diff options
Diffstat (limited to 'vendor/github.com/opencontainers')
13 files changed, 778 insertions, 516 deletions
diff --git a/vendor/github.com/opencontainers/runtime-tools/README.md b/vendor/github.com/opencontainers/runtime-tools/README.md index bbcafc26e..5f16436bc 100644 --- a/vendor/github.com/opencontainers/runtime-tools/README.md +++ b/vendor/github.com/opencontainers/runtime-tools/README.md @@ -8,7 +8,7 @@ To build from source code, runtime-tools requires Go 1.7.x or above. [`oci-runtime-tool generate`][generate.1] generates [configuration JSON][config.json] for an [OCI bundle][bundle]. [OCI-compatible runtimes][runtime-spec] like [runC][] expect to read the configuration from `config.json`. -```sh +```console $ oci-runtime-tool generate --output config.json $ cat config.json { @@ -22,7 +22,7 @@ $ cat config.json [`oci-runtime-tool validate`][validate.1] validates an OCI bundle. The error message will be printed if the OCI bundle failed the validation procedure. -```sh +```console $ oci-runtime-tool generate $ oci-runtime-tool validate INFO[0000] Bundle validation succeeded. @@ -30,55 +30,153 @@ INFO[0000] Bundle validation succeeded. ## Testing OCI runtimes -```sh -$ sudo make RUNTIME=runc localvalidation -RUNTIME=runc go test -tags "" -v github.com/opencontainers/runtime-tools/validation -=== RUN TestValidateBasic -TAP version 13 -ok 1 - root filesystem -ok 2 - hostname -ok 3 - mounts -ok 4 - capabilities -ok 5 - default symlinks -ok 6 - default devices -ok 7 - linux devices -ok 8 - linux process -ok 9 - masked paths -ok 10 - oom score adj -ok 11 - read only paths -ok 12 - rlimits -ok 13 - sysctls -ok 14 - uid mappings -ok 15 - gid mappings -1..15 ---- PASS: TestValidateBasic (0.08s) -=== RUN TestValidateSysctls +The runtime validation suite uses [node-tap][], which is packaged for some distributions (for example, it is in [Debian's `node-tap` package][debian-node-tap]). +If your distribution does not package node-tap, you can install [npm][] (for example, from [Gentoo's `nodejs` package][gentoo-nodejs]) and use it: + +```console +$ npm install tap +``` + +```console +$ make runtimetest validation-executables +RUNTIME=runc tap validation/linux_rootfs_propagation_shared.t validation/create.t validation/default.t validation/linux_readonly_paths.t validation/linux_masked_paths.t validation/mounts.t validation/process.t validation/root_readonly_false.t validation/linux_sysctl.t validation/linux_devices.t validation/linux_gid_mappings.t validation/process_oom_score_adj.t validation/process_capabilities.t validation/process_rlimits.t validation/root_readonly_true.t validation/linux_rootfs_propagation_unbindable.t validation/hostname.t validation/linux_uid_mappings.t +validation/linux_rootfs_propagation_shared.t ........ 18/19 + not ok rootfs propagation + +validation/create.t ................................... 4/4 +validation/default.t ................................ 19/19 +validation/linux_readonly_paths.t ................... 19/19 +validation/linux_masked_paths.t ..................... 18/19 + not ok masked paths + +validation/mounts.t ................................... 0/1 + Skipped: 1 + TODO: mounts generation options have not been implemented + +validation/process.t ................................ 19/19 +validation/root_readonly_false.t .................... 19/19 +validation/linux_sysctl.t ........................... 19/19 +validation/linux_devices.t .......................... 19/19 +validation/linux_gid_mappings.t ..................... 18/19 + not ok gid mappings + +validation/process_oom_score_adj.t .................. 19/19 +validation/process_capabilities.t ................... 19/19 +validation/process_rlimits.t ........................ 19/19 +validation/root_readonly_true.t ...................failed to create the container +rootfsPropagation=unbindable is not supported +exit status 1 +validation/root_readonly_true.t ..................... 19/19 +validation/linux_rootfs_propagation_unbindable.t ...... 0/1 + not ok validation/linux_rootfs_propagation_unbindable.t + timeout: 30000 + file: validation/linux_rootfs_propagation_unbindable.t + command: validation/linux_rootfs_propagation_unbindable.t + args: [] + stdio: + - 0 + - pipe + - 2 + cwd: /…/go/src/github.com/opencontainers/runtime-tools + exitCode: 1 + +validation/hostname.t ...................failed to create the container +User namespace mappings specified, but USER namespace isn't enabled in the config +exit status 1 +validation/hostname.t ............................... 19/19 +validation/linux_uid_mappings.t ....................... 0/1 + not ok validation/linux_uid_mappings.t + timeout: 30000 + file: validation/linux_uid_mappings.t + command: validation/linux_uid_mappings.t + args: [] + stdio: + - 0 + - pipe + - 2 + cwd: /…/go/src/github.com/opencontainers/runtime-tools + exitCode: 1 + +total ............................................. 267/273 + + + 267 passing (31s) + 1 pending + 5 failing + +make: *** [Makefile:43: localvalidation] Error 1 +``` + +You can also run an individual test executable directly: + +```console +$ RUNTIME=runc validation/default.t TAP version 13 ok 1 - root filesystem ok 2 - hostname -ok 3 - mounts -ok 4 - capabilities -ok 5 - default symlinks -ok 6 - default devices -ok 7 - linux devices -ok 8 - linux process -ok 9 - masked paths -ok 10 - oom score adj -ok 11 - read only paths -ok 12 - rlimits -ok 13 - sysctls -ok 14 - uid mappings -ok 15 - gid mappings -1..15 ---- PASS: TestValidateSysctls (0.20s) -PASS -ok github.com/opencontainers/runtime-tools/validation 0.281s +ok 3 - process +ok 4 - mounts +ok 5 - user +ok 6 - rlimits +ok 7 - capabilities +ok 8 - default symlinks +ok 9 - default file system +ok 10 - default devices +ok 11 - linux devices +ok 12 - linux process +ok 13 - masked paths +ok 14 - oom score adj +ok 15 - read only paths +ok 16 - rootfs propagation +ok 17 - sysctls +ok 18 - uid mappings +ok 19 - gid mappings +1..19 +``` + +If you cannot install node-tap, you can probably run the test suite with another [TAP consumer][tap-consumers]. +For example, with [`prove`][prove]: + +```console +$ sudo make TAP='prove -Q -j9' RUNTIME=runc localvalidation +RUNTIME=runc prove -Q -j9 validation/linux_rootfs_propagation_shared.t validation/create.t validation/default.t validation/linux_readonly_paths.t validation/linux_masked_paths.t validation/mounts.t validation/process.t validation/root_readonly_false.t validation/linux_sysctl.t validation/linux_devices.t validation/linux_gid_mappings.t validation/process_oom_score_adj.t validation/process_capabilities.t validation/process_rlimits.t validation/root_readonly_true.t validation/linux_rootfs_propagation_unbindable.t validation/hostname.t validation/linux_uid_mappings.t +failed to create the container +rootfsPropagation=unbindable is not supported +exit status 1 +failed to create the container +User namespace mappings specified, but USER namespace isn't enabled in the config +exit status 1 + +Test Summary Report +------------------- +validation/linux_rootfs_propagation_shared.t (Wstat: 0 Tests: 19 Failed: 1) + Failed test: 16 +validation/linux_masked_paths.t (Wstat: 0 Tests: 19 Failed: 1) + Failed test: 13 +validation/linux_rootfs_propagation_unbindable.t (Wstat: 256 Tests: 0 Failed: 0) + Non-zero exit status: 1 + Parse errors: No plan found in TAP output +validation/linux_uid_mappings.t (Wstat: 256 Tests: 0 Failed: 0) + Non-zero exit status: 1 + Parse errors: No plan found in TAP output +validation/linux_gid_mappings.t (Wstat: 0 Tests: 19 Failed: 1) + Failed test: 19 +Files=18, Tests=271, 6 wallclock secs ( 0.06 usr 0.01 sys + 0.59 cusr 0.24 csys = 0.90 CPU) +Result: FAIL +make: *** [Makefile:43: localvalidation] Error 1 ``` [bundle]: https://github.com/opencontainers/runtime-spec/blob/master/bundle.md [config.json]: https://github.com/opencontainers/runtime-spec/blob/master/config.md +[debian-node-tap]: https://packages.debian.org/stretch/node-tap +[debian-nodejs]: https://packages.debian.org/stretch/nodejs +[gentoo-nodejs]: https://packages.gentoo.org/packages/net-libs/nodejs +[node-tap]: http://www.node-tap.org/ +[npm]: https://www.npmjs.com/ +[prove]: http://search.cpan.org/~leont/Test-Harness-3.39/bin/prove [runC]: https://github.com/opencontainers/runc [runtime-spec]: https://github.com/opencontainers/runtime-spec +[tap-consumers]: https://testanything.org/consumers.html [generate.1]: man/oci-runtime-tool-generate.1.md [validate.1]: man/oci-runtime-tool-validate.1.md diff --git a/vendor/github.com/opencontainers/runtime-tools/filepath/abs.go b/vendor/github.com/opencontainers/runtime-tools/filepath/abs.go index c19bba26a..e4ab7453f 100644 --- a/vendor/github.com/opencontainers/runtime-tools/filepath/abs.go +++ b/vendor/github.com/opencontainers/runtime-tools/filepath/abs.go @@ -1,7 +1,6 @@ package filepath import ( - "errors" "regexp" "strings" ) @@ -11,9 +10,6 @@ var windowsAbs = regexp.MustCompile(`^[a-zA-Z]:\\.*$`) // Abs is a version of path/filepath's Abs with an explicit operating // system and current working directory. func Abs(os, path, cwd string) (_ string, err error) { - if os == "windows" { - return "", errors.New("Abs() does not support windows yet") - } if IsAbs(os, path) { return Clean(os, path), nil } diff --git a/vendor/github.com/opencontainers/runtime-tools/filepath/clean.go b/vendor/github.com/opencontainers/runtime-tools/filepath/clean.go index b70c575f2..d5dd65ae1 100644 --- a/vendor/github.com/opencontainers/runtime-tools/filepath/clean.go +++ b/vendor/github.com/opencontainers/runtime-tools/filepath/clean.go @@ -30,6 +30,9 @@ func Clean(os, path string) string { // Eliminate each inner .. path name element (the parent directory) // along with the non-.. element that precedes it. for i := 1; i < len(elements); i++ { + if i == 1 && abs && sep == '\\' { + continue + } if i > 0 && elements[i] == ".." { elements = append(elements[:i-1], elements[i+1:]...) i -= 2 @@ -39,16 +42,31 @@ func Clean(os, path string) string { // Eliminate .. elements that begin a rooted path: // that is, replace "/.." by "/" at the beginning of a path, // assuming Separator is '/'. - if abs && len(elements) > 0 { - for elements[0] == ".." { - elements = elements[1:] + offset := 0 + if sep == '\\' { + offset = 1 + } + if abs { + for len(elements) > offset && elements[offset] == ".." { + elements = append(elements[:offset], elements[offset+1:]...) } } cleaned := strings.Join(elements, string(sep)) if abs { - cleaned = fmt.Sprintf("%c%s", sep, cleaned) + if sep == '/' { + cleaned = fmt.Sprintf("%c%s", sep, cleaned) + } else if len(elements) == 1 { + cleaned = fmt.Sprintf("%s%c", cleaned, sep) + } } + + // If the result of this process is an empty string, Clean returns + // the string ".". + if len(cleaned) == 0 { + cleaned = "." + } + if cleaned == path { return path } diff --git a/vendor/github.com/opencontainers/runtime-tools/generate/generate.go b/vendor/github.com/opencontainers/runtime-tools/generate/generate.go index 5a1f5543e..d2951b52d 100644 --- a/vendor/github.com/opencontainers/runtime-tools/generate/generate.go +++ b/vendor/github.com/opencontainers/runtime-tools/generate/generate.go @@ -233,6 +233,7 @@ func NewFromFile(path string) (Generator, error) { if os.IsNotExist(err) { return Generator{}, fmt.Errorf("template configuration at %s not found", path) } + return Generator{}, err } defer cf.Close() @@ -439,17 +440,16 @@ func (g *Generator) AddProcessRlimits(rType string, rHard uint64, rSoft uint64) } // RemoveProcessRlimits removes a rlimit from g.spec.Process.Rlimits. -func (g *Generator) RemoveProcessRlimits(rType string) error { +func (g *Generator) RemoveProcessRlimits(rType string) { if g.spec == nil || g.spec.Process == nil { - return nil + return } for i, rlimit := range g.spec.Process.Rlimits { if rlimit.Type == rType { g.spec.Process.Rlimits = append(g.spec.Process.Rlimits[:i], g.spec.Process.Rlimits[i+1:]...) - return nil + return } } - return nil } // ClearProcessRlimits clear g.spec.Process.Rlimits. @@ -491,6 +491,12 @@ func (g *Generator) SetLinuxCgroupsPath(path string) { g.spec.Linux.CgroupsPath = path } +// SetLinuxIntelRdtL3CacheSchema sets g.spec.Linux.IntelRdt.L3CacheSchema +func (g *Generator) SetLinuxIntelRdtL3CacheSchema(schema string) { + g.initSpecLinuxIntelRdt() + g.spec.Linux.IntelRdt.L3CacheSchema = schema +} + // SetLinuxMountLabel sets g.spec.Linux.MountLabel. func (g *Generator) SetLinuxMountLabel(label string) { g.initSpecLinux() @@ -503,6 +509,162 @@ func (g *Generator) SetProcessOOMScoreAdj(adj int) { g.spec.Process.OOMScoreAdj = &adj } +// SetLinuxResourcesBlockIOLeafWeight sets g.spec.Linux.Resources.BlockIO.LeafWeight. +func (g *Generator) SetLinuxResourcesBlockIOLeafWeight(weight uint16) { + g.initSpecLinuxResourcesBlockIO() + g.spec.Linux.Resources.BlockIO.LeafWeight = &weight +} + +// AddLinuxResourcesBlockIOLeafWeightDevice adds or sets g.spec.Linux.Resources.BlockIO.WeightDevice.LeafWeight. +func (g *Generator) AddLinuxResourcesBlockIOLeafWeightDevice(major int64, minor int64, weight uint16) { + g.initSpecLinuxResourcesBlockIO() + for i, weightDevice := range g.spec.Linux.Resources.BlockIO.WeightDevice { + if weightDevice.Major == major && weightDevice.Minor == minor { + g.spec.Linux.Resources.BlockIO.WeightDevice[i].LeafWeight = &weight + return + } + } + weightDevice := new(rspec.LinuxWeightDevice) + weightDevice.Major = major + weightDevice.Minor = minor + weightDevice.LeafWeight = &weight + g.spec.Linux.Resources.BlockIO.WeightDevice = append(g.spec.Linux.Resources.BlockIO.WeightDevice, *weightDevice) +} + +// DropLinuxResourcesBlockIOLeafWeightDevice drops a item form g.spec.Linux.Resources.BlockIO.WeightDevice.LeafWeight +func (g *Generator) DropLinuxResourcesBlockIOLeafWeightDevice(major int64, minor int64) { + if g.spec == nil || g.spec.Linux == nil || g.spec.Linux.Resources == nil || g.spec.Linux.Resources.BlockIO == nil { + return + } + + for i, weightDevice := range g.spec.Linux.Resources.BlockIO.WeightDevice { + if weightDevice.Major == major && weightDevice.Minor == minor { + if weightDevice.Weight != nil { + newWeightDevice := new(rspec.LinuxWeightDevice) + newWeightDevice.Major = major + newWeightDevice.Minor = minor + newWeightDevice.Weight = weightDevice.Weight + g.spec.Linux.Resources.BlockIO.WeightDevice[i] = *newWeightDevice + } else { + g.spec.Linux.Resources.BlockIO.WeightDevice = append(g.spec.Linux.Resources.BlockIO.WeightDevice[:i], g.spec.Linux.Resources.BlockIO.WeightDevice[i+1:]...) + } + return + } + } +} + +// SetLinuxResourcesBlockIOWeight sets g.spec.Linux.Resources.BlockIO.Weight. +func (g *Generator) SetLinuxResourcesBlockIOWeight(weight uint16) { + g.initSpecLinuxResourcesBlockIO() + g.spec.Linux.Resources.BlockIO.Weight = &weight +} + +// AddLinuxResourcesBlockIOWeightDevice adds or sets g.spec.Linux.Resources.BlockIO.WeightDevice.Weight. +func (g *Generator) AddLinuxResourcesBlockIOWeightDevice(major int64, minor int64, weight uint16) { + g.initSpecLinuxResourcesBlockIO() + for i, weightDevice := range g.spec.Linux.Resources.BlockIO.WeightDevice { + if weightDevice.Major == major && weightDevice.Minor == minor { + g.spec.Linux.Resources.BlockIO.WeightDevice[i].Weight = &weight + return + } + } + weightDevice := new(rspec.LinuxWeightDevice) + weightDevice.Major = major + weightDevice.Minor = minor + weightDevice.Weight = &weight + g.spec.Linux.Resources.BlockIO.WeightDevice = append(g.spec.Linux.Resources.BlockIO.WeightDevice, *weightDevice) +} + +// DropLinuxResourcesBlockIOWeightDevice drops a item form g.spec.Linux.Resources.BlockIO.WeightDevice.Weight +func (g *Generator) DropLinuxResourcesBlockIOWeightDevice(major int64, minor int64) { + if g.spec == nil || g.spec.Linux == nil || g.spec.Linux.Resources == nil || g.spec.Linux.Resources.BlockIO == nil { + return + } + + for i, weightDevice := range g.spec.Linux.Resources.BlockIO.WeightDevice { + if weightDevice.Major == major && weightDevice.Minor == minor { + if weightDevice.LeafWeight != nil { + newWeightDevice := new(rspec.LinuxWeightDevice) + newWeightDevice.Major = major + newWeightDevice.Minor = minor + newWeightDevice.LeafWeight = weightDevice.LeafWeight + g.spec.Linux.Resources.BlockIO.WeightDevice[i] = *newWeightDevice + } else { + g.spec.Linux.Resources.BlockIO.WeightDevice = append(g.spec.Linux.Resources.BlockIO.WeightDevice[:i], g.spec.Linux.Resources.BlockIO.WeightDevice[i+1:]...) + } + return + } + } +} + +// AddLinuxResourcesBlockIOThrottleReadBpsDevice adds or sets g.spec.Linux.Resources.BlockIO.ThrottleReadBpsDevice. +func (g *Generator) AddLinuxResourcesBlockIOThrottleReadBpsDevice(major int64, minor int64, rate uint64) { + g.initSpecLinuxResourcesBlockIO() + throttleDevices := addOrReplaceBlockIOThrottleDevice(g.spec.Linux.Resources.BlockIO.ThrottleReadBpsDevice, major, minor, rate) + g.spec.Linux.Resources.BlockIO.ThrottleReadBpsDevice = throttleDevices +} + +// DropLinuxResourcesBlockIOThrottleReadBpsDevice drops a item from g.spec.Linux.Resources.BlockIO.ThrottleReadBpsDevice. +func (g *Generator) DropLinuxResourcesBlockIOThrottleReadBpsDevice(major int64, minor int64) { + if g.spec == nil || g.spec.Linux == nil || g.spec.Linux.Resources == nil || g.spec.Linux.Resources.BlockIO == nil { + return + } + + throttleDevices := dropBlockIOThrottleDevice(g.spec.Linux.Resources.BlockIO.ThrottleReadBpsDevice, major, minor) + g.spec.Linux.Resources.BlockIO.ThrottleReadBpsDevice = throttleDevices +} + +// AddLinuxResourcesBlockIOThrottleReadIOPSDevice adds or sets g.spec.Linux.Resources.BlockIO.ThrottleReadIOPSDevice. +func (g *Generator) AddLinuxResourcesBlockIOThrottleReadIOPSDevice(major int64, minor int64, rate uint64) { + g.initSpecLinuxResourcesBlockIO() + throttleDevices := addOrReplaceBlockIOThrottleDevice(g.spec.Linux.Resources.BlockIO.ThrottleReadIOPSDevice, major, minor, rate) + g.spec.Linux.Resources.BlockIO.ThrottleReadIOPSDevice = throttleDevices +} + +// DropLinuxResourcesBlockIOThrottleReadIOPSDevice drops a item from g.spec.Linux.Resources.BlockIO.ThrottleReadIOPSDevice. +func (g *Generator) DropLinuxResourcesBlockIOThrottleReadIOPSDevice(major int64, minor int64) { + if g.spec == nil || g.spec.Linux == nil || g.spec.Linux.Resources == nil || g.spec.Linux.Resources.BlockIO == nil { + return + } + + throttleDevices := dropBlockIOThrottleDevice(g.spec.Linux.Resources.BlockIO.ThrottleReadIOPSDevice, major, minor) + g.spec.Linux.Resources.BlockIO.ThrottleReadIOPSDevice = throttleDevices +} + +// AddLinuxResourcesBlockIOThrottleWriteBpsDevice adds or sets g.spec.Linux.Resources.BlockIO.ThrottleWriteBpsDevice. +func (g *Generator) AddLinuxResourcesBlockIOThrottleWriteBpsDevice(major int64, minor int64, rate uint64) { + g.initSpecLinuxResourcesBlockIO() + throttleDevices := addOrReplaceBlockIOThrottleDevice(g.spec.Linux.Resources.BlockIO.ThrottleWriteBpsDevice, major, minor, rate) + g.spec.Linux.Resources.BlockIO.ThrottleWriteBpsDevice = throttleDevices +} + +// DropLinuxResourcesBlockIOThrottleWriteBpsDevice drops a item from g.spec.Linux.Resources.BlockIO.ThrottleWriteBpsDevice. +func (g *Generator) DropLinuxResourcesBlockIOThrottleWriteBpsDevice(major int64, minor int64) { + if g.spec == nil || g.spec.Linux == nil || g.spec.Linux.Resources == nil || g.spec.Linux.Resources.BlockIO == nil { + return + } + + throttleDevices := dropBlockIOThrottleDevice(g.spec.Linux.Resources.BlockIO.ThrottleWriteBpsDevice, major, minor) + g.spec.Linux.Resources.BlockIO.ThrottleWriteBpsDevice = throttleDevices +} + +// AddLinuxResourcesBlockIOThrottleWriteIOPSDevice adds or sets g.spec.Linux.Resources.BlockIO.ThrottleWriteIOPSDevice. +func (g *Generator) AddLinuxResourcesBlockIOThrottleWriteIOPSDevice(major int64, minor int64, rate uint64) { + g.initSpecLinuxResourcesBlockIO() + throttleDevices := addOrReplaceBlockIOThrottleDevice(g.spec.Linux.Resources.BlockIO.ThrottleWriteIOPSDevice, major, minor, rate) + g.spec.Linux.Resources.BlockIO.ThrottleWriteIOPSDevice = throttleDevices +} + +// DropLinuxResourcesBlockIOThrottleWriteIOPSDevice drops a item from g.spec.Linux.Resources.BlockIO.ThrottleWriteIOPSDevice. +func (g *Generator) DropLinuxResourcesBlockIOThrottleWriteIOPSDevice(major int64, minor int64) { + if g.spec == nil || g.spec.Linux == nil || g.spec.Linux.Resources == nil || g.spec.Linux.Resources.BlockIO == nil { + return + } + + throttleDevices := dropBlockIOThrottleDevice(g.spec.Linux.Resources.BlockIO.ThrottleWriteIOPSDevice, major, minor) + g.spec.Linux.Resources.BlockIO.ThrottleWriteIOPSDevice = throttleDevices +} + // SetLinuxResourcesCPUShares sets g.spec.Linux.Resources.CPU.Shares. func (g *Generator) SetLinuxResourcesCPUShares(shares uint64) { g.initSpecLinuxResourcesCPU() @@ -563,16 +725,17 @@ func (g *Generator) AddLinuxResourcesHugepageLimit(pageSize string, limit uint64 } // DropLinuxResourcesHugepageLimit drops a hugepage limit from g.spec.Linux.Resources.HugepageLimits. -func (g *Generator) DropLinuxResourcesHugepageLimit(pageSize string) error { - g.initSpecLinuxResources() +func (g *Generator) DropLinuxResourcesHugepageLimit(pageSize string) { + if g.spec == nil || g.spec.Linux == nil || g.spec.Linux.Resources == nil { + return + } + for i, pageLimit := range g.spec.Linux.Resources.HugepageLimits { if pageLimit.Pagesize == pageSize { g.spec.Linux.Resources.HugepageLimits = append(g.spec.Linux.Resources.HugepageLimits[:i], g.spec.Linux.Resources.HugepageLimits[i+1:]...) - return nil + return } } - - return nil } // SetLinuxResourcesMemoryLimit sets g.spec.Linux.Resources.Memory.Limit. @@ -640,7 +803,10 @@ func (g *Generator) AddLinuxResourcesNetworkPriorities(name string, prio uint32) // DropLinuxResourcesNetworkPriorities drops one item from g.spec.Linux.Resources.Network.Priorities. func (g *Generator) DropLinuxResourcesNetworkPriorities(name string) { - g.initSpecLinuxResourcesNetwork() + if g.spec == nil || g.spec.Linux == nil || g.spec.Linux.Resources == nil || g.spec.Linux.Resources.Network == nil { + return + } + for i, netPriority := range g.spec.Linux.Resources.Network.Priorities { if netPriority.Name == name { g.spec.Linux.Resources.Network.Priorities = append(g.spec.Linux.Resources.Network.Priorities[:i], g.spec.Linux.Resources.Network.Priorities[i+1:]...) @@ -722,11 +888,15 @@ func (g *Generator) SetLinuxRootPropagation(rp string) error { switch rp { case "": case "private": + case "rprivate": case "slave": + case "rslave": case "shared": + case "rshared": case "unbindable": + case "runbindable": default: - return fmt.Errorf("rootfs-propagation must be empty or one of private|slave|shared|unbindable") + return fmt.Errorf("rootfs-propagation %q must be empty or one of (r)private|(r)slave|(r)shared|(r)unbindable", rp) } g.initSpecLinux() g.spec.Linux.RootfsPropagation = rp @@ -742,42 +912,16 @@ func (g *Generator) ClearPreStartHooks() { } // AddPreStartHook add a prestart hook into g.spec.Hooks.Prestart. -func (g *Generator) AddPreStartHook(path string, args []string) { +func (g *Generator) AddPreStartHook(preStartHook rspec.Hook) error { g.initSpecHooks() - hook := rspec.Hook{Path: path, Args: args} for i, hook := range g.spec.Hooks.Prestart { - if hook.Path == path { - g.spec.Hooks.Prestart[i] = hook - return - } - } - g.spec.Hooks.Prestart = append(g.spec.Hooks.Prestart, hook) -} - -// AddPreStartHookEnv adds envs of a prestart hook into g.spec.Hooks.Prestart. -func (g *Generator) AddPreStartHookEnv(path string, envs []string) { - g.initSpecHooks() - for i, hook := range g.spec.Hooks.Prestart { - if hook.Path == path { - g.spec.Hooks.Prestart[i].Env = envs - return - } - } - hook := rspec.Hook{Path: path, Env: envs} - g.spec.Hooks.Prestart = append(g.spec.Hooks.Prestart, hook) -} - -// AddPreStartHookTimeout adds timeout of a prestart hook into g.spec.Hooks.Prestart. -func (g *Generator) AddPreStartHookTimeout(path string, timeout int) { - g.initSpecHooks() - for i, hook := range g.spec.Hooks.Prestart { - if hook.Path == path { - g.spec.Hooks.Prestart[i].Timeout = &timeout - return + if hook.Path == preStartHook.Path { + g.spec.Hooks.Prestart[i] = preStartHook + return nil } } - hook := rspec.Hook{Path: path, Timeout: &timeout} - g.spec.Hooks.Prestart = append(g.spec.Hooks.Prestart, hook) + g.spec.Hooks.Prestart = append(g.spec.Hooks.Prestart, preStartHook) + return nil } // ClearPostStopHooks clear g.spec.Hooks.Poststop. @@ -789,42 +933,16 @@ func (g *Generator) ClearPostStopHooks() { } // AddPostStopHook adds a poststop hook into g.spec.Hooks.Poststop. -func (g *Generator) AddPostStopHook(path string, args []string) { +func (g *Generator) AddPostStopHook(postStopHook rspec.Hook) error { g.initSpecHooks() - hook := rspec.Hook{Path: path, Args: args} for i, hook := range g.spec.Hooks.Poststop { - if hook.Path == path { - g.spec.Hooks.Poststop[i] = hook - return - } - } - g.spec.Hooks.Poststop = append(g.spec.Hooks.Poststop, hook) -} - -// AddPostStopHookEnv adds envs of a poststop hook into g.spec.Hooks.Poststop. -func (g *Generator) AddPostStopHookEnv(path string, envs []string) { - g.initSpecHooks() - for i, hook := range g.spec.Hooks.Poststop { - if hook.Path == path { - g.spec.Hooks.Poststop[i].Env = envs - return - } - } - hook := rspec.Hook{Path: path, Env: envs} - g.spec.Hooks.Poststop = append(g.spec.Hooks.Poststop, hook) -} - -// AddPostStopHookTimeout adds timeout of a poststop hook into g.spec.Hooks.Poststop. -func (g *Generator) AddPostStopHookTimeout(path string, timeout int) { - g.initSpecHooks() - for i, hook := range g.spec.Hooks.Poststop { - if hook.Path == path { - g.spec.Hooks.Poststop[i].Timeout = &timeout - return + if hook.Path == postStopHook.Path { + g.spec.Hooks.Poststop[i] = postStopHook + return nil } } - hook := rspec.Hook{Path: path, Timeout: &timeout} - g.spec.Hooks.Poststop = append(g.spec.Hooks.Poststop, hook) + g.spec.Hooks.Poststop = append(g.spec.Hooks.Poststop, postStopHook) + return nil } // ClearPostStartHooks clear g.spec.Hooks.Poststart. @@ -836,107 +954,50 @@ func (g *Generator) ClearPostStartHooks() { } // AddPostStartHook adds a poststart hook into g.spec.Hooks.Poststart. -func (g *Generator) AddPostStartHook(path string, args []string) { +func (g *Generator) AddPostStartHook(postStartHook rspec.Hook) error { g.initSpecHooks() - hook := rspec.Hook{Path: path, Args: args} for i, hook := range g.spec.Hooks.Poststart { - if hook.Path == path { - g.spec.Hooks.Poststart[i] = hook - return + if hook.Path == postStartHook.Path { + g.spec.Hooks.Poststart[i] = postStartHook + return nil } } - g.spec.Hooks.Poststart = append(g.spec.Hooks.Poststart, hook) + g.spec.Hooks.Poststart = append(g.spec.Hooks.Poststart, postStartHook) + return nil } -// AddPostStartHookEnv adds envs of a poststart hook into g.spec.Hooks.Poststart. -func (g *Generator) AddPostStartHookEnv(path string, envs []string) { - g.initSpecHooks() - for i, hook := range g.spec.Hooks.Poststart { - if hook.Path == path { - g.spec.Hooks.Poststart[i].Env = envs - return - } - } - hook := rspec.Hook{Path: path, Env: envs} - g.spec.Hooks.Poststart = append(g.spec.Hooks.Poststart, hook) -} +// AddMount adds a mount into g.spec.Mounts. +func (g *Generator) AddMount(mnt rspec.Mount) { + g.initSpec() -// AddPostStartHookTimeout adds timeout of a poststart hook into g.spec.Hooks.Poststart. -func (g *Generator) AddPostStartHookTimeout(path string, timeout int) { - g.initSpecHooks() - for i, hook := range g.spec.Hooks.Poststart { - if hook.Path == path { - g.spec.Hooks.Poststart[i].Timeout = &timeout - return - } - } - hook := rspec.Hook{Path: path, Timeout: &timeout} - g.spec.Hooks.Poststart = append(g.spec.Hooks.Poststart, hook) + g.spec.Mounts = append(g.spec.Mounts, mnt) } -// AddTmpfsMount adds a tmpfs mount into g.spec.Mounts. -func (g *Generator) AddTmpfsMount(dest string, options []string) { - mnt := rspec.Mount{ - Destination: dest, - Type: "tmpfs", - Source: "tmpfs", - Options: options, - } - +// RemoveMount removes a mount point on the dest directory +func (g *Generator) RemoveMount(dest string) { g.initSpec() - g.spec.Mounts = append(g.spec.Mounts, mnt) -} -// AddCgroupsMount adds a cgroup mount into g.spec.Mounts. -func (g *Generator) AddCgroupsMount(mountCgroupOption string) error { - switch mountCgroupOption { - case "ro": - case "rw": - case "no": - return nil - default: - return fmt.Errorf("--mount-cgroups should be one of (ro,rw,no)") + for index, mount := range g.spec.Mounts { + if mount.Destination == dest { + g.spec.Mounts = append(g.spec.Mounts[:index], g.spec.Mounts[index+1:]...) + return + } } +} - mnt := rspec.Mount{ - Destination: "/sys/fs/cgroup", - Type: "cgroup", - Source: "cgroup", - Options: []string{"nosuid", "noexec", "nodev", "relatime", mountCgroupOption}, - } +// Mounts returns the list of mounts +func (g *Generator) Mounts() []rspec.Mount { g.initSpec() - g.spec.Mounts = append(g.spec.Mounts, mnt) - return nil + return g.spec.Mounts } -// AddBindMount adds a bind mount into g.spec.Mounts. -func (g *Generator) AddBindMount(source, dest string, options []string) { - if len(options) == 0 { - options = []string{"rw"} - } - - // We have to make sure that there is a bind option set, otherwise it won't - // be an actual bindmount. - foundBindOption := false - for _, opt := range options { - if opt == "bind" || opt == "rbind" { - foundBindOption = true - break - } - } - if !foundBindOption { - options = append(options, "bind") - } - - mnt := rspec.Mount{ - Destination: dest, - Type: "bind", - Source: source, - Options: options, +// ClearMounts clear g.spec.Mounts +func (g *Generator) ClearMounts() { + if g.spec == nil { + return } - g.initSpec() - g.spec.Mounts = append(g.spec.Mounts, mnt) + g.spec.Mounts = []rspec.Mount{} } // SetupPrivileged sets up the privilege-related fields inside g.spec. @@ -1093,10 +1154,11 @@ func (g *Generator) AddProcessCapabilityPermitted(c string) error { // DropProcessCapabilityAmbient drops a process capability from g.spec.Process.Capabilities.Ambient. func (g *Generator) DropProcessCapabilityAmbient(c string) error { - cp := strings.ToUpper(c) - - g.initSpecProcessCapabilities() + if g.spec == nil || g.spec.Process == nil || g.spec.Process.Capabilities == nil { + return nil + } + cp := strings.ToUpper(c) for i, cap := range g.spec.Process.Capabilities.Ambient { if strings.ToUpper(cap) == cp { g.spec.Process.Capabilities.Ambient = removeFunc(g.spec.Process.Capabilities.Ambient, i) @@ -1108,10 +1170,11 @@ func (g *Generator) DropProcessCapabilityAmbient(c string) error { // DropProcessCapabilityBounding drops a process capability from g.spec.Process.Capabilities.Bounding. func (g *Generator) DropProcessCapabilityBounding(c string) error { - cp := strings.ToUpper(c) - - g.initSpecProcessCapabilities() + if g.spec == nil || g.spec.Process == nil || g.spec.Process.Capabilities == nil { + return nil + } + cp := strings.ToUpper(c) for i, cap := range g.spec.Process.Capabilities.Bounding { if strings.ToUpper(cap) == cp { g.spec.Process.Capabilities.Bounding = removeFunc(g.spec.Process.Capabilities.Bounding, i) @@ -1123,10 +1186,11 @@ func (g *Generator) DropProcessCapabilityBounding(c string) error { // DropProcessCapabilityEffective drops a process capability from g.spec.Process.Capabilities.Effective. func (g *Generator) DropProcessCapabilityEffective(c string) error { - cp := strings.ToUpper(c) - - g.initSpecProcessCapabilities() + if g.spec == nil || g.spec.Process == nil || g.spec.Process.Capabilities == nil { + return nil + } + cp := strings.ToUpper(c) for i, cap := range g.spec.Process.Capabilities.Effective { if strings.ToUpper(cap) == cp { g.spec.Process.Capabilities.Effective = removeFunc(g.spec.Process.Capabilities.Effective, i) @@ -1138,13 +1202,11 @@ func (g *Generator) DropProcessCapabilityEffective(c string) error { // DropProcessCapabilityInheritable drops a process capability from g.spec.Process.Capabilities.Inheritable. func (g *Generator) DropProcessCapabilityInheritable(c string) error { - cp := strings.ToUpper(c) - if err := validate.CapValid(cp, g.HostSpecific); err != nil { - return err + if g.spec == nil || g.spec.Process == nil || g.spec.Process.Capabilities == nil { + return nil } - g.initSpecProcessCapabilities() - + cp := strings.ToUpper(c) for i, cap := range g.spec.Process.Capabilities.Inheritable { if strings.ToUpper(cap) == cp { g.spec.Process.Capabilities.Inheritable = removeFunc(g.spec.Process.Capabilities.Inheritable, i) @@ -1156,10 +1218,11 @@ func (g *Generator) DropProcessCapabilityInheritable(c string) error { // DropProcessCapabilityPermitted drops a process capability from g.spec.Process.Capabilities.Permitted. func (g *Generator) DropProcessCapabilityPermitted(c string) error { - cp := strings.ToUpper(c) - - g.initSpecProcessCapabilities() + if g.spec == nil || g.spec.Process == nil || g.spec.Process.Capabilities == nil { + return nil + } + cp := strings.ToUpper(c) for i, cap := range g.spec.Process.Capabilities.Permitted { if strings.ToUpper(cap) == cp { g.spec.Process.Capabilities.Ambient = removeFunc(g.spec.Process.Capabilities.Ambient, i) @@ -1254,18 +1317,17 @@ func (g *Generator) AddDevice(device rspec.LinuxDevice) { } // RemoveDevice remove a device from g.spec.Linux.Devices -func (g *Generator) RemoveDevice(path string) error { +func (g *Generator) RemoveDevice(path string) { if g.spec == nil || g.spec.Linux == nil || g.spec.Linux.Devices == nil { - return nil + return } for i, device := range g.spec.Linux.Devices { if device.Path == path { g.spec.Linux.Devices = append(g.spec.Linux.Devices[:i], g.spec.Linux.Devices[i+1:]...) - return nil + return } } - return nil } // ClearLinuxDevices clears g.spec.Linux.Devices @@ -1361,3 +1423,122 @@ func (g *Generator) AddLinuxReadonlyPaths(path string) { g.initSpecLinux() g.spec.Linux.ReadonlyPaths = append(g.spec.Linux.ReadonlyPaths, path) } + +func addOrReplaceBlockIOThrottleDevice(tmpList []rspec.LinuxThrottleDevice, major int64, minor int64, rate uint64) []rspec.LinuxThrottleDevice { + throttleDevices := tmpList + for i, throttleDevice := range throttleDevices { + if throttleDevice.Major == major && throttleDevice.Minor == minor { + throttleDevices[i].Rate = rate + return throttleDevices + } + } + throttleDevice := new(rspec.LinuxThrottleDevice) + throttleDevice.Major = major + throttleDevice.Minor = minor + throttleDevice.Rate = rate + throttleDevices = append(throttleDevices, *throttleDevice) + + return throttleDevices +} + +func dropBlockIOThrottleDevice(tmpList []rspec.LinuxThrottleDevice, major int64, minor int64) []rspec.LinuxThrottleDevice { + throttleDevices := tmpList + for i, throttleDevice := range throttleDevices { + if throttleDevice.Major == major && throttleDevice.Minor == minor { + throttleDevices = append(throttleDevices[:i], throttleDevices[i+1:]...) + return throttleDevices + } + } + + return throttleDevices +} + +// AddSolarisAnet adds network into g.spec.Solaris.Anet +func (g *Generator) AddSolarisAnet(anet rspec.SolarisAnet) { + g.initSpecSolaris() + g.spec.Solaris.Anet = append(g.spec.Solaris.Anet, anet) +} + +// SetSolarisCappedCPUNcpus sets g.spec.Solaris.CappedCPU.Ncpus +func (g *Generator) SetSolarisCappedCPUNcpus(ncpus string) { + g.initSpecSolarisCappedCPU() + g.spec.Solaris.CappedCPU.Ncpus = ncpus +} + +// SetSolarisCappedMemoryPhysical sets g.spec.Solaris.CappedMemory.Physical +func (g *Generator) SetSolarisCappedMemoryPhysical(physical string) { + g.initSpecSolarisCappedMemory() + g.spec.Solaris.CappedMemory.Physical = physical +} + +// SetSolarisCappedMemorySwap sets g.spec.Solaris.CappedMemory.Swap +func (g *Generator) SetSolarisCappedMemorySwap(swap string) { + g.initSpecSolarisCappedMemory() + g.spec.Solaris.CappedMemory.Swap = swap +} + +// SetSolarisLimitPriv sets g.spec.Solaris.LimitPriv +func (g *Generator) SetSolarisLimitPriv(limitPriv string) { + g.initSpecSolaris() + g.spec.Solaris.LimitPriv = limitPriv +} + +// SetSolarisMaxShmMemory sets g.spec.Solaris.MaxShmMemory +func (g *Generator) SetSolarisMaxShmMemory(memory string) { + g.initSpecSolaris() + g.spec.Solaris.MaxShmMemory = memory +} + +// SetSolarisMilestone sets g.spec.Solaris.Milestone +func (g *Generator) SetSolarisMilestone(milestone string) { + g.initSpecSolaris() + g.spec.Solaris.Milestone = milestone +} + +// SetWindowsHypervUntilityVMPath sets g.spec.Windows.HyperV.UtilityVMPath. +func (g *Generator) SetWindowsHypervUntilityVMPath(path string) { + g.initSpecWindowsHyperV() + g.spec.Windows.HyperV.UtilityVMPath = path +} + +// SetWinodwsIgnoreFlushesDuringBoot sets g.spec.Winodws.IgnoreFlushesDuringBoot. +func (g *Generator) SetWinodwsIgnoreFlushesDuringBoot(ignore bool) { + g.initSpecWindows() + g.spec.Windows.IgnoreFlushesDuringBoot = ignore +} + +// AddWindowsLayerFolders adds layer folders into g.spec.Windows.LayerFolders. +func (g *Generator) AddWindowsLayerFolders(folder string) { + g.initSpecWindows() + g.spec.Windows.LayerFolders = append(g.spec.Windows.LayerFolders, folder) +} + +// SetWindowsNetwork sets g.spec.Windows.Network. +func (g *Generator) SetWindowsNetwork(network rspec.WindowsNetwork) { + g.initSpecWindows() + g.spec.Windows.Network = &network +} + +// SetWindowsResourcesCPU sets g.spec.Windows.Resources.CPU. +func (g *Generator) SetWindowsResourcesCPU(cpu rspec.WindowsCPUResources) { + g.initSpecWindowsResources() + g.spec.Windows.Resources.CPU = &cpu +} + +// SetWindowsResourcesMemoryLimit sets g.spec.Windows.Resources.Memory.Limit. +func (g *Generator) SetWindowsResourcesMemoryLimit(limit uint64) { + g.initSpecWindowsResourcesMemory() + g.spec.Windows.Resources.Memory.Limit = &limit +} + +// SetWindowsResourcesStorage sets g.spec.Windows.Resources.Storage. +func (g *Generator) SetWindowsResourcesStorage(storage rspec.WindowsStorageResources) { + g.initSpecWindowsResources() + g.spec.Windows.Resources.Storage = &storage +} + +// SetWinodwsServicing sets g.spec.Winodws.Servicing. +func (g *Generator) SetWinodwsServicing(servicing bool) { + g.initSpecWindows() + g.spec.Windows.Servicing = servicing +} diff --git a/vendor/github.com/opencontainers/runtime-tools/generate/spec.go b/vendor/github.com/opencontainers/runtime-tools/generate/spec.go index 519d25448..d7a6da81d 100644 --- a/vendor/github.com/opencontainers/runtime-tools/generate/spec.go +++ b/vendor/github.com/opencontainers/runtime-tools/generate/spec.go @@ -59,6 +59,13 @@ func (g *Generator) initSpecLinux() { } } +func (g *Generator) initSpecLinuxIntelRdt() { + g.initSpecLinux() + if g.spec.Linux.IntelRdt == nil { + g.spec.Linux.IntelRdt = &rspec.LinuxIntelRdt{} + } +} + func (g *Generator) initSpecLinuxSysctl() { g.initSpecLinux() if g.spec.Linux.Sysctl == nil { @@ -80,6 +87,13 @@ func (g *Generator) initSpecLinuxResources() { } } +func (g *Generator) initSpecLinuxResourcesBlockIO() { + g.initSpecLinuxResources() + if g.spec.Linux.Resources.BlockIO == nil { + g.spec.Linux.Resources.BlockIO = &rspec.LinuxBlockIO{} + } +} + func (g *Generator) initSpecLinuxResourcesCPU() { g.initSpecLinuxResources() if g.spec.Linux.Resources.CPU == nil { @@ -107,3 +121,52 @@ func (g *Generator) initSpecLinuxResourcesPids() { g.spec.Linux.Resources.Pids = &rspec.LinuxPids{} } } + +func (g *Generator) initSpecSolaris() { + g.initSpec() + if g.spec.Solaris == nil { + g.spec.Solaris = &rspec.Solaris{} + } +} + +func (g *Generator) initSpecSolarisCappedCPU() { + g.initSpecSolaris() + if g.spec.Solaris.CappedCPU == nil { + g.spec.Solaris.CappedCPU = &rspec.SolarisCappedCPU{} + } +} + +func (g *Generator) initSpecSolarisCappedMemory() { + g.initSpecSolaris() + if g.spec.Solaris.CappedMemory == nil { + g.spec.Solaris.CappedMemory = &rspec.SolarisCappedMemory{} + } +} + +func (g *Generator) initSpecWindows() { + g.initSpec() + if g.spec.Windows == nil { + g.spec.Windows = &rspec.Windows{} + } +} + +func (g *Generator) initSpecWindowsHyperV() { + g.initSpecWindows() + if g.spec.Windows.HyperV == nil { + g.spec.Windows.HyperV = &rspec.WindowsHyperV{} + } +} + +func (g *Generator) initSpecWindowsResources() { + g.initSpecWindows() + if g.spec.Windows.Resources == nil { + g.spec.Windows.Resources = &rspec.WindowsResources{} + } +} + +func (g *Generator) initSpecWindowsResourcesMemory() { + g.initSpecWindowsResources() + if g.spec.Windows.Resources.Memory == nil { + g.spec.Windows.Resources.Memory = &rspec.WindowsMemoryResources{} + } +} diff --git a/vendor/github.com/opencontainers/runtime-tools/specerror/bundle.go b/vendor/github.com/opencontainers/runtime-tools/specerror/bundle.go index 0a6b2d423..dbe32af3d 100644 --- a/vendor/github.com/opencontainers/runtime-tools/specerror/bundle.go +++ b/vendor/github.com/opencontainers/runtime-tools/specerror/bundle.go @@ -9,11 +9,11 @@ import ( // define error codes const ( // ConfigInRootBundleDir represents "This REQUIRED file MUST reside in the root of the bundle directory" - ConfigInRootBundleDir = "This REQUIRED file MUST reside in the root of the bundle directory." + ConfigInRootBundleDir Code = 0xa001 + iota // ConfigConstName represents "This REQUIRED file MUST be named `config.json`." - ConfigConstName = "This REQUIRED file MUST be named `config.json`." + ConfigConstName // ArtifactsInSingleDir represents "When supplied, while these artifacts MUST all be present in a single directory on the local filesystem, that directory itself is not part of the bundle." - ArtifactsInSingleDir = "When supplied, while these artifacts MUST all be present in a single directory on the local filesystem, that directory itself is not part of the bundle." + ArtifactsInSingleDir ) var ( diff --git a/vendor/github.com/opencontainers/runtime-tools/specerror/config-linux.go b/vendor/github.com/opencontainers/runtime-tools/specerror/config-linux.go index 2967adcef..aa2a284ce 100644 --- a/vendor/github.com/opencontainers/runtime-tools/specerror/config-linux.go +++ b/vendor/github.com/opencontainers/runtime-tools/specerror/config-linux.go @@ -9,59 +9,59 @@ import ( // define error codes const ( // DefaultFilesystems represents "The following filesystems SHOULD be made available in each container's filesystem:" - DefaultFilesystems = "The following filesystems SHOULD be made available in each container's filesystem:" + DefaultFilesystems Code = 0xc001 + iota // NSPathAbs represents "This value MUST be an absolute path in the runtime mount namespace." - NSPathAbs = "This value MUST be an absolute path in the runtime mount namespace." + NSPathAbs // NSProcInPath represents "The runtime MUST place the container process in the namespace associated with that `path`." - NSProcInPath = "The runtime MUST place the container process in the namespace associated with that `path`." + NSProcInPath // NSPathMatchTypeError represents "The runtime MUST generate an error if `path` is not associated with a namespace of type `type`." - NSPathMatchTypeError = "The runtime MUST generate an error if `path` is not associated with a namespace of type `type`." + NSPathMatchTypeError // NSNewNSWithoutPath represents "If `path` is not specified, the runtime MUST create a new container namespace of type `type`." - NSNewNSWithoutPath = "If `path` is not specified, the runtime MUST create a new container namespace of type `type`." + NSNewNSWithoutPath // NSInheritWithoutType represents "If a namespace type is not specified in the `namespaces` array, the container MUST inherit the runtime namespace of that type." - NSInheritWithoutType = "If a namespace type is not specified in the `namespaces` array, the container MUST inherit the runtime namespace of that type." + NSInheritWithoutType // NSErrorOnDup represents "If a `namespaces` field contains duplicated namespaces with same `type`, the runtime MUST generate an error." - NSErrorOnDup = "If a `namespaces` field contains duplicated namespaces with same `type`, the runtime MUST generate an error." + NSErrorOnDup // UserNSMapOwnershipRO represents "The runtime SHOULD NOT modify the ownership of referenced filesystems to realize the mapping." - UserNSMapOwnershipRO = "The runtime SHOULD NOT modify the ownership of referenced filesystems to realize the mapping." + UserNSMapOwnershipRO // DevicesAvailable represents "devices (array of objects, OPTIONAL) lists devices that MUST be available in the container." - DevicesAvailable = "devices (array of objects, OPTIONAL) lists devices that MUST be available in the container." + DevicesAvailable // DevicesFileNotMatch represents "If a file already exists at `path` that does not match the requested device, the runtime MUST generate an error." - DevicesFileNotMatch = "If a file already exists at `path` that does not match the requested device, the runtime MUST generate an error." + DevicesFileNotMatch // DevicesMajMinRequired represents "`major, minor` (int64, REQUIRED unless `type` is `p`) - major, minor numbers for the device." - DevicesMajMinRequired = "`major, minor` (int64, REQUIRED unless `type` is `p`) - major, minor numbers for the device." + DevicesMajMinRequired // DevicesErrorOnDup represents "The same `type`, `major` and `minor` SHOULD NOT be used for multiple devices." - DevicesErrorOnDup = "The same `type`, `major` and `minor` SHOULD NOT be used for multiple devices." + DevicesErrorOnDup // DefaultDevices represents "In addition to any devices configured with this setting, the runtime MUST also supply default devices." - DefaultDevices = "In addition to any devices configured with this setting, the runtime MUST also supply default devices." + DefaultDevices // CgroupsPathAbsOrRel represents "The value of `cgroupsPath` MUST be either an absolute path or a relative path." - CgroupsPathAbsOrRel = "The value of `cgroupsPath` MUST be either an absolute path or a relative path." + CgroupsPathAbsOrRel // CgroupsAbsPathRelToMount represents "In the case of an absolute path (starting with `/`), the runtime MUST take the path to be relative to the cgroups mount point." - CgroupsAbsPathRelToMount = "In the case of an absolute path (starting with `/`), the runtime MUST take the path to be relative to the cgroups mount point." + CgroupsAbsPathRelToMount // CgroupsPathAttach represents "If the value is specified, the runtime MUST consistently attach to the same place in the cgroups hierarchy given the same value of `cgroupsPath`." - CgroupsPathAttach = "If the value is specified, the runtime MUST consistently attach to the same place in the cgroups hierarchy given the same value of `cgroupsPath`." + CgroupsPathAttach // CgroupsPathError represents "Runtimes MAY consider certain `cgroupsPath` values to be invalid, and MUST generate an error if this is the case." - CgroupsPathError = "Runtimes MAY consider certain `cgroupsPath` values to be invalid, and MUST generate an error if this is the case." + CgroupsPathError // DevicesApplyInOrder represents "The runtime MUST apply entries in the listed order." - DevicesApplyInOrder = "The runtime MUST apply entries in the listed order." + DevicesApplyInOrder // BlkIOWeightOrLeafWeightExist represents "You MUST specify at least one of `weight` or `leafWeight` in a given entry, and MAY specify both." - BlkIOWeightOrLeafWeightExist = "You MUST specify at least one of `weight` or `leafWeight` in a given entry, and MAY specify both." + BlkIOWeightOrLeafWeightExist // IntelRdtPIDWrite represents "If `intelRdt` is set, the runtime MUST write the container process ID to the `<container-id>/tasks` file in a mounted `resctrl` pseudo-filesystem, using the container ID from `start` and creating the `container-id` directory if necessary." - IntelRdtPIDWrite = "If `intelRdt` is set, the runtime MUST write the container process ID to the `<container-id>/tasks` file in a mounted `resctrl` pseudo-filesystem, using the container ID from `start` and creating the `<container-id>` directory if necessary." + IntelRdtPIDWrite // IntelRdtNoMountedResctrlError represents "If no mounted `resctrl` pseudo-filesystem is available in the runtime mount namespace, the runtime MUST generate an error." - IntelRdtNoMountedResctrlError = "If no mounted `resctrl` pseudo-filesystem is available in the runtime mount namespace, the runtime MUST generate an error." + IntelRdtNoMountedResctrlError // NotManipResctrlWithoutIntelRdt represents "If `intelRdt` is not set, the runtime MUST NOT manipulate any `resctrl` pseudo-filesystems." - NotManipResctrlWithoutIntelRdt = "If `intelRdt` is not set, the runtime MUST NOT manipulate any `resctrl` pseudo-filesystems." + NotManipResctrlWithoutIntelRdt // IntelRdtL3CacheSchemaWrite represents "If `l3CacheSchema` is set, runtimes MUST write the value to the `schemata` file in the `<container-id>` directory discussed in `intelRdt`." - IntelRdtL3CacheSchemaWrite = "If `l3CacheSchema` is set, runtimes MUST write the value to the `schemata` file in the `<container-id>` directory discussed in `intelRdt`." + IntelRdtL3CacheSchemaWrite // IntelRdtL3CacheSchemaNotWrite represents "If `l3CacheSchema` is not set, runtimes MUST NOT write to `schemata` files in any `resctrl` pseudo-filesystems." - IntelRdtL3CacheSchemaNotWrite = "If `l3CacheSchema` is not set, runtimes MUST NOT write to `schemata` files in any `resctrl` pseudo-filesystems." + IntelRdtL3CacheSchemaNotWrite // SeccSyscallsNamesRequired represents "`names` MUST contain at least one entry." - SeccSyscallsNamesRequired = "`names` MUST contain at least one entry." + SeccSyscallsNamesRequired // MaskedPathsAbs represents "maskedPaths (array of strings, OPTIONAL) will mask over the provided paths inside the container so that they cannot be read. The values MUST be absolute paths in the container namespace." - MaskedPathsAbs = "maskedPaths (array of strings, OPTIONAL) will mask over the provided paths inside the container so that they cannot be read. The values MUST be absolute paths in the container namespace." + MaskedPathsAbs // ReadonlyPathsAbs represents "readonlyPaths (array of strings, OPTIONAL) will set the provided paths as readonly inside the container. The values MUST be absolute paths in the container namespace." - ReadonlyPathsAbs = "readonlyPaths (array of strings, OPTIONAL) will set the provided paths as readonly inside the container. The values MUST be absolute paths in the container namespace." + ReadonlyPathsAbs ) var ( diff --git a/vendor/github.com/opencontainers/runtime-tools/specerror/config-windows.go b/vendor/github.com/opencontainers/runtime-tools/specerror/config-windows.go index 58765286b..c8134867d 100644 --- a/vendor/github.com/opencontainers/runtime-tools/specerror/config-windows.go +++ b/vendor/github.com/opencontainers/runtime-tools/specerror/config-windows.go @@ -9,11 +9,11 @@ import ( // define error codes const ( // WindowsLayerFoldersRequired represents "`layerFolders` MUST contain at least one entry." - WindowsLayerFoldersRequired = "`layerFolders` MUST contain at least one entry." + WindowsLayerFoldersRequired Code = 0xd001 + iota // WindowsHyperVPresent represents "If present, the container MUST be run with Hyper-V isolation." - WindowsHyperVPresent = "If present, the container MUST be run with Hyper-V isolation." + WindowsHyperVPresent // WindowsHyperVOmit represents "If omitted, the container MUST be run as a Windows Server container." - WindowsHyperVOmit = "If omitted, the container MUST be run as a Windows Server container." + WindowsHyperVOmit ) var ( diff --git a/vendor/github.com/opencontainers/runtime-tools/specerror/config.go b/vendor/github.com/opencontainers/runtime-tools/specerror/config.go index e59b459c1..8a73f47fc 100644 --- a/vendor/github.com/opencontainers/runtime-tools/specerror/config.go +++ b/vendor/github.com/opencontainers/runtime-tools/specerror/config.go @@ -9,91 +9,91 @@ import ( // define error codes const ( // SpecVersionInSemVer represents "`ociVersion` (string, REQUIRED) MUST be in SemVer v2.0.0 format and specifies the version of the Open Container Initiative Runtime Specification with which the bundle complies." - SpecVersionInSemVer = "`ociVersion` (string, REQUIRED) MUST be in SemVer v2.0.0 format and specifies the version of the Open Container Initiative Runtime Specification with which the bundle complies." + SpecVersionInSemVer Code = 0xb001 + iota // RootOnWindowsRequired represents "On Windows, for Windows Server Containers, this field is REQUIRED." - RootOnWindowsRequired = "On Windows, for Windows Server Containers, this field is REQUIRED." + RootOnWindowsRequired // RootOnHyperVNotSet represents "For Hyper-V Containers, this field MUST NOT be set." - RootOnHyperVNotSet = "For Hyper-V Containers, this field MUST NOT be set." + RootOnHyperVNotSet // RootOnNonHyperVRequired represents "On all other platforms, this field is REQUIRED." - RootOnNonHyperVRequired = "On all other platforms, this field is REQUIRED." + RootOnNonHyperVRequired // RootPathOnWindowsGUID represents "On Windows, `path` MUST be a volume GUID path." - RootPathOnWindowsGUID = "On Windows, `path` MUST be a volume GUID path." + RootPathOnWindowsGUID // RootPathOnPosixConvention represents "The value SHOULD be the conventional `rootfs`." - RootPathOnPosixConvention = "The value SHOULD be the conventional `rootfs`." + RootPathOnPosixConvention // RootPathExist represents "A directory MUST exist at the path declared by the field." - RootPathExist = "A directory MUST exist at the path declared by the field." + RootPathExist // RootReadonlyImplement represents "`readonly` (bool, OPTIONAL) If true then the root filesystem MUST be read-only inside the container, defaults to false." - RootReadonlyImplement = "`readonly` (bool, OPTIONAL) If true then the root filesystem MUST be read-only inside the container, defaults to false." + RootReadonlyImplement // RootReadonlyOnWindowsFalse represents "* On Windows, this field MUST be omitted or false." - RootReadonlyOnWindowsFalse = "On Windows, this field MUST be omitted or false." + RootReadonlyOnWindowsFalse // MountsInOrder represents "The runtime MUST mount entries in the listed order." - MountsInOrder = "The runtime MUST mount entries in the listed order." + MountsInOrder // MountsDestAbs represents "Destination of mount point: path inside container. This value MUST be an absolute path." - MountsDestAbs = "Destination of mount point: path inside container. This value MUST be an absolute path." + MountsDestAbs // MountsDestOnWindowsNotNested represents "Windows: one mount destination MUST NOT be nested within another mount (e.g., c:\\foo and c:\\foo\\bar)." - MountsDestOnWindowsNotNested = "Windows: one mount destination MUST NOT be nested within another mount (e.g., c:\\foo and c:\\foo\\bar)." + MountsDestOnWindowsNotNested // MountsOptionsOnWindowsROSupport represents "Windows: runtimes MUST support `ro`, mounting the filesystem read-only when `ro` is given." - MountsOptionsOnWindowsROSupport = "Windows: runtimes MUST support `ro`, mounting the filesystem read-only when `ro` is given." + MountsOptionsOnWindowsROSupport // ProcRequiredAtStart represents "This property is REQUIRED when `start` is called." - ProcRequiredAtStart = "This property is REQUIRED when `start` is called." + ProcRequiredAtStart // ProcConsoleSizeIgnore represents "Runtimes MUST ignore `consoleSize` if `terminal` is `false` or unset." - ProcConsoleSizeIgnore = "Runtimes MUST ignore `consoleSize` if `terminal` is `false` or unset." + ProcConsoleSizeIgnore // ProcCwdAbs represents "cwd (string, REQUIRED) is the working directory that will be set for the executable. This value MUST be an absolute path." - ProcCwdAbs = "cwd (string, REQUIRED) is the working directory that will be set for the executable. This value MUST be an absolute path." + ProcCwdAbs // ProcArgsOneEntryRequired represents "This specification extends the IEEE standard in that at least one entry is REQUIRED, and that entry is used with the same semantics as `execvp`'s *file*." - ProcArgsOneEntryRequired = "This specification extends the IEEE standard in that at least one entry is REQUIRED, and that entry is used with the same semantics as `execvp`'s *file*." + ProcArgsOneEntryRequired // PosixProcRlimitsTypeGenError represents "The runtime MUST generate an error for any values which cannot be mapped to a relevant kernel interface." - PosixProcRlimitsTypeGenError = "The runtime MUST generate an error for any values which cannot be mapped to a relevant kernel interface." + PosixProcRlimitsTypeGenError // PosixProcRlimitsTypeGet represents "For each entry in `rlimits`, a `getrlimit(3)` on `type` MUST succeed." - PosixProcRlimitsTypeGet = "For each entry in `rlimits`, a `getrlimit(3)` on `type` MUST succeed." + PosixProcRlimitsTypeGet // PosixProcRlimitsTypeValueError represents "valid values are defined in the ... man page" - PosixProcRlimitsTypeValueError = "valid values are defined in the ... man page" + PosixProcRlimitsTypeValueError // PosixProcRlimitsSoftMatchCur represents "`rlim.rlim_cur` MUST match the configured value." - PosixProcRlimitsSoftMatchCur = "`rlim.rlim_cur` MUST match the configured value." + PosixProcRlimitsSoftMatchCur // PosixProcRlimitsHardMatchMax represents "`rlim.rlim_max` MUST match the configured value." - PosixProcRlimitsHardMatchMax = "`rlim.rlim_max` MUST match the configured value." + PosixProcRlimitsHardMatchMax // PosixProcRlimitsErrorOnDup represents "If `rlimits` contains duplicated entries with same `type`, the runtime MUST generate an error." - PosixProcRlimitsErrorOnDup = "If `rlimits` contains duplicated entries with same `type`, the runtime MUST generate an error." + PosixProcRlimitsErrorOnDup // LinuxProcCapError represents "Any value which cannot be mapped to a relevant kernel interface MUST cause an error." - LinuxProcCapError = "Any value which cannot be mapped to a relevant kernel interface MUST cause an error." + LinuxProcCapError // LinuxProcOomScoreAdjSet represents "If `oomScoreAdj` is set, the runtime MUST set `oom_score_adj` to the given value." - LinuxProcOomScoreAdjSet = "If `oomScoreAdj` is set, the runtime MUST set `oom_score_adj` to the given value." + LinuxProcOomScoreAdjSet // LinuxProcOomScoreAdjNotSet represents "If `oomScoreAdj` is not set, the runtime MUST NOT change the value of `oom_score_adj`." - LinuxProcOomScoreAdjNotSet = "If `oomScoreAdj` is not set, the runtime MUST NOT change the value of `oom_score_adj`." + LinuxProcOomScoreAdjNotSet // PlatformSpecConfOnWindowsSet represents "This MUST be set if the target platform of this spec is `windows`." - PlatformSpecConfOnWindowsSet = "This MUST be set if the target platform of this spec is `windows`." + PlatformSpecConfOnWindowsSet // PosixHooksPathAbs represents "This specification extends the IEEE standard in that `path` MUST be absolute." - PosixHooksPathAbs = "This specification extends the IEEE standard in that `path` MUST be absolute." + PosixHooksPathAbs // PosixHooksTimeoutPositive represents "If set, `timeout` MUST be greater than zero." - PosixHooksTimeoutPositive = "If set, `timeout` MUST be greater than zero." + PosixHooksTimeoutPositive // PosixHooksCalledInOrder represents "Hooks MUST be called in the listed order." - PosixHooksCalledInOrder = "Hooks MUST be called in the listed order." + PosixHooksCalledInOrder // PosixHooksStateToStdin represents "The state of the container MUST be passed to hooks over stdin so that they may do work appropriate to the current state of the container." - PosixHooksStateToStdin = "The state of the container MUST be passed to hooks over stdin so that they may do work appropriate to the current state of the container." + PosixHooksStateToStdin // PrestartTiming represents "The pre-start hooks MUST be called after the `start` operation is called but before the user-specified program command is executed." - PrestartTiming = "The pre-start hooks MUST be called after the `start` operation is called but before the user-specified program command is executed." + PrestartTiming // PoststartTiming represents "The post-start hooks MUST be called after the user-specified process is executed but before the `start` operation returns." - PoststartTiming = "The post-start hooks MUST be called after the user-specified process is executed but before the `start` operation returns." + PoststartTiming // PoststopTiming represents "The post-stop hooks MUST be called after the container is deleted but before the `delete` operation returns." - PoststopTiming = "The post-stop hooks MUST be called after the container is deleted but before the `delete` operation returns." + PoststopTiming // AnnotationsKeyValueMap represents "Annotations MUST be a key-value map." - AnnotationsKeyValueMap = "Annotations MUST be a key-value map." + AnnotationsKeyValueMap // AnnotationsKeyString represents "Keys MUST be strings." - AnnotationsKeyString = "Keys MUST be strings." + AnnotationsKeyString // AnnotationsKeyRequired represents "Keys MUST NOT be an empty string." - AnnotationsKeyRequired = "Keys MUST NOT be an empty string." + AnnotationsKeyRequired // AnnotationsKeyReversedDomain represents "Keys SHOULD be named using a reverse domain notation - e.g. `com.example.myKey`." - AnnotationsKeyReversedDomain = "Keys SHOULD be named using a reverse domain notation - e.g. `com.example.myKey`." + AnnotationsKeyReversedDomain // AnnotationsKeyReservedNS represents "Keys using the `org.opencontainers` namespace are reserved and MUST NOT be used by subsequent specifications." - AnnotationsKeyReservedNS = "Keys using the `org.opencontainers` namespace are reserved and MUST NOT be used by subsequent specifications." + AnnotationsKeyReservedNS // AnnotationsKeyIgnoreUnknown represents "Implementations that are reading/processing this configuration file MUST NOT generate an error if they encounter an unknown annotation key." - AnnotationsKeyIgnoreUnknown = "Implementations that are reading/processing this configuration file MUST NOT generate an error if they encounter an unknown annotation key." + AnnotationsKeyIgnoreUnknown // AnnotationsValueString represents "Values MUST be strings." - AnnotationsValueString = "Values MUST be strings." + AnnotationsValueString // ExtensibilityIgnoreUnknownProp represents "Runtimes that are reading or processing this configuration file MUST NOT generate an error if they encounter an unknown property." - ExtensibilityIgnoreUnknownProp = "Runtimes that are reading or processing this configuration file MUST NOT generate an error if they encounter an unknown property.\nInstead they MUST ignore unknown properties." + ExtensibilityIgnoreUnknownProp // ValidValues represents "Runtimes that are reading or processing this configuration file MUST generate an error when invalid or unsupported values are encountered." - ValidValues = "Runtimes that are reading or processing this configuration file MUST generate an error when invalid or unsupported values are encountered." + ValidValues ) var ( diff --git a/vendor/github.com/opencontainers/runtime-tools/specerror/error.go b/vendor/github.com/opencontainers/runtime-tools/specerror/error.go index 1cfe054c2..0300f7df2 100644 --- a/vendor/github.com/opencontainers/runtime-tools/specerror/error.go +++ b/vendor/github.com/opencontainers/runtime-tools/specerror/error.go @@ -13,13 +13,13 @@ const referenceTemplate = "https://github.com/opencontainers/runtime-spec/blob/v // Code represents the spec violation, enumerating both // configuration violations and runtime violations. -type Code string +type Code int64 const ( // NonError represents that an input is not an error - NonError = "the input is not an error" + NonError Code = 0x1a001 + iota // NonRFCError represents that an error is not a rfc2119 error - NonRFCError = "the error is not a rfc2119 error" + NonRFCError ) type errorTemplate struct { @@ -50,7 +50,7 @@ var ociErrors = map[Code]errorTemplate{} func register(code Code, level rfc2119.Level, ref func(versiong string) (string, error)) { if _, ok := ociErrors[code]; ok { - panic(fmt.Sprintf("should not regist a same code twice: %s", code)) + panic(fmt.Sprintf("should not regist a same code twice: %v", code)) } ociErrors[code] = errorTemplate{Level: level, Reference: ref} diff --git a/vendor/github.com/opencontainers/runtime-tools/specerror/runtime-linux.go b/vendor/github.com/opencontainers/runtime-tools/specerror/runtime-linux.go index 3ce7c3ed4..8eb259ba1 100644 --- a/vendor/github.com/opencontainers/runtime-tools/specerror/runtime-linux.go +++ b/vendor/github.com/opencontainers/runtime-tools/specerror/runtime-linux.go @@ -9,7 +9,7 @@ import ( // define error codes const ( // DefaultRuntimeLinuxSymlinks represents "While creating the container (step 2 in the lifecycle), runtimes MUST create default symlinks if the source file exists after processing `mounts`." - DefaultRuntimeLinuxSymlinks = "While creating the container (step 2 in the lifecycle), runtimes MUST create the default symlinks if the source file exists after processing `mounts`." + DefaultRuntimeLinuxSymlinks Code = 0xf001 + iota ) var ( diff --git a/vendor/github.com/opencontainers/runtime-tools/specerror/runtime.go b/vendor/github.com/opencontainers/runtime-tools/specerror/runtime.go index 7552b3c84..0144f6696 100644 --- a/vendor/github.com/opencontainers/runtime-tools/specerror/runtime.go +++ b/vendor/github.com/opencontainers/runtime-tools/specerror/runtime.go @@ -9,91 +9,91 @@ import ( // define error codes const ( // EntityOperSameContainer represents "The entity using a runtime to create a container MUST be able to use the operations defined in this specification against that same container." - EntityOperSameContainer = "The entity using a runtime to create a container MUST be able to use the operations defined in this specification against that same container." + EntityOperSameContainer Code = 0xe001 + iota // StateIDUniq represents "`id` (string, REQUIRED) is the container's ID. This MUST be unique across all containers on this host." - StateIDUniq = "`id` (string, REQUIRED) is the container's ID. This MUST be unique across all containers on this host." + StateIDUniq // StateNewStatus represents "Additional values MAY be defined by the runtime, however, they MUST be used to represent new runtime states not defined above." - StateNewStatus = "Additional values MAY be defined by the runtime, however, they MUST be used to represent new runtime states not defined above." + StateNewStatus // DefaultStateJSONPattern represents "When serialized in JSON, the format MUST adhere to the default pattern." - DefaultStateJSONPattern = "When serialized in JSON, the format MUST adhere to the default pattern." + DefaultStateJSONPattern // EnvCreateImplement represents "The container's runtime environment MUST be created according to the configuration in `config.json`." - EnvCreateImplement = "The container's runtime environment MUST be created according to the configuration in `config.json`." + EnvCreateImplement // EnvCreateError represents "If the runtime is unable to create the environment specified in the `config.json`, it MUST generate an error." - EnvCreateError = "If the runtime is unable to create the environment specified in the `config.json`. it MUST generate an error." + EnvCreateError // ProcNotRunAtResRequest represents "While the resources requested in the `config.json` MUST be created, the user-specified program (from `process`) MUST NOT be run at this time." - ProcNotRunAtResRequest = "While the resources requested in the `config.json` MUST be created, the user-specified program (from `process`) MUST NOT be run at this time." + ProcNotRunAtResRequest // ConfigUpdatesWithoutAffect represents "Any updates to `config.json` after this step MUST NOT affect the container." - ConfigUpdatesWithoutAffect = "Any updates to `config.json` after this step MUST NOT affect the container." + ConfigUpdatesWithoutAffect // PrestartHooksInvoke represents "The prestart hooks MUST be invoked by the runtime." - PrestartHooksInvoke = "The prestart hooks MUST be invoked by the runtime." + PrestartHooksInvoke // PrestartHookFailGenError represents "If any prestart hook fails, the runtime MUST generate an error, stop the container, and continue the lifecycle at step 9." - PrestartHookFailGenError = "If any prestart hook fails, the runtime MUST generate an error, stop the container, and continue the lifecycle at step 9." + PrestartHookFailGenError // ProcImplement represents "The runtime MUST run the user-specified program, as specified by `process`." - ProcImplement = "The runtime MUST run the user-specified program, as specified by `process`." + ProcImplement // PoststartHooksInvoke represents "The poststart hooks MUST be invoked by the runtime." - PoststartHooksInvoke = "The poststart hooks MUST be invoked by the runtime." + PoststartHooksInvoke // PoststartHookFailGenWarn represents "If any poststart hook fails, the runtime MUST log a warning, but the remaining hooks and lifecycle continue as if the hook had succeeded." - PoststartHookFailGenWarn = "If any poststart hook fails, the runtime MUST log a warning, but the remaining hooks and lifecycle continue as if the hook had succeeded." + PoststartHookFailGenWarn // UndoCreateSteps represents "The container MUST be destroyed by undoing the steps performed during create phase (step 2)." - UndoCreateSteps = "The container MUST be destroyed by undoing the steps performed during create phase (step 2)." + UndoCreateSteps // PoststopHooksInvoke represents "The poststop hooks MUST be invoked by the runtime." - PoststopHooksInvoke = "The poststop hooks MUST be invoked by the runtime." + PoststopHooksInvoke // PoststopHookFailGenWarn represents "If any poststop hook fails, the runtime MUST log a warning, but the remaining hooks and lifecycle continue as if the hook had succeeded." - PoststopHookFailGenWarn = "If any poststop hook fails, the runtime MUST log a warning, but the remaining hooks and lifecycle continue as if the hook had succeeded." + PoststopHookFailGenWarn // ErrorsLeaveStateUnchange represents "Unless otherwise stated, generating an error MUST leave the state of the environment as if the operation were never attempted - modulo any possible trivial ancillary changes such as logging." - ErrorsLeaveStateUnchange = "Unless otherwise stated, generating an error MUST leave the state of the environment as if the operation were never attempted - modulo any possible trivial ancillary changes such as logging." + ErrorsLeaveStateUnchange // WarnsLeaveFlowUnchange represents "Unless otherwise stated, logging a warning does not change the flow of the operation; it MUST continue as if the warning had not been logged." - WarnsLeaveFlowUnchange = "Unless otherwise stated, logging a warning does not change the flow of the operation; it MUST continue as if the warning had not been logged." + WarnsLeaveFlowUnchange // DefaultOperations represents "Unless otherwise stated, runtimes MUST support the default operations." - DefaultOperations = "Unless otherwise stated, runtimes MUST support the default operations." + DefaultOperations // QueryWithoutIDGenError represents "This operation MUST generate an error if it is not provided the ID of a container." - QueryWithoutIDGenError = "This operation MUST generate an error if it is not provided the ID of a container." + QueryWithoutIDGenError // QueryNonExistGenError represents "Attempting to query a container that does not exist MUST generate an error." - QueryNonExistGenError = "Attempting to query a container that does not exist MUST generate an error." + QueryNonExistGenError // QueryStateImplement represents "This operation MUST return the state of a container as specified in the State section." - QueryStateImplement = "This operation MUST return the state of a container as specified in the State section." + QueryStateImplement // CreateWithBundlePathAndID represents "This operation MUST generate an error if it is not provided a path to the bundle and the container ID to associate with the container." - CreateWithBundlePathAndID = "This operation MUST generate an error if it is not provided a path to the bundle and the container ID to associate with the container." + CreateWithBundlePathAndID // CreateWithUniqueID represents "If the ID provided is not unique across all containers within the scope of the runtime, or is not valid in any other way, the implementation MUST generate an error and a new container MUST NOT be created." - CreateWithUniqueID = "If the ID provided is not unique across all containers within the scope of the runtime, or is not valid in any other way, the implementation MUST generate an error and a new container MUST NOT be created." + CreateWithUniqueID // CreateNewContainer represents "This operation MUST create a new container." - CreateNewContainer = "This operation MUST create a new container." + CreateNewContainer // PropsApplyExceptProcOnCreate represents "All of the properties configured in `config.json` except for `process` MUST be applied." - PropsApplyExceptProcOnCreate = "All of the properties configured in `config.json` except for `process` MUST be applied." + PropsApplyExceptProcOnCreate // ProcArgsApplyUntilStart represents `process.args` MUST NOT be applied until triggered by the `start` operation." - ProcArgsApplyUntilStart = "`process.args` MUST NOT be applied until triggered by the `start` operation." + ProcArgsApplyUntilStart // PropApplyFailGenError represents "If the runtime cannot apply a property as specified in the configuration, it MUST generate an error." - PropApplyFailGenError = "If the runtime cannot apply a property as specified in the configuration, it MUST generate an error." + PropApplyFailGenError // PropApplyFailNotCreate represents "If the runtime cannot apply a property as specified in the configuration, a new container MUST NOT be created." - PropApplyFailNotCreate = "If the runtime cannot apply a property as specified in the configuration, a new container MUST NOT be created." + PropApplyFailNotCreate // StartWithoutIDGenError represents "`start` operation MUST generate an error if it is not provided the container ID." - StartWithoutIDGenError = "`start` operation MUST generate an error if it is not provided the container ID." + StartWithoutIDGenError // StartNonCreateHaveNoEffect represents "Attempting to `start` a container that is not `created` MUST have no effect on the container." - StartNonCreateHaveNoEffect = "Attempting to `start` a container that is not `created` MUST have no effect on the container." + StartNonCreateHaveNoEffect // StartNonCreateGenError represents "Attempting to `start` a container that is not `created` MUST generate an error." - StartNonCreateGenError = "Attempting to `start` a container that is not `created` MUST generate an error." + StartNonCreateGenError // StartProcImplement represents "`start` operation MUST run the user-specified program as specified by `process`." - StartProcImplement = "`start` operation MUST run the user-specified program as specified by `process`." + StartProcImplement // StartWithProcUnsetGenError represents "`start` operation MUST generate an error if `process` was not set." - StartWithProcUnsetGenError = "`start` operation MUST generate an error if `process` was not set." + StartWithProcUnsetGenError // KillWithoutIDGenError represents "`kill` operation MUST generate an error if it is not provided the container ID." - KillWithoutIDGenError = "`kill` operation MUST generate an error if it is not provided the container ID." + KillWithoutIDGenError // KillNonCreateRunHaveNoEffect represents "Attempting to send a signal to a container that is neither `created` nor `running` MUST have no effect on the container." - KillNonCreateRunHaveNoEffect = "Attempting to send a signal to a container that is neither `created` nor `running` MUST have no effect on the container." + KillNonCreateRunHaveNoEffect // KillNonCreateRunGenError represents "Attempting to send a signal to a container that is neither `created` nor `running` MUST generate an error." - KillNonCreateRunGenError = "Attempting to send a signal to a container that is neither `created` nor `running` MUST generate an error." + KillNonCreateRunGenError // KillSignalImplement represents "`kill` operation MUST send the specified signal to the container process." - KillSignalImplement = "`kill` operation MUST send the specified signal to the container process." + KillSignalImplement // DeleteWithoutIDGenError represents "`delete` operation MUST generate an error if it is not provided the container ID." - DeleteWithoutIDGenError = "`delete` operation MUST generate an error if it is not provided the container ID." + DeleteWithoutIDGenError // DeleteNonStopHaveNoEffect represents "Attempting to `delete` a container that is not `stopped` MUST have no effect on the container." - DeleteNonStopHaveNoEffect = "Attempting to `delete` a container that is not `stopped` MUST have no effect on the container." + DeleteNonStopHaveNoEffect // DeleteNonStopGenError represents "Attempting to `delete` a container that is not `stopped` MUST generate an error." - DeleteNonStopGenError = "Attempting to `delete` a container that is not `stopped` MUST generate an error." + DeleteNonStopGenError // DeleteResImplement represents "Deleting a container MUST delete the resources that were created during the `create` step." - DeleteResImplement = "Deleting a container MUST delete the resources that were created during the `create` step." + DeleteResImplement // DeleteOnlyCreatedRes represents "Note that resources associated with the container, but not created by this container, MUST NOT be deleted." - DeleteOnlyCreatedRes = "Note that resources associated with the container, but not created by this container, MUST NOT be deleted." + DeleteOnlyCreatedRes ) var ( diff --git a/vendor/github.com/opencontainers/runtime-tools/validate/validate.go b/vendor/github.com/opencontainers/runtime-tools/validate/validate.go index 0914bc691..1030099df 100644 --- a/vendor/github.com/opencontainers/runtime-tools/validate/validate.go +++ b/vendor/github.com/opencontainers/runtime-tools/validate/validate.go @@ -66,23 +66,20 @@ type Validator struct { } // NewValidator creates a Validator -func NewValidator(spec *rspec.Spec, bundlePath string, hostSpecific bool, platform string) Validator { +func NewValidator(spec *rspec.Spec, bundlePath string, hostSpecific bool, platform string) (Validator, error) { if hostSpecific && platform != runtime.GOOS { - platform = runtime.GOOS + return Validator{}, fmt.Errorf("When hostSpecific is set, platform must be same as the host platform") } return Validator{ spec: spec, bundlePath: bundlePath, HostSpecific: hostSpecific, platform: platform, - } + }, nil } // NewValidatorFromPath creates a Validator with specified bundle path func NewValidatorFromPath(bundlePath string, hostSpecific bool, platform string) (Validator, error) { - if hostSpecific && platform != runtime.GOOS { - platform = runtime.GOOS - } if bundlePath == "" { return Validator{}, fmt.Errorf("bundle path shouldn't be empty") } @@ -104,7 +101,7 @@ func NewValidatorFromPath(bundlePath string, hostSpecific bool, platform string) return Validator{}, err } - return NewValidator(&spec, bundlePath, hostSpecific, platform), nil + return NewValidator(&spec, bundlePath, hostSpecific, platform) } // CheckAll checks all parts of runtime bundle @@ -117,8 +114,10 @@ func (v *Validator) CheckAll() error { errs = multierror.Append(errs, v.CheckSemVer()) errs = multierror.Append(errs, v.CheckMounts()) errs = multierror.Append(errs, v.CheckProcess()) - errs = multierror.Append(errs, v.CheckHooks()) errs = multierror.Append(errs, v.CheckLinux()) + if v.platform == "linux" || v.platform == "solaris" { + errs = multierror.Append(errs, v.CheckHooks()) + } return errs.ErrorOrNil() } @@ -264,6 +263,11 @@ func (v *Validator) CheckSemVer() (errs error) { func (v *Validator) CheckHooks() (errs error) { logrus.Debugf("check hooks") + if v.platform != "linux" && v.platform != "solaris" { + errs = multierror.Append(errs, fmt.Errorf("For %q platform, the configuration structure does not support hooks", v.platform)) + return + } + if v.spec.Hooks != nil { errs = multierror.Append(errs, v.checkEventHooks("prestart", v.spec.Hooks.Prestart, v.HostSpecific)) errs = multierror.Append(errs, v.checkEventHooks("poststart", v.spec.Hooks.Poststart, v.HostSpecific)) @@ -334,7 +338,7 @@ func (v *Validator) CheckProcess() (errs error) { fmt.Errorf("args must not be empty"), rspec.Version)) } else { - if filepath.IsAbs(process.Args[0]) { + if filepath.IsAbs(process.Args[0]) && v.spec.Root != nil { var rootfsPath string if filepath.IsAbs(v.spec.Root.Path) { rootfsPath = v.spec.Root.Path @@ -356,12 +360,15 @@ func (v *Validator) CheckProcess() (errs error) { } } - if v.spec.Process.Capabilities != nil { - errs = multierror.Append(errs, v.CheckCapabilities()) + if v.platform == "linux" || v.platform == "solaris" { + errs = multierror.Append(errs, v.CheckRlimits()) } - errs = multierror.Append(errs, v.CheckRlimits()) if v.platform == "linux" { + if v.spec.Process.Capabilities != nil { + errs = multierror.Append(errs, v.CheckCapabilities()) + } + if len(process.ApparmorProfile) > 0 { profilePath := filepath.Join(v.bundlePath, v.spec.Root.Path, "/etc/apparmor.d", process.ApparmorProfile) _, err := os.Stat(profilePath) @@ -376,60 +383,61 @@ func (v *Validator) CheckProcess() (errs error) { // CheckCapabilities checks v.spec.Process.Capabilities func (v *Validator) CheckCapabilities() (errs error) { + if v.platform != "linux" { + errs = multierror.Append(errs, fmt.Errorf("For %q platform, the configuration structure does not support process.capabilities", v.platform)) + return + } + process := v.spec.Process - if v.platform == "linux" { - var effective, permitted, inheritable, ambient bool - caps := make(map[string][]string) + var effective, permitted, inheritable, ambient bool + caps := make(map[string][]string) - for _, cap := range process.Capabilities.Bounding { - caps[cap] = append(caps[cap], "bounding") - } - for _, cap := range process.Capabilities.Effective { - caps[cap] = append(caps[cap], "effective") - } - for _, cap := range process.Capabilities.Inheritable { - caps[cap] = append(caps[cap], "inheritable") - } - for _, cap := range process.Capabilities.Permitted { - caps[cap] = append(caps[cap], "permitted") - } - for _, cap := range process.Capabilities.Ambient { - caps[cap] = append(caps[cap], "ambient") + for _, cap := range process.Capabilities.Bounding { + caps[cap] = append(caps[cap], "bounding") + } + for _, cap := range process.Capabilities.Effective { + caps[cap] = append(caps[cap], "effective") + } + for _, cap := range process.Capabilities.Inheritable { + caps[cap] = append(caps[cap], "inheritable") + } + for _, cap := range process.Capabilities.Permitted { + caps[cap] = append(caps[cap], "permitted") + } + for _, cap := range process.Capabilities.Ambient { + caps[cap] = append(caps[cap], "ambient") + } + + for capability, owns := range caps { + if err := CapValid(capability, v.HostSpecific); err != nil { + errs = multierror.Append(errs, fmt.Errorf("capability %q is not valid, man capabilities(7)", capability)) } - for capability, owns := range caps { - if err := CapValid(capability, v.HostSpecific); err != nil { - errs = multierror.Append(errs, fmt.Errorf("capability %q is not valid, man capabilities(7)", capability)) + effective, permitted, ambient, inheritable = false, false, false, false + for _, set := range owns { + if set == "effective" { + effective = true + continue } - - effective, permitted, ambient, inheritable = false, false, false, false - for _, set := range owns { - if set == "effective" { - effective = true - continue - } - if set == "inheritable" { - inheritable = true - continue - } - if set == "permitted" { - permitted = true - continue - } - if set == "ambient" { - ambient = true - continue - } + if set == "inheritable" { + inheritable = true + continue } - if effective && !permitted { - errs = multierror.Append(errs, fmt.Errorf("effective capability %q is not allowed, as it's not permitted", capability)) + if set == "permitted" { + permitted = true + continue } - if ambient && !(permitted && inheritable) { - errs = multierror.Append(errs, fmt.Errorf("ambient capability %q is not allowed, as it's not permitted and inheribate", capability)) + if set == "ambient" { + ambient = true + continue } } - } else { - logrus.Warnf("process.capabilities validation not yet implemented for OS %q", v.platform) + if effective && !permitted { + errs = multierror.Append(errs, fmt.Errorf("effective capability %q is not allowed, as it's not permitted", capability)) + } + if ambient && !(permitted && inheritable) { + errs = multierror.Append(errs, fmt.Errorf("ambient capability %q is not allowed, as it's not permitted and inheribate", capability)) + } } return @@ -437,7 +445,8 @@ func (v *Validator) CheckCapabilities() (errs error) { // CheckRlimits checks v.spec.Process.Rlimits func (v *Validator) CheckRlimits() (errs error) { - if v.platform == "windows" { + if v.platform != "linux" && v.platform != "solaris" { + errs = multierror.Append(errs, fmt.Errorf("For %q platform, the configuration structure does not support process.rlimits", v.platform)) return } @@ -597,8 +606,8 @@ func (v *Validator) CheckLinux() (errs error) { for index := 0; index < len(v.spec.Linux.Namespaces); index++ { ns := v.spec.Linux.Namespaces[index] - if !v.namespaceValid(ns) { - errs = multierror.Append(errs, fmt.Errorf("namespace %v is invalid", ns)) + if ns.Path != "" && !osFilepath.IsAbs(v.platform, ns.Path) { + errs = multierror.Append(errs, specerror.NewError(specerror.NSPathAbs, fmt.Errorf("namespace.path %q is not an absolute path", ns.Path), rspec.Version)) } tmpItem := nsTypeList[ns.Type] @@ -615,10 +624,6 @@ func (v *Validator) CheckLinux() (errs error) { if (len(v.spec.Linux.UIDMappings) > 0 || len(v.spec.Linux.GIDMappings) > 0) && !nsTypeList[rspec.UserNamespace].newExist { errs = multierror.Append(errs, errors.New("the UID/GID mappings requires a new User namespace to be specified as well")) - } else if len(v.spec.Linux.UIDMappings) > 5 { - errs = multierror.Append(errs, errors.New("only 5 UID mappings are allowed (linux kernel restriction)")) - } else if len(v.spec.Linux.GIDMappings) > 5 { - errs = multierror.Append(errs, errors.New("only 5 GID mappings are allowed (linux kernel restriction)")) } for k := range v.spec.Linux.Sysctl { @@ -738,10 +743,6 @@ func (v *Validator) CheckLinux() (errs error) { errs = multierror.Append(errs, v.CheckLinuxResources()) } - if v.spec.Linux.Seccomp != nil { - errs = multierror.Append(errs, v.CheckSeccomp()) - } - for _, maskedPath := range v.spec.Linux.MaskedPaths { if !strings.HasPrefix(maskedPath, "/") { errs = multierror.Append(errs, @@ -819,47 +820,6 @@ func (v *Validator) CheckLinuxResources() (errs error) { return } -// CheckSeccomp checkc v.spec.Linux.Seccomp -func (v *Validator) CheckSeccomp() (errs error) { - logrus.Debugf("check linux seccomp") - - s := v.spec.Linux.Seccomp - if !seccompActionValid(s.DefaultAction) { - errs = multierror.Append(errs, fmt.Errorf("seccomp defaultAction %q is invalid", s.DefaultAction)) - } - for index := 0; index < len(s.Syscalls); index++ { - if !syscallValid(s.Syscalls[index]) { - errs = multierror.Append(errs, fmt.Errorf("syscall %v is invalid", s.Syscalls[index])) - } - } - for index := 0; index < len(s.Architectures); index++ { - switch s.Architectures[index] { - case rspec.ArchX86: - case rspec.ArchX86_64: - case rspec.ArchX32: - case rspec.ArchARM: - case rspec.ArchAARCH64: - case rspec.ArchMIPS: - case rspec.ArchMIPS64: - case rspec.ArchMIPS64N32: - case rspec.ArchMIPSEL: - case rspec.ArchMIPSEL64: - case rspec.ArchMIPSEL64N32: - case rspec.ArchPPC: - case rspec.ArchPPC64: - case rspec.ArchPPC64LE: - case rspec.ArchS390: - case rspec.ArchS390X: - case rspec.ArchPARISC: - case rspec.ArchPARISC64: - default: - errs = multierror.Append(errs, fmt.Errorf("seccomp architecture %q is invalid", s.Architectures[index])) - } - } - - return -} - // CapValid checks whether a capability is valid func CapValid(c string, hostSpecific bool) error { isValid := false @@ -936,26 +896,6 @@ func (v *Validator) rlimitValid(rlimit rspec.POSIXRlimit) (errs error) { return } -func (v *Validator) namespaceValid(ns rspec.LinuxNamespace) bool { - switch ns.Type { - case rspec.PIDNamespace: - case rspec.NetworkNamespace: - case rspec.MountNamespace: - case rspec.IPCNamespace: - case rspec.UTSNamespace: - case rspec.UserNamespace: - case rspec.CgroupNamespace: - default: - return false - } - - if ns.Path != "" && !osFilepath.IsAbs(v.platform, ns.Path) { - return false - } - - return true -} - func deviceValid(d rspec.LinuxDevice) bool { switch d.Type { case "b", "c", "u": @@ -972,40 +912,6 @@ func deviceValid(d rspec.LinuxDevice) bool { return true } -func seccompActionValid(secc rspec.LinuxSeccompAction) bool { - switch secc { - case rspec.ActKill: - case rspec.ActTrap: - case rspec.ActErrno: - case rspec.ActTrace: - case rspec.ActAllow: - default: - return false - } - return true -} - -func syscallValid(s rspec.LinuxSyscall) bool { - if !seccompActionValid(s.Action) { - return false - } - for index := 0; index < len(s.Args); index++ { - arg := s.Args[index] - switch arg.Op { - case rspec.OpNotEqual: - case rspec.OpLessThan: - case rspec.OpLessEqual: - case rspec.OpEqualTo: - case rspec.OpGreaterEqual: - case rspec.OpGreaterThan: - case rspec.OpMaskedEqual: - default: - return false - } - } - return true -} - func isStruct(t reflect.Type) bool { return t.Kind() == reflect.Struct } |