1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
|
// +build linux
package libpod
import (
"context"
"strings"
"github.com/containers/libpod/libpod/image"
"github.com/containers/libpod/pkg/rootless"
"github.com/opencontainers/image-spec/specs-go/v1"
spec "github.com/opencontainers/runtime-spec/specs-go"
"github.com/opencontainers/runtime-tools/generate"
"github.com/pkg/errors"
)
const (
// IDTruncLength is the length of the pod's id that will be used to make the
// infra container name
IDTruncLength = 12
)
func (r *Runtime) makeInfraContainer(ctx context.Context, p *Pod, imgName, imgID string, config *v1.ImageConfig) (*Container, error) {
// Set up generator for infra container defaults
g, err := generate.New("linux")
if err != nil {
return nil, err
}
isRootless := rootless.IsRootless()
entryCmd := []string{r.config.InfraCommand}
if config == nil {
}
// I've seen circumstances where config is being passed as nil.
// Let's err on the side of safety and make sure it's safe to use.
if config != nil {
// default to entrypoint in image if there is one
if len(config.Entrypoint) > 0 {
entryCmd = config.Entrypoint
}
if len(config.Env) > 0 {
for _, nameValPair := range config.Env {
nameValSlice := strings.Split(nameValPair, "=")
if len(nameValSlice) < 2 {
return nil, errors.Errorf("Invalid environment variable structure in pause image")
}
g.AddProcessEnv(nameValSlice[0], nameValSlice[1])
}
}
}
g.SetRootReadonly(true)
g.SetProcessArgs(entryCmd)
if isRootless {
g.RemoveMount("/dev/pts")
devPts := spec.Mount{
Destination: "/dev/pts",
Type: "devpts",
Source: "devpts",
Options: []string{"private", "nosuid", "noexec", "newinstance", "ptmxmode=0666", "mode=0620"},
}
g.AddMount(devPts)
}
containerName := p.ID()[:IDTruncLength] + "-infra"
var options []CtrCreateOption
options = append(options, r.WithPod(p))
options = append(options, WithRootFSFromImage(imgID, imgName, false))
options = append(options, WithName(containerName))
options = append(options, withIsInfra())
// Since user namespace sharing is not implemented, we only need to check if it's rootless
networks := make([]string, 0)
netmode := "bridge"
if isRootless {
netmode = "slirp4netns"
}
options = append(options, WithNetNS(p.config.InfraContainer.PortBindings, isRootless, netmode, networks))
return r.newContainer(ctx, g.Config, options...)
}
// createInfraContainer wrap creates an infra container for a pod.
// An infra container becomes the basis for kernel namespace sharing between
// containers in the pod.
func (r *Runtime) createInfraContainer(ctx context.Context, p *Pod) (*Container, error) {
if !r.valid {
return nil, ErrRuntimeStopped
}
newImage, err := r.ImageRuntime().New(ctx, r.config.InfraImage, "", "", nil, nil, image.SigningOptions{}, false, nil)
if err != nil {
return nil, err
}
data, err := newImage.Inspect(ctx)
if err != nil {
return nil, err
}
imageName := newImage.Names()[0]
imageID := data.ID
return r.makeInfraContainer(ctx, p, imageName, imageID, data.Config)
}
|
