summaryrefslogtreecommitdiff
path: root/pkg/specgen
diff options
context:
space:
mode:
Diffstat (limited to 'pkg/specgen')
-rw-r--r--pkg/specgen/config_linux_cgo.go62
-rw-r--r--pkg/specgen/config_linux_nocgo.go11
-rw-r--r--pkg/specgen/config_unsupported.go13
-rw-r--r--pkg/specgen/container_create.go189
-rw-r--r--pkg/specgen/container_validate.go167
-rw-r--r--pkg/specgen/namespaces.go474
-rw-r--r--pkg/specgen/oci.go260
-rw-r--r--pkg/specgen/pod_create.go83
-rw-r--r--pkg/specgen/pod_validate.go104
-rw-r--r--pkg/specgen/podspecgen.go153
-rw-r--r--pkg/specgen/specgen.go416
11 files changed, 1932 insertions, 0 deletions
diff --git a/pkg/specgen/config_linux_cgo.go b/pkg/specgen/config_linux_cgo.go
new file mode 100644
index 000000000..6f547a40d
--- /dev/null
+++ b/pkg/specgen/config_linux_cgo.go
@@ -0,0 +1,62 @@
+// +build linux,cgo
+
+package specgen
+
+import (
+ "context"
+ "io/ioutil"
+
+ "github.com/containers/libpod/libpod/image"
+ "github.com/containers/libpod/pkg/seccomp"
+ spec "github.com/opencontainers/runtime-spec/specs-go"
+ "github.com/pkg/errors"
+ goSeccomp "github.com/seccomp/containers-golang"
+ "github.com/sirupsen/logrus"
+)
+
+func (s *SpecGenerator) getSeccompConfig(configSpec *spec.Spec, img *image.Image) (*spec.LinuxSeccomp, error) {
+ var seccompConfig *spec.LinuxSeccomp
+ var err error
+
+ scp, err := seccomp.LookupPolicy(s.SeccompPolicy)
+ if err != nil {
+ return nil, err
+ }
+
+ if scp == seccomp.PolicyImage {
+ labels, err := img.Labels(context.Background())
+ if err != nil {
+ return nil, err
+ }
+ imagePolicy := labels[seccomp.ContainerImageLabel]
+ if len(imagePolicy) < 1 {
+ return nil, errors.New("no seccomp policy defined by image")
+ }
+ logrus.Debug("Loading seccomp profile from the security config")
+ seccompConfig, err = goSeccomp.LoadProfile(imagePolicy, configSpec)
+ if err != nil {
+ return nil, errors.Wrap(err, "loading seccomp profile failed")
+ }
+ return seccompConfig, nil
+ }
+
+ if s.SeccompProfilePath != "" {
+ logrus.Debugf("Loading seccomp profile from %q", s.SeccompProfilePath)
+ seccompProfile, err := ioutil.ReadFile(s.SeccompProfilePath)
+ if err != nil {
+ return nil, errors.Wrapf(err, "opening seccomp profile (%s) failed", s.SeccompProfilePath)
+ }
+ seccompConfig, err = goSeccomp.LoadProfile(string(seccompProfile), configSpec)
+ if err != nil {
+ return nil, errors.Wrapf(err, "loading seccomp profile (%s) failed", s.SeccompProfilePath)
+ }
+ } else {
+ logrus.Debug("Loading default seccomp profile")
+ seccompConfig, err = goSeccomp.GetDefaultProfile(configSpec)
+ if err != nil {
+ return nil, errors.Wrapf(err, "loading seccomp profile (%s) failed", s.SeccompProfilePath)
+ }
+ }
+
+ return seccompConfig, nil
+}
diff --git a/pkg/specgen/config_linux_nocgo.go b/pkg/specgen/config_linux_nocgo.go
new file mode 100644
index 000000000..fc0c58c37
--- /dev/null
+++ b/pkg/specgen/config_linux_nocgo.go
@@ -0,0 +1,11 @@
+// +build linux,!cgo
+
+package specgen
+
+import (
+ spec "github.com/opencontainers/runtime-spec/specs-go"
+)
+
+func (s *SpecGenerator) getSeccompConfig(configSpec *spec.Spec) (*spec.LinuxSeccomp, error) {
+ return nil, nil
+}
diff --git a/pkg/specgen/config_unsupported.go b/pkg/specgen/config_unsupported.go
new file mode 100644
index 000000000..c2d3257c9
--- /dev/null
+++ b/pkg/specgen/config_unsupported.go
@@ -0,0 +1,13 @@
+// +build !linux
+
+package specgen
+
+import (
+ "github.com/containers/libpod/libpod/image"
+ spec "github.com/opencontainers/runtime-spec/specs-go"
+ "github.com/pkg/errors"
+)
+
+func (s *SpecGenerator) getSeccompConfig(configSpec *spec.Spec, img *image.Image) (*spec.LinuxSeccomp, error) {
+ return nil, errors.New("function not supported on non-linux OS's")
+}
diff --git a/pkg/specgen/container_create.go b/pkg/specgen/container_create.go
new file mode 100644
index 000000000..b4039bb91
--- /dev/null
+++ b/pkg/specgen/container_create.go
@@ -0,0 +1,189 @@
+package specgen
+
+import (
+ "context"
+ "os"
+
+ "github.com/containers/common/pkg/config"
+ "github.com/containers/libpod/libpod"
+ "github.com/containers/libpod/libpod/define"
+ "github.com/containers/storage"
+ "github.com/pkg/errors"
+ "github.com/sirupsen/logrus"
+)
+
+// MakeContainer creates a container based on the SpecGenerator
+func (s *SpecGenerator) MakeContainer(rt *libpod.Runtime) (*libpod.Container, error) {
+ if err := s.validate(); err != nil {
+ return nil, errors.Wrap(err, "invalid config provided")
+ }
+ rtc, err := rt.GetConfig()
+ if err != nil {
+ return nil, err
+ }
+
+ options, err := s.createContainerOptions(rt)
+ if err != nil {
+ return nil, err
+ }
+
+ podmanPath, err := os.Executable()
+ if err != nil {
+ return nil, err
+ }
+ options = append(options, s.createExitCommandOption(rt.StorageConfig(), rtc, podmanPath))
+ newImage, err := rt.ImageRuntime().NewFromLocal(s.Image)
+ if err != nil {
+ return nil, err
+ }
+
+ options = append(options, libpod.WithRootFSFromImage(newImage.ID(), s.Image, s.RawImageName))
+
+ runtimeSpec, err := s.toOCISpec(rt, newImage)
+ if err != nil {
+ return nil, err
+ }
+ return rt.NewContainer(context.Background(), runtimeSpec, options...)
+}
+
+func (s *SpecGenerator) createContainerOptions(rt *libpod.Runtime) ([]libpod.CtrCreateOption, error) {
+ var options []libpod.CtrCreateOption
+ var err error
+
+ if s.Stdin {
+ options = append(options, libpod.WithStdin())
+ }
+ if len(s.Systemd) > 0 {
+ options = append(options, libpod.WithSystemd())
+ }
+ if len(s.Name) > 0 {
+ logrus.Debugf("setting container name %s", s.Name)
+ options = append(options, libpod.WithName(s.Name))
+ }
+ if s.Pod != "" {
+ pod, err := rt.LookupPod(s.Pod)
+ if err != nil {
+ return nil, err
+ }
+ logrus.Debugf("adding container to pod %s", s.Pod)
+ options = append(options, rt.WithPod(pod))
+ }
+ destinations := []string{}
+ // // Take all mount and named volume destinations.
+ for _, mount := range s.Mounts {
+ destinations = append(destinations, mount.Destination)
+ }
+ for _, volume := range s.Volumes {
+ destinations = append(destinations, volume.Dest)
+ }
+ options = append(options, libpod.WithUserVolumes(destinations))
+
+ if len(s.Volumes) != 0 {
+ options = append(options, libpod.WithNamedVolumes(s.Volumes))
+ }
+
+ if len(s.Command) != 0 {
+ options = append(options, libpod.WithCommand(s.Command))
+ }
+
+ options = append(options, libpod.WithEntrypoint(s.Entrypoint))
+ if s.StopSignal != nil {
+ options = append(options, libpod.WithStopSignal(*s.StopSignal))
+ }
+ if s.StopTimeout != nil {
+ options = append(options, libpod.WithStopTimeout(*s.StopTimeout))
+ }
+ if s.LogConfiguration != nil {
+ if len(s.LogConfiguration.Path) > 0 {
+ options = append(options, libpod.WithLogPath(s.LogConfiguration.Path))
+ }
+ if len(s.LogConfiguration.Options) > 0 && s.LogConfiguration.Options["tag"] != "" {
+ // Note: I'm really guessing here.
+ options = append(options, libpod.WithLogTag(s.LogConfiguration.Options["tag"]))
+ }
+
+ if len(s.LogConfiguration.Driver) > 0 {
+ options = append(options, libpod.WithLogDriver(s.LogConfiguration.Driver))
+ }
+ }
+
+ // Security options
+ if len(s.SelinuxOpts) > 0 {
+ options = append(options, libpod.WithSecLabels(s.SelinuxOpts))
+ }
+ options = append(options, libpod.WithPrivileged(s.Privileged))
+
+ // Get namespace related options
+ namespaceOptions, err := s.generateNamespaceContainerOpts(rt)
+ if err != nil {
+ return nil, err
+ }
+ options = append(options, namespaceOptions...)
+
+ if len(s.ConmonPidFile) > 0 {
+ options = append(options, libpod.WithConmonPidFile(s.ConmonPidFile))
+ }
+ options = append(options, libpod.WithLabels(s.Labels))
+ if s.ShmSize != nil {
+ options = append(options, libpod.WithShmSize(*s.ShmSize))
+ }
+ if s.Rootfs != "" {
+ options = append(options, libpod.WithRootFS(s.Rootfs))
+ }
+ // Default used if not overridden on command line
+
+ if s.RestartPolicy != "" {
+ if s.RestartPolicy == "unless-stopped" {
+ return nil, errors.Wrapf(define.ErrInvalidArg, "the unless-stopped restart policy is not supported")
+ }
+ if s.RestartRetries != nil {
+ options = append(options, libpod.WithRestartRetries(*s.RestartRetries))
+ }
+ options = append(options, libpod.WithRestartPolicy(s.RestartPolicy))
+ }
+
+ if s.ContainerHealthCheckConfig.HealthConfig != nil {
+ options = append(options, libpod.WithHealthCheck(s.ContainerHealthCheckConfig.HealthConfig))
+ logrus.Debugf("New container has a health check")
+ }
+ return options, nil
+}
+
+func (s *SpecGenerator) createExitCommandOption(storageConfig storage.StoreOptions, config *config.Config, podmanPath string) libpod.CtrCreateOption {
+ // We need a cleanup process for containers in the current model.
+ // But we can't assume that the caller is Podman - it could be another
+ // user of the API.
+ // As such, provide a way to specify a path to Podman, so we can
+ // still invoke a cleanup process.
+
+ command := []string{podmanPath,
+ "--root", storageConfig.GraphRoot,
+ "--runroot", storageConfig.RunRoot,
+ "--log-level", logrus.GetLevel().String(),
+ "--cgroup-manager", config.Engine.CgroupManager,
+ "--tmpdir", config.Engine.TmpDir,
+ }
+ if config.Engine.OCIRuntime != "" {
+ command = append(command, []string{"--runtime", config.Engine.OCIRuntime}...)
+ }
+ if storageConfig.GraphDriverName != "" {
+ command = append(command, []string{"--storage-driver", storageConfig.GraphDriverName}...)
+ }
+ for _, opt := range storageConfig.GraphDriverOptions {
+ command = append(command, []string{"--storage-opt", opt}...)
+ }
+ if config.Engine.EventsLogger != "" {
+ command = append(command, []string{"--events-backend", config.Engine.EventsLogger}...)
+ }
+
+ // TODO Mheon wants to leave this for now
+ //if s.sys {
+ // command = append(command, "--syslog", "true")
+ //}
+ command = append(command, []string{"container", "cleanup"}...)
+
+ if s.Remove {
+ command = append(command, "--rm")
+ }
+ return libpod.WithExitCommand(command)
+}
diff --git a/pkg/specgen/container_validate.go b/pkg/specgen/container_validate.go
new file mode 100644
index 000000000..b27659f5f
--- /dev/null
+++ b/pkg/specgen/container_validate.go
@@ -0,0 +1,167 @@
+package specgen
+
+import (
+ "strings"
+
+ "github.com/containers/libpod/pkg/rootless"
+ "github.com/containers/libpod/pkg/util"
+ "github.com/pkg/errors"
+)
+
+var (
+ // ErrInvalidSpecConfig describes an error that the given SpecGenerator is invalid
+ ErrInvalidSpecConfig error = errors.New("invalid configuration")
+ // SystemDValues describes the only values that SystemD can be
+ SystemDValues = []string{"true", "false", "always"}
+ // ImageVolumeModeValues describes the only values that ImageVolumeMode can be
+ ImageVolumeModeValues = []string{"ignore", "tmpfs", "anonymous"}
+)
+
+func exclusiveOptions(opt1, opt2 string) error {
+ return errors.Errorf("%s and %s are mutually exclusive options", opt1, opt2)
+}
+
+// Validate verifies that the given SpecGenerator is valid and satisfies required
+// input for creating a container.
+func (s *SpecGenerator) validate() error {
+
+ //
+ // ContainerBasicConfig
+ //
+ // Rootfs and Image cannot both populated
+ if len(s.ContainerStorageConfig.Image) > 0 && len(s.ContainerStorageConfig.Rootfs) > 0 {
+ return errors.Wrap(ErrInvalidSpecConfig, "both image and rootfs cannot be simultaneously")
+ }
+ // Cannot set hostname and utsns
+ if len(s.ContainerBasicConfig.Hostname) > 0 && !s.ContainerBasicConfig.UtsNS.IsPrivate() {
+ return errors.Wrap(ErrInvalidSpecConfig, "cannot set hostname when creating an UTS namespace")
+ }
+ // systemd values must be true, false, or always
+ if len(s.ContainerBasicConfig.Systemd) > 0 && !util.StringInSlice(strings.ToLower(s.ContainerBasicConfig.Systemd), SystemDValues) {
+ return errors.Wrapf(ErrInvalidSpecConfig, "SystemD values must be one of %s", strings.Join(SystemDValues, ","))
+ }
+
+ //
+ // ContainerStorageConfig
+ //
+ // rootfs and image cannot both be set
+ if len(s.ContainerStorageConfig.Image) > 0 && len(s.ContainerStorageConfig.Rootfs) > 0 {
+ return exclusiveOptions("rootfs", "image")
+ }
+ // imagevolumemode must be one of ignore, tmpfs, or anonymous if given
+ if len(s.ContainerStorageConfig.ImageVolumeMode) > 0 && !util.StringInSlice(strings.ToLower(s.ContainerStorageConfig.ImageVolumeMode), ImageVolumeModeValues) {
+ return errors.Errorf("ImageVolumeMode values must be one of %s", strings.Join(ImageVolumeModeValues, ","))
+ }
+ // shmsize conflicts with IPC namespace
+ if s.ContainerStorageConfig.ShmSize != nil && !s.ContainerStorageConfig.IpcNS.IsPrivate() {
+ return errors.New("cannot set shmsize when creating an IPC namespace")
+ }
+
+ //
+ // ContainerSecurityConfig
+ //
+ // groups and privileged are exclusive
+ if len(s.Groups) > 0 && s.Privileged {
+ return exclusiveOptions("Groups", "privileged")
+ }
+ // capadd and privileged are exclusive
+ if len(s.CapAdd) > 0 && s.Privileged {
+ return exclusiveOptions("CapAdd", "privileged")
+ }
+ // selinuxprocesslabel and privileged are exclusive
+ if len(s.SelinuxProcessLabel) > 0 && s.Privileged {
+ return exclusiveOptions("SelinuxProcessLabel", "privileged")
+ }
+ // selinuxmounmtlabel and privileged are exclusive
+ if len(s.SelinuxMountLabel) > 0 && s.Privileged {
+ return exclusiveOptions("SelinuxMountLabel", "privileged")
+ }
+ // selinuxopts and privileged are exclusive
+ if len(s.SelinuxOpts) > 0 && s.Privileged {
+ return exclusiveOptions("SelinuxOpts", "privileged")
+ }
+ // apparmor and privileged are exclusive
+ if len(s.ApparmorProfile) > 0 && s.Privileged {
+ return exclusiveOptions("AppArmorProfile", "privileged")
+ }
+ // userns and idmappings conflict
+ if s.UserNS.IsPrivate() && s.IDMappings == nil {
+ return errors.Wrap(ErrInvalidSpecConfig, "IDMappings are required when not creating a User namespace")
+ }
+
+ //
+ // ContainerCgroupConfig
+ //
+ //
+ // None for now
+
+ //
+ // ContainerNetworkConfig
+ //
+ if !s.NetNS.IsPrivate() && s.ConfigureNetNS {
+ return errors.New("can only configure network namespace when creating a network a network namespace")
+ }
+ // useimageresolveconf conflicts with dnsserver, dnssearch, dnsoption
+ if s.UseImageResolvConf {
+ if len(s.DNSServer) > 0 {
+ return exclusiveOptions("UseImageResolvConf", "DNSServer")
+ }
+ if len(s.DNSSearch) > 0 {
+ return exclusiveOptions("UseImageResolvConf", "DNSSearch")
+ }
+ if len(s.DNSOption) > 0 {
+ return exclusiveOptions("UseImageResolvConf", "DNSOption")
+ }
+ }
+ // UseImageHosts and HostAdd are exclusive
+ if s.UseImageHosts && len(s.HostAdd) > 0 {
+ return exclusiveOptions("UseImageHosts", "HostAdd")
+ }
+
+ // TODO the specgen does not appear to handle this? Should it
+ //switch config.Cgroup.Cgroups {
+ //case "disabled":
+ // if addedResources {
+ // return errors.New("cannot specify resource limits when cgroups are disabled is specified")
+ // }
+ // configSpec.Linux.Resources = &spec.LinuxResources{}
+ //case "enabled", "no-conmon", "":
+ // // Do nothing
+ //default:
+ // return errors.New("unrecognized option for cgroups; supported are 'default', 'disabled', 'no-conmon'")
+ //}
+
+ // Namespaces
+ if err := s.UtsNS.validate(); err != nil {
+ return err
+ }
+ if err := s.IpcNS.validate(); err != nil {
+ return err
+ }
+ if err := s.PidNS.validate(); err != nil {
+ return err
+ }
+ if err := s.CgroupNS.validate(); err != nil {
+ return err
+ }
+ if err := s.UserNS.validate(); err != nil {
+ return err
+ }
+
+ // The following are defaults as needed by container creation
+ if len(s.WorkDir) < 1 {
+ s.WorkDir = "/"
+ }
+
+ // Set defaults if network info is not provided
+ if s.NetNS.NSMode == "" {
+ s.NetNS.NSMode = Bridge
+ if rootless.IsRootless() {
+ s.NetNS.NSMode = Slirp
+ }
+ }
+ if err := validateNetNS(&s.NetNS); err != nil {
+ return err
+ }
+ return nil
+}
diff --git a/pkg/specgen/namespaces.go b/pkg/specgen/namespaces.go
new file mode 100644
index 000000000..fa2dee77d
--- /dev/null
+++ b/pkg/specgen/namespaces.go
@@ -0,0 +1,474 @@
+package specgen
+
+import (
+ "os"
+
+ "github.com/containers/common/pkg/capabilities"
+ "github.com/containers/libpod/libpod"
+ "github.com/containers/libpod/libpod/image"
+ "github.com/cri-o/ocicni/pkg/ocicni"
+ spec "github.com/opencontainers/runtime-spec/specs-go"
+ "github.com/opencontainers/runtime-tools/generate"
+ "github.com/pkg/errors"
+ "github.com/sirupsen/logrus"
+)
+
+type NamespaceMode string
+
+const (
+ // Host means the the namespace is derived from
+ // the host
+ Host NamespaceMode = "host"
+ // Path is the path to a namespace
+ Path NamespaceMode = "path"
+ // FromContainer means namespace is derived from a
+ // different container
+ FromContainer NamespaceMode = "container"
+ // FromPod indicates the namespace is derived from a pod
+ FromPod NamespaceMode = "pod"
+ // Private indicates the namespace is private
+ Private NamespaceMode = "private"
+ // NoNetwork indicates no network namespace should
+ // be joined. loopback should still exists
+ NoNetwork NamespaceMode = "none"
+ // Bridge indicates that a CNI network stack
+ // should be used
+ Bridge NamespaceMode = "bridge"
+ // Slirp indicates that a slirp4ns network stack should
+ // be used
+ Slirp NamespaceMode = "slirp4ns"
+)
+
+// Namespace describes the namespace
+type Namespace struct {
+ NSMode NamespaceMode `json:"nsmode,omitempty"`
+ Value string `json:"string,omitempty"`
+}
+
+// IsHost returns a bool if the namespace is host based
+func (n *Namespace) IsHost() bool {
+ return n.NSMode == Host
+}
+
+// IsPath indicates via bool if the namespace is based on a path
+func (n *Namespace) IsPath() bool {
+ return n.NSMode == Path
+}
+
+// IsContainer indicates via bool if the namespace is based on a container
+func (n *Namespace) IsContainer() bool {
+ return n.NSMode == FromContainer
+}
+
+// IsPod indicates via bool if the namespace is based on a pod
+func (n *Namespace) IsPod() bool {
+ return n.NSMode == FromPod
+}
+
+// IsPrivate indicates the namespace is private
+func (n *Namespace) IsPrivate() bool {
+ return n.NSMode == Private
+}
+
+func validateNetNS(n *Namespace) error {
+ if n == nil {
+ return nil
+ }
+ switch n.NSMode {
+ case Host, Path, FromContainer, FromPod, Private, NoNetwork, Bridge, Slirp:
+ break
+ default:
+ return errors.Errorf("invalid network %q", n.NSMode)
+ }
+ return nil
+}
+
+// validate perform simple validation on the namespace to make sure it is not
+// invalid from the get-go
+func (n *Namespace) validate() error {
+ if n == nil {
+ return nil
+ }
+ // Path and From Container MUST have a string value set
+ if n.NSMode == Path || n.NSMode == FromContainer {
+ if len(n.Value) < 1 {
+ return errors.Errorf("namespace mode %s requires a value", n.NSMode)
+ }
+ } else {
+ // All others must NOT set a string value
+ if len(n.Value) > 0 {
+ return errors.Errorf("namespace value %s cannot be provided with namespace mode %s", n.Value, n.NSMode)
+ }
+ }
+ return nil
+}
+
+func (s *SpecGenerator) generateNamespaceContainerOpts(rt *libpod.Runtime) ([]libpod.CtrCreateOption, error) {
+ var portBindings []ocicni.PortMapping
+ options := make([]libpod.CtrCreateOption, 0)
+
+ // Cgroups
+ switch {
+ case s.CgroupNS.IsPrivate():
+ ns := s.CgroupNS.Value
+ if _, err := os.Stat(ns); err != nil {
+ return nil, err
+ }
+ case s.CgroupNS.IsContainer():
+ connectedCtr, err := rt.LookupContainer(s.CgroupNS.Value)
+ if err != nil {
+ return nil, errors.Wrapf(err, "container %q not found", s.CgroupNS.Value)
+ }
+ options = append(options, libpod.WithCgroupNSFrom(connectedCtr))
+ // TODO
+ //default:
+ // return nil, errors.New("cgroup name only supports private and container")
+ }
+
+ if s.CgroupParent != "" {
+ options = append(options, libpod.WithCgroupParent(s.CgroupParent))
+ }
+
+ if s.CgroupsMode != "" {
+ options = append(options, libpod.WithCgroupsMode(s.CgroupsMode))
+ }
+
+ // ipc
+ switch {
+ case s.IpcNS.IsHost():
+ options = append(options, libpod.WithShmDir("/dev/shm"))
+ case s.IpcNS.IsContainer():
+ connectedCtr, err := rt.LookupContainer(s.IpcNS.Value)
+ if err != nil {
+ return nil, errors.Wrapf(err, "container %q not found", s.IpcNS.Value)
+ }
+ options = append(options, libpod.WithIPCNSFrom(connectedCtr))
+ options = append(options, libpod.WithShmDir(connectedCtr.ShmDir()))
+ }
+
+ // pid
+ if s.PidNS.IsContainer() {
+ connectedCtr, err := rt.LookupContainer(s.PidNS.Value)
+ if err != nil {
+ return nil, errors.Wrapf(err, "container %q not found", s.PidNS.Value)
+ }
+ options = append(options, libpod.WithPIDNSFrom(connectedCtr))
+ }
+
+ // uts
+ switch {
+ case s.UtsNS.IsPod():
+ connectedPod, err := rt.LookupPod(s.UtsNS.Value)
+ if err != nil {
+ return nil, errors.Wrapf(err, "pod %q not found", s.UtsNS.Value)
+ }
+ options = append(options, libpod.WithUTSNSFromPod(connectedPod))
+ case s.UtsNS.IsContainer():
+ connectedCtr, err := rt.LookupContainer(s.UtsNS.Value)
+ if err != nil {
+ return nil, errors.Wrapf(err, "container %q not found", s.UtsNS.Value)
+ }
+
+ options = append(options, libpod.WithUTSNSFrom(connectedCtr))
+ }
+
+ if s.UseImageHosts {
+ options = append(options, libpod.WithUseImageHosts())
+ } else if len(s.HostAdd) > 0 {
+ options = append(options, libpod.WithHosts(s.HostAdd))
+ }
+
+ // User
+
+ switch {
+ case s.UserNS.IsPath():
+ ns := s.UserNS.Value
+ if ns == "" {
+ return nil, errors.Errorf("invalid empty user-defined user namespace")
+ }
+ _, err := os.Stat(ns)
+ if err != nil {
+ return nil, err
+ }
+ if s.IDMappings != nil {
+ options = append(options, libpod.WithIDMappings(*s.IDMappings))
+ }
+ case s.UserNS.IsContainer():
+ connectedCtr, err := rt.LookupContainer(s.UserNS.Value)
+ if err != nil {
+ return nil, errors.Wrapf(err, "container %q not found", s.UserNS.Value)
+ }
+ options = append(options, libpod.WithUserNSFrom(connectedCtr))
+ default:
+ if s.IDMappings != nil {
+ options = append(options, libpod.WithIDMappings(*s.IDMappings))
+ }
+ }
+
+ options = append(options, libpod.WithUser(s.User))
+ options = append(options, libpod.WithGroups(s.Groups))
+
+ if len(s.PortMappings) > 0 {
+ portBindings = s.PortMappings
+ }
+
+ switch {
+ case s.NetNS.IsPath():
+ ns := s.NetNS.Value
+ if ns == "" {
+ return nil, errors.Errorf("invalid empty user-defined network namespace")
+ }
+ _, err := os.Stat(ns)
+ if err != nil {
+ return nil, err
+ }
+ case s.NetNS.IsContainer():
+ connectedCtr, err := rt.LookupContainer(s.NetNS.Value)
+ if err != nil {
+ return nil, errors.Wrapf(err, "container %q not found", s.NetNS.Value)
+ }
+ options = append(options, libpod.WithNetNSFrom(connectedCtr))
+ case !s.NetNS.IsHost() && s.NetNS.NSMode != NoNetwork:
+ postConfigureNetNS := !s.UserNS.IsHost()
+ options = append(options, libpod.WithNetNS(portBindings, postConfigureNetNS, string(s.NetNS.NSMode), s.CNINetworks))
+ }
+
+ if len(s.DNSSearch) > 0 {
+ options = append(options, libpod.WithDNSSearch(s.DNSSearch))
+ }
+ if len(s.DNSServer) > 0 {
+ // TODO I'm not sure how we are going to handle this given the input
+ if len(s.DNSServer) == 1 { //&& strings.ToLower(s.DNSServer[0].) == "none" {
+ options = append(options, libpod.WithUseImageResolvConf())
+ } else {
+ var dnsServers []string
+ for _, d := range s.DNSServer {
+ dnsServers = append(dnsServers, d.String())
+ }
+ options = append(options, libpod.WithDNS(dnsServers))
+ }
+ }
+ if len(s.DNSOption) > 0 {
+ options = append(options, libpod.WithDNSOption(s.DNSOption))
+ }
+ if s.StaticIP != nil {
+ options = append(options, libpod.WithStaticIP(*s.StaticIP))
+ }
+
+ if s.StaticMAC != nil {
+ options = append(options, libpod.WithStaticMAC(*s.StaticMAC))
+ }
+ return options, nil
+}
+
+func (s *SpecGenerator) pidConfigureGenerator(g *generate.Generator) error {
+ if s.PidNS.IsPath() {
+ return g.AddOrReplaceLinuxNamespace(string(spec.PIDNamespace), s.PidNS.Value)
+ }
+ if s.PidNS.IsHost() {
+ return g.RemoveLinuxNamespace(string(spec.PIDNamespace))
+ }
+ if s.PidNS.IsContainer() {
+ logrus.Debugf("using container %s pidmode", s.PidNS.Value)
+ }
+ if s.PidNS.IsPod() {
+ logrus.Debug("using pod pidmode")
+ }
+ return nil
+}
+
+func (s *SpecGenerator) utsConfigureGenerator(g *generate.Generator, runtime *libpod.Runtime) error {
+ hostname := s.Hostname
+ var err error
+ if hostname == "" {
+ switch {
+ case s.UtsNS.IsContainer():
+ utsCtr, err := runtime.LookupContainer(s.UtsNS.Value)
+ if err != nil {
+ return errors.Wrapf(err, "unable to retrieve hostname from dependency container %s", s.UtsNS.Value)
+ }
+ hostname = utsCtr.Hostname()
+ case s.NetNS.IsHost() || s.UtsNS.IsHost():
+ hostname, err = os.Hostname()
+ if err != nil {
+ return errors.Wrap(err, "unable to retrieve hostname of the host")
+ }
+ default:
+ logrus.Debug("No hostname set; container's hostname will default to runtime default")
+ }
+ }
+ g.RemoveHostname()
+ if s.Hostname != "" || !s.UtsNS.IsHost() {
+ // Set the hostname in the OCI configuration only
+ // if specified by the user or if we are creating
+ // a new UTS namespace.
+ g.SetHostname(hostname)
+ }
+ g.AddProcessEnv("HOSTNAME", hostname)
+
+ if s.UtsNS.IsPath() {
+ return g.AddOrReplaceLinuxNamespace(string(spec.UTSNamespace), s.UtsNS.Value)
+ }
+ if s.UtsNS.IsHost() {
+ return g.RemoveLinuxNamespace(string(spec.UTSNamespace))
+ }
+ if s.UtsNS.IsContainer() {
+ logrus.Debugf("using container %s utsmode", s.UtsNS.Value)
+ }
+ return nil
+}
+
+func (s *SpecGenerator) ipcConfigureGenerator(g *generate.Generator) error {
+ if s.IpcNS.IsPath() {
+ return g.AddOrReplaceLinuxNamespace(string(spec.IPCNamespace), s.IpcNS.Value)
+ }
+ if s.IpcNS.IsHost() {
+ return g.RemoveLinuxNamespace(s.IpcNS.Value)
+ }
+ if s.IpcNS.IsContainer() {
+ logrus.Debugf("Using container %s ipcmode", s.IpcNS.Value)
+ }
+ return nil
+}
+
+func (s *SpecGenerator) cgroupConfigureGenerator(g *generate.Generator) error {
+ if s.CgroupNS.IsPath() {
+ return g.AddOrReplaceLinuxNamespace(string(spec.CgroupNamespace), s.CgroupNS.Value)
+ }
+ if s.CgroupNS.IsHost() {
+ return g.RemoveLinuxNamespace(s.CgroupNS.Value)
+ }
+ if s.CgroupNS.IsPrivate() {
+ return g.AddOrReplaceLinuxNamespace(string(spec.CgroupNamespace), "")
+ }
+ if s.CgroupNS.IsContainer() {
+ logrus.Debugf("Using container %s cgroup mode", s.CgroupNS.Value)
+ }
+ return nil
+}
+
+func (s *SpecGenerator) networkConfigureGenerator(g *generate.Generator) error {
+ switch {
+ case s.NetNS.IsHost():
+ logrus.Debug("Using host netmode")
+ if err := g.RemoveLinuxNamespace(string(spec.NetworkNamespace)); err != nil {
+ return err
+ }
+
+ case s.NetNS.NSMode == NoNetwork:
+ logrus.Debug("Using none netmode")
+ case s.NetNS.NSMode == Bridge:
+ logrus.Debug("Using bridge netmode")
+ case s.NetNS.IsContainer():
+ logrus.Debugf("using container %s netmode", s.NetNS.Value)
+ case s.NetNS.IsPath():
+ logrus.Debug("Using ns netmode")
+ if err := g.AddOrReplaceLinuxNamespace(string(spec.NetworkNamespace), s.NetNS.Value); err != nil {
+ return err
+ }
+ case s.NetNS.IsPod():
+ logrus.Debug("Using pod netmode, unless pod is not sharing")
+ case s.NetNS.NSMode == Slirp:
+ logrus.Debug("Using slirp4netns netmode")
+ default:
+ return errors.Errorf("unknown network mode")
+ }
+
+ if g.Config.Annotations == nil {
+ g.Config.Annotations = make(map[string]string)
+ }
+
+ if s.PublishImagePorts {
+ g.Config.Annotations[libpod.InspectAnnotationPublishAll] = libpod.InspectResponseTrue
+ } else {
+ g.Config.Annotations[libpod.InspectAnnotationPublishAll] = libpod.InspectResponseFalse
+ }
+
+ return nil
+}
+
+func (s *SpecGenerator) userConfigureGenerator(g *generate.Generator) error {
+ if s.UserNS.IsPath() {
+ if err := g.AddOrReplaceLinuxNamespace(string(spec.UserNamespace), s.UserNS.Value); err != nil {
+ return err
+ }
+ // runc complains if no mapping is specified, even if we join another ns. So provide a dummy mapping
+ g.AddLinuxUIDMapping(uint32(0), uint32(0), uint32(1))
+ g.AddLinuxGIDMapping(uint32(0), uint32(0), uint32(1))
+ }
+
+ if s.IDMappings != nil {
+ if (len(s.IDMappings.UIDMap) > 0 || len(s.IDMappings.GIDMap) > 0) && !s.UserNS.IsHost() {
+ if err := g.AddOrReplaceLinuxNamespace(string(spec.UserNamespace), ""); err != nil {
+ return err
+ }
+ }
+ for _, uidmap := range s.IDMappings.UIDMap {
+ g.AddLinuxUIDMapping(uint32(uidmap.HostID), uint32(uidmap.ContainerID), uint32(uidmap.Size))
+ }
+ for _, gidmap := range s.IDMappings.GIDMap {
+ g.AddLinuxGIDMapping(uint32(gidmap.HostID), uint32(gidmap.ContainerID), uint32(gidmap.Size))
+ }
+ }
+ return nil
+}
+
+func (s *SpecGenerator) securityConfigureGenerator(g *generate.Generator, newImage *image.Image) error {
+ // HANDLE CAPABILITIES
+ // NOTE: Must happen before SECCOMP
+ if s.Privileged {
+ g.SetupPrivileged(true)
+ }
+
+ useNotRoot := func(user string) bool {
+ if user == "" || user == "root" || user == "0" {
+ return false
+ }
+ return true
+ }
+ configSpec := g.Config
+ var err error
+ var caplist []string
+ bounding := configSpec.Process.Capabilities.Bounding
+ if useNotRoot(s.User) {
+ configSpec.Process.Capabilities.Bounding = caplist
+ }
+ caplist, err = capabilities.MergeCapabilities(configSpec.Process.Capabilities.Bounding, s.CapAdd, s.CapDrop)
+ if err != nil {
+ return err
+ }
+
+ configSpec.Process.Capabilities.Bounding = caplist
+ configSpec.Process.Capabilities.Permitted = caplist
+ configSpec.Process.Capabilities.Inheritable = caplist
+ configSpec.Process.Capabilities.Effective = caplist
+ configSpec.Process.Capabilities.Ambient = caplist
+ if useNotRoot(s.User) {
+ caplist, err = capabilities.MergeCapabilities(bounding, s.CapAdd, s.CapDrop)
+ if err != nil {
+ return err
+ }
+ }
+ configSpec.Process.Capabilities.Bounding = caplist
+
+ // HANDLE SECCOMP
+ if s.SeccompProfilePath != "unconfined" {
+ seccompConfig, err := s.getSeccompConfig(configSpec, newImage)
+ if err != nil {
+ return err
+ }
+ configSpec.Linux.Seccomp = seccompConfig
+ }
+
+ // Clear default Seccomp profile from Generator for privileged containers
+ if s.SeccompProfilePath == "unconfined" || s.Privileged {
+ configSpec.Linux.Seccomp = nil
+ }
+
+ g.SetRootReadonly(s.ReadOnlyFilesystem)
+ for sysctlKey, sysctlVal := range s.Sysctl {
+ g.AddLinuxSysctl(sysctlKey, sysctlVal)
+ }
+
+ return nil
+}
diff --git a/pkg/specgen/oci.go b/pkg/specgen/oci.go
new file mode 100644
index 000000000..2523f21b3
--- /dev/null
+++ b/pkg/specgen/oci.go
@@ -0,0 +1,260 @@
+package specgen
+
+import (
+ "strings"
+
+ "github.com/containers/libpod/libpod"
+ "github.com/containers/libpod/libpod/image"
+ "github.com/containers/libpod/pkg/rootless"
+ createconfig "github.com/containers/libpod/pkg/spec"
+ spec "github.com/opencontainers/runtime-spec/specs-go"
+ "github.com/opencontainers/runtime-tools/generate"
+)
+
+func (s *SpecGenerator) toOCISpec(rt *libpod.Runtime, newImage *image.Image) (*spec.Spec, error) {
+ var (
+ inUserNS bool
+ )
+ cgroupPerm := "ro"
+ g, err := generate.New("linux")
+ if err != nil {
+ return nil, err
+ }
+ // Remove the default /dev/shm mount to ensure we overwrite it
+ g.RemoveMount("/dev/shm")
+ g.HostSpecific = true
+ addCgroup := true
+ canMountSys := true
+
+ isRootless := rootless.IsRootless()
+ if isRootless {
+ inUserNS = true
+ }
+ if !s.UserNS.IsHost() {
+ if s.UserNS.IsContainer() || s.UserNS.IsPath() {
+ inUserNS = true
+ }
+ if s.UserNS.IsPrivate() {
+ inUserNS = true
+ }
+ }
+ if inUserNS && s.NetNS.IsHost() {
+ canMountSys = false
+ }
+
+ if s.Privileged && canMountSys {
+ cgroupPerm = "rw"
+ g.RemoveMount("/sys")
+ sysMnt := spec.Mount{
+ Destination: "/sys",
+ Type: "sysfs",
+ Source: "sysfs",
+ Options: []string{"rprivate", "nosuid", "noexec", "nodev", "rw"},
+ }
+ g.AddMount(sysMnt)
+ } else if !canMountSys {
+ addCgroup = false
+ g.RemoveMount("/sys")
+ r := "ro"
+ if s.Privileged {
+ r = "rw"
+ }
+ sysMnt := spec.Mount{
+ Destination: "/sys",
+ Type: "bind", // should we use a constant for this, like createconfig?
+ Source: "/sys",
+ Options: []string{"rprivate", "nosuid", "noexec", "nodev", r, "rbind"},
+ }
+ g.AddMount(sysMnt)
+ if !s.Privileged && isRootless {
+ g.AddLinuxMaskedPaths("/sys/kernel")
+ }
+ }
+ gid5Available := true
+ if isRootless {
+ nGids, err := createconfig.GetAvailableGids()
+ if err != nil {
+ return nil, err
+ }
+ gid5Available = nGids >= 5
+ }
+ // When using a different user namespace, check that the GID 5 is mapped inside
+ // the container.
+ if gid5Available && (s.IDMappings != nil && len(s.IDMappings.GIDMap) > 0) {
+ mappingFound := false
+ for _, r := range s.IDMappings.GIDMap {
+ if r.ContainerID <= 5 && 5 < r.ContainerID+r.Size {
+ mappingFound = true
+ break
+ }
+ }
+ if !mappingFound {
+ gid5Available = false
+ }
+
+ }
+ if !gid5Available {
+ // If we have no GID mappings, the gid=5 default option would fail, so drop it.
+ g.RemoveMount("/dev/pts")
+ devPts := spec.Mount{
+ Destination: "/dev/pts",
+ Type: "devpts",
+ Source: "devpts",
+ Options: []string{"rprivate", "nosuid", "noexec", "newinstance", "ptmxmode=0666", "mode=0620"},
+ }
+ g.AddMount(devPts)
+ }
+
+ if inUserNS && s.IpcNS.IsHost() {
+ g.RemoveMount("/dev/mqueue")
+ devMqueue := spec.Mount{
+ Destination: "/dev/mqueue",
+ Type: "bind", // constant ?
+ Source: "/dev/mqueue",
+ Options: []string{"bind", "nosuid", "noexec", "nodev"},
+ }
+ g.AddMount(devMqueue)
+ }
+ if inUserNS && s.PidNS.IsHost() {
+ g.RemoveMount("/proc")
+ procMount := spec.Mount{
+ Destination: "/proc",
+ Type: createconfig.TypeBind,
+ Source: "/proc",
+ Options: []string{"rbind", "nosuid", "noexec", "nodev"},
+ }
+ g.AddMount(procMount)
+ }
+
+ if addCgroup {
+ cgroupMnt := spec.Mount{
+ Destination: "/sys/fs/cgroup",
+ Type: "cgroup",
+ Source: "cgroup",
+ Options: []string{"rprivate", "nosuid", "noexec", "nodev", "relatime", cgroupPerm},
+ }
+ g.AddMount(cgroupMnt)
+ }
+ g.SetProcessCwd(s.WorkDir)
+ g.SetProcessArgs(s.Command)
+ g.SetProcessTerminal(s.Terminal)
+
+ for key, val := range s.Annotations {
+ g.AddAnnotation(key, val)
+ }
+ g.AddProcessEnv("container", "podman")
+
+ g.Config.Linux.Resources = s.ResourceLimits
+
+ // Devices
+ if s.Privileged {
+ // If privileged, we need to add all the host devices to the
+ // spec. We do not add the user provided ones because we are
+ // already adding them all.
+ if err := createconfig.AddPrivilegedDevices(&g); err != nil {
+ return nil, err
+ }
+ } else {
+ for _, device := range s.Devices {
+ if err := createconfig.DevicesFromPath(&g, device.Path); err != nil {
+ return nil, err
+ }
+ }
+ }
+
+ // SECURITY OPTS
+ g.SetProcessNoNewPrivileges(s.NoNewPrivileges)
+
+ if !s.Privileged {
+ g.SetProcessApparmorProfile(s.ApparmorProfile)
+ }
+
+ createconfig.BlockAccessToKernelFilesystems(s.Privileged, s.PidNS.IsHost(), &g)
+
+ for name, val := range s.Env {
+ g.AddProcessEnv(name, val)
+ }
+
+ // TODO rlimits and ulimits needs further refinement by someone more
+ // familiar with the code.
+ //if err := addRlimits(config, &g); err != nil {
+ // return nil, err
+ //}
+
+ // NAMESPACES
+
+ if err := s.pidConfigureGenerator(&g); err != nil {
+ return nil, err
+ }
+
+ if err := s.userConfigureGenerator(&g); err != nil {
+ return nil, err
+ }
+
+ if err := s.networkConfigureGenerator(&g); err != nil {
+ return nil, err
+ }
+
+ if err := s.utsConfigureGenerator(&g, rt); err != nil {
+ return nil, err
+ }
+
+ if err := s.ipcConfigureGenerator(&g); err != nil {
+ return nil, err
+ }
+
+ if err := s.cgroupConfigureGenerator(&g); err != nil {
+ return nil, err
+ }
+ configSpec := g.Config
+
+ if err := s.securityConfigureGenerator(&g, newImage); err != nil {
+ return nil, err
+ }
+
+ // BIND MOUNTS
+ configSpec.Mounts = createconfig.SupercedeUserMounts(s.Mounts, configSpec.Mounts)
+ // Process mounts to ensure correct options
+ finalMounts, err := createconfig.InitFSMounts(configSpec.Mounts)
+ if err != nil {
+ return nil, err
+ }
+ configSpec.Mounts = finalMounts
+
+ // Add annotations
+ if configSpec.Annotations == nil {
+ configSpec.Annotations = make(map[string]string)
+ }
+
+ // TODO cidfile is not in specgen; when wiring up cli, we will need to move this out of here
+ // leaving as a reminder
+ //if config.CidFile != "" {
+ // configSpec.Annotations[libpod.InspectAnnotationCIDFile] = config.CidFile
+ //}
+
+ if s.Remove {
+ configSpec.Annotations[libpod.InspectAnnotationAutoremove] = libpod.InspectResponseTrue
+ } else {
+ configSpec.Annotations[libpod.InspectAnnotationAutoremove] = libpod.InspectResponseFalse
+ }
+
+ if len(s.VolumesFrom) > 0 {
+ configSpec.Annotations[libpod.InspectAnnotationVolumesFrom] = strings.Join(s.VolumesFrom, ",")
+ }
+
+ if s.Privileged {
+ configSpec.Annotations[libpod.InspectAnnotationPrivileged] = libpod.InspectResponseTrue
+ } else {
+ configSpec.Annotations[libpod.InspectAnnotationPrivileged] = libpod.InspectResponseFalse
+ }
+
+ // TODO Init might not make it into the specgen and therefore is not available here. We should deal
+ // with this when we wire up the CLI; leaving as a reminder
+ //if s.Init {
+ // configSpec.Annotations[libpod.InspectAnnotationInit] = libpod.InspectResponseTrue
+ //} else {
+ // configSpec.Annotations[libpod.InspectAnnotationInit] = libpod.InspectResponseFalse
+ //}
+
+ return configSpec, nil
+}
diff --git a/pkg/specgen/pod_create.go b/pkg/specgen/pod_create.go
new file mode 100644
index 000000000..06aa24e22
--- /dev/null
+++ b/pkg/specgen/pod_create.go
@@ -0,0 +1,83 @@
+package specgen
+
+import (
+ "context"
+
+ "github.com/containers/libpod/cmd/podman/shared"
+ "github.com/containers/libpod/libpod"
+ "github.com/sirupsen/logrus"
+)
+
+func (p *PodSpecGenerator) MakePod(rt *libpod.Runtime) (*libpod.Pod, error) {
+ if err := p.validate(); err != nil {
+ return nil, err
+ }
+ options, err := p.createPodOptions()
+ if err != nil {
+ return nil, err
+ }
+ return rt.NewPod(context.Background(), options...)
+}
+
+func (p *PodSpecGenerator) createPodOptions() ([]libpod.PodCreateOption, error) {
+ var (
+ options []libpod.PodCreateOption
+ )
+ if !p.NoInfra {
+ options = append(options, libpod.WithInfraContainer())
+ nsOptions, err := shared.GetNamespaceOptions(p.SharedNamespaces)
+ if err != nil {
+ return nil, err
+ }
+ options = append(options, nsOptions...)
+ }
+ if len(p.CgroupParent) > 0 {
+ options = append(options, libpod.WithPodCgroupParent(p.CgroupParent))
+ }
+ if len(p.Labels) > 0 {
+ options = append(options, libpod.WithPodLabels(p.Labels))
+ }
+ if len(p.Name) > 0 {
+ options = append(options, libpod.WithPodName(p.Name))
+ }
+ if len(p.Hostname) > 0 {
+ options = append(options, libpod.WithPodHostname(p.Hostname))
+ }
+ if len(p.HostAdd) > 0 {
+ options = append(options, libpod.WithPodHosts(p.HostAdd))
+ }
+ if len(p.DNSOption) > 0 {
+ options = append(options, libpod.WithPodDNSOption(p.DNSOption))
+ }
+ if len(p.DNSSearch) > 0 {
+ options = append(options, libpod.WithPodDNSSearch(p.DNSSearch))
+ }
+ if p.StaticIP != nil {
+ options = append(options, libpod.WithPodStaticIP(*p.StaticIP))
+ }
+ if p.StaticMAC != nil {
+ options = append(options, libpod.WithPodStaticMAC(*p.StaticMAC))
+ }
+ if p.NoManageResolvConf {
+ options = append(options, libpod.WithPodUseImageResolvConf())
+ }
+ switch p.NetNS.NSMode {
+ case Bridge:
+ logrus.Debugf("Pod using default network mode")
+ case Host:
+ logrus.Debugf("Pod will use host networking")
+ options = append(options, libpod.WithPodHostNetwork())
+ default:
+ logrus.Debugf("Pod joining CNI networks: %v", p.CNINetworks)
+ options = append(options, libpod.WithPodNetworks(p.CNINetworks))
+ }
+
+ if p.NoManageHosts {
+ options = append(options, libpod.WithPodUseImageHosts())
+ }
+ if len(p.PortMappings) > 0 {
+ options = append(options, libpod.WithInfraContainerPorts(p.PortMappings))
+ }
+ options = append(options, libpod.WithPodCgroups())
+ return options, nil
+}
diff --git a/pkg/specgen/pod_validate.go b/pkg/specgen/pod_validate.go
new file mode 100644
index 000000000..50309f096
--- /dev/null
+++ b/pkg/specgen/pod_validate.go
@@ -0,0 +1,104 @@
+package specgen
+
+import (
+ "github.com/containers/libpod/libpod/define"
+ "github.com/containers/libpod/pkg/rootless"
+ "github.com/pkg/errors"
+)
+
+var (
+ // ErrInvalidPodSpecConfig describes an error given when the podspecgenerator is invalid
+ ErrInvalidPodSpecConfig error = errors.New("invalid pod spec")
+)
+
+func exclusivePodOptions(opt1, opt2 string) error {
+ return errors.Wrapf(ErrInvalidPodSpecConfig, "%s and %s are mutually exclusive pod options", opt1, opt2)
+}
+
+func (p *PodSpecGenerator) validate() error {
+ // PodBasicConfig
+ if p.NoInfra {
+ if len(p.InfraCommand) > 0 {
+ return exclusivePodOptions("NoInfra", "InfraCommand")
+ }
+ if len(p.InfraImage) > 0 {
+ return exclusivePodOptions("NoInfra", "InfraImage")
+ }
+ if len(p.SharedNamespaces) > 0 {
+ return exclusivePodOptions("NoInfo", "SharedNamespaces")
+ }
+ }
+
+ // PodNetworkConfig
+ if err := p.NetNS.validate(); err != nil {
+ return err
+ }
+ if p.NoInfra {
+ if p.NetNS.NSMode == NoNetwork {
+ return errors.New("NoInfra and a none network cannot be used toegther")
+ }
+ if p.StaticIP != nil {
+ return exclusivePodOptions("NoInfra", "StaticIP")
+ }
+ if p.StaticMAC != nil {
+ return exclusivePodOptions("NoInfra", "StaticMAC")
+ }
+ if len(p.DNSOption) > 0 {
+ return exclusivePodOptions("NoInfra", "DNSOption")
+ }
+ if len(p.DNSSearch) > 0 {
+ return exclusivePodOptions("NoInfo", "DNSSearch")
+ }
+ if len(p.DNSServer) > 0 {
+ return exclusivePodOptions("NoInfra", "DNSServer")
+ }
+ if len(p.HostAdd) > 0 {
+ return exclusivePodOptions("NoInfra", "HostAdd")
+ }
+ if p.NoManageResolvConf {
+ return exclusivePodOptions("NoInfra", "NoManageResolvConf")
+ }
+ }
+ if p.NetNS.NSMode != Bridge {
+ if len(p.PortMappings) > 0 {
+ return errors.New("PortMappings can only be used with Bridge mode networking")
+ }
+ if len(p.CNINetworks) > 0 {
+ return errors.New("CNINetworks can only be used with Bridge mode networking")
+ }
+ }
+ if p.NoManageResolvConf {
+ if len(p.DNSServer) > 0 {
+ return exclusivePodOptions("NoManageResolvConf", "DNSServer")
+ }
+ if len(p.DNSSearch) > 0 {
+ return exclusivePodOptions("NoManageResolvConf", "DNSSearch")
+ }
+ if len(p.DNSOption) > 0 {
+ return exclusivePodOptions("NoManageResolvConf", "DNSOption")
+ }
+ }
+ if p.NoManageHosts && len(p.HostAdd) > 0 {
+ return exclusivePodOptions("NoManageHosts", "HostAdd")
+ }
+
+ if err := p.NetNS.validate(); err != nil {
+ return err
+ }
+
+ // Set Defaults
+ if p.NetNS.Value == "" {
+ if rootless.IsRootless() {
+ p.NetNS.NSMode = Slirp
+ } else {
+ p.NetNS.NSMode = Bridge
+ }
+ }
+ if len(p.InfraImage) < 1 {
+ p.InfraImage = define.DefaultInfraImage
+ }
+ if len(p.InfraCommand) < 1 {
+ p.InfraCommand = []string{define.DefaultInfraCommand}
+ }
+ return nil
+}
diff --git a/pkg/specgen/podspecgen.go b/pkg/specgen/podspecgen.go
new file mode 100644
index 000000000..3f830014d
--- /dev/null
+++ b/pkg/specgen/podspecgen.go
@@ -0,0 +1,153 @@
+package specgen
+
+import (
+ "net"
+
+ "github.com/cri-o/ocicni/pkg/ocicni"
+)
+
+// PodBasicConfig contains basic configuration options for pods.
+type PodBasicConfig struct {
+ // Name is the name of the pod.
+ // If not provided, a name will be generated when the pod is created.
+ // Optional.
+ Name string `json:"name,omitempty"`
+ // Hostname is the pod's hostname. If not set, the name of the pod will
+ // be used (if a name was not provided here, the name auto-generated for
+ // the pod will be used). This will be used by the infra container and
+ // all containers in the pod as long as the UTS namespace is shared.
+ // Optional.
+ Hostname string `json:"hostname,omitempty"`
+ // Labels are key-value pairs that are used to add metadata to pods.
+ // Optional.
+ Labels map[string]string `json:"labels,omitempty"`
+ // NoInfra tells the pod not to create an infra container. If this is
+ // done, many networking-related options will become unavailable.
+ // Conflicts with setting any options in PodNetworkConfig, and the
+ // InfraCommand and InfraImages in this struct.
+ // Optional.
+ NoInfra bool `json:"no_infra,omitempty"`
+ // InfraCommand sets the command that will be used to start the infra
+ // container.
+ // If not set, the default set in the Libpod configuration file will be
+ // used.
+ // Conflicts with NoInfra=true.
+ // Optional.
+ InfraCommand []string `json:"infra_command,omitempty"`
+ // InfraImage is the image that will be used for the infra container.
+ // If not set, the default set in the Libpod configuration file will be
+ // used.
+ // Conflicts with NoInfra=true.
+ // Optional.
+ InfraImage string `json:"infra_image,omitempty"`
+ // SharedNamespaces instructs the pod to share a set of namespaces.
+ // Shared namespaces will be joined (by default) by every container
+ // which joins the pod.
+ // If not set and NoInfra is false, the pod will set a default set of
+ // namespaces to share.
+ // Conflicts with NoInfra=true.
+ // Optional.
+ SharedNamespaces []string `json:"shared_namespaces,omitempty"`
+}
+
+// PodNetworkConfig contains networking configuration for a pod.
+type PodNetworkConfig struct {
+ // NetNS is the configuration to use for the infra container's network
+ // namespace. This network will, by default, be shared with all
+ // containers in the pod.
+ // Cannot be set to FromContainer and FromPod.
+ // Setting this to anything except "" conflicts with NoInfra=true.
+ // Defaults to Bridge as root and Slirp as rootless.
+ // Mandatory.
+ NetNS Namespace `json:"netns,omitempty"`
+ // StaticIP sets a static IP for the infra container. As the infra
+ // container's network is used for the entire pod by default, this will
+ // thus be a static IP for the whole pod.
+ // Only available if NetNS is set to Bridge (the default for root).
+ // As such, conflicts with NoInfra=true by proxy.
+ // Optional.
+ StaticIP *net.IP `json:"static_ip,omitempty"`
+ // StaticMAC sets a static MAC for the infra container. As the infra
+ // container's network is used for the entire pod by default, this will
+ // thus be a static MAC for the entire pod.
+ // Only available if NetNS is set to Bridge (the default for root).
+ // As such, conflicts with NoInfra=true by proxy.
+ // Optional.
+ StaticMAC *net.HardwareAddr `json:"static_mac,omitempty"`
+ // PortMappings is a set of ports to map into the infra container.
+ // As, by default, containers share their network with the infra
+ // container, this will forward the ports to the entire pod.
+ // Only available if NetNS is set to Bridge or Slirp.
+ // Optional.
+ PortMappings []ocicni.PortMapping `json:"portmappings,omitempty"`
+ // CNINetworks is a list of CNI networks that the infra container will
+ // join. As, by default, containers share their network with the infra
+ // container, these networks will effectively be joined by the
+ // entire pod.
+ // Only available when NetNS is set to Bridge, the default for root.
+ // Optional.
+ CNINetworks []string `json:"cni_networks,omitempty"`
+ // NoManageResolvConf indicates that /etc/resolv.conf should not be
+ // managed by the pod. Instead, each container will create and manage a
+ // separate resolv.conf as if they had not joined a pod.
+ // Conflicts with NoInfra=true and DNSServer, DNSSearch, DNSOption.
+ // Optional.
+ NoManageResolvConf bool `json:"no_manage_resolv_conf,omitempty"`
+ // DNSServer is a set of DNS servers that will be used in the infra
+ // container's resolv.conf, which will, by default, be shared with all
+ // containers in the pod.
+ // If not provided, the host's DNS servers will be used, unless the only
+ // server set is a localhost address. As the container cannot connect to
+ // the host's localhost, a default server will instead be set.
+ // Conflicts with NoInfra=true.
+ // Optional.
+ DNSServer []net.IP `json:"dns_server,omitempty"`
+ // DNSSearch is a set of DNS search domains that will be used in the
+ // infra container's resolv.conf, which will, by default, be shared with
+ // all containers in the pod.
+ // If not provided, DNS search domains from the host's resolv.conf will
+ // be used.
+ // Conflicts with NoInfra=true.
+ // Optional.
+ DNSSearch []string `json:"dns_search,omitempty"`
+ // DNSOption is a set of DNS options that will be used in the infra
+ // container's resolv.conf, which will, by default, be shared with all
+ // containers in the pod.
+ // Conflicts with NoInfra=true.
+ // Optional.
+ DNSOption []string `json:"dns_option,omitempty"`
+ // NoManageHosts indicates that /etc/hosts should not be managed by the
+ // pod. Instead, each container will create a separate /etc/hosts as
+ // they would if not in a pod.
+ // Conflicts with HostAdd.
+ NoManageHosts bool `json:"no_manage_hosts,omitempty"`
+ // HostAdd is a set of hosts that will be added to the infra container's
+ // /etc/hosts that will, by default, be shared with all containers in
+ // the pod.
+ // Conflicts with NoInfra=true and NoManageHosts.
+ // Optional.
+ HostAdd []string `json:"hostadd,omitempty"`
+}
+
+// PodCgroupConfig contains configuration options about a pod's cgroups.
+// This will be expanded in future updates to pods.
+type PodCgroupConfig struct {
+ // CgroupParent is the parent for the CGroup that the pod will create.
+ // This pod cgroup will, in turn, be the default cgroup parent for all
+ // containers in the pod.
+ // Optional.
+ CgroupParent string `json:"cgroup_parent,omitempty"`
+}
+
+// PodSpecGenerator describes options to create a pod
+// swagger:model PodSpecGenerator
+type PodSpecGenerator struct {
+ PodBasicConfig
+ PodNetworkConfig
+ PodCgroupConfig
+}
+
+// NewPodSpecGenerator creates a new pod spec
+func NewPodSpecGenerator() *PodSpecGenerator {
+ return &PodSpecGenerator{}
+}
diff --git a/pkg/specgen/specgen.go b/pkg/specgen/specgen.go
new file mode 100644
index 000000000..89c76c273
--- /dev/null
+++ b/pkg/specgen/specgen.go
@@ -0,0 +1,416 @@
+package specgen
+
+import (
+ "net"
+ "syscall"
+
+ "github.com/containers/image/v5/manifest"
+ "github.com/containers/libpod/libpod"
+ "github.com/containers/libpod/pkg/rootless"
+ "github.com/containers/storage"
+ "github.com/cri-o/ocicni/pkg/ocicni"
+ spec "github.com/opencontainers/runtime-spec/specs-go"
+)
+
+// LogConfig describes the logging characteristics for a container
+type LogConfig struct {
+ // LogDriver is the container's log driver.
+ // Optional.
+ Driver string `json:"driver,omitempty"`
+ // LogPath is the path the container's logs will be stored at.
+ // Only available if LogDriver is set to "json-file" or "k8s-file".
+ // Optional.
+ Path string `json:"path,omitempty"`
+ // A set of options to accompany the log driver.
+ // Optional.
+ Options map[string]string `json:"options,omitempty"`
+}
+
+// ContainerBasicConfig contains the basic parts of a container.
+type ContainerBasicConfig struct {
+ // Name is the name the container will be given.
+ // If no name is provided, one will be randomly generated.
+ // Optional.
+ Name string `json:"name,omitempty"`
+ // Pod is the ID of the pod the container will join.
+ // Optional.
+ Pod string `json:"pod,omitempty"`
+ // Entrypoint is the container's entrypoint.
+ // If not given and Image is specified, this will be populated by the
+ // image's configuration.
+ // Optional.
+ Entrypoint []string `json:"entrypoint,omitempty"`
+ // Command is the container's command.
+ // If not given and Image is specified, this will be populated by the
+ // image's configuration.
+ // Optional.
+ Command []string `json:"command,omitempty"`
+ // Env is a set of environment variables that will be set in the
+ // container.
+ // Optional.
+ Env map[string]string `json:"env,omitempty"`
+ // Terminal is whether the container will create a PTY.
+ Terminal bool `json:"terminal,omitempty"`
+ // Stdin is whether the container will keep its STDIN open.
+ Stdin bool `json:"stdin,omitempty"`
+ // Labels are key-value pairs that are used to add metadata to
+ // containers.
+ // Optional.
+ Labels map[string]string `json:"labels,omitempty"`
+ // Annotations are key-value options passed into the container runtime
+ // that can be used to trigger special behavior.
+ // Optional.
+ Annotations map[string]string `json:"annotations,omitempty"`
+ // StopSignal is the signal that will be used to stop the container.
+ // Must be a non-zero integer below SIGRTMAX.
+ // If not provided, the default, SIGTERM, will be used.
+ // Will conflict with Systemd if Systemd is set to "true" or "always".
+ // Optional.
+ StopSignal *syscall.Signal `json:"stop_signal,omitempty"`
+ // StopTimeout is a timeout between the container's stop signal being
+ // sent and SIGKILL being sent.
+ // If not provided, the default will be used.
+ // If 0 is used, stop signal will not be sent, and SIGKILL will be sent
+ // instead.
+ // Optional.
+ StopTimeout *uint `json:"stop_timeout,omitempty"`
+ // LogConfiguration describes the logging for a container including
+ // driver, path, and options.
+ // Optional
+ LogConfiguration *LogConfig `json:"log_configuration,omitempty"`
+ // ConmonPidFile is a path at which a PID file for Conmon will be
+ // placed.
+ // If not given, a default location will be used.
+ // Optional.
+ ConmonPidFile string `json:"conmon_pid_file,omitempty"`
+ // RestartPolicy is the container's restart policy - an action which
+ // will be taken when the container exits.
+ // If not given, the default policy, which does nothing, will be used.
+ // Optional.
+ RestartPolicy string `json:"restart_policy,omitempty"`
+ // RestartRetries is the number of attempts that will be made to restart
+ // the container.
+ // Only available when RestartPolicy is set to "on-failure".
+ // Optional.
+ RestartRetries *uint `json:"restart_tries,omitempty"`
+ // OCIRuntime is the name of the OCI runtime that will be used to create
+ // the container.
+ // If not specified, the default will be used.
+ // Optional.
+ OCIRuntime string `json:"oci_runtime,omitempty"`
+ // Systemd is whether the container will be started in systemd mode.
+ // Valid options are "true", "false", and "always".
+ // "true" enables this mode only if the binary run in the container is
+ // /sbin/init or systemd. "always" unconditionally enables systemd mode.
+ // "false" unconditionally disables systemd mode.
+ // If enabled, mounts and stop signal will be modified.
+ // If set to "always" or set to "true" and conditionally triggered,
+ // conflicts with StopSignal.
+ // If not specified, "false" will be assumed.
+ // Optional.
+ Systemd string `json:"systemd,omitempty"`
+ // Namespace is the libpod namespace the container will be placed in.
+ // Optional.
+ Namespace string `json:"namespace,omitempty"`
+ // PidNS is the container's PID namespace.
+ // It defaults to private.
+ // Mandatory.
+ PidNS Namespace `json:"pidns,omitempty"`
+ // UtsNS is the container's UTS namespace.
+ // It defaults to private.
+ // Must be set to Private to set Hostname.
+ // Mandatory.
+ UtsNS Namespace `json:"utsns,omitempty"`
+ // Hostname is the container's hostname. If not set, the hostname will
+ // not be modified (if UtsNS is not private) or will be set to the
+ // container ID (if UtsNS is private).
+ // Conflicts with UtsNS if UtsNS is not set to private.
+ // Optional.
+ Hostname string `json:"hostname,omitempty"`
+ // Sysctl sets kernel parameters for the container
+ Sysctl map[string]string `json:"sysctl,omitempty"`
+ // Remove indicates if the container should be removed once it has been started
+ // and exits
+ Remove bool `json:"remove"`
+}
+
+// ContainerStorageConfig contains information on the storage configuration of a
+// container.
+type ContainerStorageConfig struct {
+ // Image is the image the container will be based on. The image will be
+ // used as the container's root filesystem, and its environment vars,
+ // volumes, and other configuration will be applied to the container.
+ // Conflicts with Rootfs.
+ // At least one of Image or Rootfs must be specified.
+ Image string `json:"image"`
+ // RawImageName is the unprocessed and not-normalized user-specified image
+ // name. One use case for having this data at hand are auto-updates where
+ // the _exact_ user input is needed in order to look-up the correct image.
+ RawImageName string `json:"raw_image_name,omitempty"`
+ // Rootfs is the path to a directory that will be used as the
+ // container's root filesystem. No modification will be made to the
+ // directory, it will be directly mounted into the container as root.
+ // Conflicts with Image.
+ // At least one of Image or Rootfs must be specified.
+ Rootfs string `json:"rootfs,omitempty"`
+ // ImageVolumeMode indicates how image volumes will be created.
+ // Supported modes are "ignore" (do not create), "tmpfs" (create as
+ // tmpfs), and "anonymous" (create as anonymous volumes).
+ // The default is anonymous.
+ // Optional.
+ ImageVolumeMode string `json:"image_volume_mode,omitempty"`
+ // VolumesFrom is a list of containers whose volumes will be added to
+ // this container. Supported mount options may be added after the
+ // container name with a : and include "ro" and "rw".
+ // Optional.
+ VolumesFrom []string `json:"volumes_from,omitempty"`
+ // Mounts are mounts that will be added to the container.
+ // These will supersede Image Volumes and VolumesFrom volumes where
+ // there are conflicts.
+ // Optional.
+ Mounts []spec.Mount `json:"mounts,omitempty"`
+ // Volumes are named volumes that will be added to the container.
+ // These will supersede Image Volumes and VolumesFrom volumes where
+ // there are conflicts.
+ // Optional.
+ Volumes []*libpod.ContainerNamedVolume `json:"volumes,omitempty"`
+ // Devices are devices that will be added to the container.
+ // Optional.
+ Devices []spec.LinuxDevice `json:"devices,omitempty"`
+ // IpcNS is the container's IPC namespace.
+ // Default is private.
+ // Conflicts with ShmSize if not set to private.
+ // Mandatory.
+ IpcNS Namespace `json:"ipcns,omitempty"`
+ // ShmSize is the size of the tmpfs to mount in at /dev/shm, in bytes.
+ // Conflicts with ShmSize if IpcNS is not private.
+ // Optional.
+ ShmSize *int64 `json:"shm_size,omitempty"`
+ // WorkDir is the container's working directory.
+ // If unset, the default, /, will be used.
+ // Optional.
+ WorkDir string `json:"work_dir,omitempty"`
+ // RootfsPropagation is the rootfs propagation mode for the container.
+ // If not set, the default of rslave will be used.
+ // Optional.
+ RootfsPropagation string `json:"rootfs_propagation,omitempty"`
+}
+
+// ContainerSecurityConfig is a container's security features, including
+// SELinux, Apparmor, and Seccomp.
+type ContainerSecurityConfig struct {
+ // Privileged is whether the container is privileged.
+ // Privileged does the following:
+ // - Adds all devices on the system to the container.
+ // - Adds all capabilities to the container.
+ // - Disables Seccomp, SELinux, and Apparmor confinement.
+ // TODO: this conflicts with things.
+ // TODO: this does more.
+ Privileged bool `json:"privileged,omitempty"`
+ // User is the user the container will be run as.
+ // Can be given as a UID or a username; if a username, it will be
+ // resolved within the container, using the container's /etc/passwd.
+ // If unset, the container will be run as root.
+ // Optional.
+ User string `json:"user,omitempty"`
+ // Groups are a list of supplemental groups the container's user will
+ // be granted access to.
+ // Optional.
+ Groups []string `json:"groups,omitempty"`
+ // CapAdd are capabilities which will be added to the container.
+ // Conflicts with Privileged.
+ // Optional.
+ CapAdd []string `json:"cap_add,omitempty"`
+ // CapDrop are capabilities which will be removed from the container.
+ // Conflicts with Privileged.
+ // Optional.
+ CapDrop []string `json:"cap_drop,omitempty"`
+ // SelinuxProcessLabel is the process label the container will use.
+ // If SELinux is enabled and this is not specified, a label will be
+ // automatically generated if not specified.
+ // Optional.
+ SelinuxProcessLabel string `json:"selinux_process_label,omitempty"`
+ // SelinuxMountLabel is the mount label the container will use.
+ // If SELinux is enabled and this is not specified, a label will be
+ // automatically generated if not specified.
+ // Optional.
+ SelinuxMountLabel string `json:"selinux_mount_label,omitempty"`
+ // SelinuxOpts are options for configuring SELinux.
+ // Optional.
+ SelinuxOpts []string `json:"selinux_opts,omitempty"`
+ // ApparmorProfile is the name of the Apparmor profile the container
+ // will use.
+ // Optional.
+ ApparmorProfile string `json:"apparmor_profile,omitempty"`
+ // SeccompPolicy determines which seccomp profile gets applied
+ // the container. valid values: empty,default,image
+ SeccompPolicy string `json:"seccomp_policy,omitempty"`
+ // SeccompProfilePath is the path to a JSON file containing the
+ // container's Seccomp profile.
+ // If not specified, no Seccomp profile will be used.
+ // Optional.
+ SeccompProfilePath string `json:"seccomp_profile_path,omitempty"`
+ // NoNewPrivileges is whether the container will set the no new
+ // privileges flag on create, which disables gaining additional
+ // privileges (e.g. via setuid) in the container.
+ NoNewPrivileges bool `json:"no_new_privileges,omitempty"`
+ // UserNS is the container's user namespace.
+ // It defaults to host, indicating that no user namespace will be
+ // created.
+ // If set to private, IDMappings must be set.
+ // Mandatory.
+ UserNS Namespace `json:"userns,omitempty"`
+ // IDMappings are UID and GID mappings that will be used by user
+ // namespaces.
+ // Required if UserNS is private.
+ IDMappings *storage.IDMappingOptions `json:"idmappings,omitempty"`
+ // ReadOnlyFilesystem indicates that everything will be mounted
+ // as read-only
+ ReadOnlyFilesystem bool `json:"read_only_filesystem,omittempty"`
+}
+
+// ContainerCgroupConfig contains configuration information about a container's
+// cgroups.
+type ContainerCgroupConfig struct {
+ // CgroupNS is the container's cgroup namespace.
+ // It defaults to private.
+ // Mandatory.
+ CgroupNS Namespace `json:"cgroupns,omitempty"`
+ // CgroupsMode sets a policy for how cgroups will be created in the
+ // container, including the ability to disable creation entirely.
+ CgroupsMode string `json:"cgroups_mode,omitempty"`
+ // CgroupParent is the container's CGroup parent.
+ // If not set, the default for the current cgroup driver will be used.
+ // Optional.
+ CgroupParent string `json:"cgroup_parent,omitempty"`
+}
+
+// ContainerNetworkConfig contains information on a container's network
+// configuration.
+type ContainerNetworkConfig struct {
+ // NetNS is the configuration to use for the container's network
+ // namespace.
+ // Mandatory.
+ NetNS Namespace `json:"netns,omitempty"`
+ // ConfigureNetNS is whether Libpod will configure the container's
+ // network namespace to send and receive traffic.
+ // Only available is NetNS is private - conflicts with other NetNS
+ // modes.
+ ConfigureNetNS bool `json:"configure_netns,omitempty"`
+ // StaticIP is the a IPv4 address of the container.
+ // Only available if ConfigureNetNS is true.
+ // Optional.
+ StaticIP *net.IP `json:"static_ip,omitempty"`
+ // StaticIPv6 is a static IPv6 address to set in the container.
+ // Only available if ConfigureNetNS is true.
+ // Optional.
+ StaticIPv6 *net.IP `json:"static_ipv6,omitempty"`
+ // StaticMAC is a static MAC address to set in the container.
+ // Only available if ConfigureNetNS is true.
+ // Optional.
+ StaticMAC *net.HardwareAddr `json:"static_mac,omitempty"`
+ // PortBindings is a set of ports to map into the container.
+ // Only available if ConfigureNetNS is true.
+ // Optional.
+ PortMappings []ocicni.PortMapping `json:"portmappings,omitempty"`
+ // PublishImagePorts will publish ports specified in the image to random
+ // ports outside.
+ // Requires Image to be set.
+ PublishImagePorts bool `json:"publish_image_ports,omitempty"`
+ // CNINetworks is a list of CNI networks to join the container to.
+ // If this list is empty, the default CNI network will be joined
+ // instead. If at least one entry is present, we will not join the
+ // default network (unless it is part of this list).
+ // Only available if ConfigureNetNS is true.
+ // Optional.
+ CNINetworks []string `json:"cni_networks,omitempty"`
+ // UseImageResolvConf indicates that resolv.conf should not be managed
+ // by Podman, but instead sourced from the image.
+ // Conflicts with DNSServer, DNSSearch, DNSOption.
+ UseImageResolvConf bool `json:"use_image_resolve_conf,omitempty"`
+ // DNSServer is a set of DNS servers that will be used in the
+ // container's resolv.conf, replacing the host's DNS Servers which are
+ // used by default.
+ // Conflicts with UseImageResolvConf.
+ // Optional.
+ DNSServer []net.IP `json:"dns_server,omitempty"`
+ // DNSSearch is a set of DNS search domains that will be used in the
+ // container's resolv.conf, replacing the host's DNS search domains
+ // which are used by default.
+ // Conflicts with UseImageResolvConf.
+ // Optional.
+ DNSSearch []string `json:"dns_search,omitempty"`
+ // DNSOption is a set of DNS options that will be used in the
+ // container's resolv.conf, replacing the host's DNS options which are
+ // used by default.
+ // Conflicts with UseImageResolvConf.
+ // Optional.
+ DNSOption []string `json:"dns_option,omitempty"`
+ // UseImageHosts indicates that /etc/hosts should not be managed by
+ // Podman, and instead sourced from the image.
+ // Conflicts with HostAdd.
+ UseImageHosts bool `json:"use_image_hosts,omitempty"`
+ // HostAdd is a set of hosts which will be added to the container's
+ // /etc/hosts file.
+ // Conflicts with UseImageHosts.
+ // Optional.
+ HostAdd []string `json:"hostadd,omitempty"`
+}
+
+// ContainerResourceConfig contains information on container resource limits.
+type ContainerResourceConfig struct {
+ // ResourceLimits are resource limits to apply to the container.,
+ // Can only be set as root on cgroups v1 systems, but can be set as
+ // rootless as well for cgroups v2.
+ // Optional.
+ ResourceLimits *spec.LinuxResources `json:"resource_limits,omitempty"`
+ // Rlimits are POSIX rlimits to apply to the container.
+ // Optional.
+ Rlimits []spec.POSIXRlimit `json:"r_limits,omitempty"`
+ // OOMScoreAdj adjusts the score used by the OOM killer to determine
+ // processes to kill for the container's process.
+ // Optional.
+ OOMScoreAdj *int `json:"oom_score_adj,omitempty"`
+}
+
+// ContainerHealthCheckConfig describes a container healthcheck with attributes
+// like command, retries, interval, start period, and timeout.
+type ContainerHealthCheckConfig struct {
+ HealthConfig *manifest.Schema2HealthConfig `json:"healthconfig,omitempty"`
+}
+
+// SpecGenerator creates an OCI spec and Libpod configuration options to create
+// a container based on the given configuration.
+// swagger:model SpecGenerator
+type SpecGenerator struct {
+ ContainerBasicConfig
+ ContainerStorageConfig
+ ContainerSecurityConfig
+ ContainerCgroupConfig
+ ContainerNetworkConfig
+ ContainerResourceConfig
+ ContainerHealthCheckConfig
+}
+
+// NewSpecGenerator returns a SpecGenerator struct given one of two mandatory inputs
+func NewSpecGenerator(image string) *SpecGenerator {
+ networkConfig := ContainerNetworkConfig{
+ NetNS: Namespace{
+ NSMode: Bridge,
+ },
+ }
+ csc := ContainerStorageConfig{Image: image}
+ if rootless.IsRootless() {
+ networkConfig.NetNS.NSMode = Slirp
+ }
+ return &SpecGenerator{
+ ContainerStorageConfig: csc,
+ ContainerNetworkConfig: networkConfig,
+ }
+}
+
+// NewSpecGenerator returns a SpecGenerator struct given one of two mandatory inputs
+func NewSpecGeneratorWithRootfs(rootfs string) *SpecGenerator {
+ csc := ContainerStorageConfig{Rootfs: rootfs}
+ return &SpecGenerator{ContainerStorageConfig: csc}
+}
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-02-06 18:25:28 +0000