package libpod import ( "bytes" "errors" "fmt" "net" "os" "strconv" "strings" "sync" "time" "github.com/containers/common/libnetwork/types" "github.com/containers/podman/v4/libpod/define" jsoniter "github.com/json-iterator/go" "github.com/sirupsen/logrus" bolt "go.etcd.io/bbolt" ) var json = jsoniter.ConfigCompatibleWithStandardLibrary // BoltState is a state implementation backed by a Bolt DB type BoltState struct { valid bool dbPath string dbLock sync.Mutex namespace string namespaceBytes []byte runtime *Runtime } // A brief description of the format of the BoltDB state: // At the top level, the following buckets are created: // - idRegistryBkt: Maps ID to Name for containers and pods. // Used to ensure container and pod IDs are globally unique. // - nameRegistryBkt: Maps Name to ID for containers and pods. // Used to ensure container and pod names are globally unique. // - nsRegistryBkt: Maps ID to namespace for all containers and pods. // Used during lookup operations to determine if a given ID is in the same // namespace as the state. // - ctrBkt: Contains a sub-bucket for each container in the state. // Each sub-bucket has config and state keys holding the container's JSON // encoded configuration and state (respectively), an optional netNS key // containing the path to the container's network namespace, a dependencies // bucket containing the container's dependencies, and an optional pod key // containing the ID of the pod the container is joined to. // After updates to include exec sessions, may also include an exec bucket // with the IDs of exec sessions currently in use by the container. // - allCtrsBkt: Map of ID to name containing only containers. Used for // container lookup operations. // - podBkt: Contains a sub-bucket for each pod in the state. // Each sub-bucket has config and state keys holding the pod's JSON encoded // configuration and state, plus a containers sub bucket holding the IDs of // containers in the pod. // - allPodsBkt: Map of ID to name containing only pods. Used for pod lookup // operations. // - execBkt: Map of exec session ID to container ID - used for resolving // exec session IDs to the containers that hold the exec session. // - aliasesBkt - Contains a bucket for each CNI network, which contain a map of // network alias (an extra name for containers in DNS) to the ID of the // container holding the alias. Aliases must be unique per-network, and cannot // conflict with names registered in nameRegistryBkt. // - runtimeConfigBkt: Contains configuration of the libpod instance that // initially created the database. This must match for any further instances // that access the database, to ensure that state mismatches with // containers/storage do not occur. // - exitCodeBucket/exitCodeTimeStampBucket: (#14559) exit codes must be part // of the database to resolve a previous race condition when one process waits // for the exit file to be written and another process removes it along with // the container during auto-removal. The same race would happen trying to // read the exit code from the containers bucket. Hence, exit codes go into // their own bucket. To avoid the rather expensive JSON (un)marshaling, we // have two buckets: one for the exit codes, the other for the timestamps. // NewBoltState creates a new bolt-backed state database func NewBoltState(path string, runtime *Runtime) (State, error) { state := new(BoltState) state.dbPath = path state.runtime = runtime state.namespace = "" state.namespaceBytes = nil logrus.Debugf("Initializing boltdb state at %s", path) db, err := bolt.Open(path, 0600, nil) if err != nil { return nil, fmt.Errorf("opening database %s: %w", path, err) } // Everywhere else, we use s.deferredCloseDBCon(db) to ensure the state's DB // mutex is also unlocked. // However, here, the mutex has not been locked, since we just created // the DB connection, and it hasn't left this function yet - no risk of // concurrent access. // As such, just a db.Close() is fine here. defer db.Close() createBuckets := [][]byte{ idRegistryBkt, nameRegistryBkt, nsRegistryBkt, ctrBkt, allCtrsBkt, podBkt, allPodsBkt, volBkt, allVolsBkt, execBkt, runtimeConfigBkt, exitCodeBkt, exitCodeTimeStampBkt, volCtrsBkt, } // Does the DB need an update? needsUpdate := false err = db.View(func(tx *bolt.Tx) error { for _, bkt := range createBuckets { if test := tx.Bucket(bkt); test == nil { needsUpdate = true break } } return nil }) if err != nil { return nil, fmt.Errorf("checking DB schema: %w", err) } if !needsUpdate { state.valid = true return state, nil } // Ensure schema is properly created in DB err = db.Update(func(tx *bolt.Tx) error { for _, bkt := range createBuckets { if _, err := tx.CreateBucketIfNotExists(bkt); err != nil { return fmt.Errorf("creating bucket %s: %w", string(bkt), err) } } return nil }) if err != nil { return nil, fmt.Errorf("creating buckets for DB: %w", err) } state.valid = true return state, nil } // Close closes the state and prevents further use func (s *BoltState) Close() error { s.valid = false return nil } // Refresh clears container and pod states after a reboot func (s *BoltState) Refresh() error { if !s.valid { return define.ErrDBClosed } db, err := s.getDBCon() if err != nil { return err } defer s.deferredCloseDBCon(db) err = db.Update(func(tx *bolt.Tx) error { idBucket, err := getIDBucket(tx) if err != nil { return err } namesBucket, err := getNamesBucket(tx) if err != nil { return err } ctrsBucket, err := getCtrBucket(tx) if err != nil { return err } podsBucket, err := getPodBucket(tx) if err != nil { return err } allVolsBucket, err := getAllVolsBucket(tx) if err != nil { return err } volBucket, err := getVolBucket(tx) if err != nil { return err } execBucket, err := getExecBucket(tx) if err != nil { return err } exitCodeBucket, err := getExitCodeBucket(tx) if err != nil { return err } timeStampBucket, err := getExitCodeTimeStampBucket(tx) if err != nil { return err } // Clear all exec exit codes toRemoveExitCodes := []string{} err = exitCodeBucket.ForEach(func(id, _ []byte) error { toRemoveExitCodes = append(toRemoveExitCodes, string(id)) return nil }) if err != nil { return fmt.Errorf("reading exit codes bucket: %w", err) } for _, id := range toRemoveExitCodes { if err := exitCodeBucket.Delete([]byte(id)); err != nil { return fmt.Errorf("removing exit code for ID %s: %w", id, err) } } toRemoveTimeStamps := []string{} err = timeStampBucket.ForEach(func(id, _ []byte) error { toRemoveTimeStamps = append(toRemoveTimeStamps, string(id)) return nil }) if err != nil { return fmt.Errorf("reading timestamps bucket: %w", err) } for _, id := range toRemoveTimeStamps { if err := timeStampBucket.Delete([]byte(id)); err != nil { return fmt.Errorf("removing timestamp for ID %s: %w", id, err) } } // Iterate through all IDs. Check if they are containers. // If they are, unmarshal their state, and then clear // PID, mountpoint, and state for all of them // Then save the modified state // Also clear all network namespaces toRemoveIDs := []string{} err = idBucket.ForEach(func(id, name []byte) error { ctrBkt := ctrsBucket.Bucket(id) if ctrBkt == nil { // It's a pod podBkt := podsBucket.Bucket(id) if podBkt == nil { // This is neither a pod nor a container // Something is seriously wrong, but // continue on and try to clean up the // state and become consistent. // Just note what needs to be removed // for now - ForEach says you shouldn't // remove things from the table during // it. logrus.Errorf("Database issue: dangling ID %s found (not a pod or container) - removing", string(id)) toRemoveIDs = append(toRemoveIDs, string(id)) return nil } // Get the state stateBytes := podBkt.Get(stateKey) if stateBytes == nil { return fmt.Errorf("pod %s missing state key: %w", string(id), define.ErrInternal) } state := new(podState) if err := json.Unmarshal(stateBytes, state); err != nil { return fmt.Errorf("unmarshalling state for pod %s: %w", string(id), err) } // Clear the Cgroup path state.CgroupPath = "" newStateBytes, err := json.Marshal(state) if err != nil { return fmt.Errorf("marshalling modified state for pod %s: %w", string(id), err) } if err := podBkt.Put(stateKey, newStateBytes); err != nil { return fmt.Errorf("updating state for pod %s in DB: %w", string(id), err) } // It's not a container, nothing to do return nil } // First, delete the network namespace if err := ctrBkt.Delete(netNSKey); err != nil { return fmt.Errorf("removing network namespace for container %s: %w", string(id), err) } stateBytes := ctrBkt.Get(stateKey) if stateBytes == nil { // Badly formatted container bucket return fmt.Errorf("container %s missing state in DB: %w", string(id), define.ErrInternal) } state := new(ContainerState) if err := json.Unmarshal(stateBytes, state); err != nil { return fmt.Errorf("unmarshalling state for container %s: %w", string(id), err) } resetState(state) newStateBytes, err := json.Marshal(state) if err != nil { return fmt.Errorf("marshalling modified state for container %s: %w", string(id), err) } if err := ctrBkt.Put(stateKey, newStateBytes); err != nil { return fmt.Errorf("updating state for container %s in DB: %w", string(id), err) } // Delete all exec sessions, if there are any ctrExecBkt := ctrBkt.Bucket(execBkt) if ctrExecBkt != nil { // Can't delete in a ForEach, so build a list of // what to remove then remove. toRemove := []string{} err = ctrExecBkt.ForEach(func(id, unused []byte) error { toRemove = append(toRemove, string(id)) return nil }) if err != nil { return err } for _, execID := range toRemove { if err := ctrExecBkt.Delete([]byte(execID)); err != nil { return fmt.Errorf("removing exec session %s from container %s: %w", execID, string(id), err) } } } return nil }) if err != nil { return err } // Remove dangling IDs. for _, id := range toRemoveIDs { // Look up the ID to see if we also have a dangling name // in the DB. name := idBucket.Get([]byte(id)) if name != nil { if testID := namesBucket.Get(name); testID != nil { logrus.Infof("Found dangling name %s (ID %s) in database", string(name), id) if err := namesBucket.Delete(name); err != nil { return fmt.Errorf("removing dangling name %s (ID %s) from database: %w", string(name), id, err) } } } if err := idBucket.Delete([]byte(id)); err != nil { return fmt.Errorf("removing dangling ID %s from database: %w", id, err) } } // Now refresh volumes err = allVolsBucket.ForEach(func(id, name []byte) error { dbVol := volBucket.Bucket(id) if dbVol == nil { return fmt.Errorf("inconsistency in state - volume %s is in all volumes bucket but volume not found: %w", string(id), define.ErrInternal) } // Get the state volStateBytes := dbVol.Get(stateKey) if volStateBytes == nil { // If the volume doesn't have a state, nothing to do return nil } oldState := new(VolumeState) if err := json.Unmarshal(volStateBytes, oldState); err != nil { return fmt.Errorf("unmarshalling state for volume %s: %w", string(id), err) } // Reset mount count to 0 oldState.MountCount = 0 oldState.MountPoint = "" newState, err := json.Marshal(oldState) if err != nil { return fmt.Errorf("marshalling state for volume %s: %w", string(id), err) } if err := dbVol.Put(stateKey, newState); err != nil { return fmt.Errorf("storing new state for volume %s: %w", string(id), err) } return nil }) if err != nil { return err } // Now refresh exec sessions // We want to remove them all, but for-each can't modify buckets // So we have to make a list of what to operate on, then do the // work. toRemoveExec := []string{} err = execBucket.ForEach(func(id, unused []byte) error { toRemoveExec = append(toRemoveExec, string(id)) return nil }) if err != nil { return err } for _, execSession := range toRemoveExec { if err := execBucket.Delete([]byte(execSession)); err != nil { return fmt.Errorf("deleting exec session %s registry from database: %w", execSession, err) } } return nil }) return err } // GetDBConfig retrieves runtime configuration fields that were created when // the database was first initialized func (s *BoltState) GetDBConfig() (*DBConfig, error) { if !s.valid { return nil, define.ErrDBClosed } cfg := new(DBConfig) db, err := s.getDBCon() if err != nil { return nil, err } defer s.deferredCloseDBCon(db) err = db.View(func(tx *bolt.Tx) error { configBucket, err := getRuntimeConfigBucket(tx) if err != nil { return err } // Some of these may be nil // When we convert to string, Go will coerce them to "" // That's probably fine - we could raise an error if the key is // missing, but just not including it is also OK. libpodRoot := configBucket.Get(staticDirKey) libpodTmp := configBucket.Get(tmpDirKey) storageRoot := configBucket.Get(graphRootKey) storageTmp := configBucket.Get(runRootKey) graphDriver := configBucket.Get(graphDriverKey) volumePath := configBucket.Get(volPathKey) cfg.LibpodRoot = string(libpodRoot) cfg.LibpodTmp = string(libpodTmp) cfg.StorageRoot = string(storageRoot) cfg.StorageTmp = string(storageTmp) cfg.GraphDriver = string(graphDriver) cfg.VolumePath = string(volumePath) return nil }) if err != nil { return nil, err } return cfg, nil } // ValidateDBConfig validates paths in the given runtime against the database func (s *BoltState) ValidateDBConfig(runtime *Runtime) error { if !s.valid { return define.ErrDBClosed } db, err := s.getDBCon() if err != nil { return err } defer s.deferredCloseDBCon(db) // Check runtime configuration if err := checkRuntimeConfig(db, runtime); err != nil { return err } return nil } // SetNamespace sets the namespace that will be used for container and pod // retrieval func (s *BoltState) SetNamespace(ns string) error { s.namespace = ns if ns != "" { s.namespaceBytes = []byte(ns) } else { s.namespaceBytes = nil } return nil } // GetName returns the name associated with a given ID. Since IDs are globally // unique, it works for both containers and pods. // Returns ErrNoSuchCtr if the ID does not exist. func (s *BoltState) GetName(id string) (string, error) { if id == "" { return "", define.ErrEmptyID } if !s.valid { return "", define.ErrDBClosed } idBytes := []byte(id) db, err := s.getDBCon() if err != nil { return "", err } defer s.deferredCloseDBCon(db) name := "" err = db.View(func(tx *bolt.Tx) error { idBkt, err := getIDBucket(tx) if err != nil { return err } nameBytes := idBkt.Get(idBytes) if nameBytes == nil { return define.ErrNoSuchCtr } if s.namespaceBytes != nil { nsBkt, err := getNSBucket(tx) if err != nil { return err } idNs := nsBkt.Get(idBytes) if !bytes.Equal(idNs, s.namespaceBytes) { return define.ErrNoSuchCtr } } name = string(nameBytes) return nil }) if err != nil { return "", err } return name, nil } // Container retrieves a single container from the state by its full ID func (s *BoltState) Container(id string) (*Container, error) { if id == "" { return nil, define.ErrEmptyID } if !s.valid { return nil, define.ErrDBClosed } ctrID := []byte(id) ctr := new(Container) ctr.config = new(ContainerConfig) ctr.state = new(ContainerState) db, err := s.getDBCon() if err != nil { return nil, err } defer s.deferredCloseDBCon(db) err = db.View(func(tx *bolt.Tx) error { ctrBucket, err := getCtrBucket(tx) if err != nil { return err } return s.getContainerFromDB(ctrID, ctr, ctrBucket) }) if err != nil { return nil, err } return ctr, nil } // LookupContainerID retrieves a container ID from the state by full or unique // partial ID or name func (s *BoltState) LookupContainerID(idOrName string) (string, error) { if idOrName == "" { return "", define.ErrEmptyID } if !s.valid { return "", define.ErrDBClosed } db, err := s.getDBCon() if err != nil { return "", err } defer s.deferredCloseDBCon(db) var id []byte err = db.View(func(tx *bolt.Tx) error { ctrBucket, err := getCtrBucket(tx) if err != nil { return err } namesBucket, err := getNamesBucket(tx) if err != nil { return err } nsBucket, err := getNSBucket(tx) if err != nil { return err } fullID, err := s.lookupContainerID(idOrName, ctrBucket, namesBucket, nsBucket) // Check if it is in our namespace if s.namespaceBytes != nil { ns := nsBucket.Get(fullID) if !bytes.Equal(ns, s.namespaceBytes) { return fmt.Errorf("no container found with name or ID %s: %w", idOrName, define.ErrNoSuchCtr) } } id = fullID return err }) if err != nil { return "", err } retID := string(id) return retID, nil } // LookupContainer retrieves a container from the state by full or unique // partial ID or name func (s *BoltState) LookupContainer(idOrName string) (*Container, error) { if idOrName == "" { return nil, define.ErrEmptyID } if !s.valid { return nil, define.ErrDBClosed } ctr := new(Container) ctr.config = new(ContainerConfig) ctr.state = new(ContainerState) db, err := s.getDBCon() if err != nil { return nil, err } defer s.deferredCloseDBCon(db) err = db.View(func(tx *bolt.Tx) error { ctrBucket, err := getCtrBucket(tx) if err != nil { return err } namesBucket, err := getNamesBucket(tx) if err != nil { return err } nsBucket, err := getNSBucket(tx) if err != nil { return err } id, err := s.lookupContainerID(idOrName, ctrBucket, namesBucket, nsBucket) if err != nil { return err } return s.getContainerFromDB(id, ctr, ctrBucket) }) if err != nil { return nil, err } return ctr, nil } // HasContainer checks if a container is present in the state func (s *BoltState) HasContainer(id string) (bool, error) { if id == "" { return false, define.ErrEmptyID } if !s.valid { return false, define.ErrDBClosed } ctrID := []byte(id) db, err := s.getDBCon() if err != nil { return false, err } defer s.deferredCloseDBCon(db) exists := false err = db.View(func(tx *bolt.Tx) error { ctrBucket, err := getCtrBucket(tx) if err != nil { return err } ctrDB := ctrBucket.Bucket(ctrID) if ctrDB != nil { if s.namespaceBytes != nil { nsBytes := ctrDB.Get(namespaceKey) if bytes.Equal(nsBytes, s.namespaceBytes) { exists = true } } else { exists = true } } return nil }) if err != nil { return false, err } return exists, nil } // AddContainer adds a container to the state // The container being added cannot belong to a pod func (s *BoltState) AddContainer(ctr *Container) error { if !s.valid { return define.ErrDBClosed } if !ctr.valid { return define.ErrCtrRemoved } if ctr.config.Pod != "" { return fmt.Errorf("cannot add a container that belongs to a pod with AddContainer - use AddContainerToPod: %w", define.ErrInvalidArg) } return s.addContainer(ctr, nil) } // RemoveContainer removes a container from the state // Only removes containers not in pods - for containers that are a member of a // pod, use RemoveContainerFromPod func (s *BoltState) RemoveContainer(ctr *Container) error { if !s.valid { return define.ErrDBClosed } if ctr.config.Pod != "" { return fmt.Errorf("container %s is part of a pod, use RemoveContainerFromPod instead: %w", ctr.ID(), define.ErrPodExists) } db, err := s.getDBCon() if err != nil { return err } defer s.deferredCloseDBCon(db) err = db.Update(func(tx *bolt.Tx) error { return s.removeContainer(ctr, nil, tx) }) return err } // UpdateContainer updates a container's state from the database func (s *BoltState) UpdateContainer(ctr *Container) error { if !s.valid { return define.ErrDBClosed } if !ctr.valid { return define.ErrCtrRemoved } if s.namespace != "" && s.namespace != ctr.config.Namespace { return fmt.Errorf("container %s is in namespace %q, does not match our namespace %q: %w", ctr.ID(), ctr.config.Namespace, s.namespace, define.ErrNSMismatch) } newState := new(ContainerState) netNSPath := "" ctrID := []byte(ctr.ID()) db, err := s.getDBCon() if err != nil { return err } defer s.deferredCloseDBCon(db) err = db.View(func(tx *bolt.Tx) error { ctrBucket, err := getCtrBucket(tx) if err != nil { return err } ctrToUpdate := ctrBucket.Bucket(ctrID) if ctrToUpdate == nil { ctr.valid = false return fmt.Errorf("container %s does not exist in database: %w", ctr.ID(), define.ErrNoSuchCtr) } newStateBytes := ctrToUpdate.Get(stateKey) if newStateBytes == nil { return fmt.Errorf("container %s does not have a state key in DB: %w", ctr.ID(), define.ErrInternal) } if err := json.Unmarshal(newStateBytes, newState); err != nil { return fmt.Errorf("unmarshalling container %s state: %w", ctr.ID(), err) } netNSBytes := ctrToUpdate.Get(netNSKey) if netNSBytes != nil { netNSPath = string(netNSBytes) } return nil }) if err != nil { return err } // Handle network namespace. if os.Geteuid() == 0 { // Do it only when root, either on the host or as root in the // user namespace. if err := replaceNetNS(netNSPath, ctr, newState); err != nil { return err } } // New state compiled successfully, swap it into the current state ctr.state = newState return nil } // SaveContainer saves a container's current state in the database func (s *BoltState) SaveContainer(ctr *Container) error { if !s.valid { return define.ErrDBClosed } if !ctr.valid { return define.ErrCtrRemoved } if s.namespace != "" && s.namespace != ctr.config.Namespace { return fmt.Errorf("container %s is in namespace %q, does not match our namespace %q: %w", ctr.ID(), ctr.config.Namespace, s.namespace, define.ErrNSMismatch) } stateJSON, err := json.Marshal(ctr.state) if err != nil { return fmt.Errorf("marshalling container %s state to JSON: %w", ctr.ID(), err) } netNSPath := getNetNSPath(ctr) ctrID := []byte(ctr.ID()) db, err := s.getDBCon() if err != nil { return err } defer s.deferredCloseDBCon(db) err = db.Update(func(tx *bolt.Tx) error { ctrBucket, err := getCtrBucket(tx) if err != nil { return err } ctrToSave := ctrBucket.Bucket(ctrID) if ctrToSave == nil { ctr.valid = false return fmt.Errorf("container %s does not exist in DB: %w", ctr.ID(), define.ErrNoSuchCtr) } // Update the state if err := ctrToSave.Put(stateKey, stateJSON); err != nil { return fmt.Errorf("updating container %s state in DB: %w", ctr.ID(), err) } if netNSPath != "" { if err := ctrToSave.Put(netNSKey, []byte(netNSPath)); err != nil { return fmt.Errorf("updating network namespace path for container %s in DB: %w", ctr.ID(), err) } } else { // Delete the existing network namespace if err := ctrToSave.Delete(netNSKey); err != nil { return fmt.Errorf("removing network namespace path for container %s in DB: %w", ctr.ID(), err) } } return nil }) return err } // ContainerInUse checks if other containers depend on the given container // It returns a slice of the IDs of the containers depending on the given // container. If the slice is empty, no containers depend on the given container func (s *BoltState) ContainerInUse(ctr *Container) ([]string, error) { if !s.valid { return nil, define.ErrDBClosed } if !ctr.valid { return nil, define.ErrCtrRemoved } if s.namespace != "" && s.namespace != ctr.config.Namespace { return nil, fmt.Errorf("container %s is in namespace %q, does not match our namespace %q: %w", ctr.ID(), ctr.config.Namespace, s.namespace, define.ErrNSMismatch) } depCtrs := []string{} db, err := s.getDBCon() if err != nil { return nil, err } defer s.deferredCloseDBCon(db) err = db.View(func(tx *bolt.Tx) error { ctrBucket, err := getCtrBucket(tx) if err != nil { return err } ctrDB := ctrBucket.Bucket([]byte(ctr.ID())) if ctrDB == nil { ctr.valid = false return fmt.Errorf("no container with ID %q found in DB: %w", ctr.ID(), define.ErrNoSuchCtr) } dependsBkt := ctrDB.Bucket(dependenciesBkt) if dependsBkt == nil { return fmt.Errorf("container %s has no dependencies bucket: %w", ctr.ID(), define.ErrInternal) } // Iterate through and add dependencies err = dependsBkt.ForEach(func(id, value []byte) error { depCtrs = append(depCtrs, string(id)) return nil }) if err != nil { return err } return nil }) if err != nil { return nil, err } return depCtrs, nil } // AllContainers retrieves all the containers in the database func (s *BoltState) AllContainers() ([]*Container, error) { if !s.valid { return nil, define.ErrDBClosed } ctrs := []*Container{} db, err := s.getDBCon() if err != nil { return nil, err } defer s.deferredCloseDBCon(db) err = db.View(func(tx *bolt.Tx) error { allCtrsBucket, err := getAllCtrsBucket(tx) if err != nil { return err } ctrBucket, err := getCtrBucket(tx) if err != nil { return err } return allCtrsBucket.ForEach(func(id, name []byte) error { // If performance becomes an issue, this check can be // removed. But the error messages that come back will // be much less helpful. ctrExists := ctrBucket.Bucket(id) if ctrExists == nil { return fmt.Errorf("state is inconsistent - container ID %s in all containers, but container not found: %w", string(id), define.ErrInternal) } ctr := new(Container) ctr.config = new(ContainerConfig) ctr.state = new(ContainerState) if err := s.getContainerFromDB(id, ctr, ctrBucket); err != nil { // If the error is a namespace mismatch, we can // ignore it safely. // We just won't include the container in the // results. if !errors.Is(err, define.ErrNSMismatch) { // Even if it's not an NS mismatch, it's // not worth erroring over. // If we do, a single bad container JSON // could render libpod unusable. logrus.Errorf("Retrieving container %s from the database: %v", string(id), err) } } else { ctrs = append(ctrs, ctr) } return nil }) }) if err != nil { return nil, err } return ctrs, nil } // GetNetworks returns the CNI networks this container is a part of. func (s *BoltState) GetNetworks(ctr *Container) (map[string]types.PerNetworkOptions, error) { if !s.valid { return nil, define.ErrDBClosed } if !ctr.valid { return nil, define.ErrCtrRemoved } if s.namespace != "" && s.namespace != ctr.config.Namespace { return nil, fmt.Errorf("container %s is in namespace %q, does not match our namespace %q: %w", ctr.ID(), ctr.config.Namespace, s.namespace, define.ErrNSMismatch) } // if the network mode is not bridge return no networks if !ctr.config.NetMode.IsBridge() { return nil, nil } ctrID := []byte(ctr.ID()) db, err := s.getDBCon() if err != nil { return nil, err } defer s.deferredCloseDBCon(db) networks := make(map[string]types.PerNetworkOptions) var convertDB bool err = db.View(func(tx *bolt.Tx) error { ctrBucket, err := getCtrBucket(tx) if err != nil { return err } dbCtr := ctrBucket.Bucket(ctrID) if dbCtr == nil { ctr.valid = false return fmt.Errorf("container %s does not exist in database: %w", ctr.ID(), define.ErrNoSuchCtr) } ctrNetworkBkt := dbCtr.Bucket(networksBkt) if ctrNetworkBkt == nil { // convert if needed convertDB = true return nil } return ctrNetworkBkt.ForEach(func(network, v []byte) error { opts := types.PerNetworkOptions{} if err := json.Unmarshal(v, &opts); err != nil { // special case for backwards compat // earlier version used the container id as value so we set a // special error to indicate the we have to migrate the db if !bytes.Equal(v, ctrID) { return err } convertDB = true } networks[string(network)] = opts return nil }) }) if err != nil { return nil, err } if convertDB { err = db.Update(func(tx *bolt.Tx) error { ctrBucket, err := getCtrBucket(tx) if err != nil { return err } dbCtr := ctrBucket.Bucket(ctrID) if dbCtr == nil { ctr.valid = false return fmt.Errorf("container %s does not exist in database: %w", ctr.ID(), define.ErrNoSuchCtr) } var networkList []string ctrNetworkBkt := dbCtr.Bucket(networksBkt) if ctrNetworkBkt == nil { ctrNetworkBkt, err = dbCtr.CreateBucket(networksBkt) if err != nil { return fmt.Errorf("creating networks bucket for container %s: %w", ctr.ID(), err) } // the container has no networks in the db lookup config and write to the db networkList = ctr.config.NetworksDeprecated // if there are no networks we have to add the default if len(networkList) == 0 { networkList = []string{ctr.runtime.config.Network.DefaultNetwork} } } else { err = ctrNetworkBkt.ForEach(func(network, v []byte) error { networkList = append(networkList, string(network)) return nil }) if err != nil { return err } } // the container has no networks in the db lookup config and write to the db for i, network := range networkList { var intName string if ctr.state.NetInterfaceDescriptions != nil { eth, exists := ctr.state.NetInterfaceDescriptions.getInterfaceByName(network) if !exists { return fmt.Errorf("no network interface name for container %s on network %s", ctr.config.ID, network) } intName = eth } else { intName = fmt.Sprintf("eth%d", i) } getAliases := func(network string) []string { var aliases []string ctrAliasesBkt := dbCtr.Bucket(aliasesBkt) if ctrAliasesBkt == nil { return nil } netAliasesBkt := ctrAliasesBkt.Bucket([]byte(network)) if netAliasesBkt == nil { // No aliases for this specific network. return nil } // lets ignore the error here there is nothing we can do _ = netAliasesBkt.ForEach(func(alias, v []byte) error { aliases = append(aliases, string(alias)) return nil }) // also add the short container id as alias return aliases } netOpts := &types.PerNetworkOptions{ InterfaceName: intName, // we have to add the short id as alias for docker compat Aliases: append(getAliases(network), ctr.config.ID[:12]), } // only set the static ip/mac on the first network if i == 0 { if ctr.config.StaticIP != nil { netOpts.StaticIPs = []net.IP{ctr.config.StaticIP} } netOpts.StaticMAC = ctr.config.StaticMAC } optsBytes, err := json.Marshal(netOpts) if err != nil { return err } // insert into network map because we need to return this networks[network] = *netOpts err = ctrNetworkBkt.Put([]byte(network), optsBytes) if err != nil { return err } } return nil }) if err != nil { return nil, err } } return networks, nil } // NetworkConnect adds the given container to the given network. If aliases are // specified, those will be added to the given network. func (s *BoltState) NetworkConnect(ctr *Container, network string, opts types.PerNetworkOptions) error { if !s.valid { return define.ErrDBClosed } if !ctr.valid { return define.ErrCtrRemoved } if network == "" { return fmt.Errorf("network names must not be empty: %w", define.ErrInvalidArg) } if s.namespace != "" && s.namespace != ctr.config.Namespace { return fmt.Errorf("container %s is in namespace %q, does not match our namespace %q: %w", ctr.ID(), ctr.config.Namespace, s.namespace, define.ErrNSMismatch) } optBytes, err := json.Marshal(opts) if err != nil { return fmt.Errorf("marshalling network options JSON for container %s: %w", ctr.ID(), err) } ctrID := []byte(ctr.ID()) db, err := s.getDBCon() if err != nil { return err } defer s.deferredCloseDBCon(db) return db.Update(func(tx *bolt.Tx) error { ctrBucket, err := getCtrBucket(tx) if err != nil { return err } dbCtr := ctrBucket.Bucket(ctrID) if dbCtr == nil { ctr.valid = false return fmt.Errorf("container %s does not exist in database: %w", ctr.ID(), define.ErrNoSuchCtr) } ctrNetworksBkt := dbCtr.Bucket(networksBkt) if ctrNetworksBkt == nil { return fmt.Errorf("container %s does not have a network bucket: %w", ctr.ID(), define.ErrNoSuchNetwork) } netConnected := ctrNetworksBkt.Get([]byte(network)) if netConnected != nil { return fmt.Errorf("container %s is already connected to network %q: %w", ctr.ID(), network, define.ErrNetworkConnected) } // Add the network if err := ctrNetworksBkt.Put([]byte(network), optBytes); err != nil { return fmt.Errorf("adding container %s to network %s in DB: %w", ctr.ID(), network, err) } return nil }) } // NetworkDisconnect disconnects the container from the given network, also // removing any aliases in the network. func (s *BoltState) NetworkDisconnect(ctr *Container, network string) error { if !s.valid { return define.ErrDBClosed } if !ctr.valid { return define.ErrCtrRemoved } if network == "" { return fmt.Errorf("network names must not be empty: %w", define.ErrInvalidArg) } if s.namespace != "" && s.namespace != ctr.config.Namespace { return fmt.Errorf("container %s is in namespace %q, does not match our namespace %q: %w", ctr.ID(), ctr.config.Namespace, s.namespace, define.ErrNSMismatch) } ctrID := []byte(ctr.ID()) db, err := s.getDBCon() if err != nil { return err } defer s.deferredCloseDBCon(db) return db.Update(func(tx *bolt.Tx) error { ctrBucket, err := getCtrBucket(tx) if err != nil { return err } dbCtr := ctrBucket.Bucket(ctrID) if dbCtr == nil { ctr.valid = false return fmt.Errorf("container %s does not exist in database: %w", ctr.ID(), define.ErrNoSuchCtr) } ctrAliasesBkt := dbCtr.Bucket(aliasesBkt) ctrNetworksBkt := dbCtr.Bucket(networksBkt) if ctrNetworksBkt == nil { return fmt.Errorf("container %s is not connected to any CNI networks, so cannot disconnect: %w", ctr.ID(), define.ErrNoSuchNetwork) } netConnected := ctrNetworksBkt.Get([]byte(network)) if netConnected == nil { return fmt.Errorf("container %s is not connected to CNI network %q: %w", ctr.ID(), network, define.ErrNoSuchNetwork) } if err := ctrNetworksBkt.Delete([]byte(network)); err != nil { return fmt.Errorf("removing container %s from network %s: %w", ctr.ID(), network, err) } if ctrAliasesBkt != nil { bktExists := ctrAliasesBkt.Bucket([]byte(network)) if bktExists == nil { return nil } if err := ctrAliasesBkt.DeleteBucket([]byte(network)); err != nil { return fmt.Errorf("removing container %s network aliases for network %s: %w", ctr.ID(), network, err) } } return nil }) } // GetContainerConfig returns a container config from the database by full ID func (s *BoltState) GetContainerConfig(id string) (*ContainerConfig, error) { if len(id) == 0 { return nil, define.ErrEmptyID } if !s.valid { return nil, define.ErrDBClosed } config := new(ContainerConfig) db, err := s.getDBCon() if err != nil { return nil, err } defer s.deferredCloseDBCon(db) err = db.View(func(tx *bolt.Tx) error { ctrBucket, err := getCtrBucket(tx) if err != nil { return err } return s.getContainerConfigFromDB([]byte(id), config, ctrBucket) }) if err != nil { return nil, err } return config, nil } // AddContainerExitCode adds the exit code for the specified container to the database. func (s *BoltState) AddContainerExitCode(id string, exitCode int32) error { if len(id) == 0 { return define.ErrEmptyID } if !s.valid { return define.ErrDBClosed } db, err := s.getDBCon() if err != nil { return err } defer s.deferredCloseDBCon(db) rawID := []byte(id) rawExitCode := []byte(strconv.Itoa(int(exitCode))) rawTimeStamp, err := time.Now().MarshalText() if err != nil { return fmt.Errorf("marshaling exit-code time stamp: %w", err) } return db.Update(func(tx *bolt.Tx) error { exitCodeBucket, err := getExitCodeBucket(tx) if err != nil { return err } timeStampBucket, err := getExitCodeTimeStampBucket(tx) if err != nil { return err } if err := exitCodeBucket.Put(rawID, rawExitCode); err != nil { return fmt.Errorf("adding exit code of container %s to DB: %w", id, err) } if err := timeStampBucket.Put(rawID, rawTimeStamp); err != nil { if rmErr := exitCodeBucket.Delete(rawID); rmErr != nil { logrus.Errorf("Removing exit code of container %s from DB: %v", id, rmErr) } return fmt.Errorf("adding exit-code time stamp of container %s to DB: %w", id, err) } return nil }) } // GetContainerExitCode returns the exit code for the specified container. func (s *BoltState) GetContainerExitCode(id string) (int32, error) { if len(id) == 0 { return -1, define.ErrEmptyID } if !s.valid { return -1, define.ErrDBClosed } db, err := s.getDBCon() if err != nil { return -1, err } defer s.deferredCloseDBCon(db) rawID := []byte(id) result := int32(-1) return result, db.View(func(tx *bolt.Tx) error { exitCodeBucket, err := getExitCodeBucket(tx) if err != nil { return err } rawExitCode := exitCodeBucket.Get(rawID) if rawExitCode == nil { return fmt.Errorf("getting exit code of container %s from DB: %w", id, define.ErrNoSuchExitCode) } exitCode, err := strconv.Atoi(string(rawExitCode)) if err != nil { return fmt.Errorf("converting raw exit code %v of container %s: %w", rawExitCode, id, err) } result = int32(exitCode) return nil }) } // GetContainerExitCodeTimeStamp returns the time stamp when the exit code of // the specified container was added to the database. func (s *BoltState) GetContainerExitCodeTimeStamp(id string) (*time.Time, error) { if len(id) == 0 { return nil, define.ErrEmptyID } if !s.valid { return nil, define.ErrDBClosed } db, err := s.getDBCon() if err != nil { return nil, err } defer s.deferredCloseDBCon(db) rawID := []byte(id) var result time.Time return &result, db.View(func(tx *bolt.Tx) error { timeStampBucket, err := getExitCodeTimeStampBucket(tx) if err != nil { return err } rawTimeStamp := timeStampBucket.Get(rawID) if rawTimeStamp == nil { return fmt.Errorf("getting exit-code time stamp of container %s from DB: %w", id, define.ErrNoSuchExitCode) } if err := result.UnmarshalText(rawTimeStamp); err != nil { return fmt.Errorf("converting raw time stamp %v of container %s from DB: %w", rawTimeStamp, id, err) } return nil }) } // PruneExitCodes removes exit codes older than 5 minutes. func (s *BoltState) PruneContainerExitCodes() error { if !s.valid { return define.ErrDBClosed } db, err := s.getDBCon() if err != nil { return err } defer s.deferredCloseDBCon(db) toRemoveIDs := []string{} threshold := time.Minute * 5 err = db.View(func(tx *bolt.Tx) error { timeStampBucket, err := getExitCodeTimeStampBucket(tx) if err != nil { return err } return timeStampBucket.ForEach(func(rawID, rawTimeStamp []byte) error { var timeStamp time.Time if err := timeStamp.UnmarshalText(rawTimeStamp); err != nil { return fmt.Errorf("converting raw time stamp %v of container %s from DB: %w", rawTimeStamp, string(rawID), err) } if time.Since(timeStamp) > threshold { toRemoveIDs = append(toRemoveIDs, string(rawID)) } return nil }) }) if err != nil { return fmt.Errorf("reading exit codes to prune: %w", err) } if len(toRemoveIDs) > 0 { err = db.Update(func(tx *bolt.Tx) error { exitCodeBucket, err := getExitCodeBucket(tx) if err != nil { return err } timeStampBucket, err := getExitCodeTimeStampBucket(tx) if err != nil { return err } var finalErr error for _, id := range toRemoveIDs { rawID := []byte(id) if err := exitCodeBucket.Delete(rawID); err != nil { if finalErr != nil { logrus.Error(finalErr) } finalErr = fmt.Errorf("removing exit code of container %s from DB: %w", id, err) } if err := timeStampBucket.Delete(rawID); err != nil { if finalErr != nil { logrus.Error(finalErr) } finalErr = fmt.Errorf("removing exit code timestamp of container %s from DB: %w", id, err) } } return finalErr }) if err != nil { return fmt.Errorf("pruning exit codes: %w", err) } } return nil } // AddExecSession adds an exec session to the state. func (s *BoltState) AddExecSession(ctr *Container, session *ExecSession) error { if !s.valid { return define.ErrDBClosed } if !ctr.valid { return define.ErrCtrRemoved } db, err := s.getDBCon() if err != nil { return err } defer s.deferredCloseDBCon(db) ctrID := []byte(ctr.ID()) sessionID := []byte(session.ID()) err = db.Update(func(tx *bolt.Tx) error { execBucket, err := getExecBucket(tx) if err != nil { return err } ctrBucket, err := getCtrBucket(tx) if err != nil { return err } dbCtr := ctrBucket.Bucket(ctrID) if dbCtr == nil { ctr.valid = false return fmt.Errorf("container %s is not present in the database: %w", ctr.ID(), define.ErrNoSuchCtr) } ctrExecSessionBucket, err := dbCtr.CreateBucketIfNotExists(execBkt) if err != nil { return fmt.Errorf("creating exec sessions bucket for container %s: %w", ctr.ID(), err) } execExists := execBucket.Get(sessionID) if execExists != nil { return fmt.Errorf("an exec session with ID %s already exists: %w", session.ID(), define.ErrExecSessionExists) } if err := execBucket.Put(sessionID, ctrID); err != nil { return fmt.Errorf("adding exec session %s to DB: %w", session.ID(), err) } if err := ctrExecSessionBucket.Put(sessionID, ctrID); err != nil { return fmt.Errorf("adding exec session %s to container %s in DB: %w", session.ID(), ctr.ID(), err) } return nil }) return err } // GetExecSession returns the ID of the container an exec session is associated // with. func (s *BoltState) GetExecSession(id string) (string, error) { if !s.valid { return "", define.ErrDBClosed } if id == "" { return "", define.ErrEmptyID } db, err := s.getDBCon() if err != nil { return "", err } defer s.deferredCloseDBCon(db) ctrID := "" err = db.View(func(tx *bolt.Tx) error { execBucket, err := getExecBucket(tx) if err != nil { return err } ctr := execBucket.Get([]byte(id)) if ctr == nil { return fmt.Errorf("no exec session with ID %s found: %w", id, define.ErrNoSuchExecSession) } ctrID = string(ctr) return nil }) return ctrID, err } // RemoveExecSession removes references to the given exec session in the // database. func (s *BoltState) RemoveExecSession(session *ExecSession) error { if !s.valid { return define.ErrDBClosed } db, err := s.getDBCon() if err != nil { return err } defer s.deferredCloseDBCon(db) sessionID := []byte(session.ID()) containerID := []byte(session.ContainerID()) err = db.Update(func(tx *bolt.Tx) error { execBucket, err := getExecBucket(tx) if err != nil { return err } ctrBucket, err := getCtrBucket(tx) if err != nil { return err } sessionExists := execBucket.Get(sessionID) if sessionExists == nil { return define.ErrNoSuchExecSession } // Check that container ID matches if string(sessionExists) != session.ContainerID() { return fmt.Errorf("database inconsistency: exec session %s points to container %s in state but %s in database: %w", session.ID(), session.ContainerID(), string(sessionExists), define.ErrInternal) } if err := execBucket.Delete(sessionID); err != nil { return fmt.Errorf("removing exec session %s from database: %w", session.ID(), err) } dbCtr := ctrBucket.Bucket(containerID) if dbCtr == nil { // State is inconsistent. We refer to a container that // is no longer in the state. // Return without error, to attempt to recover. return nil } ctrExecBucket := dbCtr.Bucket(execBkt) if ctrExecBucket == nil { // Again, state is inconsistent. We should have an exec // bucket, and it should have this session. // Again, nothing we can do, so proceed and try to // recover. return nil } ctrSessionExists := ctrExecBucket.Get(sessionID) if ctrSessionExists != nil { if err := ctrExecBucket.Delete(sessionID); err != nil { return fmt.Errorf("removing exec session %s from container %s in database: %w", session.ID(), session.ContainerID(), err) } } return nil }) return err } // GetContainerExecSessions retrieves the IDs of all exec sessions running in a // container that the database is aware of (IE, were added via AddExecSession). func (s *BoltState) GetContainerExecSessions(ctr *Container) ([]string, error) { if !s.valid { return nil, define.ErrDBClosed } if !ctr.valid { return nil, define.ErrCtrRemoved } db, err := s.getDBCon() if err != nil { return nil, err } defer s.deferredCloseDBCon(db) ctrID := []byte(ctr.ID()) sessions := []string{} err = db.View(func(tx *bolt.Tx) error { ctrBucket, err := getCtrBucket(tx) if err != nil { return err } dbCtr := ctrBucket.Bucket(ctrID) if dbCtr == nil { ctr.valid = false return define.ErrNoSuchCtr } ctrExecSessions := dbCtr.Bucket(execBkt) if ctrExecSessions == nil { return nil } return ctrExecSessions.ForEach(func(id, unused []byte) error { sessions = append(sessions, string(id)) return nil }) }) if err != nil { return nil, err } return sessions, nil } // RemoveContainerExecSessions removes all exec sessions attached to a given // container. func (s *BoltState) RemoveContainerExecSessions(ctr *Container) error { if !s.valid { return define.ErrDBClosed } if !ctr.valid { return define.ErrCtrRemoved } db, err := s.getDBCon() if err != nil { return err } defer s.deferredCloseDBCon(db) ctrID := []byte(ctr.ID()) sessions := []string{} err = db.Update(func(tx *bolt.Tx) error { execBucket, err := getExecBucket(tx) if err != nil { return err } ctrBucket, err := getCtrBucket(tx) if err != nil { return err } dbCtr := ctrBucket.Bucket(ctrID) if dbCtr == nil { ctr.valid = false return define.ErrNoSuchCtr } ctrExecSessions := dbCtr.Bucket(execBkt) if ctrExecSessions == nil { return nil } err = ctrExecSessions.ForEach(func(id, unused []byte) error { sessions = append(sessions, string(id)) return nil }) if err != nil { return err } for _, session := range sessions { if err := ctrExecSessions.Delete([]byte(session)); err != nil { return fmt.Errorf("removing container %s exec session %s from database: %w", ctr.ID(), session, err) } // Check if the session exists in the global table // before removing. It should, but in cases where the DB // has become inconsistent, we should try and proceed // so we can recover. sessionExists := execBucket.Get([]byte(session)) if sessionExists == nil { continue } if string(sessionExists) != ctr.ID() { return fmt.Errorf("database mismatch: exec session %s is associated with containers %s and %s: %w", session, ctr.ID(), string(sessionExists), define.ErrInternal) } if err := execBucket.Delete([]byte(session)); err != nil { return fmt.Errorf("removing container %s exec session %s from exec sessions: %w", ctr.ID(), session, err) } } return nil }) return err } // RewriteContainerConfig rewrites a container's configuration. // WARNING: This function is DANGEROUS. Do not use without reading the full // comment on this function in state.go. func (s *BoltState) RewriteContainerConfig(ctr *Container, newCfg *ContainerConfig) error { if !s.valid { return define.ErrDBClosed } if !ctr.valid { return define.ErrCtrRemoved } newCfgJSON, err := json.Marshal(newCfg) if err != nil { return fmt.Errorf("marshalling new configuration JSON for container %s: %w", ctr.ID(), err) } db, err := s.getDBCon() if err != nil { return err } defer s.deferredCloseDBCon(db) err = db.Update(func(tx *bolt.Tx) error { ctrBkt, err := getCtrBucket(tx) if err != nil { return err } ctrDB := ctrBkt.Bucket([]byte(ctr.ID())) if ctrDB == nil { ctr.valid = false return fmt.Errorf("no container with ID %q found in DB: %w", ctr.ID(), define.ErrNoSuchCtr) } if err := ctrDB.Put(configKey, newCfgJSON); err != nil { return fmt.Errorf("updating container %s config JSON: %w", ctr.ID(), err) } return nil }) return err } // SafeRewriteContainerConfig rewrites a container's configuration in a more // limited fashion than RewriteContainerConfig. It is marked as safe to use // under most circumstances, unlike RewriteContainerConfig. // DO NOT USE TO: Change container dependencies, change pod membership, change // locks, change container ID. func (s *BoltState) SafeRewriteContainerConfig(ctr *Container, oldName, newName string, newCfg *ContainerConfig) error { if !s.valid { return define.ErrDBClosed } if !ctr.valid { return define.ErrCtrRemoved } if newName != "" && newCfg.Name != newName { return fmt.Errorf("new name %s for container %s must match name in given container config: %w", newName, ctr.ID(), define.ErrInvalidArg) } if newName != "" && oldName == "" { return fmt.Errorf("must provide old name for container if a new name is given: %w", define.ErrInvalidArg) } newCfgJSON, err := json.Marshal(newCfg) if err != nil { return fmt.Errorf("marshalling new configuration JSON for container %s: %w", ctr.ID(), err) } db, err := s.getDBCon() if err != nil { return err } defer s.deferredCloseDBCon(db) err = db.Update(func(tx *bolt.Tx) error { if newName != "" { idBkt, err := getIDBucket(tx) if err != nil { return err } namesBkt, err := getNamesBucket(tx) if err != nil { return err } allCtrsBkt, err := getAllCtrsBucket(tx) if err != nil { return err } needsRename := true if exists := namesBkt.Get([]byte(newName)); exists != nil { if string(exists) == ctr.ID() { // Name already associated with the ID // of this container. No need for a // rename. needsRename = false } else { return fmt.Errorf("name %s already in use, cannot rename container %s: %w", newName, ctr.ID(), define.ErrCtrExists) } } if needsRename { // We do have to remove the old name. The other // buckets are ID-indexed so we just need to // overwrite the values there. if err := namesBkt.Delete([]byte(oldName)); err != nil { return fmt.Errorf("deleting container %s old name from DB for rename: %w", ctr.ID(), err) } if err := idBkt.Put([]byte(ctr.ID()), []byte(newName)); err != nil { return fmt.Errorf("renaming container %s in ID bucket in DB: %w", ctr.ID(), err) } if err := namesBkt.Put([]byte(newName), []byte(ctr.ID())); err != nil { return fmt.Errorf("adding new name %s for container %s in DB: %w", newName, ctr.ID(), err) } if err := allCtrsBkt.Put([]byte(ctr.ID()), []byte(newName)); err != nil { return fmt.Errorf("renaming container %s in all containers bucket in DB: %w", ctr.ID(), err) } if ctr.config.Pod != "" { podsBkt, err := getPodBucket(tx) if err != nil { return err } podBkt := podsBkt.Bucket([]byte(ctr.config.Pod)) if podBkt == nil { return fmt.Errorf("bucket for pod %s does not exist: %w", ctr.config.Pod, define.ErrInternal) } podCtrBkt := podBkt.Bucket(containersBkt) if podCtrBkt == nil { return fmt.Errorf("pod %s does not have a containers bucket: %w", ctr.config.Pod, define.ErrInternal) } if err := podCtrBkt.Put([]byte(ctr.ID()), []byte(newName)); err != nil { return fmt.Errorf("renaming container %s in pod %s members bucket: %w", ctr.ID(), ctr.config.Pod, err) } } } } ctrBkt, err := getCtrBucket(tx) if err != nil { return err } ctrDB := ctrBkt.Bucket([]byte(ctr.ID())) if ctrDB == nil { ctr.valid = false return fmt.Errorf("no container with ID %q found in DB: %w", ctr.ID(), define.ErrNoSuchCtr) } if err := ctrDB.Put(configKey, newCfgJSON); err != nil { return fmt.Errorf("updating container %s config JSON: %w", ctr.ID(), err) } return nil }) return err } // RewritePodConfig rewrites a pod's configuration. // WARNING: This function is DANGEROUS. Do not use without reading the full // comment on this function in state.go. func (s *BoltState) RewritePodConfig(pod *Pod, newCfg *PodConfig) error { if !s.valid { return define.ErrDBClosed } if !pod.valid { return define.ErrPodRemoved } newCfgJSON, err := json.Marshal(newCfg) if err != nil { return fmt.Errorf("marshalling new configuration JSON for pod %s: %w", pod.ID(), err) } db, err := s.getDBCon() if err != nil { return err } defer s.deferredCloseDBCon(db) err = db.Update(func(tx *bolt.Tx) error { podBkt, err := getPodBucket(tx) if err != nil { return err } podDB := podBkt.Bucket([]byte(pod.ID())) if podDB == nil { pod.valid = false return fmt.Errorf("no pod with ID %s found in DB: %w", pod.ID(), define.ErrNoSuchPod) } if err := podDB.Put(configKey, newCfgJSON); err != nil { return fmt.Errorf("updating pod %s config JSON: %w", pod.ID(), err) } return nil }) return err } // RewriteVolumeConfig rewrites a volume's configuration. // WARNING: This function is DANGEROUS. Do not use without reading the full // comment on this function in state.go. func (s *BoltState) RewriteVolumeConfig(volume *Volume, newCfg *VolumeConfig) error { if !s.valid { return define.ErrDBClosed } if !volume.valid { return define.ErrVolumeRemoved } newCfgJSON, err := json.Marshal(newCfg) if err != nil { return fmt.Errorf("marshalling new configuration JSON for volume %q: %w", volume.Name(), err) } db, err := s.getDBCon() if err != nil { return err } defer s.deferredCloseDBCon(db) err = db.Update(func(tx *bolt.Tx) error { volBkt, err := getVolBucket(tx) if err != nil { return err } volDB := volBkt.Bucket([]byte(volume.Name())) if volDB == nil { volume.valid = false return fmt.Errorf("no volume with name %q found in DB: %w", volume.Name(), define.ErrNoSuchVolume) } if err := volDB.Put(configKey, newCfgJSON); err != nil { return fmt.Errorf("updating volume %q config JSON: %w", volume.Name(), err) } return nil }) return err } // Pod retrieves a pod given its full ID func (s *BoltState) Pod(id string) (*Pod, error) { if id == "" { return nil, define.ErrEmptyID } if !s.valid { return nil, define.ErrDBClosed } podID := []byte(id) pod := new(Pod) pod.config = new(PodConfig) pod.state = new(podState) db, err := s.getDBCon() if err != nil { return nil, err } defer s.deferredCloseDBCon(db) err = db.View(func(tx *bolt.Tx) error { podBkt, err := getPodBucket(tx) if err != nil { return err } return s.getPodFromDB(podID, pod, podBkt) }) if err != nil { return nil, err } return pod, nil } // LookupPod retrieves a pod from full or unique partial ID or name func (s *BoltState) LookupPod(idOrName string) (*Pod, error) { if idOrName == "" { return nil, define.ErrEmptyID } if !s.valid { return nil, define.ErrDBClosed } pod := new(Pod) pod.config = new(PodConfig) pod.state = new(podState) db, err := s.getDBCon() if err != nil { return nil, err } defer s.deferredCloseDBCon(db) err = db.View(func(tx *bolt.Tx) error { podBkt, err := getPodBucket(tx) if err != nil { return err } namesBkt, err := getNamesBucket(tx) if err != nil { return err } nsBkt, err := getNSBucket(tx) if err != nil { return err } // First, check if the ID given was the actual pod ID var id []byte podExists := podBkt.Bucket([]byte(idOrName)) if podExists != nil { // A full pod ID was given. // It might not be in our namespace, but getPodFromDB() // will handle that case. id = []byte(idOrName) return s.getPodFromDB(id, pod, podBkt) } // Next, check if the full name was given isCtr := false fullID := namesBkt.Get([]byte(idOrName)) if fullID != nil { // The name exists and maps to an ID. // However, we aren't yet sure if the ID is a pod. podExists = podBkt.Bucket(fullID) if podExists != nil { // A pod bucket matching the full ID was found. return s.getPodFromDB(fullID, pod, podBkt) } // Don't error if we have a name match but it's not a // pod - there's a chance we have a pod with an ID // starting with those characters. // However, so we can return a good error, note whether // this is a container. isCtr = true } // They did not give us a full pod name or ID. // Search for partial ID matches. exists := false err = podBkt.ForEach(func(checkID, checkName []byte) error { // If the pod isn't in our namespace, we // can't match it if s.namespaceBytes != nil { ns := nsBkt.Get(checkID) if !bytes.Equal(ns, s.namespaceBytes) { return nil } } if strings.HasPrefix(string(checkID), idOrName) { if exists { return fmt.Errorf("more than one result for ID or name %s: %w", idOrName, define.ErrPodExists) } id = checkID exists = true } return nil }) if err != nil { return err } else if !exists { if isCtr { return fmt.Errorf("%s is a container, not a pod: %w", idOrName, define.ErrNoSuchPod) } return fmt.Errorf("no pod with name or ID %s found: %w", idOrName, define.ErrNoSuchPod) } // We might have found a container ID, but it's OK // We'll just fail in getPodFromDB with ErrNoSuchPod return s.getPodFromDB(id, pod, podBkt) }) if err != nil { return nil, err } return pod, nil } // HasPod checks if a pod with the given ID exists in the state func (s *BoltState) HasPod(id string) (bool, error) { if id == "" { return false, define.ErrEmptyID } if !s.valid { return false, define.ErrDBClosed } podID := []byte(id) exists := false db, err := s.getDBCon() if err != nil { return false, err } defer s.deferredCloseDBCon(db) err = db.View(func(tx *bolt.Tx) error { podBkt, err := getPodBucket(tx) if err != nil { return err } podDB := podBkt.Bucket(podID) if podDB != nil { if s.namespaceBytes != nil { podNS := podDB.Get(namespaceKey) if bytes.Equal(s.namespaceBytes, podNS) { exists = true } } else { exists = true } } return nil }) if err != nil { return false, err } return exists, nil } // PodHasContainer checks if the given pod has a container with the given ID func (s *BoltState) PodHasContainer(pod *Pod, id string) (bool, error) { if id == "" { return false, define.ErrEmptyID } if !s.valid { return false, define.ErrDBClosed } if !pod.valid { return false, define.ErrPodRemoved } if s.namespace != "" && s.namespace != pod.config.Namespace { return false, fmt.Errorf("pod %s is in namespace %q but we are in namespace %q: %w", pod.ID(), pod.config.Namespace, s.namespace, define.ErrNSMismatch) } ctrID := []byte(id) podID := []byte(pod.ID()) exists := false db, err := s.getDBCon() if err != nil { return false, err } defer s.deferredCloseDBCon(db) err = db.View(func(tx *bolt.Tx) error { podBkt, err := getPodBucket(tx) if err != nil { return err } // Get pod itself podDB := podBkt.Bucket(podID) if podDB == nil { pod.valid = false return fmt.Errorf("pod %s not found in database: %w", pod.ID(), define.ErrNoSuchPod) } // Get pod containers bucket podCtrs := podDB.Bucket(containersBkt) if podCtrs == nil { return fmt.Errorf("pod %s missing containers bucket in DB: %w", pod.ID(), define.ErrInternal) } // Don't bother with a namespace check on the container - // We maintain the invariant that container namespaces must // match the namespace of the pod they join. // We already checked the pod namespace, so we should be fine. ctr := podCtrs.Get(ctrID) if ctr != nil { exists = true } return nil }) if err != nil { return false, err } return exists, nil } // PodContainersByID returns the IDs of all containers present in the given pod func (s *BoltState) PodContainersByID(pod *Pod) ([]string, error) { if !s.valid { return nil, define.ErrDBClosed } if !pod.valid { return nil, define.ErrPodRemoved } if s.namespace != "" && s.namespace != pod.config.Namespace { return nil, fmt.Errorf("pod %s is in namespace %q but we are in namespace %q: %w", pod.ID(), pod.config.Namespace, s.namespace, define.ErrNSMismatch) } podID := []byte(pod.ID()) ctrs := []string{} db, err := s.getDBCon() if err != nil { return nil, err } defer s.deferredCloseDBCon(db) err = db.View(func(tx *bolt.Tx) error { podBkt, err := getPodBucket(tx) if err != nil { return err } // Get pod itself podDB := podBkt.Bucket(podID) if podDB == nil { pod.valid = false return fmt.Errorf("pod %s not found in database: %w", pod.ID(), define.ErrNoSuchPod) } // Get pod containers bucket podCtrs := podDB.Bucket(containersBkt) if podCtrs == nil { return fmt.Errorf("pod %s missing containers bucket in DB: %w", pod.ID(), define.ErrInternal) } // Iterate through all containers in the pod err = podCtrs.ForEach(func(id, val []byte) error { ctrs = append(ctrs, string(id)) return nil }) if err != nil { return err } return nil }) if err != nil { return nil, err } return ctrs, nil } // PodContainers returns all the containers present in the given pod func (s *BoltState) PodContainers(pod *Pod) ([]*Container, error) { if !s.valid { return nil, define.ErrDBClosed } if !pod.valid { return nil, define.ErrPodRemoved } if s.namespace != "" && s.namespace != pod.config.Namespace { return nil, fmt.Errorf("pod %s is in namespace %q but we are in namespace %q: %w", pod.ID(), pod.config.Namespace, s.namespace, define.ErrNSMismatch) } podID := []byte(pod.ID()) ctrs := []*Container{} db, err := s.getDBCon() if err != nil { return nil, err } defer s.deferredCloseDBCon(db) err = db.View(func(tx *bolt.Tx) error { podBkt, err := getPodBucket(tx) if err != nil { return err } ctrBkt, err := getCtrBucket(tx) if err != nil { return err } // Get pod itself podDB := podBkt.Bucket(podID) if podDB == nil { pod.valid = false return fmt.Errorf("pod %s not found in database: %w", pod.ID(), define.ErrNoSuchPod) } // Get pod containers bucket podCtrs := podDB.Bucket(containersBkt) if podCtrs == nil { return fmt.Errorf("pod %s missing containers bucket in DB: %w", pod.ID(), define.ErrInternal) } // Iterate through all containers in the pod err = podCtrs.ForEach(func(id, val []byte) error { newCtr := new(Container) newCtr.config = new(ContainerConfig) newCtr.state = new(ContainerState) ctrs = append(ctrs, newCtr) return s.getContainerFromDB(id, newCtr, ctrBkt) }) if err != nil { return err } return nil }) if err != nil { return nil, err } return ctrs, nil } // AddVolume adds the given volume to the state. It also adds ctrDepID to // the sub bucket holding the container dependencies that this volume has func (s *BoltState) AddVolume(volume *Volume) error { if !s.valid { return define.ErrDBClosed } if !volume.valid { return define.ErrVolumeRemoved } volName := []byte(volume.Name()) volConfigJSON, err := json.Marshal(volume.config) if err != nil { return fmt.Errorf("marshalling volume %s config to JSON: %w", volume.Name(), err) } // Volume state is allowed to not exist var volStateJSON []byte if volume.state != nil { volStateJSON, err = json.Marshal(volume.state) if err != nil { return fmt.Errorf("marshalling volume %s state to JSON: %w", volume.Name(), err) } } db, err := s.getDBCon() if err != nil { return err } defer s.deferredCloseDBCon(db) err = db.Update(func(tx *bolt.Tx) error { volBkt, err := getVolBucket(tx) if err != nil { return err } allVolsBkt, err := getAllVolsBucket(tx) if err != nil { return err } volCtrsBkt, err := getVolumeContainersBucket(tx) if err != nil { return err } // Check if we already have a volume with the given name volExists := allVolsBkt.Get(volName) if volExists != nil { return fmt.Errorf("name %s is in use: %w", volume.Name(), define.ErrVolumeExists) } // We are good to add the volume // Make a bucket for it newVol, err := volBkt.CreateBucket(volName) if err != nil { return fmt.Errorf("creating bucket for volume %s: %w", volume.Name(), err) } // Make a subbucket for the containers using the volume. Dependent container IDs will be addedremoved to // this bucket in addcontainer/removeContainer if _, err := newVol.CreateBucket(volDependenciesBkt); err != nil { return fmt.Errorf("creating bucket for containers using volume %s: %w", volume.Name(), err) } if err := newVol.Put(configKey, volConfigJSON); err != nil { return fmt.Errorf("storing volume %s configuration in DB: %w", volume.Name(), err) } if volStateJSON != nil { if err := newVol.Put(stateKey, volStateJSON); err != nil { return fmt.Errorf("storing volume %s state in DB: %w", volume.Name(), err) } } if volume.config.StorageID != "" { if err := volCtrsBkt.Put([]byte(volume.config.StorageID), volName); err != nil { return fmt.Errorf("storing volume %s container ID in DB: %w", volume.Name(), err) } } if err := allVolsBkt.Put(volName, volName); err != nil { return fmt.Errorf("storing volume %s in all volumes bucket in DB: %w", volume.Name(), err) } return nil }) return err } // RemoveVolume removes the given volume from the state func (s *BoltState) RemoveVolume(volume *Volume) error { if !s.valid { return define.ErrDBClosed } volName := []byte(volume.Name()) db, err := s.getDBCon() if err != nil { return err } defer s.deferredCloseDBCon(db) err = db.Update(func(tx *bolt.Tx) error { volBkt, err := getVolBucket(tx) if err != nil { return err } allVolsBkt, err := getAllVolsBucket(tx) if err != nil { return err } ctrBkt, err := getCtrBucket(tx) if err != nil { return err } volCtrIDBkt, err := getVolumeContainersBucket(tx) if err != nil { return err } // Check if the volume exists volDB := volBkt.Bucket(volName) if volDB == nil { volume.valid = false return fmt.Errorf("volume %s does not exist in DB: %w", volume.Name(), define.ErrNoSuchVolume) } // Check if volume is not being used by any container // This should never be nil // But if it is, we can assume that no containers are using // the volume. volCtrsBkt := volDB.Bucket(volDependenciesBkt) if volCtrsBkt != nil { var deps []string err = volCtrsBkt.ForEach(func(id, value []byte) error { // Alright, this is ugly. // But we need it to work around the change in // volume dependency handling, to make sure that // older Podman versions don't cause DB // corruption. // Look up all dependencies and see that they // still exist before appending. ctrExists := ctrBkt.Bucket(id) if ctrExists == nil { return nil } deps = append(deps, string(id)) return nil }) if err != nil { return fmt.Errorf("getting list of dependencies from dependencies bucket for volumes %q: %w", volume.Name(), err) } if len(deps) > 0 { return fmt.Errorf("volume %s is being used by container(s) %s: %w", volume.Name(), strings.Join(deps, ","), define.ErrVolumeBeingUsed) } } // volume is ready for removal // Let's kick it out if err := allVolsBkt.Delete(volName); err != nil { return fmt.Errorf("removing volume %s from all volumes bucket in DB: %w", volume.Name(), err) } if err := volBkt.DeleteBucket(volName); err != nil { return fmt.Errorf("removing volume %s from DB: %w", volume.Name(), err) } if volume.config.StorageID != "" { if err := volCtrIDBkt.Delete([]byte(volume.config.StorageID)); err != nil { return fmt.Errorf("removing volume %s container ID from DB: %w", volume.Name(), err) } } return nil }) return err } // UpdateVolume updates the volume's state from the database. func (s *BoltState) UpdateVolume(volume *Volume) error { if !s.valid { return define.ErrDBClosed } if !volume.valid { return define.ErrVolumeRemoved } newState := new(VolumeState) volumeName := []byte(volume.Name()) db, err := s.getDBCon() if err != nil { return err } defer s.deferredCloseDBCon(db) err = db.View(func(tx *bolt.Tx) error { volBucket, err := getVolBucket(tx) if err != nil { return err } volToUpdate := volBucket.Bucket(volumeName) if volToUpdate == nil { volume.valid = false return fmt.Errorf("no volume with name %s found in database: %w", volume.Name(), define.ErrNoSuchVolume) } stateBytes := volToUpdate.Get(stateKey) if stateBytes == nil { // Having no state is valid. // Return nil, use the empty state. return nil } if err := json.Unmarshal(stateBytes, newState); err != nil { return fmt.Errorf("unmarshalling volume %s state: %w", volume.Name(), err) } return nil }) if err != nil { return err } volume.state = newState return nil } // SaveVolume saves the volume's state to the database. func (s *BoltState) SaveVolume(volume *Volume) error { if !s.valid { return define.ErrDBClosed } if !volume.valid { return define.ErrVolumeRemoved } volumeName := []byte(volume.Name()) var newStateJSON []byte if volume.state != nil { stateJSON, err := json.Marshal(volume.state) if err != nil { return fmt.Errorf("marshalling volume %s state to JSON: %w", volume.Name(), err) } newStateJSON = stateJSON } db, err := s.getDBCon() if err != nil { return err } defer s.deferredCloseDBCon(db) err = db.Update(func(tx *bolt.Tx) error { volBucket, err := getVolBucket(tx) if err != nil { return err } volToUpdate := volBucket.Bucket(volumeName) if volToUpdate == nil { volume.valid = false return fmt.Errorf("no volume with name %s found in database: %w", volume.Name(), define.ErrNoSuchVolume) } return volToUpdate.Put(stateKey, newStateJSON) }) return err } // AllVolumes returns all volumes present in the state func (s *BoltState) AllVolumes() ([]*Volume, error) { if !s.valid { return nil, define.ErrDBClosed } volumes := []*Volume{} db, err := s.getDBCon() if err != nil { return nil, err } defer s.deferredCloseDBCon(db) err = db.View(func(tx *bolt.Tx) error { allVolsBucket, err := getAllVolsBucket(tx) if err != nil { return err } volBucket, err := getVolBucket(tx) if err != nil { return err } err = allVolsBucket.ForEach(func(id, name []byte) error { volExists := volBucket.Bucket(id) // This check can be removed if performance becomes an // issue, but much less helpful errors will be produced if volExists == nil { return fmt.Errorf("inconsistency in state - volume %s is in all volumes bucket but volume not found: %w", string(id), define.ErrInternal) } volume := new(Volume) volume.config = new(VolumeConfig) volume.state = new(VolumeState) if err := s.getVolumeFromDB(id, volume, volBucket); err != nil { if !errors.Is(err, define.ErrNSMismatch) { logrus.Errorf("Retrieving volume %s from the database: %v", string(id), err) } } else { volumes = append(volumes, volume) } return nil }) return err }) if err != nil { return nil, err } return volumes, nil } // Volume retrieves a volume from full name func (s *BoltState) Volume(name string) (*Volume, error) { if name == "" { return nil, define.ErrEmptyID } if !s.valid { return nil, define.ErrDBClosed } volName := []byte(name) volume := new(Volume) volume.config = new(VolumeConfig) volume.state = new(VolumeState) db, err := s.getDBCon() if err != nil { return nil, err } defer s.deferredCloseDBCon(db) err = db.View(func(tx *bolt.Tx) error { volBkt, err := getVolBucket(tx) if err != nil { return err } return s.getVolumeFromDB(volName, volume, volBkt) }) if err != nil { return nil, err } return volume, nil } // LookupVolume locates a volume from a partial name. func (s *BoltState) LookupVolume(name string) (*Volume, error) { if name == "" { return nil, define.ErrEmptyID } if !s.valid { return nil, define.ErrDBClosed } volName := []byte(name) volume := new(Volume) volume.config = new(VolumeConfig) volume.state = new(VolumeState) db, err := s.getDBCon() if err != nil { return nil, err } defer s.deferredCloseDBCon(db) err = db.View(func(tx *bolt.Tx) error { volBkt, err := getVolBucket(tx) if err != nil { return err } allVolsBkt, err := getAllVolsBucket(tx) if err != nil { return err } // Check for exact match on name volDB := volBkt.Bucket(volName) if volDB != nil { return s.getVolumeFromDB(volName, volume, volBkt) } // No exact match. Search all names. foundMatch := false err = allVolsBkt.ForEach(func(checkName, checkName2 []byte) error { if strings.HasPrefix(string(checkName), name) { if foundMatch { return fmt.Errorf("more than one result for volume name %q: %w", name, define.ErrVolumeExists) } foundMatch = true volName = checkName } return nil }) if err != nil { return err } if !foundMatch { return fmt.Errorf("no volume with name %q found: %w", name, define.ErrNoSuchVolume) } return s.getVolumeFromDB(volName, volume, volBkt) }) if err != nil { return nil, err } return volume, nil } // HasVolume returns true if the given volume exists in the state, otherwise it returns false func (s *BoltState) HasVolume(name string) (bool, error) { if name == "" { return false, define.ErrEmptyID } if !s.valid { return false, define.ErrDBClosed } volName := []byte(name) exists := false db, err := s.getDBCon() if err != nil { return false, err } defer s.deferredCloseDBCon(db) err = db.View(func(tx *bolt.Tx) error { volBkt, err := getVolBucket(tx) if err != nil { return err } volDB := volBkt.Bucket(volName) if volDB != nil { exists = true } return nil }) if err != nil { return false, err } return exists, nil } // VolumeInUse checks if any container is using the volume // It returns a slice of the IDs of the containers using the given // volume. If the slice is empty, no containers use the given volume func (s *BoltState) VolumeInUse(volume *Volume) ([]string, error) { if !s.valid { return nil, define.ErrDBClosed } if !volume.valid { return nil, define.ErrVolumeRemoved } depCtrs := []string{} db, err := s.getDBCon() if err != nil { return nil, err } defer s.deferredCloseDBCon(db) err = db.View(func(tx *bolt.Tx) error { volBucket, err := getVolBucket(tx) if err != nil { return err } ctrBucket, err := getCtrBucket(tx) if err != nil { return err } volDB := volBucket.Bucket([]byte(volume.Name())) if volDB == nil { volume.valid = false return fmt.Errorf("no volume with name %s found in DB: %w", volume.Name(), define.ErrNoSuchVolume) } dependsBkt := volDB.Bucket(volDependenciesBkt) if dependsBkt == nil { return fmt.Errorf("volume %s has no dependencies bucket: %w", volume.Name(), define.ErrInternal) } // Iterate through and add dependencies err = dependsBkt.ForEach(func(id, value []byte) error { // Look up all dependencies and see that they // still exist before appending. ctrExists := ctrBucket.Bucket(id) if ctrExists == nil { return nil } depCtrs = append(depCtrs, string(id)) return nil }) if err != nil { return err } return nil }) if err != nil { return nil, err } return depCtrs, nil } // AddPod adds the given pod to the state. func (s *BoltState) AddPod(pod *Pod) error { if !s.valid { return define.ErrDBClosed } if !pod.valid { return define.ErrPodRemoved } if s.namespace != "" && s.namespace != pod.config.Namespace { return fmt.Errorf("pod %s is in namespace %q but we are in namespace %q: %w", pod.ID(), pod.config.Namespace, s.namespace, define.ErrNSMismatch) } podID := []byte(pod.ID()) podName := []byte(pod.Name()) var podNamespace []byte if pod.config.Namespace != "" { podNamespace = []byte(pod.config.Namespace) } podConfigJSON, err := json.Marshal(pod.config) if err != nil { return fmt.Errorf("marshalling pod %s config to JSON: %w", pod.ID(), err) } podStateJSON, err := json.Marshal(pod.state) if err != nil { return fmt.Errorf("marshalling pod %s state to JSON: %w", pod.ID(), err) } db, err := s.getDBCon() if err != nil { return err } defer s.deferredCloseDBCon(db) err = db.Update(func(tx *bolt.Tx) error { podBkt, err := getPodBucket(tx) if err != nil { return err } allPodsBkt, err := getAllPodsBucket(tx) if err != nil { return err } idsBkt, err := getIDBucket(tx) if err != nil { return err } namesBkt, err := getNamesBucket(tx) if err != nil { return err } nsBkt, err := getNSBucket(tx) if err != nil { return err } // Check if we already have something with the given ID and name idExist := idsBkt.Get(podID) if idExist != nil { err = define.ErrPodExists if allPodsBkt.Get(idExist) == nil { err = define.ErrCtrExists } return fmt.Errorf("ID \"%s\" is in use: %w", pod.ID(), err) } nameExist := namesBkt.Get(podName) if nameExist != nil { err = define.ErrPodExists if allPodsBkt.Get(nameExist) == nil { err = define.ErrCtrExists } return fmt.Errorf("name \"%s\" is in use: %w", pod.Name(), err) } // We are good to add the pod // Make a bucket for it newPod, err := podBkt.CreateBucket(podID) if err != nil { return fmt.Errorf("creating bucket for pod %s: %w", pod.ID(), err) } // Make a subbucket for pod containers if _, err := newPod.CreateBucket(containersBkt); err != nil { return fmt.Errorf("creating bucket for pod %s containers: %w", pod.ID(), err) } if err := newPod.Put(configKey, podConfigJSON); err != nil { return fmt.Errorf("storing pod %s configuration in DB: %w", pod.ID(), err) } if err := newPod.Put(stateKey, podStateJSON); err != nil { return fmt.Errorf("storing pod %s state JSON in DB: %w", pod.ID(), err) } if podNamespace != nil { if err := newPod.Put(namespaceKey, podNamespace); err != nil { return fmt.Errorf("storing pod %s namespace in DB: %w", pod.ID(), err) } if err := nsBkt.Put(podID, podNamespace); err != nil { return fmt.Errorf("storing pod %s namespace in DB: %w", pod.ID(), err) } } // Add us to the ID and names buckets if err := idsBkt.Put(podID, podName); err != nil { return fmt.Errorf("storing pod %s ID in DB: %w", pod.ID(), err) } if err := namesBkt.Put(podName, podID); err != nil { return fmt.Errorf("storing pod %s name in DB: %w", pod.Name(), err) } if err := allPodsBkt.Put(podID, podName); err != nil { return fmt.Errorf("storing pod %s in all pods bucket in DB: %w", pod.ID(), err) } return nil }) if err != nil { return err } return nil } // RemovePod removes the given pod from the state // Only empty pods can be removed func (s *BoltState) RemovePod(pod *Pod) error { if !s.valid { return define.ErrDBClosed } if !pod.valid { return define.ErrPodRemoved } if s.namespace != "" && s.namespace != pod.config.Namespace { return fmt.Errorf("pod %s is in namespace %q but we are in namespace %q: %w", pod.ID(), pod.config.Namespace, s.namespace, define.ErrNSMismatch) } podID := []byte(pod.ID()) podName := []byte(pod.Name()) db, err := s.getDBCon() if err != nil { return err } defer s.deferredCloseDBCon(db) err = db.Update(func(tx *bolt.Tx) error { podBkt, err := getPodBucket(tx) if err != nil { return err } allPodsBkt, err := getAllPodsBucket(tx) if err != nil { return err } idsBkt, err := getIDBucket(tx) if err != nil { return err } namesBkt, err := getNamesBucket(tx) if err != nil { return err } nsBkt, err := getNSBucket(tx) if err != nil { return err } // Check if the pod exists podDB := podBkt.Bucket(podID) if podDB == nil { pod.valid = false return fmt.Errorf("pod %s does not exist in DB: %w", pod.ID(), define.ErrNoSuchPod) } // Check if pod is empty // This should never be nil // But if it is, we can assume there are no containers in the // pod. // So let's eject the malformed pod without error. podCtrsBkt := podDB.Bucket(containersBkt) if podCtrsBkt != nil { cursor := podCtrsBkt.Cursor() if id, _ := cursor.First(); id != nil { return fmt.Errorf("pod %s is not empty: %w", pod.ID(), define.ErrCtrExists) } } // Pod is empty, and ready for removal // Let's kick it out if err := idsBkt.Delete(podID); err != nil { return fmt.Errorf("removing pod %s ID from DB: %w", pod.ID(), err) } if err := namesBkt.Delete(podName); err != nil { return fmt.Errorf("removing pod %s name (%s) from DB: %w", pod.ID(), pod.Name(), err) } if err := nsBkt.Delete(podID); err != nil { return fmt.Errorf("removing pod %s namespace from DB: %w", pod.ID(), err) } if err := allPodsBkt.Delete(podID); err != nil { return fmt.Errorf("removing pod %s ID from all pods bucket in DB: %w", pod.ID(), err) } if err := podBkt.DeleteBucket(podID); err != nil { return fmt.Errorf("removing pod %s from DB: %w", pod.ID(), err) } return nil }) if err != nil { return err } return nil } // RemovePodContainers removes all containers in a pod func (s *BoltState) RemovePodContainers(pod *Pod) error { if !s.valid { return define.ErrDBClosed } if !pod.valid { return define.ErrPodRemoved } if s.namespace != "" && s.namespace != pod.config.Namespace { return fmt.Errorf("pod %s is in namespace %q but we are in namespace %q: %w", pod.ID(), pod.config.Namespace, s.namespace, define.ErrNSMismatch) } podID := []byte(pod.ID()) db, err := s.getDBCon() if err != nil { return err } defer s.deferredCloseDBCon(db) err = db.Update(func(tx *bolt.Tx) error { podBkt, err := getPodBucket(tx) if err != nil { return err } ctrBkt, err := getCtrBucket(tx) if err != nil { return err } allCtrsBkt, err := getAllCtrsBucket(tx) if err != nil { return err } idsBkt, err := getIDBucket(tx) if err != nil { return err } namesBkt, err := getNamesBucket(tx) if err != nil { return err } // Check if the pod exists podDB := podBkt.Bucket(podID) if podDB == nil { pod.valid = false return fmt.Errorf("pod %s does not exist in DB: %w", pod.ID(), define.ErrNoSuchPod) } podCtrsBkt := podDB.Bucket(containersBkt) if podCtrsBkt == nil { return fmt.Errorf("pod %s does not have a containers bucket: %w", pod.ID(), define.ErrInternal) } // Traverse all containers in the pod with a cursor // for-each has issues with data mutation err = podCtrsBkt.ForEach(func(id, name []byte) error { // Get the container so we can check dependencies ctr := ctrBkt.Bucket(id) if ctr == nil { // This should never happen // State is inconsistent return fmt.Errorf("pod %s referenced nonexistent container %s: %w", pod.ID(), string(id), define.ErrNoSuchCtr) } ctrDeps := ctr.Bucket(dependenciesBkt) // This should never be nil, but if it is, we're // removing it anyways, so continue if it is if ctrDeps != nil { err = ctrDeps.ForEach(func(depID, name []byte) error { exists := podCtrsBkt.Get(depID) if exists == nil { return fmt.Errorf("container %s has dependency %s outside of pod %s: %w", string(id), string(depID), pod.ID(), define.ErrCtrExists) } return nil }) if err != nil { return err } } // Dependencies are set, we're clear to remove if err := ctrBkt.DeleteBucket(id); err != nil { return fmt.Errorf("deleting container %s from DB: %w", string(id), define.ErrInternal) } if err := idsBkt.Delete(id); err != nil { return fmt.Errorf("deleting container %s ID in DB: %w", string(id), err) } if err := namesBkt.Delete(name); err != nil { return fmt.Errorf("deleting container %s name in DB: %w", string(id), err) } if err := allCtrsBkt.Delete(id); err != nil { return fmt.Errorf("deleting container %s ID from all containers bucket in DB: %w", string(id), err) } return nil }) if err != nil { return err } // Delete and recreate the bucket to empty it if err := podDB.DeleteBucket(containersBkt); err != nil { return fmt.Errorf("removing pod %s containers bucket: %w", pod.ID(), err) } if _, err := podDB.CreateBucket(containersBkt); err != nil { return fmt.Errorf("recreating pod %s containers bucket: %w", pod.ID(), err) } return nil }) if err != nil { return err } return nil } // AddContainerToPod adds the given container to an existing pod // The container will be added to the state and the pod func (s *BoltState) AddContainerToPod(pod *Pod, ctr *Container) error { if !s.valid { return define.ErrDBClosed } if !pod.valid { return define.ErrPodRemoved } if !ctr.valid { return define.ErrCtrRemoved } if ctr.config.Pod != pod.ID() { return fmt.Errorf("container %s is not part of pod %s: %w", ctr.ID(), pod.ID(), define.ErrNoSuchCtr) } return s.addContainer(ctr, pod) } // RemoveContainerFromPod removes a container from an existing pod // The container will also be removed from the state func (s *BoltState) RemoveContainerFromPod(pod *Pod, ctr *Container) error { if !s.valid { return define.ErrDBClosed } if !pod.valid { return define.ErrPodRemoved } if s.namespace != "" { if s.namespace != pod.config.Namespace { return fmt.Errorf("pod %s is in namespace %q but we are in namespace %q: %w", pod.ID(), pod.config.Namespace, s.namespace, define.ErrNSMismatch) } if s.namespace != ctr.config.Namespace { return fmt.Errorf("container %s in in namespace %q but we are in namespace %q: %w", ctr.ID(), ctr.config.Namespace, s.namespace, define.ErrNSMismatch) } } if ctr.config.Pod == "" { return fmt.Errorf("container %s is not part of a pod, use RemoveContainer instead: %w", ctr.ID(), define.ErrNoSuchPod) } if ctr.config.Pod != pod.ID() { return fmt.Errorf("container %s is not part of pod %s: %w", ctr.ID(), pod.ID(), define.ErrInvalidArg) } db, err := s.getDBCon() if err != nil { return err } defer s.deferredCloseDBCon(db) err = db.Update(func(tx *bolt.Tx) error { return s.removeContainer(ctr, pod, tx) }) return err } // UpdatePod updates a pod's state from the database func (s *BoltState) UpdatePod(pod *Pod) error { if !s.valid { return define.ErrDBClosed } if !pod.valid { return define.ErrPodRemoved } if s.namespace != "" && s.namespace != pod.config.Namespace { return fmt.Errorf("pod %s is in namespace %q but we are in namespace %q: %w", pod.ID(), pod.config.Namespace, s.namespace, define.ErrNSMismatch) } newState := new(podState) db, err := s.getDBCon() if err != nil { return err } defer s.deferredCloseDBCon(db) podID := []byte(pod.ID()) err = db.View(func(tx *bolt.Tx) error { podBkt, err := getPodBucket(tx) if err != nil { return err } podDB := podBkt.Bucket(podID) if podDB == nil { pod.valid = false return fmt.Errorf("no pod with ID %s found in database: %w", pod.ID(), define.ErrNoSuchPod) } // Get the pod state JSON podStateBytes := podDB.Get(stateKey) if podStateBytes == nil { return fmt.Errorf("pod %s is missing state key in DB: %w", pod.ID(), define.ErrInternal) } if err := json.Unmarshal(podStateBytes, newState); err != nil { return fmt.Errorf("unmarshalling pod %s state JSON: %w", pod.ID(), err) } return nil }) if err != nil { return err } pod.state = newState return nil } // SavePod saves a pod's state to the database func (s *BoltState) SavePod(pod *Pod) error { if !s.valid { return define.ErrDBClosed } if !pod.valid { return define.ErrPodRemoved } if s.namespace != "" && s.namespace != pod.config.Namespace { return fmt.Errorf("pod %s is in namespace %q but we are in namespace %q: %w", pod.ID(), pod.config.Namespace, s.namespace, define.ErrNSMismatch) } stateJSON, err := json.Marshal(pod.state) if err != nil { return fmt.Errorf("marshalling pod %s state to JSON: %w", pod.ID(), err) } db, err := s.getDBCon() if err != nil { return err } defer s.deferredCloseDBCon(db) podID := []byte(pod.ID()) err = db.Update(func(tx *bolt.Tx) error { podBkt, err := getPodBucket(tx) if err != nil { return err } podDB := podBkt.Bucket(podID) if podDB == nil { pod.valid = false return fmt.Errorf("no pod with ID %s found in database: %w", pod.ID(), define.ErrNoSuchPod) } // Set the pod state JSON if err := podDB.Put(stateKey, stateJSON); err != nil { return fmt.Errorf("updating pod %s state in database: %w", pod.ID(), err) } return nil }) if err != nil { return err } return nil } // AllPods returns all pods present in the state func (s *BoltState) AllPods() ([]*Pod, error) { if !s.valid { return nil, define.ErrDBClosed } pods := []*Pod{} db, err := s.getDBCon() if err != nil { return nil, err } defer s.deferredCloseDBCon(db) err = db.View(func(tx *bolt.Tx) error { allPodsBucket, err := getAllPodsBucket(tx) if err != nil { return err } podBucket, err := getPodBucket(tx) if err != nil { return err } err = allPodsBucket.ForEach(func(id, name []byte) error { podExists := podBucket.Bucket(id) // This check can be removed if performance becomes an // issue, but much less helpful errors will be produced if podExists == nil { return fmt.Errorf("inconsistency in state - pod %s is in all pods bucket but pod not found: %w", string(id), define.ErrInternal) } pod := new(Pod) pod.config = new(PodConfig) pod.state = new(podState) if err := s.getPodFromDB(id, pod, podBucket); err != nil { if !errors.Is(err, define.ErrNSMismatch) { logrus.Errorf("Retrieving pod %s from the database: %v", string(id), err) } } else { pods = append(pods, pod) } return nil }) return err }) if err != nil { return nil, err } return pods, nil } // ContainerIDIsVolume checks if the given c/storage container ID is used as // backing storage for a volume. func (s *BoltState) ContainerIDIsVolume(id string) (bool, error) { if !s.valid { return false, define.ErrDBClosed } isVol := false db, err := s.getDBCon() if err != nil { return false, err } defer s.deferredCloseDBCon(db) err = db.View(func(tx *bolt.Tx) error { volCtrsBkt, err := getVolumeContainersBucket(tx) if err != nil { return err } volName := volCtrsBkt.Get([]byte(id)) if volName != nil { isVol = true } return nil }) return isVol, err }