From 48530acbd9a622cf88dbbb10cbc8e91575c476e5 Mon Sep 17 00:00:00 2001 From: Giuseppe Scrivano Date: Wed, 22 Apr 2020 12:38:19 +0200 Subject: podman: handle namespaces specified on the CLI and handle differently the user namespace as it supports additional options. Signed-off-by: Giuseppe Scrivano --- cmd/podman/common/create.go | 15 ++++++--- cmd/podman/common/specgen.go | 71 +++++++++++++---------------------------- cmd/podman/containers/create.go | 15 +++++++++ 3 files changed, 47 insertions(+), 54 deletions(-) (limited to 'cmd') diff --git a/cmd/podman/common/create.go b/cmd/podman/common/create.go index e5ee76390..a0aed984c 100644 --- a/cmd/podman/common/create.go +++ b/cmd/podman/common/create.go @@ -49,8 +49,9 @@ func GetCreateFlags(cf *ContainerCLIOpts) *pflag.FlagSet { "cap-drop", []string{}, "Drop capabilities from the container", ) + cgroupNS := "" createFlags.StringVar( - &cf.CGroupsNS, + &cgroupNS, "cgroupns", containerConfig.CgroupNS(), "cgroup namespace to use", ) @@ -247,8 +248,9 @@ func GetCreateFlags(cf *ContainerCLIOpts) *pflag.FlagSet { "interactive", "i", false, "Keep STDIN open even if not attached", ) + ipcNS := "" createFlags.StringVar( - &cf.IPC, + &ipcNS, "ipc", containerConfig.IPCNS(), "IPC namespace to use", ) @@ -329,8 +331,9 @@ func GetCreateFlags(cf *ContainerCLIOpts) *pflag.FlagSet { "use `OS` instead of the running OS for choosing images", ) // markFlagHidden(createFlags, "override-os") + pid := "" createFlags.StringVar( - &cf.PID, + &pid, "pid", containerConfig.PidNS(), "PID namespace to use", ) @@ -461,13 +464,15 @@ func GetCreateFlags(cf *ContainerCLIOpts) *pflag.FlagSet { "user", "u", "", "Username or UID (format: [:])", ) + userNS := "" createFlags.StringVar( - &cf.UserNS, + &userNS, "userns", containerConfig.Containers.UserNS, "User namespace to use", ) + utsNS := "" createFlags.StringVar( - &cf.UTS, + &utsNS, "uts", containerConfig.Containers.UTSNS, "UTS namespace to use", ) diff --git a/cmd/podman/common/specgen.go b/cmd/podman/common/specgen.go index 994c5367e..b90030f7f 100644 --- a/cmd/podman/common/specgen.go +++ b/cmd/podman/common/specgen.go @@ -222,55 +222,28 @@ func FillOutSpecGen(s *specgen.SpecGenerator, c *ContainerCLIOpts, args []string s.PortMappings = ep s.Pod = c.Pod - //s.CgroupNS = specgen.Namespace{ - // NSMode: , - // Value: "", - //} - - //s.UserNS = specgen.Namespace{} - - // Kernel Namespaces - // TODO Fix handling of namespace from pod - // Instead of integrating here, should be done in libpod - // However, that also involves setting up security opts - // when the pod's namespace is integrated - //namespaces = map[string]string{ - // "cgroup": c.CGroupsNS, - // "pid": c.PID, - // //"net": c.Net.Network.Value, // TODO need help here - // "ipc": c.IPC, - // "user": c.User, - // "uts": c.UTS, - //} - // - //if len(c.PID) > 0 { - // split := strings.SplitN(c.PID, ":", 2) - // // need a way to do thsi - // specgen.Namespace{ - // NSMode: split[0], - // } - // //Value: split1 if len allows - //} - // TODO this is going to have be done after things like pod creation are done because - // pod creation changes these values. - //pidMode := ns.PidMode(namespaces["pid"]) - //usernsMode := ns.UsernsMode(namespaces["user"]) - //utsMode := ns.UTSMode(namespaces["uts"]) - //cgroupMode := ns.CgroupMode(namespaces["cgroup"]) - //ipcMode := ns.IpcMode(namespaces["ipc"]) - //// Make sure if network is set to container namespace, port binding is not also being asked for - //netMode := ns.NetworkMode(namespaces["net"]) - //if netMode.IsContainer() { - // if len(portBindings) > 0 { - // return nil, errors.Errorf("cannot set port bindings on an existing container network namespace") - // } - //} - - // TODO Remove when done with namespaces for realz - // Setting a default for IPC to get this working - s.IpcNS = specgen.Namespace{ - NSMode: specgen.Private, - Value: "", + for k, v := range map[string]*specgen.Namespace{ + c.IPC: &s.IpcNS, + c.PID: &s.PidNS, + c.UTS: &s.UtsNS, + c.CGroupsNS: &s.CgroupNS, + } { + if k != "" { + *v, err = specgen.ParseNamespace(k) + if err != nil { + return err + } + } + } + // userns must be treated differently + if c.UserNS != "" { + s.UserNS, err = specgen.ParseUserNamespace(c.UserNS) + if err != nil { + return err + } + } + if c.Net != nil { + s.NetNS = c.Net.Network } // TODO this is going to have to be done the libpod/server end of things diff --git a/cmd/podman/containers/create.go b/cmd/podman/containers/create.go index f8a7c07ef..8f140e2b8 100644 --- a/cmd/podman/containers/create.go +++ b/cmd/podman/containers/create.go @@ -149,6 +149,21 @@ func createInit(c *cobra.Command) error { if c.Flag("no-hosts").Changed && c.Flag("add-host").Changed { return errors.Errorf("--no-hosts and --add-host cannot be set together") } + if c.Flag("userns").Changed { + cliVals.UserNS = c.Flag("userns").Value.String() + } + if c.Flag("ipc").Changed { + cliVals.IPC = c.Flag("ipc").Value.String() + } + if c.Flag("uts").Changed { + cliVals.UTS = c.Flag("uts").Value.String() + } + if c.Flag("pid").Changed { + cliVals.PID = c.Flag("pid").Value.String() + } + if c.Flag("cgroupns").Changed { + cliVals.CGroupsNS = c.Flag("cgroupns").Value.String() + } // Docker-compatibility: the "-h" flag for run/create is reserved for // the hostname (see https://github.com/containers/libpod/issues/1367). -- cgit v1.2.3-54-g00ecf