1 files changed, 95 insertions, 29 deletions

diff --git a/pkg/specgen/generate/oci.go b/pkg/specgen/generate/oci.go
index 0ed091f9a..87262684e 100644
--- a/pkg/specgen/generate/oci.go
+++ b/pkg/specgen/generate/oci.go
@@ -1,8 +1,10 @@
 package generate
 
 import (
+	"context"
 	"strings"
 
+	"github.com/containers/common/pkg/config"
 	"github.com/containers/libpod/libpod"
 	"github.com/containers/libpod/libpod/image"
 	"github.com/containers/libpod/pkg/rootless"
@@ -10,9 +12,90 @@ import (
 	"github.com/opencontainers/runc/libcontainer/user"
 	spec "github.com/opencontainers/runtime-spec/specs-go"
 	"github.com/opencontainers/runtime-tools/generate"
+	"github.com/pkg/errors"
 )
 
-func SpecGenToOCI(s *specgen.SpecGenerator, rt *libpod.Runtime, newImage *image.Image) (*spec.Spec, error) {
+func addRlimits(s *specgen.SpecGenerator, g *generate.Generator) error {
+	var (
+		kernelMax  uint64 = 1048576
+		isRootless        = rootless.IsRootless()
+		nofileSet         = false
+		nprocSet          = false
+	)
+
+	if s.Rlimits == nil {
+		g.Config.Process.Rlimits = nil
+		return nil
+	}
+
+	for _, u := range s.Rlimits {
+		name := "RLIMIT_" + strings.ToUpper(u.Type)
+		if name == "RLIMIT_NOFILE" {
+			nofileSet = true
+		} else if name == "RLIMIT_NPROC" {
+			nprocSet = true
+		}
+		g.AddProcessRlimits(name, u.Hard, u.Soft)
+	}
+
+	// If not explicitly overridden by the user, default number of open
+	// files and number of processes to the maximum they can be set to
+	// (without overriding a sysctl)
+	if !nofileSet && !isRootless {
+		g.AddProcessRlimits("RLIMIT_NOFILE", kernelMax, kernelMax)
+	}
+	if !nprocSet && !isRootless {
+		g.AddProcessRlimits("RLIMIT_NPROC", kernelMax, kernelMax)
+	}
+
+	return nil
+}
+
+// Produce the final command for the container.
+func makeCommand(ctx context.Context, s *specgen.SpecGenerator, img *image.Image, rtc *config.Config) ([]string, error) {
+	finalCommand := []string{}
+
+	entrypoint := s.Entrypoint
+	if len(entrypoint) == 0 && img != nil {
+		newEntry, err := img.Entrypoint(ctx)
+		if err != nil {
+			return nil, err
+		}
+		entrypoint = newEntry
+	}
+
+	finalCommand = append(finalCommand, entrypoint...)
+
+	command := s.Command
+	if len(command) == 0 && img != nil {
+		newCmd, err := img.Cmd(ctx)
+		if err != nil {
+			return nil, err
+		}
+		command = newCmd
+	}
+
+	finalCommand = append(finalCommand, command...)
+
+	if len(finalCommand) == 0 {
+		return nil, errors.Errorf("no command or entrypoint provided, and no CMD or ENTRYPOINT from image")
+	}
+
+	if s.Init {
+		initPath := s.InitPath
+		if initPath == "" && rtc != nil {
+			initPath = rtc.Engine.InitPath
+		}
+		if initPath == "" {
+			return nil, errors.Errorf("no path to init binary found but container requested an init")
+		}
+		finalCommand = append([]string{initPath, "--"}, finalCommand...)
+	}
+
+	return finalCommand, nil
+}
+
+func SpecGenToOCI(ctx context.Context, s *specgen.SpecGenerator, rt *libpod.Runtime, rtc *config.Config, newImage *image.Image, mounts []spec.Mount) (*spec.Spec, error) {
 	var (
 		inUserNS bool
 	)
@@ -137,7 +220,13 @@ func SpecGenToOCI(s *specgen.SpecGenerator, rt *libpod.Runtime, newImage *image.
 		g.AddMount(cgroupMnt)
 	}
 	g.SetProcessCwd(s.WorkDir)
-	g.SetProcessArgs(s.Command)
+
+	finalCmd, err := makeCommand(ctx, s, newImage, rtc)
+	if err != nil {
+		return nil, err
+	}
+	g.SetProcessArgs(finalCmd)
+
 	g.SetProcessTerminal(s.Terminal)
 
 	for key, val := range s.Annotations {
@@ -176,35 +265,12 @@ func SpecGenToOCI(s *specgen.SpecGenerator, rt *libpod.Runtime, newImage *image.
 		g.AddProcessEnv(name, val)
 	}
 
-	// TODO rlimits and ulimits needs further refinement by someone more
-	// familiar with the code.
-	//if err := addRlimits(config, &g); err != nil {
-	//	return nil, err
-	//}
-
-	// NAMESPACES
-
-	if err := pidConfigureGenerator(s, &g); err != nil {
-		return nil, err
-	}
-
-	if err := userConfigureGenerator(s, &g); err != nil {
-		return nil, err
-	}
-
-	if err := networkConfigureGenerator(s, &g); err != nil {
+	if err := addRlimits(s, &g); err != nil {
 		return nil, err
 	}
 
-	if err := utsConfigureGenerator(s, &g, rt); err != nil {
-		return nil, err
-	}
-
-	if err := ipcConfigureGenerator(s, &g); err != nil {
-		return nil, err
-	}
-
-	if err := cgroupConfigureGenerator(s, &g); err != nil {
+	// NAMESPACES
+	if err := specConfigureNamespaces(s, &g, rt); err != nil {
 		return nil, err
 	}
 	configSpec := g.Config
@@ -214,7 +280,7 @@ func SpecGenToOCI(s *specgen.SpecGenerator, rt *libpod.Runtime, newImage *image.
 	}
 
 	// BIND MOUNTS
-	configSpec.Mounts = SupercedeUserMounts(s.Mounts, configSpec.Mounts)
+	configSpec.Mounts = SupercedeUserMounts(mounts, configSpec.Mounts)
 	// Process mounts to ensure correct options
 	if err := InitFSMounts(configSpec.Mounts); err != nil {
 		return nil, err