summaryrefslogtreecommitdiff
path: root/cmd/podman/create_cli.go
blob: ae0549687e8eb50b16d9968cfb36b5103dd3911b (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
package main

import (
	"fmt"
	"os"
	"path/filepath"
	"strings"

	cc "github.com/containers/libpod/pkg/spec"
	"github.com/containers/libpod/pkg/sysinfo"
	"github.com/docker/go-units"
	spec "github.com/opencontainers/runtime-spec/specs-go"
	"github.com/pkg/errors"
	"github.com/sirupsen/logrus"
)

const (
	// It's not kernel limit, we want this 4M limit to supply a reasonable functional container
	linuxMinMemory = 4194304
)

func getAllLabels(labelFile, inputLabels []string) (map[string]string, error) {
	labels := make(map[string]string)
	labelErr := readKVStrings(labels, labelFile, inputLabels)
	if labelErr != nil {
		return labels, errors.Wrapf(labelErr, "unable to process labels from --label and label-file")
	}
	return labels, nil
}

// validateSysctl validates a sysctl and returns it.
func validateSysctl(strSlice []string) (map[string]string, error) {
	sysctl := make(map[string]string)
	validSysctlMap := map[string]bool{
		"kernel.msgmax":          true,
		"kernel.msgmnb":          true,
		"kernel.msgmni":          true,
		"kernel.sem":             true,
		"kernel.shmall":          true,
		"kernel.shmmax":          true,
		"kernel.shmmni":          true,
		"kernel.shm_rmid_forced": true,
	}
	validSysctlPrefixes := []string{
		"net.",
		"fs.mqueue.",
	}

	for _, val := range strSlice {
		foundMatch := false
		arr := strings.Split(val, "=")
		if len(arr) < 2 {
			return nil, errors.Errorf("%s is invalid, sysctl values must be in the form of KEY=VALUE", val)
		}
		if validSysctlMap[arr[0]] {
			sysctl[arr[0]] = arr[1]
			continue
		}

		for _, prefix := range validSysctlPrefixes {
			if strings.HasPrefix(arr[0], prefix) {
				sysctl[arr[0]] = arr[1]
				foundMatch = true
				break
			}
		}
		if !foundMatch {
			return nil, errors.Errorf("sysctl '%s' is not whitelisted", arr[0])
		}
	}
	return sysctl, nil
}

func addWarning(warnings []string, msg string) []string {
	logrus.Warn(msg)
	return append(warnings, msg)
}

// Format supported.
// podman run --mount type=bind,src=/etc/resolv.conf,target=/etc/resolv.conf ...
// podman run --mount type=tmpfs,target=/dev/shm ..
func parseMounts(mounts []string) ([]spec.Mount, error) {
	// TODO(vrothberg): the manual parsing can be replaced with a regular expression
	//                  to allow a more robust parsing of the mount format and to give
	//                  precise errors regarding supported format versus suppored options.
	var mountList []spec.Mount
	errInvalidSyntax := errors.Errorf("incorrect mount format: should be --mount type=<bind|tmpfs>,[src=<host-dir>,]target=<ctr-dir>[,options]")
	for _, mount := range mounts {
		var tokenCount int
		var mountInfo spec.Mount

		arr := strings.SplitN(mount, ",", 2)
		if len(arr) < 2 {
			return nil, errors.Wrapf(errInvalidSyntax, "%q", mount)
		}
		kv := strings.Split(arr[0], "=")
		if kv[0] != "type" {
			return nil, errors.Wrapf(errInvalidSyntax, "%q", mount)
		}
		switch kv[1] {
		case "bind":
			mountInfo.Type = string(cc.TypeBind)
		case "tmpfs":
			mountInfo.Type = string(cc.TypeTmpfs)
			mountInfo.Source = string(cc.TypeTmpfs)
			mountInfo.Options = append(mountInfo.Options, []string{"rprivate", "noexec", "nosuid", "nodev", "size=65536k"}...)

		default:
			return nil, errors.Errorf("invalid filesystem type %q", kv[1])
		}

		tokens := strings.Split(arr[1], ",")
		for i, val := range tokens {
			if i == (tokenCount - 1) {
				//Parse tokens before options.
				break
			}
			kv := strings.Split(val, "=")
			switch kv[0] {
			case "ro", "nosuid", "nodev", "noexec":
				mountInfo.Options = append(mountInfo.Options, kv[0])
			case "shared", "rshared", "private", "rprivate", "slave", "rslave", "Z", "z":
				if mountInfo.Type != "bind" {
					return nil, errors.Errorf("%s can only be used with bind mounts", kv[0])
				}
				mountInfo.Options = append(mountInfo.Options, kv[0])
			case "tmpfs-mode":
				if mountInfo.Type != "tmpfs" {
					return nil, errors.Errorf("%s can only be used with tmpfs mounts", kv[0])
				}
				mountInfo.Options = append(mountInfo.Options, fmt.Sprintf("mode=%s", kv[1]))
			case "tmpfs-size":
				if mountInfo.Type != "tmpfs" {
					return nil, errors.Errorf("%s can only be used with tmpfs mounts", kv[0])
				}
				shmSize, err := units.FromHumanSize(kv[1])
				if err != nil {
					return nil, errors.Wrapf(err, "unable to translate tmpfs-size")
				}

				mountInfo.Options = append(mountInfo.Options, fmt.Sprintf("size=%d", shmSize))

			case "bind-propagation":
				if mountInfo.Type != "bind" {
					return nil, errors.Errorf("%s can only be used with bind mounts", kv[0])
				}
				mountInfo.Options = append(mountInfo.Options, kv[1])
			case "src", "source":
				if mountInfo.Type == "tmpfs" {
					return nil, errors.Errorf("cannot use src= on a tmpfs file system")
				}
				if err := validateVolumeHostDir(kv[1]); err != nil {
					return nil, err
				}
				mountInfo.Source = kv[1]
			case "target", "dst", "destination":
				if err := validateVolumeCtrDir(kv[1]); err != nil {
					return nil, err
				}
				mountInfo.Destination = kv[1]
			default:
				return nil, errors.Errorf("incorrect mount option : %s", kv[0])
			}
		}
		mountList = append(mountList, mountInfo)
	}
	return mountList, nil
}

func parseVolumes(volumes []string) error {
	for _, volume := range volumes {
		arr := strings.SplitN(volume, ":", 3)
		if len(arr) < 2 {
			return errors.Errorf("incorrect volume format %q, should be host-dir:ctr-dir[:option]", volume)
		}
		if err := validateVolumeHostDir(arr[0]); err != nil {
			return err
		}
		if err := validateVolumeCtrDir(arr[1]); err != nil {
			return err
		}
		if len(arr) > 2 {
			if err := validateVolumeOpts(arr[2]); err != nil {
				return err
			}
		}
	}
	return nil
}

func parseVolumesFrom(volumesFrom []string) error {
	for _, vol := range volumesFrom {
		arr := strings.SplitN(vol, ":", 2)
		if len(arr) == 2 {
			if strings.Contains(arr[1], "Z") || strings.Contains(arr[1], "private") || strings.Contains(arr[1], "slave") || strings.Contains(arr[1], "shared") {
				return errors.Errorf("invalid options %q, can only specify 'ro', 'rw', and 'z", arr[1])
			}
			if err := validateVolumeOpts(arr[1]); err != nil {
				return err
			}
		}
	}
	return nil
}

func validateVolumeHostDir(hostDir string) error {
	if len(hostDir) == 0 {
		return errors.Errorf("host directory cannot be empty")
	}
	if filepath.IsAbs(hostDir) {
		if _, err := os.Stat(hostDir); err != nil {
			return errors.Wrapf(err, "error checking path %q", hostDir)
		}
	}
	// If hostDir is not an absolute path, that means the user wants to create a
	// named volume. This will be done later on in the code.
	return nil
}

func validateVolumeCtrDir(ctrDir string) error {
	if len(ctrDir) == 0 {
		return errors.Errorf("container directory cannot be empty")
	}
	if !filepath.IsAbs(ctrDir) {
		return errors.Errorf("invalid container path, must be an absolute path %q", ctrDir)
	}
	return nil
}

func validateVolumeOpts(option string) error {
	var foundRootPropagation, foundRWRO, foundLabelChange int
	options := strings.Split(option, ",")
	for _, opt := range options {
		switch opt {
		case "rw", "ro":
			foundRWRO++
			if foundRWRO > 1 {
				return errors.Errorf("invalid options %q, can only specify 1 'rw' or 'ro' option", option)
			}
		case "z", "Z":
			foundLabelChange++
			if foundLabelChange > 1 {
				return errors.Errorf("invalid options %q, can only specify 1 'z' or 'Z' option", option)
			}
		case "private", "rprivate", "shared", "rshared", "slave", "rslave":
			foundRootPropagation++
			if foundRootPropagation > 1 {
				return errors.Errorf("invalid options %q, can only specify 1 '[r]shared', '[r]private' or '[r]slave' option", option)
			}
		default:
			return errors.Errorf("invalid option type %q", option)
		}
	}
	return nil
}

func verifyContainerResources(config *cc.CreateConfig, update bool) ([]string, error) {
	warnings := []string{}
	sysInfo := sysinfo.New(true)

	// memory subsystem checks and adjustments
	if config.Resources.Memory != 0 && config.Resources.Memory < linuxMinMemory {
		return warnings, fmt.Errorf("minimum memory limit allowed is 4MB")
	}
	if config.Resources.Memory > 0 && !sysInfo.MemoryLimit {
		warnings = addWarning(warnings, "Your kernel does not support memory limit capabilities or the cgroup is not mounted. Limitation discarded.")
		config.Resources.Memory = 0
		config.Resources.MemorySwap = -1
	}
	if config.Resources.Memory > 0 && config.Resources.MemorySwap != -1 && !sysInfo.SwapLimit {
		warnings = addWarning(warnings, "Your kernel does not support swap limit capabilities,or the cgroup is not mounted. Memory limited without swap.")
		config.Resources.MemorySwap = -1
	}
	if config.Resources.Memory > 0 && config.Resources.MemorySwap > 0 && config.Resources.MemorySwap < config.Resources.Memory {
		return warnings, fmt.Errorf("minimum memoryswap limit should be larger than memory limit, see usage")
	}
	if config.Resources.Memory == 0 && config.Resources.MemorySwap > 0 && !update {
		return warnings, fmt.Errorf("you should always set the memory limit when using memoryswap limit, see usage")
	}
	if config.Resources.MemorySwappiness != -1 {
		if !sysInfo.MemorySwappiness {
			msg := "Your kernel does not support memory swappiness capabilities, or the cgroup is not mounted. Memory swappiness discarded."
			warnings = addWarning(warnings, msg)
			config.Resources.MemorySwappiness = -1
		} else {
			swappiness := config.Resources.MemorySwappiness
			if swappiness < -1 || swappiness > 100 {
				return warnings, fmt.Errorf("invalid value: %v, valid memory swappiness range is 0-100", swappiness)
			}
		}
	}
	if config.Resources.MemoryReservation > 0 && !sysInfo.MemoryReservation {
		warnings = addWarning(warnings, "Your kernel does not support memory soft limit capabilities or the cgroup is not mounted. Limitation discarded.")
		config.Resources.MemoryReservation = 0
	}
	if config.Resources.MemoryReservation > 0 && config.Resources.MemoryReservation < linuxMinMemory {
		return warnings, fmt.Errorf("minimum memory reservation allowed is 4MB")
	}
	if config.Resources.Memory > 0 && config.Resources.MemoryReservation > 0 && config.Resources.Memory < config.Resources.MemoryReservation {
		return warnings, fmt.Errorf("minimum memory limit cannot be less than memory reservation limit, see usage")
	}
	if config.Resources.KernelMemory > 0 && !sysInfo.KernelMemory {
		warnings = addWarning(warnings, "Your kernel does not support kernel memory limit capabilities or the cgroup is not mounted. Limitation discarded.")
		config.Resources.KernelMemory = 0
	}
	if config.Resources.KernelMemory > 0 && config.Resources.KernelMemory < linuxMinMemory {
		return warnings, fmt.Errorf("minimum kernel memory limit allowed is 4MB")
	}
	if config.Resources.DisableOomKiller == true && !sysInfo.OomKillDisable {
		// only produce warnings if the setting wasn't to *disable* the OOM Kill; no point
		// warning the caller if they already wanted the feature to be off
		warnings = addWarning(warnings, "Your kernel does not support OomKillDisable. OomKillDisable discarded.")
		config.Resources.DisableOomKiller = false
	}

	if config.Resources.PidsLimit != 0 && !sysInfo.PidsLimit {
		warnings = addWarning(warnings, "Your kernel does not support pids limit capabilities or the cgroup is not mounted. PIDs limit discarded.")
		config.Resources.PidsLimit = 0
	}

	if config.Resources.CPUShares > 0 && !sysInfo.CPUShares {
		warnings = addWarning(warnings, "Your kernel does not support CPU shares or the cgroup is not mounted. Shares discarded.")
		config.Resources.CPUShares = 0
	}
	if config.Resources.CPUPeriod > 0 && !sysInfo.CPUCfsPeriod {
		warnings = addWarning(warnings, "Your kernel does not support CPU cfs period or the cgroup is not mounted. Period discarded.")
		config.Resources.CPUPeriod = 0
	}
	if config.Resources.CPUPeriod != 0 && (config.Resources.CPUPeriod < 1000 || config.Resources.CPUPeriod > 1000000) {
		return warnings, fmt.Errorf("CPU cfs period cannot be less than 1ms (i.e. 1000) or larger than 1s (i.e. 1000000)")
	}
	if config.Resources.CPUQuota > 0 && !sysInfo.CPUCfsQuota {
		warnings = addWarning(warnings, "Your kernel does not support CPU cfs quota or the cgroup is not mounted. Quota discarded.")
		config.Resources.CPUQuota = 0
	}
	if config.Resources.CPUQuota > 0 && config.Resources.CPUQuota < 1000 {
		return warnings, fmt.Errorf("CPU cfs quota cannot be less than 1ms (i.e. 1000)")
	}
	// cpuset subsystem checks and adjustments
	if (config.Resources.CPUsetCPUs != "" || config.Resources.CPUsetMems != "") && !sysInfo.Cpuset {
		warnings = addWarning(warnings, "Your kernel does not support cpuset or the cgroup is not mounted. CPUset discarded.")
		config.Resources.CPUsetCPUs = ""
		config.Resources.CPUsetMems = ""
	}
	cpusAvailable, err := sysInfo.IsCpusetCpusAvailable(config.Resources.CPUsetCPUs)
	if err != nil {
		return warnings, fmt.Errorf("invalid value %s for cpuset cpus", config.Resources.CPUsetCPUs)
	}
	if !cpusAvailable {
		return warnings, fmt.Errorf("requested CPUs are not available - requested %s, available: %s", config.Resources.CPUsetCPUs, sysInfo.Cpus)
	}
	memsAvailable, err := sysInfo.IsCpusetMemsAvailable(config.Resources.CPUsetMems)
	if err != nil {
		return warnings, fmt.Errorf("invalid value %s for cpuset mems", config.Resources.CPUsetMems)
	}
	if !memsAvailable {
		return warnings, fmt.Errorf("requested memory nodes are not available - requested %s, available: %s", config.Resources.CPUsetMems, sysInfo.Mems)
	}

	// blkio subsystem checks and adjustments
	if config.Resources.BlkioWeight > 0 && !sysInfo.BlkioWeight {
		warnings = addWarning(warnings, "Your kernel does not support Block I/O weight or the cgroup is not mounted. Weight discarded.")
		config.Resources.BlkioWeight = 0
	}
	if config.Resources.BlkioWeight > 0 && (config.Resources.BlkioWeight < 10 || config.Resources.BlkioWeight > 1000) {
		return warnings, fmt.Errorf("range of blkio weight is from 10 to 1000")
	}
	if len(config.Resources.BlkioWeightDevice) > 0 && !sysInfo.BlkioWeightDevice {
		warnings = addWarning(warnings, "Your kernel does not support Block I/O weight_device or the cgroup is not mounted. Weight-device discarded.")
		config.Resources.BlkioWeightDevice = []string{}
	}
	if len(config.Resources.DeviceReadBps) > 0 && !sysInfo.BlkioReadBpsDevice {
		warnings = addWarning(warnings, "Your kernel does not support BPS Block I/O read limit or the cgroup is not mounted. Block I/O BPS read limit discarded")
		config.Resources.DeviceReadBps = []string{}
	}
	if len(config.Resources.DeviceWriteBps) > 0 && !sysInfo.BlkioWriteBpsDevice {
		warnings = addWarning(warnings, "Your kernel does not support BPS Block I/O write limit or the cgroup is not mounted. Block I/O BPS write limit discarded.")
		config.Resources.DeviceWriteBps = []string{}
	}
	if len(config.Resources.DeviceReadIOps) > 0 && !sysInfo.BlkioReadIOpsDevice {
		warnings = addWarning(warnings, "Your kernel does not support IOPS Block read limit or the cgroup is not mounted. Block I/O IOPS read limit discarded.")
		config.Resources.DeviceReadIOps = []string{}
	}
	if len(config.Resources.DeviceWriteIOps) > 0 && !sysInfo.BlkioWriteIOpsDevice {
		warnings = addWarning(warnings, "Your kernel does not support IOPS Block I/O write limit or the cgroup is not mounted. Block I/O IOPS write limit discarded.")
		config.Resources.DeviceWriteIOps = []string{}
	}

	return warnings, nil
}