summaryrefslogtreecommitdiff
path: root/libpod
diff options
context:
space:
mode:
Diffstat (limited to 'libpod')
-rw-r--r--libpod/container.go5
-rw-r--r--libpod/container_internal.go18
-rw-r--r--libpod/define/ctr_inspect.go (renamed from libpod/define/inspect.go)0
-rw-r--r--libpod/define/info.go1
-rw-r--r--libpod/define/pod_inspect.go97
-rw-r--r--libpod/info.go5
-rw-r--r--libpod/oci.go3
-rw-r--r--libpod/oci_conmon_linux.go28
-rw-r--r--libpod/oci_conmon_unsupported.go2
-rw-r--r--libpod/oci_missing.go6
-rw-r--r--libpod/runtime.go23
-rw-r--r--libpod/runtime_ctr.go3
12 files changed, 168 insertions, 23 deletions
diff --git a/libpod/container.go b/libpod/container.go
index c1deb95f9..a1848b96a 100644
--- a/libpod/container.go
+++ b/libpod/container.go
@@ -564,6 +564,11 @@ func (c *Container) MountLabel() string {
return c.config.MountLabel
}
+// Systemd returns whether the container will be running in systemd mode
+func (c *Container) Systemd() bool {
+ return c.config.Systemd
+}
+
// User returns the user who the container is run as
func (c *Container) User() string {
return c.config.User
diff --git a/libpod/container_internal.go b/libpod/container_internal.go
index c930017a4..50bd9bc25 100644
--- a/libpod/container_internal.go
+++ b/libpod/container_internal.go
@@ -19,6 +19,7 @@ import (
"github.com/containers/libpod/pkg/hooks"
"github.com/containers/libpod/pkg/hooks/exec"
"github.com/containers/libpod/pkg/rootless"
+ "github.com/containers/libpod/pkg/util"
"github.com/containers/storage"
"github.com/containers/storage/pkg/archive"
"github.com/containers/storage/pkg/mount"
@@ -430,7 +431,22 @@ func (c *Container) setupStorage(ctx context.Context) error {
c.config.IDMappings.UIDMap = containerInfo.UIDMap
c.config.IDMappings.GIDMap = containerInfo.GIDMap
- c.config.ProcessLabel = containerInfo.ProcessLabel
+
+ processLabel := containerInfo.ProcessLabel
+ switch {
+ case c.ociRuntime.SupportsKVM():
+ processLabel, err = util.SELinuxKVMLabel(processLabel)
+ if err != nil {
+ return err
+ }
+ case c.config.Systemd:
+ processLabel, err = util.SELinuxInitLabel(processLabel)
+ if err != nil {
+ return err
+ }
+ }
+
+ c.config.ProcessLabel = processLabel
c.config.MountLabel = containerInfo.MountLabel
c.config.StaticDir = containerInfo.Dir
c.state.RunDir = containerInfo.RunDir
diff --git a/libpod/define/inspect.go b/libpod/define/ctr_inspect.go
index b7cd13f82..b7cd13f82 100644
--- a/libpod/define/inspect.go
+++ b/libpod/define/ctr_inspect.go
diff --git a/libpod/define/info.go b/libpod/define/info.go
index e9809c367..2516cad77 100644
--- a/libpod/define/info.go
+++ b/libpod/define/info.go
@@ -8,6 +8,7 @@ type Info struct {
Host *HostInfo `json:"host"`
Store *StoreInfo `json:"store"`
Registries map[string]interface{} `json:"registries"`
+ Version Version `json:"version"`
}
//HostInfo describes the libpod host
diff --git a/libpod/define/pod_inspect.go b/libpod/define/pod_inspect.go
new file mode 100644
index 000000000..8558c149b
--- /dev/null
+++ b/libpod/define/pod_inspect.go
@@ -0,0 +1,97 @@
+package define
+
+import (
+ "net"
+ "time"
+
+ "github.com/cri-o/ocicni/pkg/ocicni"
+)
+
+// InspectPodData contains detailed information on a pod's configuration and
+// state. It is used as the output of Inspect on pods.
+type InspectPodData struct {
+ // ID is the ID of the pod.
+ ID string `json:"Id"`
+ // Name is the name of the pod.
+ Name string
+ // Namespace is the Libpod namespace the pod is placed in.
+ Namespace string `json:"Namespace,omitempty"`
+ // Created is the time when the pod was created.
+ Created time.Time
+ // Hostname is the hostname that the pod will set.
+ Hostname string
+ // Labels is a set of key-value labels that have been applied to the
+ // pod.
+ Labels map[string]string `json:"Labels,omitempty"`
+ // CreateCgroup is whether this pod will create its own CGroup to group
+ // containers under.
+ CreateCgroup bool
+ // CgroupParent is the parent of the pod's CGroup.
+ CgroupParent string `json:"CgroupParent,omitempty"`
+ // CgroupPath is the path to the pod's CGroup.
+ CgroupPath string `json:"CgroupPath,omitempty"`
+ // CreateInfra is whether this pod will create an infra container to
+ // share namespaces.
+ CreateInfra bool
+ // InfraContainerID is the ID of the pod's infra container, if one is
+ // present.
+ InfraContainerID string `json:"InfraContainerID,omitempty"`
+ // InfraConfig is the configuration of the infra container of the pod.
+ // Will only be set if CreateInfra is true.
+ InfraConfig *InspectPodInfraConfig `json:"InfraConfig,omitempty"`
+ // SharedNamespaces contains a list of namespaces that will be shared by
+ // containers within the pod. Can only be set if CreateInfra is true.
+ SharedNamespaces []string `json:"SharedNamespaces,omitempty"`
+ // NumContainers is the number of containers in the pod, including the
+ // infra container.
+ NumContainers uint
+ // Containers gives a brief summary of all containers in the pod and
+ // their current status.
+ Containers []InspectPodContainerInfo `json:"Containers,omitempty"`
+}
+
+// InspectPodInfraConfig contains the configuration of the pod's infra
+// container.
+type InspectPodInfraConfig struct {
+ // PortBindings are ports that will be forwarded to the infra container
+ // and then shared with the pod.
+ PortBindings []ocicni.PortMapping
+ // HostNetwork is whether the infra container (and thus the whole pod)
+ // will use the host's network and not create a network namespace.
+ HostNetwork bool
+ // StaticIP is a static IPv4 that will be assigned to the infra
+ // container and then used by the pod.
+ StaticIP net.IP
+ // StaticMAC is a static MAC address that will be assigned to the infra
+ // container and then used by the pod.
+ StaticMAC net.HardwareAddr
+ // NoManageResolvConf indicates that the pod will not manage resolv.conf
+ // and instead each container will handle their own.
+ NoManageResolvConf bool
+ // DNSServer is a set of DNS Servers that will be used by the infra
+ // container's resolv.conf and shared with the remainder of the pod.
+ DNSServer []string
+ // DNSSearch is a set of DNS search domains that will be used by the
+ // infra container's resolv.conf and shared with the remainder of the
+ // pod.
+ DNSSearch []string
+ // DNSOption is a set of DNS options that will be used by the infra
+ // container's resolv.conf and shared with the remainder of the pod.
+ DNSOption []string
+ // NoManageHosts indicates that the pod will not manage /etc/hosts and
+ // instead each container will handle their own.
+ NoManageHosts bool
+ // HostAdd adds a number of hosts to the infra container's resolv.conf
+ // which will be shared with the rest of the pod.
+ HostAdd []string
+}
+
+// InspectPodContainerInfo contains information on a container in a pod.
+type InspectPodContainerInfo struct {
+ // ID is the ID of the container.
+ ID string `json:"Id"`
+ // Name is the name of the container.
+ Name string
+ // State is the current status of the container.
+ State string
+}
diff --git a/libpod/info.go b/libpod/info.go
index 3cc767be6..d7ed5bb16 100644
--- a/libpod/info.go
+++ b/libpod/info.go
@@ -26,6 +26,11 @@ import (
// Info returns the store and host information
func (r *Runtime) info() (*define.Info, error) {
info := define.Info{}
+ versionInfo, err := define.GetVersion()
+ if err != nil {
+ return nil, errors.Wrapf(err, "error getting version info")
+ }
+ info.Version = versionInfo
// get host information
hostInfo, err := r.hostInfo()
if err != nil {
diff --git a/libpod/oci.go b/libpod/oci.go
index 6adf42497..9991c5625 100644
--- a/libpod/oci.go
+++ b/libpod/oci.go
@@ -103,6 +103,9 @@ type OCIRuntime interface {
// SupportsNoCgroups is whether the runtime supports running containers
// without cgroups.
SupportsNoCgroups() bool
+ // SupportsKVM os whether the OCI runtime supports running containers
+ // without KVM separation
+ SupportsKVM() bool
// AttachSocketPath is the path to the socket to attach to a given
// container.
diff --git a/libpod/oci_conmon_linux.go b/libpod/oci_conmon_linux.go
index 18b438792..0113f7d8e 100644
--- a/libpod/oci_conmon_linux.go
+++ b/libpod/oci_conmon_linux.go
@@ -60,6 +60,7 @@ type ConmonOCIRuntime struct {
noPivot bool
reservePorts bool
supportsJSON bool
+ supportsKVM bool
supportsNoCgroups bool
sdNotify bool
}
@@ -70,11 +71,25 @@ type ConmonOCIRuntime struct {
// The first path that points to a valid executable will be used.
// Deliberately private. Someone should not be able to construct this outside of
// libpod.
-func newConmonOCIRuntime(name string, paths []string, conmonPath string, runtimeCfg *config.Config, supportsJSON, supportsNoCgroups bool) (OCIRuntime, error) {
+func newConmonOCIRuntime(name string, paths []string, conmonPath string, runtimeCfg *config.Config) (OCIRuntime, error) {
if name == "" {
return nil, errors.Wrapf(define.ErrInvalidArg, "the OCI runtime must be provided a non-empty name")
}
+ // Make lookup tables for runtime support
+ supportsJSON := make(map[string]bool, len(runtimeCfg.Engine.RuntimeSupportsJSON))
+ supportsNoCgroups := make(map[string]bool, len(runtimeCfg.Engine.RuntimeSupportsNoCgroups))
+ supportsKVM := make(map[string]bool, len(runtimeCfg.Engine.RuntimeSupportsKVM))
+ for _, r := range runtimeCfg.Engine.RuntimeSupportsJSON {
+ supportsJSON[r] = true
+ }
+ for _, r := range runtimeCfg.Engine.RuntimeSupportsNoCgroups {
+ supportsNoCgroups[r] = true
+ }
+ for _, r := range runtimeCfg.Engine.RuntimeSupportsKVM {
+ supportsKVM[r] = true
+ }
+
runtime := new(ConmonOCIRuntime)
runtime.name = name
runtime.conmonPath = conmonPath
@@ -89,8 +104,9 @@ func newConmonOCIRuntime(name string, paths []string, conmonPath string, runtime
// TODO: probe OCI runtime for feature and enable automatically if
// available.
- runtime.supportsJSON = supportsJSON
- runtime.supportsNoCgroups = supportsNoCgroups
+ runtime.supportsJSON = supportsJSON[name]
+ runtime.supportsNoCgroups = supportsNoCgroups[name]
+ runtime.supportsKVM = supportsKVM[name]
foundPath := false
for _, path := range paths {
@@ -971,6 +987,12 @@ func (r *ConmonOCIRuntime) SupportsNoCgroups() bool {
return r.supportsNoCgroups
}
+// SupportsKVM checks if the OCI runtime supports running containers
+// without KVM separation
+func (r *ConmonOCIRuntime) SupportsKVM() bool {
+ return r.supportsKVM
+}
+
// AttachSocketPath is the path to a single container's attach socket.
func (r *ConmonOCIRuntime) AttachSocketPath(ctr *Container) (string, error) {
if ctr == nil {
diff --git a/libpod/oci_conmon_unsupported.go b/libpod/oci_conmon_unsupported.go
index 1f9d89ff6..309e0d417 100644
--- a/libpod/oci_conmon_unsupported.go
+++ b/libpod/oci_conmon_unsupported.go
@@ -17,7 +17,7 @@ type ConmonOCIRuntime struct {
}
// newConmonOCIRuntime is not supported on this OS.
-func newConmonOCIRuntime(name string, paths []string, conmonPath string, runtimeCfg *config.Config, supportsJSON, supportsNoCgroups bool) (OCIRuntime, error) {
+func newConmonOCIRuntime(name string, paths []string, conmonPath string, runtimeCfg *config.Config) (OCIRuntime, error) {
return nil, define.ErrNotImplemented
}
diff --git a/libpod/oci_missing.go b/libpod/oci_missing.go
index 5284fb4b7..172805b0d 100644
--- a/libpod/oci_missing.go
+++ b/libpod/oci_missing.go
@@ -168,6 +168,12 @@ func (r *MissingRuntime) SupportsNoCgroups() bool {
return false
}
+// SupportsKVM checks if the OCI runtime supports running containers
+// without KVM separation
+func (r *MissingRuntime) SupportsKVM() bool {
+ return false
+}
+
// AttachSocketPath does not work as there is no runtime to attach to.
// (Theoretically we could follow ExitFilePath but there is no guarantee the
// container is running and thus has an attach socket...)
diff --git a/libpod/runtime.go b/libpod/runtime.go
index a6032ad23..3b8f9e057 100644
--- a/libpod/runtime.go
+++ b/libpod/runtime.go
@@ -359,25 +359,13 @@ func makeRuntime(ctx context.Context, runtime *Runtime) (err error) {
}
}
- // Make lookup tables for runtime support
- supportsJSON := make(map[string]bool)
- supportsNoCgroups := make(map[string]bool)
- for _, r := range runtime.config.Engine.RuntimeSupportsJSON {
- supportsJSON[r] = true
- }
- for _, r := range runtime.config.Engine.RuntimeSupportsNoCgroups {
- supportsNoCgroups[r] = true
- }
-
// Get us at least one working OCI runtime.
runtime.ociRuntimes = make(map[string]OCIRuntime)
// Initialize remaining OCI runtimes
for name, paths := range runtime.config.Engine.OCIRuntimes {
- json := supportsJSON[name]
- nocgroups := supportsNoCgroups[name]
- ociRuntime, err := newConmonOCIRuntime(name, paths, runtime.conmonPath, runtime.config, json, nocgroups)
+ ociRuntime, err := newConmonOCIRuntime(name, paths, runtime.conmonPath, runtime.config)
if err != nil {
// Don't fatally error.
// This will allow us to ship configs including optional
@@ -397,10 +385,7 @@ func makeRuntime(ctx context.Context, runtime *Runtime) (err error) {
if strings.HasPrefix(runtime.config.Engine.OCIRuntime, "/") {
name := filepath.Base(runtime.config.Engine.OCIRuntime)
- json := supportsJSON[name]
- nocgroups := supportsNoCgroups[name]
-
- ociRuntime, err := newConmonOCIRuntime(name, []string{runtime.config.Engine.OCIRuntime}, runtime.conmonPath, runtime.config, json, nocgroups)
+ ociRuntime, err := newConmonOCIRuntime(name, []string{runtime.config.Engine.OCIRuntime}, runtime.conmonPath, runtime.config)
if err != nil {
return err
}
@@ -813,3 +798,7 @@ func (r *Runtime) mergeDBConfig(dbConfig *DBConfig) error {
}
return nil
}
+
+func (r *Runtime) EnableLabeling() bool {
+ return r.config.Containers.EnableLabeling
+}
diff --git a/libpod/runtime_ctr.go b/libpod/runtime_ctr.go
index 207ac6477..9d3e69d56 100644
--- a/libpod/runtime_ctr.go
+++ b/libpod/runtime_ctr.go
@@ -887,8 +887,9 @@ func (r *Runtime) PruneContainers(filterFuncs []ContainerFilter) (map[string]int
continue
}
err = r.RemoveContainer(context.Background(), ctr, false, false)
- pruneErrors[ctr.ID()] = err
if err != nil {
+ pruneErrors[ctr.ID()] = err
+ } else {
prunedContainers[ctr.ID()] = size
}
}
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2024-12-29 17:24:29 +0000