blob: 853f87ab66e094ede25eccbee275ad91bd1d7ccf (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
|
package common
import (
"fmt"
"os"
"github.com/containers/buildah/pkg/parse"
"github.com/containers/libpod/pkg/apparmor"
"github.com/containers/libpod/pkg/cgroups"
"github.com/containers/libpod/pkg/rootless"
"github.com/containers/libpod/pkg/specgen"
"github.com/containers/libpod/pkg/sysinfo"
"github.com/opencontainers/selinux/go-selinux"
)
var (
// DefaultHealthCheckInterval default value
DefaultHealthCheckInterval = "30s"
// DefaultHealthCheckRetries default value
DefaultHealthCheckRetries uint = 3
// DefaultHealthCheckStartPeriod default value
DefaultHealthCheckStartPeriod = "0s"
// DefaultHealthCheckTimeout default value
DefaultHealthCheckTimeout = "30s"
// DefaultImageVolume default value
DefaultImageVolume = "bind"
)
// TODO these options are directly embedded into many of the CLI cobra values, as such
// this approach will not work in a remote client. so we will need to likely do something like a
// supported and unsupported approach here and backload these options into the specgen
// once we are "on" the host system.
func getDefaultSecurityOptions() []string {
securityOpts := []string{}
if containerConfig.Containers.SeccompProfile != "" && containerConfig.Containers.SeccompProfile != parse.SeccompDefaultPath {
securityOpts = append(securityOpts, fmt.Sprintf("seccomp=%s", containerConfig.Containers.SeccompProfile))
}
if apparmor.IsEnabled() && containerConfig.Containers.ApparmorProfile != "" {
securityOpts = append(securityOpts, fmt.Sprintf("apparmor=%s", containerConfig.Containers.ApparmorProfile))
}
if selinux.GetEnabled() && !containerConfig.Containers.EnableLabeling {
securityOpts = append(securityOpts, fmt.Sprintf("label=%s", selinux.DisableSecOpt()[0]))
}
return securityOpts
}
// getDefaultSysctls
func getDefaultSysctls() []string {
return containerConfig.Containers.DefaultSysctls
}
func getDefaultVolumes() []string {
return containerConfig.Containers.Volumes
}
func getDefaultDevices() []string {
return containerConfig.Containers.Devices
}
func getDefaultDNSServers() []string { //nolint
return containerConfig.Containers.DNSServers
}
func getDefaultDNSSearches() []string { //nolint
return containerConfig.Containers.DNSSearches
}
func getDefaultDNSOptions() []string { //nolint
return containerConfig.Containers.DNSOptions
}
func getDefaultEnv() []string {
return containerConfig.Containers.Env
}
func getDefaultInitPath() string {
return containerConfig.Containers.InitPath
}
func getDefaultIPCNS() string {
return containerConfig.Containers.IPCNS
}
func getDefaultPidNS() string {
return containerConfig.Containers.PidNS
}
func getDefaultNetNS() string { //nolint
if containerConfig.Containers.NetNS == string(specgen.Private) && rootless.IsRootless() {
return string(specgen.Slirp)
}
return containerConfig.Containers.NetNS
}
func getDefaultCgroupNS() string {
return containerConfig.Containers.CgroupNS
}
func getDefaultUTSNS() string {
return containerConfig.Containers.UTSNS
}
func getDefaultShmSize() string {
return containerConfig.Containers.ShmSize
}
func getDefaultUlimits() []string {
return containerConfig.Containers.DefaultUlimits
}
func getDefaultUserNS() string {
userns := os.Getenv("PODMAN_USERNS")
if userns != "" {
return userns
}
return containerConfig.Containers.UserNS
}
func getDefaultPidsLimit() int64 {
if rootless.IsRootless() {
cgroup2, _ := cgroups.IsCgroup2UnifiedMode()
if cgroup2 {
return containerConfig.Containers.PidsLimit
}
}
return sysinfo.GetDefaultPidsLimit()
}
func getDefaultPidsDescription() string {
return "Tune container pids limit (set 0 for unlimited)"
}
func GetDefaultDetachKeys() string {
return containerConfig.Engine.DetachKeys
}
|
