errNotADevice = errors.New("not a device node")

)

func addPrivilegedDevices(g *generate.Generator) error {

hostDevices, err := getDevices("/dev")

if err != nil {

if err != nil {

return nil, err

}

// Get Default Environment from containers.conf

if err != nil {

return nil, errors.Wrap(err, "error parsing fields in containers.conf")

}

defaultEnvs = envLib.Join(defaultEnvs, envs)

}

// Caller Specified defaults

if s.EnvHost {

defaultEnvs = envLib.Join(defaultEnvs, osEnv)

if err := unix.Stat(k, &statT); err != nil {

return err

}

s.ResourceLimits.BlockIO.ThrottleReadBpsDevice = append(s.ResourceLimits.BlockIO.ThrottleReadBpsDevice, v)

}

}

if err := unix.Stat(k, &statT); err != nil {

return err

}

s.ResourceLimits.BlockIO.ThrottleWriteBpsDevice = append(s.ResourceLimits.BlockIO.ThrottleWriteBpsDevice, v)

}

}

if err := unix.Stat(k, &statT); err != nil {

return err

}

s.ResourceLimits.BlockIO.ThrottleReadIOPSDevice = append(s.ResourceLimits.BlockIO.ThrottleReadIOPSDevice, v)

}

}

if err := unix.Stat(k, &statT); err != nil {

return err

}

s.ResourceLimits.BlockIO.ThrottleWriteIOPSDevice = append(s.ResourceLimits.BlockIO.ThrottleWriteIOPSDevice, v)

}

}

"fmt"

"strings"

"github.com/containers/podman/v2/libpod/image"

ann "github.com/containers/podman/v2/pkg/annotations"

"github.com/containers/podman/v2/pkg/specgen"

// TODO: We don't understand why specgen does not take of this, but

// integration tests clearly pointed out that it was required.

imageData, err := opts.Image.Inspect(ctx)

if err != nil {

return nil, err

}

s.WorkDir = "/"

if imageData != nil && imageData.Config != nil {

if imageData.Config.WorkingDir != "" {

s.WorkDir = imageData.Config.WorkingDir

}

// Pull entrypoint and cmd from image

s.Labels = imageData.Config.Labels

if len(imageData.Config.StopSignal) > 0 {

stopSignal, err := util.ParseSignal(imageData.Config.StopSignal)

}

// If only the yaml.Command is specified, set it as the entrypoint and drop the image Cmd

if len(opts.Container.Command) != 0 {

}

// Only override the cmd field if yaml.Args is specified

// Keep the image entrypoint, or the yaml.command if specified

if len(opts.Container.Args) != 0 {

}

// FIXME,

// we are currently ignoring imageData.Config.ExposedPorts

if opts.Container.WorkingDir != "" {

import (

"os"

"github.com/containers/podman/v2/libpod"

"github.com/pkg/errors"

"github.com/sirupsen/logrus"

case specgen.Private:

fallthrough

case specgen.Bridge:

portMappings, err := createPortMappings(ctx, s, img)

if err != nil {

return nil, err

// namespaces?

g.SetHostname(hostname)

}

// User

switch s.UserNS.NSMode {

// Only use image command if the user did not manually set an

// entrypoint.

command := s.Command

newCmd, err := img.Cmd(ctx)

if err != nil {

return nil, err

return finalCommand, nil

}

func SpecGenToOCI(ctx context.Context, s *specgen.SpecGenerator, rt *libpod.Runtime, rtc *config.Config, newImage *image.Image, mounts []spec.Mount, pod *libpod.Pod, finalCmd []string) (*spec.Spec, error) {

cgroupPerm := "ro"

g, err := generate.New("linux")

if err != nil {

g.RemoveMount("/dev/shm")

g.HostSpecific = true

addCgroup := true

isRootless := rootless.IsRootless()

if s.Privileged && canMountSys {

cgroupPerm = "rw"

g.AddMount(devPts)

}

if inUserNS && s.IpcNS.IsHost() {

g.RemoveMount("/dev/mqueue")

devMqueue := spec.Mount{

configSpec := g.Config

configSpec.Process.Capabilities.Ambient = []string{}

configSpec.Process.Capabilities.Bounding = caplist

user := strings.Split(s.User, ":")[0]

if (user == "" && s.UserNS.NSMode != specgen.KeepID) || user == "root" || user == "0" {

configSpec.Process.Capabilities.Effective = caplist

configSpec.Process.Capabilities.Permitted = caplist

} else {

userCaps, err := capabilities.MergeCapabilities(nil, s.CapAdd, nil)

if err != nil {

}

configSpec.Process.Capabilities.Effective = userCaps

configSpec.Process.Capabilities.Permitted = userCaps

// Ambient capabilities were added to Linux 4.3. Set ambient

// capabilities only when the kernel supports them.

// Clear default Seccomp profile from Generator for unconfined containers

// and privileged containers which do not specify a seccomp profile.

configSpec.Linux.Seccomp = nil

}

g.SetRootReadonly(s.ReadOnlyFilesystem)

// Add default sysctls

defaultSysctls, err := util.ValidateSysctls(rtc.Sysctls())

if err != nil {

for sysctlKey, sysctlVal := range defaultSysctls {

// Ignore mqueue sysctls if --ipc=host

logrus.Infof("Sysctl %s=%s ignored in containers.conf, since IPC Namespace set to host", sysctlKey, sysctlVal)

continue

}

// Ignore net sysctls if --net=host

logrus.Infof("Sysctl %s=%s ignored in containers.conf, since Network Namespace set to host", sysctlKey, sysctlVal)

continue

}

// Ignore uts sysctls if --uts=host

logrus.Infof("Sysctl %s=%s ignored in containers.conf, since UTS Namespace set to host", sysctlKey, sysctlVal)

continue

}

// named volumes, and vice versa.

// We'll delete the conflicts here as we supersede.

for dest := range unifiedMounts {

}

for dest := range unifiedVolumes {

}

// Supersede volumes-from/image volumes with unified volumes from above.

warnings = append(warnings, "Your kernel does not support memory swappiness capabilities, or the cgroup is not mounted. Memory swappiness discarded.")

memory.Swappiness = nil

} else {

return warnings, errors.Errorf("invalid value: %v, valid memory swappiness range is 0-100", *memory.Swappiness)

}

}