) { staticDir string mounts string + privileged int + noNewPrivs int processLabel string mountLabel string user string - ipcNsCtrNullStr sql.NullString - mountNsCtrNullStr sql.NullString - netNsCtrNullStr sql.NullString - pidNsCtrNullStr sql.NullString - userNsCtrNullStr sql.NullString - utsNsCtrNullStr sql.NullString + ipcNsCtrNullStr sql.NullString + mountNsCtrNullStr sql.NullString + netNsCtrNullStr sql.NullString + pidNsCtrNullStr sql.NullString + userNsCtrNullStr sql.NullString + utsNsCtrNullStr sql.NullString + cgroupNsCtrNullStr sql.NullString - createNetNS int - portMappingsJSON string + createNetNS int + dnsServerJSON string + dnsSearchJSON string + dnsOptionJSON string + hostAddJSON string stdin int labelsJSON string @@ -396,6 +418,8 @@ func (s *SQLState) ctrFromScannable(row scannable) (*Container, error) { &staticDir, &mounts, + &privileged, + &noNewPrivs, &processLabel, &mountLabel, &user, @@ -406,9 +430,13 @@ func (s *SQLState) ctrFromScannable(row scannable) (*Container, error) { &pidNsCtrNullStr, &userNsCtrNullStr, &utsNsCtrNullStr, + &cgroupNsCtrNullStr, &createNetNS, - &portMappingsJSON, + &dnsServerJSON, + &dnsSearchJSON, + &dnsOptionJSON, + &hostAddJSON, &stdin, &labelsJSON, @@ -439,7 +467,7 @@ func (s *SQLState) ctrFromScannable(row scannable) (*Container, error) { ctr := new(Container) ctr.config = new(ContainerConfig) - ctr.state = new(containerRuntimeInfo) + ctr.state = new(containerState) ctr.config.ID = id ctr.config.Name = name @@ -453,6 +481,8 @@ func (s *SQLState) ctrFromScannable(row scannable) (*Container, error) { ctr.config.ShmSize = shmSize ctr.config.StaticDir = staticDir + ctr.config.Privileged = boolFromSQL(privileged) + ctr.config.NoNewPrivs = boolFromSQL(noNewPrivs) ctr.config.ProcessLabel = processLabel ctr.config.MountLabel = mountLabel ctr.config.User = user @@ -463,6 +493,7 @@ func (s *SQLState) ctrFromScannable(row scannable) (*Container, error) { ctr.config.PIDNsCtr = stringFromNullString(pidNsCtrNullStr) ctr.config.UserNsCtr = stringFromNullString(userNsCtrNullStr) ctr.config.UTSNsCtr = stringFromNullString(utsNsCtrNullStr) + ctr.config.CgroupNsCtr = stringFromNullString(cgroupNsCtrNullStr) ctr.config.CreateNetNS = boolFromSQL(createNetNS) @@ -471,7 +502,7 @@ func (s *SQLState) ctrFromScannable(row scannable) (*Container, error) { ctr.config.StopTimeout = stopTimeout ctr.config.CgroupParent = cgroupParent - ctr.state.State = ContainerState(state) + ctr.state.State = ContainerStatus(state) ctr.state.ConfigPath = configPath ctr.state.RunDir = runDir ctr.state.Mountpoint = mountpoint @@ -490,8 +521,20 @@ func (s *SQLState) ctrFromScannable(row scannable) (*Container, error) { return nil, errors.Wrapf(err, "error parsing container %s mounts JSON", id) } - if err := json.Unmarshal([]byte(portMappingsJSON), &ctr.config.PortMappings); err != nil { - return nil, errors.Wrapf(err, "error parsing container %s port mappings JSON", id) + if err := json.Unmarshal([]byte(dnsServerJSON), &ctr.config.DNSServer); err != nil { + return nil, errors.Wrapf(err, "error parsing container %s DNS server JSON", id) + } + + if err := json.Unmarshal([]byte(dnsSearchJSON), &ctr.config.DNSSearch); err != nil { + return nil, errors.Wrapf(err, "error parsing container %s DNS search JSON", id) + } + + if err := json.Unmarshal([]byte(dnsOptionJSON), &ctr.config.DNSOption); err != nil { + return nil, errors.Wrapf(err, "error parsing container %s DNS option JSON", id) + } + + if err := json.Unmarshal([]byte(hostAddJSON), &ctr.config.HostAdd); err != nil { + return nil, errors.Wrapf(err, "error parsing container %s DNS server JSON", id) } labels := make(map[string]string) @@ -550,5 +593,25 @@ func (s *SQLState) ctrFromScannable(row scannable) (*Container, error) { } ctr.config.Spec = ociSpec + // Retrieve the ports from disk + // They may not exist - if they don't, this container just doesn't have ports + portPath := getPortsPath(s.specsDir, id) + _, err = os.Stat(portPath) + if err != nil { + if !os.IsNotExist(err) { + return nil, errors.Wrapf(err, "error stating container %s JSON ports", id) + } + } + if err == nil { + // The file exists, read it + fileContents, err := ioutil.ReadFile(portPath) + if err != nil { + return nil, errors.Wrapf(err, "error reading container %s JSON ports", id) + } + if err := json.Unmarshal(fileContents, &ctr.config.PortMappings); err != nil { + return nil, errors.Wrapf(err, "error parsing container %s JSON ports", id) + } + } + return ctr, nil } diff --git a/libpod/sql_state_test.go b/libpod/sql_state_test.go deleted file mode 100644 index 020e2ce40..000000000 --- a/libpod/sql_state_test.go +++ /dev/null @@ -1,569 +0,0 @@ -package libpod - -import ( - "encoding/json" - "io/ioutil" - "os" - "path/filepath" - "reflect" - "testing" - "time" - - "github.com/containers/storage" - "github.com/opencontainers/runtime-tools/generate" - "github.com/stretchr/testify/assert" -) - -func getTestContainer(id, name, locksDir string) (*Container, error) { - ctr := &Container{ - config: &ContainerConfig{ - ID: id, - Name: name, - RootfsImageID: id, - RootfsImageName: "testimg", - ImageVolumes: true, - ReadOnly: true, - StaticDir: "/does/not/exist/", - Stdin: true, - Labels: make(map[string]string), - StopSignal: 0, - StopTimeout: 0, - CreatedTime: time.Now(), - }, - state: &containerRuntimeInfo{ - State: ContainerStateRunning, - ConfigPath: "/does/not/exist/specs/" + id, - RunDir: "/does/not/exist/tmp/", - Mounted: true, - Mountpoint: "/does/not/exist/tmp/" + id, - PID: 1234, - }, - valid: true, - } - - g := generate.New() - ctr.config.Spec = g.Spec() - - ctr.config.Labels["test"] = "testing" - - // Must make lockfile or container will error on being retrieved from DB - lockPath := filepath.Join(locksDir, id) - lock, err := storage.GetLockfile(lockPath) - if err != nil { - return nil, err - } - ctr.lock = lock - - return ctr, nil -} - -// This horrible hack tests if containers are equal in a way that should handle -// empty arrays being dropped to nil pointers in the spec JSON -func testContainersEqual(a, b *Container) bool { - if a == nil && b == nil { - return true - } else if a == nil || b == nil { - return false - } - - if a.valid != b.valid { - return false - } - - aConfigJSON, err := json.Marshal(a.config) - if err != nil { - return false - } - - bConfigJSON, err := json.Marshal(b.config) - if err != nil { - return false - } - - if !reflect.DeepEqual(aConfigJSON, bConfigJSON) { - return false - } - - aStateJSON, err := json.Marshal(a.state) - if err != nil { - return false - } - - bStateJSON, err := json.Marshal(b.state) - if err != nil { - return false - } - - return reflect.DeepEqual(aStateJSON, bStateJSON) -} - -// Get an empty state for use in tests -// An empty Runtime is provided -func getEmptyState() (s State, p string, p2 string, err error) { - tmpDir, err := ioutil.TempDir("", "libpod_state_test_") - if err != nil { - return nil, "", "", err - } - defer func() { - if err != nil { - os.RemoveAll(tmpDir) - } - }() - - dbPath := filepath.Join(tmpDir, "db.sql") - specsDir := filepath.Join(tmpDir, "specs") - lockDir := filepath.Join(tmpDir, "locks") - - runtime := new(Runtime) - runtime.config = new(RuntimeConfig) - runtime.config.StorageConfig = storage.StoreOptions{} - - state, err := NewSQLState(dbPath, specsDir, lockDir, runtime) - if err != nil { - return nil, "", "", err - } - - return state, tmpDir, lockDir, nil -} - -func TestAddAndGetContainer(t *testing.T) { - state, path, lockPath, err := getEmptyState() - assert.NoError(t, err) - defer os.RemoveAll(path) - defer state.Close() - - testCtr, err := getTestContainer("0123456789ABCDEF0123456789ABCDEF", "test", lockPath) - assert.NoError(t, err) - - err = state.AddContainer(testCtr) - assert.NoError(t, err) - - retrievedCtr, err := state.Container(testCtr.ID()) - assert.NoError(t, err) - - // Use assert.EqualValues if the test fails to pretty print diff - // between actual and expected - if !testContainersEqual(testCtr, retrievedCtr) { - assert.EqualValues(t, testCtr, retrievedCtr) - } -} - -func TestAddAndGetContainerFromMultiple(t *testing.T) { - state, path, lockPath, err := getEmptyState() - assert.NoError(t, err) - defer os.RemoveAll(path) - defer state.Close() - - testCtr1, err := getTestContainer("11111111111111111111111111111111", "test1", lockPath) - assert.NoError(t, err) - testCtr2, err := getTestContainer("22222222222222222222222222222222", "test2", lockPath) - assert.NoError(t, err) - - err = state.AddContainer(testCtr1) - assert.NoError(t, err) - - err = state.AddContainer(testCtr2) - assert.NoError(t, err) - - retrievedCtr, err := state.Container(testCtr1.ID()) - assert.NoError(t, err) - - // Use assert.EqualValues if the test fails to pretty print diff - // between actual and expected - if !testContainersEqual(testCtr1, retrievedCtr) { - assert.EqualValues(t, testCtr1, retrievedCtr) - } -} - -func TestAddInvalidContainerFails(t *testing.T) { - state, path, _, err := getEmptyState() - assert.NoError(t, err) - defer os.RemoveAll(path) - defer state.Close() - - err = state.AddContainer(&Container{}) - assert.Error(t, err) -} - -func TestAddDuplicateIDFails(t *testing.T) { - state, path, lockPath, err := getEmptyState() - assert.NoError(t, err) - defer os.RemoveAll(path) - defer state.Close() - - testCtr1, err := getTestContainer("11111111111111111111111111111111", "test1", lockPath) - assert.NoError(t, err) - testCtr2, err := getTestContainer(testCtr1.ID(), "test2", lockPath) - assert.NoError(t, err) - - err = state.AddContainer(testCtr1) - assert.NoError(t, err) - - err = state.AddContainer(testCtr2) - assert.Error(t, err) -} - -func TestAddDuplicateNameFails(t *testing.T) { - state, path, lockPath, err := getEmptyState() - assert.NoError(t, err) - defer os.RemoveAll(path) - defer state.Close() - - testCtr1, err := getTestContainer("11111111111111111111111111111111", "test1", lockPath) - assert.NoError(t, err) - testCtr2, err := getTestContainer("22222222222222222222222222222222", testCtr1.Name(), lockPath) - assert.NoError(t, err) - - err = state.AddContainer(testCtr1) - assert.NoError(t, err) - - err = state.AddContainer(testCtr2) - assert.Error(t, err) -} - -func TestGetNonexistantContainerFails(t *testing.T) { - state, path, _, err := getEmptyState() - assert.NoError(t, err) - defer os.RemoveAll(path) - defer state.Close() - - _, err = state.Container("does not exist") - assert.Error(t, err) -} - -func TestGetContainerWithEmptyIDFails(t *testing.T) { - state, path, _, err := getEmptyState() - assert.NoError(t, err) - defer os.RemoveAll(path) - defer state.Close() - - _, err = state.Container("") - assert.Error(t, err) -} - -func TestLookupContainerWithEmptyIDFails(t *testing.T) { - state, path, _, err := getEmptyState() - assert.NoError(t, err) - defer os.RemoveAll(path) - defer state.Close() - - _, err = state.LookupContainer("") - assert.Error(t, err) -} - -func TestLookupNonexistantContainerFails(t *testing.T) { - state, path, _, err := getEmptyState() - assert.NoError(t, err) - defer os.RemoveAll(path) - - _, err = state.LookupContainer("does not exist") - assert.Error(t, err) -} - -func TestLookupContainerByFullID(t *testing.T) { - state, path, lockPath, err := getEmptyState() - assert.NoError(t, err) - defer os.RemoveAll(path) - defer state.Close() - - testCtr, err := getTestContainer("0123456789ABCDEF0123456789ABCDEF", "test", lockPath) - assert.NoError(t, err) - - err = state.AddContainer(testCtr) - assert.NoError(t, err) - - retrievedCtr, err := state.LookupContainer(testCtr.ID()) - assert.NoError(t, err) - - // Use assert.EqualValues if the test fails to pretty print diff - // between actual and expected - if !testContainersEqual(testCtr, retrievedCtr) { - assert.EqualValues(t, testCtr, retrievedCtr) - } -} - -func TestLookupContainerByUniquePartialID(t *testing.T) { - state, path, lockPath, err := getEmptyState() - assert.NoError(t, err) - defer os.RemoveAll(path) - defer state.Close() - - testCtr, err := getTestContainer("0123456789ABCDEF0123456789ABCDEF", "test", lockPath) - assert.NoError(t, err) - - err = state.AddContainer(testCtr) - assert.NoError(t, err) - - retrievedCtr, err := state.LookupContainer(testCtr.ID()[0:8]) - assert.NoError(t, err) - - // Use assert.EqualValues if the test fails to pretty print diff - // between actual and expected - if !testContainersEqual(testCtr, retrievedCtr) { - assert.EqualValues(t, testCtr, retrievedCtr) - } -} - -func TestLookupContainerByNonUniquePartialIDFails(t *testing.T) { - state, path, lockPath, err := getEmptyState() - assert.NoError(t, err) - defer os.RemoveAll(path) - defer state.Close() - - testCtr1, err := getTestContainer("00000000000000000000000000000000", "test1", lockPath) - assert.NoError(t, err) - testCtr2, err := getTestContainer("00000000000000000000000000000001", "test2", lockPath) - assert.NoError(t, err) - - err = state.AddContainer(testCtr1) - assert.NoError(t, err) - - err = state.AddContainer(testCtr2) - assert.NoError(t, err) - - _, err = state.LookupContainer(testCtr1.ID()[0:8]) - assert.Error(t, err) -} - -func TestLookupContainerByName(t *testing.T) { - state, path, lockPath, err := getEmptyState() - assert.NoError(t, err) - defer os.RemoveAll(path) - defer state.Close() - - testCtr, err := getTestContainer("0123456789ABCDEF0123456789ABCDEF", "test", lockPath) - assert.NoError(t, err) - - err = state.AddContainer(testCtr) - assert.NoError(t, err) - - retrievedCtr, err := state.LookupContainer(testCtr.Name()) - assert.NoError(t, err) - - // Use assert.EqualValues if the test fails to pretty print diff - // between actual and expected - if !testContainersEqual(testCtr, retrievedCtr) { - assert.EqualValues(t, testCtr, retrievedCtr) - } -} - -func TestHasContainerEmptyIDFails(t *testing.T) { - state, path, _, err := getEmptyState() - assert.NoError(t, err) - defer os.RemoveAll(path) - defer state.Close() - - _, err = state.HasContainer("") - assert.Error(t, err) -} - -func TestHasContainerNoSuchContainerReturnsFalse(t *testing.T) { - state, path, _, err := getEmptyState() - assert.NoError(t, err) - defer os.RemoveAll(path) - defer state.Close() - - exists, err := state.HasContainer("does not exist") - assert.NoError(t, err) - assert.False(t, exists) -} - -func TestHasContainerFindsContainer(t *testing.T) { - state, path, lockPath, err := getEmptyState() - assert.NoError(t, err) - defer os.RemoveAll(path) - defer state.Close() - - testCtr, err := getTestContainer("0123456789ABCDEF0123456789ABCDEF", "test", lockPath) - assert.NoError(t, err) - - err = state.AddContainer(testCtr) - assert.NoError(t, err) - - exists, err := state.HasContainer(testCtr.ID()) - assert.NoError(t, err) - assert.True(t, exists) -} - -func TestSaveAndUpdateContainer(t *testing.T) { - state, path, lockPath, err := getEmptyState() - assert.NoError(t, err) - defer os.RemoveAll(path) - defer state.Close() - - testCtr, err := getTestContainer("0123456789ABCDEF0123456789ABCDEF", "test", lockPath) - assert.NoError(t, err) - - err = state.AddContainer(testCtr) - assert.NoError(t, err) - - retrievedCtr, err := state.Container(testCtr.ID()) - assert.NoError(t, err) - - retrievedCtr.state.State = ContainerStateStopped - retrievedCtr.state.ExitCode = 127 - retrievedCtr.state.FinishedTime = time.Now() - - err = state.SaveContainer(retrievedCtr) - assert.NoError(t, err) - - err = state.UpdateContainer(testCtr) - assert.NoError(t, err) - - // Use assert.EqualValues if the test fails to pretty print diff - // between actual and expected - if !testContainersEqual(testCtr, retrievedCtr) { - assert.EqualValues(t, testCtr, retrievedCtr) - } -} - -func TestUpdateContainerNotInDatabaseReturnsError(t *testing.T) { - state, path, lockPath, err := getEmptyState() - assert.NoError(t, err) - defer os.RemoveAll(path) - defer state.Close() - - testCtr, err := getTestContainer("0123456789ABCDEF0123456789ABCDEF", "test", lockPath) - assert.NoError(t, err) - - err = state.UpdateContainer(testCtr) - assert.Error(t, err) - assert.False(t, testCtr.valid) -} - -func TestUpdateInvalidContainerReturnsError(t *testing.T) { - state, path, _, err := getEmptyState() - assert.NoError(t, err) - defer os.RemoveAll(path) - defer state.Close() - - err = state.UpdateContainer(&Container{}) - assert.Error(t, err) -} - -func TestSaveInvalidContainerReturnsError(t *testing.T) { - state, path, _, err := getEmptyState() - assert.NoError(t, err) - defer os.RemoveAll(path) - defer state.Close() - - err = state.SaveContainer(&Container{}) - assert.Error(t, err) -} - -func TestSaveContainerNotInStateReturnsError(t *testing.T) { - state, path, lockPath, err := getEmptyState() - assert.NoError(t, err) - defer os.RemoveAll(path) - defer state.Close() - - testCtr, err := getTestContainer("0123456789ABCDEF0123456789ABCDEF", "test", lockPath) - assert.NoError(t, err) - - err = state.SaveContainer(testCtr) - assert.Error(t, err) -} - -func TestRemoveContainer(t *testing.T) { - state, path, lockPath, err := getEmptyState() - assert.NoError(t, err) - defer os.RemoveAll(path) - defer state.Close() - - testCtr, err := getTestContainer("0123456789ABCDEF0123456789ABCDEF", "test", lockPath) - assert.NoError(t, err) - - err = state.AddContainer(testCtr) - assert.NoError(t, err) - - ctrs, err := state.AllContainers() - assert.NoError(t, err) - assert.Equal(t, 1, len(ctrs)) - - err = state.RemoveContainer(testCtr) - assert.NoError(t, err) - - ctrs2, err := state.AllContainers() - assert.NoError(t, err) - assert.Equal(t, 0, len(ctrs2)) -} - -func TestRemoveNonexistantContainerFails(t *testing.T) { - state, path, lockPath, err := getEmptyState() - assert.NoError(t, err) - defer os.RemoveAll(path) - defer state.Close() - - testCtr, err := getTestContainer("0123456789ABCDEF0123456789ABCDEF", "test", lockPath) - assert.NoError(t, err) - - err = state.RemoveContainer(testCtr) - assert.Error(t, err) -} - -func TestGetAllContainersOnNewStateIsEmpty(t *testing.T) { - state, path, _, err := getEmptyState() - assert.NoError(t, err) - defer os.RemoveAll(path) - defer state.Close() - - ctrs, err := state.AllContainers() - assert.NoError(t, err) - assert.Equal(t, 0, len(ctrs)) -} - -func TestGetAllContainersWithOneContainer(t *testing.T) { - state, path, lockPath, err := getEmptyState() - assert.NoError(t, err) - defer os.RemoveAll(path) - defer state.Close() - - testCtr, err := getTestContainer("0123456789ABCDEF0123456789ABCDEF", "test", lockPath) - assert.NoError(t, err) - - err = state.AddContainer(testCtr) - assert.NoError(t, err) - - ctrs, err := state.AllContainers() - assert.NoError(t, err) - assert.Equal(t, 1, len(ctrs)) - - // Use assert.EqualValues if the test fails to pretty print diff - // between actual and expected - if !testContainersEqual(testCtr, ctrs[0]) { - assert.EqualValues(t, testCtr, ctrs[0]) - } -} - -func TestGetAllContainersTwoContainers(t *testing.T) { - state, path, lockPath, err := getEmptyState() - assert.NoError(t, err) - defer os.RemoveAll(path) - defer state.Close() - - testCtr1, err := getTestContainer("11111111111111111111111111111111", "test1", lockPath) - assert.NoError(t, err) - testCtr2, err := getTestContainer("22222222222222222222222222222222", "test2", lockPath) - assert.NoError(t, err) - - err = state.AddContainer(testCtr1) - assert.NoError(t, err) - - err = state.AddContainer(testCtr2) - assert.NoError(t, err) - - ctrs, err := state.AllContainers() - assert.NoError(t, err) - assert.Equal(t, 2, len(ctrs)) - - // Containers should be ordered by creation time - - // Use assert.EqualValues if the test fails to pretty print diff - // between actual and expected - if !testContainersEqual(testCtr2, ctrs[0]) { - assert.EqualValues(t, testCtr2, ctrs[0]) - } - if !testContainersEqual(testCtr1, ctrs[1]) { - assert.EqualValues(t, testCtr1, ctrs[1]) - } -} diff --git a/libpod/state.go b/libpod/state.go index 4a79b8d2d..01ae58bd1 100644 --- a/libpod/state.go +++ b/libpod/state.go @@ -16,9 +16,7 @@ type State interface { // Checks if a container with the given ID is present in the state HasContainer(id string) (bool, error) // Adds container to state - // If the container belongs to a pod, that pod must already be present - // in the state when the container is added, and the container must be - // present in the pod + // The container cannot be part of a pod AddContainer(ctr *Container) error // Removes container from state // The container will only be removed from the state, not from the pod @@ -28,6 +26,13 @@ type State interface { UpdateContainer(ctr *Container) error // SaveContainer saves a container's current state to the backing store SaveContainer(ctr *Container) error + // ContainerInUse checks if other containers depend upon a given + // container + // It returns a slice of the IDs of containers which depend on the given + // container. If the slice is empty, no container depend on the given + // container. + // A container cannot be removed if other containers depend on it + ContainerInUse(ctr *Container) ([]string, error) // Retrieves all containers presently in state AllContainers() ([]*Container, error) @@ -37,6 +42,8 @@ type State interface { LookupPod(idOrName string) (*Pod, error) // Checks if a pod with the given ID is present in the state HasPod(id string) (bool, error) + // Get all the containers in a pod. Accepts full ID of pod. + PodContainers(id string) ([]*Container, error) // Adds pod to state // Only empty pods can be added to the state AddPod(pod *Pod) error @@ -44,6 +51,14 @@ type State interface { // Containers within a pod will not be removed from the state, and will // not be changed to remove them from the now-removed pod RemovePod(pod *Pod) error + // UpdatePod updates a pod's state from the backing store + UpdatePod(pod *Pod) error + // AddContainerToPod adds a container to an existing pod + // The container given will be added to the state and the pod + AddContainerToPod(pod *Pod, ctr *Container) error + // RemoveContainerFromPod removes a container from an existing pod + // The container will also be removed from the state + RemoveContainerFromPod(pod *Pod, ctr *Container) error // Retrieves all pods presently in state AllPods() ([]*Pod, error) } diff --git a/libpod/state_test.go b/libpod/state_test.go new file mode 100644 index 000000000..0a18c988d --- /dev/null +++ b/libpod/state_test.go @@ -0,0 +1,622 @@ +package libpod + +import ( + "io/ioutil" + "os" + "path/filepath" + "testing" + "time" + + "github.com/containers/storage" + "github.com/stretchr/testify/assert" +) + +// Returns state, tmp directory containing all state files, locks directory +// (subdirectory of tmp dir), and error +// Closing the state and removing the given tmp directory should be sufficient +// to clean up +type emptyStateFunc func() (State, string, string, error) + +const ( + tmpDirPrefix = "libpod_state_test_" +) + +var ( + testedStates = map[string]emptyStateFunc{ + "sql": getEmptySQLState, + "in-memory": getEmptyInMemoryState, + } +) + +// Get an empty in-memory state for use in tests +func getEmptyInMemoryState() (s State, p string, p2 string, err error) { + tmpDir, err := ioutil.TempDir("", tmpDirPrefix) + if err != nil { + return nil, "", "", err + } + defer func() { + if err != nil { + os.RemoveAll(tmpDir) + } + }() + + state, err := NewInMemoryState() + if err != nil { + return nil, "", "", err + } + + // Don't need a separate locks dir as InMemoryState stores nothing on + // disk + return state, tmpDir, tmpDir, nil +} + +// Get an empty SQL state for use in tests +// An empty Runtime is provided +func getEmptySQLState() (s State, p string, p2 string, err error) { + tmpDir, err := ioutil.TempDir("", tmpDirPrefix) + if err != nil { + return nil, "", "", err + } + defer func() { + if err != nil { + os.RemoveAll(tmpDir) + } + }() + + dbPath := filepath.Join(tmpDir, "db.sql") + specsDir := filepath.Join(tmpDir, "specs") + lockDir := filepath.Join(tmpDir, "locks") + + runtime := new(Runtime) + runtime.config = new(RuntimeConfig) + runtime.config.StorageConfig = storage.StoreOptions{} + + state, err := NewSQLState(dbPath, specsDir, lockDir, runtime) + if err != nil { + return nil, "", "", err + } + + return state, tmpDir, lockDir, nil +} + +func runForAllStates(t *testing.T, testName string, testFunc func(*testing.T, State, string)) { + for stateName, stateFunc := range testedStates { + state, path, lockPath, err := stateFunc() + if err != nil { + t.Fatalf("Error initializing state %s", stateName) + } + defer os.RemoveAll(path) + defer state.Close() + + testName = testName + "-" + stateName + + success := t.Run(testName, func(t *testing.T) { + testFunc(t, state, lockPath) + }) + if !success { + t.Fail() + t.Logf("%s failed for state %s", testName, stateName) + } + } +} + +func TestAddAndGetContainer(t *testing.T) { + runForAllStates(t, "TestAddAndGetContainer", addAndGetContainer) +} + +func addAndGetContainer(t *testing.T, state State, lockPath string) { + testCtr, err := getTestContainer("0123456789ABCDEF0123456789ABCDEF", "test", lockPath) + assert.NoError(t, err) + + err = state.AddContainer(testCtr) + assert.NoError(t, err) + + retrievedCtr, err := state.Container(testCtr.ID()) + assert.NoError(t, err) + + // Use assert.EqualValues if the test fails to pretty print diff + // between actual and expected + if !testContainersEqual(testCtr, retrievedCtr) { + assert.EqualValues(t, testCtr, retrievedCtr) + } +} + +func TestAddAndGetContainerFromMultiple(t *testing.T) { + runForAllStates(t, "TestAddAndGetContainerFromMultiple", addAndGetContainerFromMultiple) +} + +func addAndGetContainerFromMultiple(t *testing.T, state State, lockPath string) { + testCtr1, err := getTestContainer("11111111111111111111111111111111", "test1", lockPath) + assert.NoError(t, err) + testCtr2, err := getTestContainer("22222222222222222222222222222222", "test2", lockPath) + assert.NoError(t, err) + + err = state.AddContainer(testCtr1) + assert.NoError(t, err) + + err = state.AddContainer(testCtr2) + assert.NoError(t, err) + + retrievedCtr, err := state.Container(testCtr1.ID()) + assert.NoError(t, err) + + // Use assert.EqualValues if the test fails to pretty print diff + // between actual and expected + if !testContainersEqual(testCtr1, retrievedCtr) { + assert.EqualValues(t, testCtr1, retrievedCtr) + } +} + +func TestAddInvalidContainerFails(t *testing.T) { + runForAllStates(t, "TestAddInvalidContainerFails", addInvalidContainerFails) +} + +func addInvalidContainerFails(t *testing.T, state State, lockPath string) { + err := state.AddContainer(&Container{config: &ContainerConfig{ID: "1234"}}) + assert.Error(t, err) +} + +func TestAddDuplicateCtrIDFails(t *testing.T) { + runForAllStates(t, "TestAddDuplicateCtrIDFails", addDuplicateCtrIDFails) +} + +func addDuplicateCtrIDFails(t *testing.T, state State, lockPath string) { + testCtr1, err := getTestContainer("11111111111111111111111111111111", "test1", lockPath) + assert.NoError(t, err) + testCtr2, err := getTestContainer(testCtr1.ID(), "test2", lockPath) + assert.NoError(t, err) + + err = state.AddContainer(testCtr1) + assert.NoError(t, err) + + err = state.AddContainer(testCtr2) + assert.Error(t, err) +} + +func TestAddDuplicateCtrNameFails(t *testing.T) { + runForAllStates(t, "TestAddDuplicateCtrNameFails", addDuplicateCtrNameFails) +} + +func addDuplicateCtrNameFails(t *testing.T, state State, lockPath string) { + testCtr1, err := getTestContainer("11111111111111111111111111111111", "test1", lockPath) + assert.NoError(t, err) + testCtr2, err := getTestContainer("22222222222222222222222222222222", testCtr1.Name(), lockPath) + assert.NoError(t, err) + + err = state.AddContainer(testCtr1) + assert.NoError(t, err) + + err = state.AddContainer(testCtr2) + assert.Error(t, err) +} + +func TestGetNonexistentContainerFails(t *testing.T) { + runForAllStates(t, "TestGetNonexistentContainerFails", getNonexistentContainerFails) +} + +func getNonexistentContainerFails(t *testing.T, state State, lockPath string) { + _, err := state.Container("does not exist") + assert.Error(t, err) +} + +func TestGetContainerWithEmptyIDFails(t *testing.T) { + runForAllStates(t, "TestGetContainerWithEmptyIDFails", getContainerWithEmptyIDFails) +} + +func getContainerWithEmptyIDFails(t *testing.T, state State, lockPath string) { + _, err := state.Container("") + assert.Error(t, err) +} + +func TestLookupContainerWithEmptyIDFails(t *testing.T) { + runForAllStates(t, "TestLookupContainerWithEmptyIDFails", lookupContainerWithEmptyIDFails) +} + +func lookupContainerWithEmptyIDFails(t *testing.T, state State, lockPath string) { + _, err := state.LookupContainer("") + assert.Error(t, err) +} + +func TestLookupNonexistentContainerFails(t *testing.T) { + runForAllStates(t, "TestLookupNonexistantContainerFails", lookupNonexistentContainerFails) +} + +func lookupNonexistentContainerFails(t *testing.T, state State, lockPath string) { + _, err := state.LookupContainer("does not exist") + assert.Error(t, err) +} + +func TestLookupContainerByFullID(t *testing.T) { + runForAllStates(t, "TestLookupContainerByFullID", lookupContainerByFullID) +} + +func lookupContainerByFullID(t *testing.T, state State, lockPath string) { + testCtr, err := getTestContainer("0123456789ABCDEF0123456789ABCDEF", "test", lockPath) + assert.NoError(t, err) + + err = state.AddContainer(testCtr) + assert.NoError(t, err) + + retrievedCtr, err := state.LookupContainer(testCtr.ID()) + assert.NoError(t, err) + + // Use assert.EqualValues if the test fails to pretty print diff + // between actual and expected + if !testContainersEqual(testCtr, retrievedCtr) { + assert.EqualValues(t, testCtr, retrievedCtr) + } +} + +func TestLookupContainerByUniquePartialID(t *testing.T) { + runForAllStates(t, "TestLookupContainerByUniquePartialID", lookupContainerByUniquePartialID) +} + +func lookupContainerByUniquePartialID(t *testing.T, state State, lockPath string) { + testCtr, err := getTestContainer("0123456789ABCDEF0123456789ABCDEF", "test", lockPath) + assert.NoError(t, err) + + err = state.AddContainer(testCtr) + assert.NoError(t, err) + + retrievedCtr, err := state.LookupContainer(testCtr.ID()[0:8]) + assert.NoError(t, err) + + // Use assert.EqualValues if the test fails to pretty print diff + // between actual and expected + if !testContainersEqual(testCtr, retrievedCtr) { + assert.EqualValues(t, testCtr, retrievedCtr) + } +} + +func TestLookupContainerByNonUniquePartialIDFails(t *testing.T) { + runForAllStates(t, "TestLookupContainerByNonUniquePartialIDFails", lookupContainerByNonUniquePartialIDFails) +} + +func lookupContainerByNonUniquePartialIDFails(t *testing.T, state State, lockPath string) { + testCtr1, err := getTestContainer("00000000000000000000000000000000", "test1", lockPath) + assert.NoError(t, err) + testCtr2, err := getTestContainer("00000000000000000000000000000001", "test2", lockPath) + assert.NoError(t, err) + + err = state.AddContainer(testCtr1) + assert.NoError(t, err) + + err = state.AddContainer(testCtr2) + assert.NoError(t, err) + + _, err = state.LookupContainer(testCtr1.ID()[0:8]) + assert.Error(t, err) +} + +func TestLookupContainerByName(t *testing.T) { + runForAllStates(t, "TestLookupContainerByName", lookupContainerByName) +} + +func lookupContainerByName(t *testing.T, state State, lockPath string) { + state, path, lockPath, err := getEmptySQLState() + assert.NoError(t, err) + defer os.RemoveAll(path) + defer state.Close() + + testCtr, err := getTestContainer("0123456789ABCDEF0123456789ABCDEF", "test", lockPath) + assert.NoError(t, err) + + err = state.AddContainer(testCtr) + assert.NoError(t, err) + + retrievedCtr, err := state.LookupContainer(testCtr.Name()) + assert.NoError(t, err) + + // Use assert.EqualValues if the test fails to pretty print diff + // between actual and expected + if !testContainersEqual(testCtr, retrievedCtr) { + assert.EqualValues(t, testCtr, retrievedCtr) + } +} + +func TestHasContainerEmptyIDFails(t *testing.T) { + runForAllStates(t, "TestHasContainerEmptyIDFails", hasContainerEmptyIDFails) +} + +func hasContainerEmptyIDFails(t *testing.T, state State, lockPath string) { + _, err := state.HasContainer("") + assert.Error(t, err) +} + +func TestHasContainerNoSuchContainerReturnsFalse(t *testing.T) { + runForAllStates(t, "TestHasContainerNoSuchContainerReturnsFalse", hasContainerNoSuchContainerReturnsFalse) +} + +func hasContainerNoSuchContainerReturnsFalse(t *testing.T, state State, lockPath string) { + exists, err := state.HasContainer("does not exist") + assert.NoError(t, err) + assert.False(t, exists) +} + +func TestHasContainerFindsContainer(t *testing.T) { + runForAllStates(t, "TestHasContainerFindsContainer", hasContainerFindsContainer) +} + +func hasContainerFindsContainer(t *testing.T, state State, lockPath string) { + testCtr, err := getTestContainer("0123456789ABCDEF0123456789ABCDEF", "test", lockPath) + assert.NoError(t, err) + + err = state.AddContainer(testCtr) + assert.NoError(t, err) + + exists, err := state.HasContainer(testCtr.ID()) + assert.NoError(t, err) + assert.True(t, exists) +} + +func TestSaveAndUpdateContainer(t *testing.T) { + runForAllStates(t, "TestSaveAndUpdateContainer", saveAndUpdateContainer) +} + +func saveAndUpdateContainer(t *testing.T, state State, lockPath string) { + testCtr, err := getTestContainer("0123456789ABCDEF0123456789ABCDEF", "test", lockPath) + assert.NoError(t, err) + + err = state.AddContainer(testCtr) + assert.NoError(t, err) + + retrievedCtr, err := state.Container(testCtr.ID()) + assert.NoError(t, err) + + retrievedCtr.state.State = ContainerStateStopped + retrievedCtr.state.ExitCode = 127 + retrievedCtr.state.FinishedTime = time.Now() + + err = state.SaveContainer(retrievedCtr) + assert.NoError(t, err) + + err = state.UpdateContainer(testCtr) + assert.NoError(t, err) + + // Use assert.EqualValues if the test fails to pretty print diff + // between actual and expected + if !testContainersEqual(testCtr, retrievedCtr) { + assert.EqualValues(t, testCtr, retrievedCtr) + } +} + +func TestUpdateContainerNotInDatabaseReturnsError(t *testing.T) { + runForAllStates(t, "TestUpdateContainerNotInDatabaseReturnsError", updateContainerNotInDatabaseReturnsError) +} + +func updateContainerNotInDatabaseReturnsError(t *testing.T, state State, lockPath string) { + testCtr, err := getTestContainer("0123456789ABCDEF0123456789ABCDEF", "test", lockPath) + assert.NoError(t, err) + + err = state.UpdateContainer(testCtr) + assert.Error(t, err) + assert.False(t, testCtr.valid) +} + +func TestUpdateInvalidContainerReturnsError(t *testing.T) { + runForAllStates(t, "TestUpdateInvalidContainerReturnsError", updateInvalidContainerReturnsError) +} + +func updateInvalidContainerReturnsError(t *testing.T, state State, lockPath string) { + err := state.UpdateContainer(&Container{config: &ContainerConfig{ID: "1234"}}) + assert.Error(t, err) +} + +func TestSaveInvalidContainerReturnsError(t *testing.T) { + runForAllStates(t, "TestSaveInvalidContainerReturnsError", saveInvalidContainerReturnsError) +} + +func saveInvalidContainerReturnsError(t *testing.T, state State, lockPath string) { + err := state.SaveContainer(&Container{config: &ContainerConfig{ID: "1234"}}) + assert.Error(t, err) +} + +func TestSaveContainerNotInStateReturnsError(t *testing.T) { + runForAllStates(t, "TestSaveContainerNotInStateReturnsError", saveContainerNotInStateReturnsError) +} + +func saveContainerNotInStateReturnsError(t *testing.T, state State, lockPath string) { + testCtr, err := getTestContainer("0123456789ABCDEF0123456789ABCDEF", "test", lockPath) + assert.NoError(t, err) + + err = state.SaveContainer(testCtr) + assert.Error(t, err) + assert.False(t, testCtr.valid) +} + +func TestRemoveContainer(t *testing.T) { + runForAllStates(t, "TestRemoveContainer", removeContainer) +} + +func removeContainer(t *testing.T, state State, lockPath string) { + testCtr, err := getTestContainer("0123456789ABCDEF0123456789ABCDEF", "test", lockPath) + assert.NoError(t, err) + + err = state.AddContainer(testCtr) + assert.NoError(t, err) + + ctrs, err := state.AllContainers() + assert.NoError(t, err) + assert.Equal(t, 1, len(ctrs)) + + err = state.RemoveContainer(testCtr) + assert.NoError(t, err) + + ctrs2, err := state.AllContainers() + assert.NoError(t, err) + assert.Equal(t, 0, len(ctrs2)) +} + +func TestRemoveNonexistantContainerFails(t *testing.T) { + runForAllStates(t, "TestRemoveNonexistantContainerFails", removeNonexistantContainerFails) +} + +func removeNonexistantContainerFails(t *testing.T, state State, lockPath string) { + testCtr, err := getTestContainer("0123456789ABCDEF0123456789ABCDEF", "test", lockPath) + assert.NoError(t, err) + + err = state.RemoveContainer(testCtr) + assert.Error(t, err) +} + +func TestGetAllContainersOnNewStateIsEmpty(t *testing.T) { + runForAllStates(t, "TestGetAllContainersOnNewStateIsEmpty", getAllContainersOnNewStateIsEmpty) +} + +func getAllContainersOnNewStateIsEmpty(t *testing.T, state State, lockPath string) { + ctrs, err := state.AllContainers() + assert.NoError(t, err) + assert.Equal(t, 0, len(ctrs)) +} + +func TestGetAllContainersWithOneContainer(t *testing.T) { + runForAllStates(t, "TestGetAllContainersWithOneContainer", getAllContainersWithOneContainer) +} + +func getAllContainersWithOneContainer(t *testing.T, state State, lockPath string) { + testCtr, err := getTestContainer("0123456789ABCDEF0123456789ABCDEF", "test", lockPath) + assert.NoError(t, err) + + err = state.AddContainer(testCtr) + assert.NoError(t, err) + + ctrs, err := state.AllContainers() + assert.NoError(t, err) + assert.Equal(t, 1, len(ctrs)) + + // Use assert.EqualValues if the test fails to pretty print diff + // between actual and expected + if !testContainersEqual(testCtr, ctrs[0]) { + assert.EqualValues(t, testCtr, ctrs[0]) + } +} + +func TestGetAllContainersTwoContainers(t *testing.T) { + runForAllStates(t, "TestGetAllContainersTwoContainers", getAllContainersTwoContainers) +} + +func getAllContainersTwoContainers(t *testing.T, state State, lockPath string) { + testCtr1, err := getTestContainer("11111111111111111111111111111111", "test1", lockPath) + assert.NoError(t, err) + testCtr2, err := getTestContainer("22222222222222222222222222222222", "test2", lockPath) + assert.NoError(t, err) + + err = state.AddContainer(testCtr1) + assert.NoError(t, err) + + err = state.AddContainer(testCtr2) + assert.NoError(t, err) + + ctrs, err := state.AllContainers() + assert.NoError(t, err) + assert.Equal(t, 2, len(ctrs)) +} + +func TestContainerInUseInvalidContainer(t *testing.T) { + runForAllStates(t, "TestContainerInUseInvalidContainer", containerInUseInvalidContainer) +} + +func containerInUseInvalidContainer(t *testing.T, state State, lockPath string) { + _, err := state.ContainerInUse(&Container{}) + assert.Error(t, err) +} + +func TestContainerInUseOneContainer(t *testing.T) { + runForAllStates(t, "TestContainerInUseOneContainer", containerInUseOneContainer) +} + +func containerInUseOneContainer(t *testing.T, state State, lockPath string) { + testCtr1, err := getTestContainer("11111111111111111111111111111111", "test1", lockPath) + assert.NoError(t, err) + testCtr2, err := getTestContainer("22222222222222222222222222222222", "test2", lockPath) + assert.NoError(t, err) + + testCtr2.config.UserNsCtr = testCtr1.config.ID + + err = state.AddContainer(testCtr1) + assert.NoError(t, err) + + err = state.AddContainer(testCtr2) + assert.NoError(t, err) + + ids, err := state.ContainerInUse(testCtr1) + assert.NoError(t, err) + assert.Equal(t, 1, len(ids)) + assert.Equal(t, testCtr2.config.ID, ids[0]) +} + +func TestContainerInUseTwoContainers(t *testing.T) { + runForAllStates(t, "TestContainerInUseTwoContainers", containerInUseTwoContainers) +} + +func containerInUseTwoContainers(t *testing.T, state State, lockPath string) { + testCtr1, err := getTestContainer("11111111111111111111111111111111", "test1", lockPath) + assert.NoError(t, err) + testCtr2, err := getTestContainer("22222222222222222222222222222222", "test2", lockPath) + assert.NoError(t, err) + testCtr3, err := getTestContainer("33333333333333333333333333333333", "test3", lockPath) + assert.NoError(t, err) + + testCtr2.config.UserNsCtr = testCtr1.config.ID + testCtr3.config.IPCNsCtr = testCtr1.config.ID + + err = state.AddContainer(testCtr1) + assert.NoError(t, err) + + err = state.AddContainer(testCtr2) + assert.NoError(t, err) + + err = state.AddContainer(testCtr3) + assert.NoError(t, err) + + ids, err := state.ContainerInUse(testCtr1) + assert.NoError(t, err) + assert.Equal(t, 2, len(ids)) +} + +func TestCannotRemoveContainerWithDependency(t *testing.T) { + runForAllStates(t, "TestCannotRemoveContainerWithDependency", cannotRemoveContainerWithDependency) +} + +func cannotRemoveContainerWithDependency(t *testing.T, state State, lockPath string) { + testCtr1, err := getTestContainer("11111111111111111111111111111111", "test1", lockPath) + assert.NoError(t, err) + testCtr2, err := getTestContainer("22222222222222222222222222222222", "test2", lockPath) + assert.NoError(t, err) + + testCtr2.config.UserNsCtr = testCtr1.config.ID + + err = state.AddContainer(testCtr1) + assert.NoError(t, err) + + err = state.AddContainer(testCtr2) + assert.NoError(t, err) + + err = state.RemoveContainer(testCtr1) + assert.Error(t, err) +} + +func TestCanRemoveContainerAfterDependencyRemoved(t *testing.T) { + runForAllStates(t, "TestCanRemoveContainerAfterDependencyRemoved", canRemoveContainerAfterDependencyRemoved) +} + +func canRemoveContainerAfterDependencyRemoved(t *testing.T, state State, lockPath string) { + testCtr1, err := getTestContainer("11111111111111111111111111111111", "test1", lockPath) + assert.NoError(t, err) + testCtr2, err := getTestContainer("22222222222222222222222222222222", "test2", lockPath) + assert.NoError(t, err) + + testCtr2.config.UserNsCtr = testCtr1.config.ID + + err = state.AddContainer(testCtr1) + assert.NoError(t, err) + + err = state.AddContainer(testCtr2) + assert.NoError(t, err) + + err = state.RemoveContainer(testCtr2) + assert.NoError(t, err) + + err = state.RemoveContainer(testCtr1) + assert.NoError(t, err) +} diff --git a/libpod/stats.go b/libpod/stats.go index 86da0679e..e87654277 100644 --- a/libpod/stats.go +++ b/libpod/stats.go @@ -29,11 +29,16 @@ type ContainerStats struct { // GetContainerStats gets the running stats for a given container func (c *Container) GetContainerStats(previousStats *ContainerStats) (*ContainerStats, error) { stats := new(ContainerStats) + stats.ContainerID = c.ID() c.lock.Lock() defer c.lock.Unlock() if err := c.syncContainer(); err != nil { return stats, errors.Wrapf(err, "error updating container %s state", c.ID()) } + if c.state.State != ContainerStateRunning { + return stats, nil + } + cgroup, err := cgroups.Load(cgroups.V1, c.CGroupPath()) if err != nil { return stats, errors.Wrapf(err, "unable to load cgroup at %+v", c.CGroupPath()) @@ -50,7 +55,6 @@ func (c *Container) GetContainerStats(previousStats *ContainerStats) (*Container previousCPU := previousStats.CPUNano previousSystem := previousStats.SystemNano - stats.ContainerID = c.ID() stats.CPU = calculateCPUPercent(cgroupStats, previousCPU, previousSystem) stats.MemUsage = cgroupStats.Memory.Usage.Usage stats.MemLimit = getMemLimit(cgroupStats.Memory.Usage.Limit) diff --git a/libpod/test_common.go b/libpod/test_common.go new file mode 100644 index 000000000..131a44d0f --- /dev/null +++ b/libpod/test_common.go @@ -0,0 +1,116 @@ +package libpod + +import ( + "encoding/json" + "net" + "path/filepath" + "reflect" + "time" + + "github.com/containers/storage" + "github.com/cri-o/ocicni/pkg/ocicni" + "github.com/opencontainers/runtime-tools/generate" +) + +// nolint +func getTestContainer(id, name, locksDir string) (*Container, error) { + ctr := &Container{ + config: &ContainerConfig{ + ID: id, + Name: name, + RootfsImageID: id, + RootfsImageName: "testimg", + ImageVolumes: true, + ReadOnly: true, + StaticDir: "/does/not/exist/", + Stdin: true, + Labels: make(map[string]string), + StopSignal: 0, + StopTimeout: 0, + CreatedTime: time.Now(), + Privileged: true, + Mounts: []string{"/does/not/exist"}, + DNSServer: []net.IP{net.ParseIP("192.168.1.1"), net.ParseIP("192.168.2.2")}, + DNSSearch: []string{"example.com", "example.example.com"}, + PortMappings: []ocicni.PortMapping{ + { + HostPort: 80, + ContainerPort: 90, + Protocol: "tcp", + HostIP: "192.168.3.3", + }, + { + HostPort: 100, + ContainerPort: 110, + Protocol: "udp", + HostIP: "192.168.4.4", + }, + }, + }, + state: &containerState{ + State: ContainerStateRunning, + ConfigPath: "/does/not/exist/specs/" + id, + RunDir: "/does/not/exist/tmp/", + Mounted: true, + Mountpoint: "/does/not/exist/tmp/" + id, + PID: 1234, + }, + valid: true, + } + + g := generate.New() + ctr.config.Spec = g.Spec() + + ctr.config.Labels["test"] = "testing" + + // Must make lockfile or container will error on being retrieved from DB + lockPath := filepath.Join(locksDir, id) + lock, err := storage.GetLockfile(lockPath) + if err != nil { + return nil, err + } + ctr.lock = lock + + return ctr, nil +} + +// This horrible hack tests if containers are equal in a way that should handle +// empty arrays being dropped to nil pointers in the spec JSON +// nolint +func testContainersEqual(a, b *Container) bool { + if a == nil && b == nil { + return true + } else if a == nil || b == nil { + return false + } + + if a.valid != b.valid { + return false + } + + aConfigJSON, err := json.Marshal(a.config) + if err != nil { + return false + } + + bConfigJSON, err := json.Marshal(b.config) + if err != nil { + return false + } + + if !reflect.DeepEqual(aConfigJSON, bConfigJSON) { + return false + } + + aStateJSON, err := json.Marshal(a.state) + if err != nil { + return false + } + + bStateJSON, err := json.Marshal(b.state) + if err != nil { + return false + } + + return reflect.DeepEqual(aStateJSON, bStateJSON) +} |