summaryrefslogtreecommitdiff
path: root/pkg
diff options
context:
space:
mode:
Diffstat (limited to 'pkg')
-rw-r--r--pkg/adapter/client.go50
-rw-r--r--pkg/adapter/client_config.go32
-rw-r--r--pkg/adapter/runtime.go5
-rw-r--r--pkg/hooks/0.1.0/hook.go2
-rw-r--r--pkg/spec/spec.go14
-rw-r--r--pkg/util/utils_supported.go24
-rw-r--r--pkg/util/utils_windows.go5
7 files changed, 108 insertions, 24 deletions
diff --git a/pkg/adapter/client.go b/pkg/adapter/client.go
index f672a92a6..01914834f 100644
--- a/pkg/adapter/client.go
+++ b/pkg/adapter/client.go
@@ -10,44 +10,56 @@ import (
"github.com/varlink/go/varlink"
)
-type VarlinkConnectionInfo struct {
- RemoteUserName string
- RemoteHost string
- VarlinkAddress string
-}
-
-// Connect provides a varlink connection
-func (r RemoteRuntime) Connect() (*varlink.Connection, error) {
- var (
- err error
- connection *varlink.Connection
- )
+var remoteEndpoint *Endpoint
- logLevel := r.cmd.LogLevel
+func (r RemoteRuntime) RemoteEndpoint() (remoteEndpoint *Endpoint, err error) {
+ if remoteEndpoint == nil {
+ remoteEndpoint = &Endpoint{Unknown, ""}
+ } else {
+ return remoteEndpoint, nil
+ }
// I'm leaving this here for now as a document of the birdge format. It can be removed later once the bridge
// function is more flushed out.
- //bridge := `ssh -T root@192.168.122.1 "/usr/bin/varlink -A '/usr/bin/podman varlink \$VARLINK_ADDRESS' bridge"`
+ // bridge := `ssh -T root@192.168.122.1 "/usr/bin/varlink -A '/usr/bin/podman varlink \$VARLINK_ADDRESS' bridge"`
if len(r.cmd.RemoteHost) > 0 {
// The user has provided a remote host endpoint
if len(r.cmd.RemoteUserName) < 1 {
return nil, errors.New("you must provide a username when providing a remote host name")
}
- bridge := fmt.Sprintf(`ssh -T %s@%s /usr/bin/varlink -A \'/usr/bin/podman --log-level=%s varlink \\\$VARLINK_ADDRESS\' bridge`, r.cmd.RemoteUserName, r.cmd.RemoteHost, logLevel)
- connection, err = varlink.NewBridge(bridge)
+ remoteEndpoint.Type = BridgeConnection
+ remoteEndpoint.Connection = fmt.Sprintf(
+ `ssh -T %s@%s /usr/bin/varlink -A \'/usr/bin/podman --log-level=%s varlink \\\$VARLINK_ADDRESS\' bridge`,
+ r.cmd.RemoteUserName, r.cmd.RemoteHost, r.cmd.LogLevel)
+
} else if bridge := os.Getenv("PODMAN_VARLINK_BRIDGE"); bridge != "" {
- connection, err = varlink.NewBridge(bridge)
+ remoteEndpoint.Type = BridgeConnection
+ remoteEndpoint.Connection = bridge
} else {
address := os.Getenv("PODMAN_VARLINK_ADDRESS")
if address == "" {
address = DefaultAddress
}
- connection, err = varlink.NewConnection(address)
+ remoteEndpoint.Type = DirectConnection
+ remoteEndpoint.Connection = address
}
+ return
+}
+
+// Connect provides a varlink connection
+func (r RemoteRuntime) Connect() (*varlink.Connection, error) {
+ ep, err := r.RemoteEndpoint()
if err != nil {
return nil, err
}
- return connection, nil
+
+ switch ep.Type {
+ case DirectConnection:
+ return varlink.NewConnection(ep.Connection)
+ case BridgeConnection:
+ return varlink.NewBridge(ep.Connection)
+ }
+ return nil, errors.New(fmt.Sprintf("Unable to determine type of varlink connection: %s", ep.Connection))
}
// RefreshConnection is used to replace the current r.Conn after things like
diff --git a/pkg/adapter/client_config.go b/pkg/adapter/client_config.go
index d165ef1cc..3559b16e3 100644
--- a/pkg/adapter/client_config.go
+++ b/pkg/adapter/client_config.go
@@ -2,3 +2,35 @@ package adapter
// DefaultAddress is the default address of the varlink socket
const DefaultAddress = "unix:/run/podman/io.podman"
+
+// EndpointType declares the type of server connection
+type EndpointType int
+
+// Enum of connection types
+const (
+ Unknown = iota - 1 // Unknown connection type
+ BridgeConnection // BridgeConnection proxy connection via ssh
+ DirectConnection // DirectConnection socket connection to server
+)
+
+// String prints ASCII string for EndpointType
+func (e EndpointType) String() string {
+ // declare an array of strings
+ // ... operator counts how many
+ // items in the array (7)
+ names := [...]string{
+ "BridgeConnection",
+ "DirectConnection",
+ }
+
+ if e < BridgeConnection || e > DirectConnection {
+ return "Unknown"
+ }
+ return names[e]
+}
+
+// Endpoint type and connection string to use
+type Endpoint struct {
+ Type EndpointType
+ Connection string
+}
diff --git a/pkg/adapter/runtime.go b/pkg/adapter/runtime.go
index 21613c425..37ee1b737 100644
--- a/pkg/adapter/runtime.go
+++ b/pkg/adapter/runtime.go
@@ -398,3 +398,8 @@ func (r *LocalRuntime) GetPodsByStatus(statuses []string) ([]*libpod.Pod, error)
func (r *LocalRuntime) GetVersion() (libpod.Version, error) {
return libpod.GetVersion()
}
+
+// RemoteEndpoint resolve interface requirement
+func (r *LocalRuntime) RemoteEndpoint() (*Endpoint, error) {
+ return nil, errors.New("RemoteEndpoint() not implemented for local connection")
+}
diff --git a/pkg/hooks/0.1.0/hook.go b/pkg/hooks/0.1.0/hook.go
index 49d833aa8..ba68b0f10 100644
--- a/pkg/hooks/0.1.0/hook.go
+++ b/pkg/hooks/0.1.0/hook.go
@@ -19,7 +19,7 @@ type Hook struct {
Hook *string `json:"hook"`
Arguments []string `json:"arguments,omitempty"`
- // https://github.com/kubernetes-sigs/cri-o/pull/1235
+ // https://github.com/cri-o/cri-o/pull/1235
Stages []string `json:"stages"`
Stage []string `json:"stage"`
diff --git a/pkg/spec/spec.go b/pkg/spec/spec.go
index 20c649f9a..df303db6d 100644
--- a/pkg/spec/spec.go
+++ b/pkg/spec/spec.go
@@ -7,6 +7,7 @@ import (
"github.com/containers/libpod/libpod"
"github.com/containers/libpod/pkg/rootless"
+ "github.com/containers/libpod/pkg/util"
pmount "github.com/containers/storage/pkg/mount"
"github.com/docker/docker/oci/caps"
"github.com/docker/go-units"
@@ -267,7 +268,9 @@ func (config *CreateConfig) createConfigToOCISpec(runtime *libpod.Runtime, userM
// SECURITY OPTS
g.SetProcessNoNewPrivileges(config.NoNewPrivs)
- g.SetProcessApparmorProfile(config.ApparmorProfile)
+ if !config.Privileged {
+ g.SetProcessApparmorProfile(config.ApparmorProfile)
+ }
blockAccessToKernelFilesystems(config, &g)
@@ -347,10 +350,13 @@ func (config *CreateConfig) createConfigToOCISpec(runtime *libpod.Runtime, userM
}
if rootless.IsRootless() {
- if addedResources {
- return nil, errors.New("invalid configuration, cannot set resources with rootless containers")
+ cgroup2, err := util.IsCgroup2UnifiedMode()
+ if err != nil {
+ return nil, err
+ }
+ if addedResources && !cgroup2 {
+ return nil, errors.New("invalid configuration, cannot set resources with rootless containers not using cgroups v2 unified mode")
}
- configSpec.Linux.Resources = &spec.LinuxResources{}
}
// Make sure that the bind mounts keep options like nosuid, noexec, nodev.
diff --git a/pkg/util/utils_supported.go b/pkg/util/utils_supported.go
index af5e67fc1..8b98658c2 100644
--- a/pkg/util/utils_supported.go
+++ b/pkg/util/utils_supported.go
@@ -11,9 +11,33 @@ import (
"github.com/pkg/errors"
"os"
"path/filepath"
+ "sync"
"syscall"
)
+const (
+ _cgroup2SuperMagic = 0x63677270
+)
+
+var (
+ isUnifiedOnce sync.Once
+ isUnified bool
+ isUnifiedErr error
+)
+
+// IsCgroup2UnifiedMode returns whether we are running in cgroup 2 unified mode.
+func IsCgroup2UnifiedMode() (bool, error) {
+ isUnifiedOnce.Do(func() {
+ var st syscall.Statfs_t
+ if err := syscall.Statfs("/sys/fs/cgroup", &st); err != nil {
+ isUnified, isUnifiedErr = false, err
+ } else {
+ isUnified, isUnifiedErr = st.Type == _cgroup2SuperMagic, nil
+ }
+ })
+ return isUnified, isUnifiedErr
+}
+
// GetRootlessRuntimeDir returns the runtime directory when running as non root
func GetRootlessRuntimeDir() (string, error) {
var rootlessRuntimeDirError error
diff --git a/pkg/util/utils_windows.go b/pkg/util/utils_windows.go
index 1e9ccea90..b33733da9 100644
--- a/pkg/util/utils_windows.go
+++ b/pkg/util/utils_windows.go
@@ -10,3 +10,8 @@ import (
func GetRootlessRuntimeDir() (string, error) {
return "", errors.New("this function is not implemented for windows")
}
+
+// IsCgroup2UnifiedMode returns whether we are running in cgroup 2 unified mode.
+func IsCgroup2UnifiedMode() (bool, error) {
+ return false, errors.New("this function is not implemented for windows")
+}
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2024-10-16 16:28:04 +0000