From 8d06bfc12ec62b8276b2db22e049d40dde016c9f Mon Sep 17 00:00:00 2001 From: Michael Crosby Date: Thu, 19 Jun 2014 15:23:19 -0700 Subject: [PATCH] Update libcontainer dep to v1.0.1 Docker-DCO-1.1-Signed-off-by: Michael Crosby (github: crosbymichael) --- hack/vendor.sh | 2 +- .../docker/libcontainer/.travis.yml | 1 + .../docker/libcontainer/CONTRIBUTORS_GUIDE.md | 12 +- .../docker/libcontainer/MAINTAINERS_GUIDE.md | 2 +- .../docker/libcontainer/cgroups/fs/cpuacct.go | 1 + .../docker/libcontainer/cgroups/stats.go | 6 +- .../docker/libcontainer/container.json | 312 ++++++++++++------ .../docker/libcontainer/container_test.go | 9 +- .../docker/libcontainer/namespaces/execin.go | 18 +- .../docker/libcontainer/namespaces/nsenter.go | 40 ++- .../docker/libcontainer/nsinit/nsenter.go | 20 +- 11 files changed, 280 insertions(+), 143 deletions(-) diff --git a/hack/vendor.sh b/hack/vendor.sh index d876551250..e5158b1d8a 100755 --- a/hack/vendor.sh +++ b/hack/vendor.sh @@ -61,4 +61,4 @@ mv tmp-tar src/code.google.com/p/go/src/pkg/archive/tar clone git github.com/godbus/dbus v1 clone git github.com/coreos/go-systemd v2 -clone git github.com/docker/libcontainer 77ffd49dfedbc78a7cd4cb7a50c7446cf118725f +clone git github.com/docker/libcontainer v1.0.1 diff --git a/vendor/src/github.com/docker/libcontainer/.travis.yml b/vendor/src/github.com/docker/libcontainer/.travis.yml index ae7e8e2fc3..94dc5ac7c8 100644 --- a/vendor/src/github.com/docker/libcontainer/.travis.yml +++ b/vendor/src/github.com/docker/libcontainer/.travis.yml @@ -9,3 +9,4 @@ install: script: - bash "$DOCKER_PATH/hack/make/validate-dco" - bash "$DOCKER_PATH/hack/make/validate-gofmt" + - go test diff --git a/vendor/src/github.com/docker/libcontainer/CONTRIBUTORS_GUIDE.md b/vendor/src/github.com/docker/libcontainer/CONTRIBUTORS_GUIDE.md index 6c0c416ed1..f02689625c 100644 --- a/vendor/src/github.com/docker/libcontainer/CONTRIBUTORS_GUIDE.md +++ b/vendor/src/github.com/docker/libcontainer/CONTRIBUTORS_GUIDE.md @@ -36,7 +36,7 @@ that feature *on top of* libcontainer. ### Discuss your design on the mailing list We recommend discussing your plans [on the mailing -list](https://groups.google.com/forum/?fromgroups#!forum/docker-dev) +list](https://groups.google.com/forum/?fromgroups#!forum/libcontainer) before starting to code - especially for more ambitious contributions. This gives other contributors a chance to point you in the right direction, give feedback on your design, and maybe point out if someone @@ -112,12 +112,12 @@ and that all the tests pass. libcontainer maintainers use LGTM (looks good to me) in comments on the code review to indicate acceptance. -A change requires LGTMs from at lease one maintainer of each -component affected. For example, if a change affects `netlink/` and `security/`, it -needs at least one LGTM from the maintainers of `netlink/` AND, separately, at -least one LGTM from the maintainers of `security/`. +A change requires LGTMs from at lease two maintainers. One of those must come from +a maintainer of the component affected. For example, if a change affects `netlink/` +and `security`, it needs at least one LGTM from a maintainer of each. Maintainers +only need one LGTM as presumably they LGTM their own change. -For more details see [MAINTAINERS.md](hack/MAINTAINERS.md) +For more details see [MAINTAINERS.md](MAINTAINERS.md) ### Sign your work diff --git a/vendor/src/github.com/docker/libcontainer/MAINTAINERS_GUIDE.md b/vendor/src/github.com/docker/libcontainer/MAINTAINERS_GUIDE.md index b67832396c..2ac9ca21f4 100644 --- a/vendor/src/github.com/docker/libcontainer/MAINTAINERS_GUIDE.md +++ b/vendor/src/github.com/docker/libcontainer/MAINTAINERS_GUIDE.md @@ -63,7 +63,7 @@ All decisions are pull requests, and the relevant maintainers make decisions by accepting or refusing the pull request. Review and acceptance by anyone is denoted by adding a comment in the pull request: `LGTM`. However, only currently listed `MAINTAINERS` are counted towards the required -majority. +two LGTMs. libcontainer follows the timeless, highly efficient and totally unfair system known as [Benevolent dictator for life](http://en.wikipedia.org/wiki/Benevolent_Dictator_for_Life), with Michael Crosby in the role of BDFL. diff --git a/vendor/src/github.com/docker/libcontainer/cgroups/fs/cpuacct.go b/vendor/src/github.com/docker/libcontainer/cgroups/fs/cpuacct.go index fe831d1be5..a3d22c9f74 100644 --- a/vendor/src/github.com/docker/libcontainer/cgroups/fs/cpuacct.go +++ b/vendor/src/github.com/docker/libcontainer/cgroups/fs/cpuacct.go @@ -84,6 +84,7 @@ func (s *cpuacctGroup) GetStats(d *data, stats *cgroups.Stats) error { if err != nil { return err } + stats.CpuStats.CpuUsage.TotalUsage = lastUsage stats.CpuStats.CpuUsage.PercpuUsage = percpuUsage stats.CpuStats.CpuUsage.UsageInKernelmode = (kernelModeUsage * nanosecondsInSecond) / clockTicks stats.CpuStats.CpuUsage.UsageInUsermode = (userModeUsage * nanosecondsInSecond) / clockTicks diff --git a/vendor/src/github.com/docker/libcontainer/cgroups/stats.go b/vendor/src/github.com/docker/libcontainer/cgroups/stats.go index 20a5f00a37..2640245e51 100644 --- a/vendor/src/github.com/docker/libcontainer/cgroups/stats.go +++ b/vendor/src/github.com/docker/libcontainer/cgroups/stats.go @@ -13,8 +13,10 @@ type CpuUsage struct { // percentage of available CPUs currently being used. PercentUsage uint64 `json:"percent_usage,omitempty"` // nanoseconds of cpu time consumed over the last 100 ms. - CurrentUsage uint64 `json:"current_usage,omitempty"` - PercpuUsage []uint64 `json:"percpu_usage,omitempty"` + CurrentUsage uint64 `json:"current_usage,omitempty"` + // total nanoseconds of cpu time consumed + TotalUsage uint64 `json:"total_usage,omitempty"` + PercpuUsage []uint64 `json:"percpu_usage,omitempty"` // Time spent by tasks of the cgroup in kernel mode. Units: nanoseconds. UsageInKernelmode uint64 `json:"usage_in_kernelmode"` // Time spent by tasks of the cgroup in user mode. Units: nanoseconds. diff --git a/vendor/src/github.com/docker/libcontainer/container.json b/vendor/src/github.com/docker/libcontainer/container.json index 7448a077e0..da138d173f 100644 --- a/vendor/src/github.com/docker/libcontainer/container.json +++ b/vendor/src/github.com/docker/libcontainer/container.json @@ -1,107 +1,213 @@ { - "namespaces": { - "NEWNET": true, - "NEWPID": true, - "NEWIPC": true, - "NEWUTS": true, - "NEWNS": true - }, - "networks": [ - { - "gateway": "localhost", - "type": "loopback", - "address": "127.0.0.1/0", - "mtu": 1500 + "capabilities": [ + "CHOWN", + "DAC_OVERRIDE", + "FOWNER", + "MKNOD", + "NET_RAW", + "SETGID", + "SETUID", + "SETFCAP", + "SETPCAP", + "NET_BIND_SERVICE", + "SYS_CHROOT", + "KILL" + ], + "cgroups": { + "allowed_devices": [ + { + "cgroup_permissions": "m", + "major_number": -1, + "minor_number": -1, + "type": 99 + }, + { + "cgroup_permissions": "m", + "major_number": -1, + "minor_number": -1, + "type": 98 + }, + { + "cgroup_permissions": "rwm", + "major_number": 5, + "minor_number": 1, + "path": "/dev/console", + "type": 99 + }, + { + "cgroup_permissions": "rwm", + "major_number": 4, + "path": "/dev/tty0", + "type": 99 + }, + { + "cgroup_permissions": "rwm", + "major_number": 4, + "minor_number": 1, + "path": "/dev/tty1", + "type": 99 + }, + { + "cgroup_permissions": "rwm", + "major_number": 136, + "minor_number": -1, + "type": 99 + }, + { + "cgroup_permissions": "rwm", + "major_number": 5, + "minor_number": 2, + "type": 99 + }, + { + "cgroup_permissions": "rwm", + "major_number": 10, + "minor_number": 200, + "type": 99 + }, + { + "cgroup_permissions": "rwm", + "file_mode": 438, + "major_number": 1, + "minor_number": 3, + "path": "/dev/null", + "type": 99 + }, + { + "cgroup_permissions": "rwm", + "file_mode": 438, + "major_number": 1, + "minor_number": 5, + "path": "/dev/zero", + "type": 99 + }, + { + "cgroup_permissions": "rwm", + "file_mode": 438, + "major_number": 1, + "minor_number": 7, + "path": "/dev/full", + "type": 99 + }, + { + "cgroup_permissions": "rwm", + "file_mode": 438, + "major_number": 5, + "path": "/dev/tty", + "type": 99 + }, + { + "cgroup_permissions": "rwm", + "file_mode": 438, + "major_number": 1, + "minor_number": 9, + "path": "/dev/urandom", + "type": 99 + }, + { + "cgroup_permissions": "rwm", + "file_mode": 438, + "major_number": 1, + "minor_number": 8, + "path": "/dev/random", + "type": 99 + } + ], + "name": "docker-koye", + "parent": "docker" }, - { - "gateway": "172.17.42.1", - "context": { - "prefix": "veth", - "bridge": "docker0" - }, - "type": "veth", - "address": "172.17.42.2/16", - "mtu": 1500 - } - ], - "routes": [ - { - "gateway": "172.17.42.1", - "interface_name": "eth0" + "context": { + "mount_label": "", + "process_label": "", + "restrictions": "true" }, - { - "destination": "192.168.0.0/24", - "interface_name": "eth0" - } - ], - "capabilities": [ - "MKNOD" - ], - "cgroups": { - "name": "docker-koye", - "parent": "docker" - }, - "hostname": "koye", - "environment": [ - "HOME=/", - "PATH=PATH=$PATH:/bin:/usr/bin:/sbin:/usr/sbin", - "container=docker", - "TERM=xterm-256color" - ], - "tty": true, - "mounts": [ - { - "type": "devtmpfs" - } - ], - "device_nodes": [ - { - "path": "/dev/null", - "type": 99, - "major_number": 1, - "minor_number": 3, - "cgroup_permissions": "rwm", - "file_mode": 438 - }, - { - "path": "/dev/zero", - "type": 99, - "major_number": 1, - "minor_number": 5, - "cgroup_permissions": "rwm", - "file_mode": 438 - }, - { - "path": "/dev/full", - "type": 99, - "major_number": 1, - "minor_number": 7, - "cgroup_permissions": "rwm", - "file_mode": 438 - }, - { - "path": "/dev/tty", - "type": 99, - "major_number": 5, - "minor_number": 0, - "cgroup_permissions": "rwm", - "file_mode": 438 - }, - { - "path": "/dev/urandom", - "type": 99, - "major_number": 1, - "minor_number": 9, - "cgroup_permissions": "rwm", - "file_mode": 438 - }, - { - "path": "/dev/random", - "type": 99, - "major_number": 1, - "minor_number": 8, - "cgroup_permissions": "rwm", - "file_mode": 438 - } - ] + "device_nodes": [ + { + "cgroup_permissions": "rwm", + "major_number": 10, + "minor_number": 229, + "path": "/dev/fuse", + "type": 99 + }, + { + "cgroup_permissions": "rwm", + "file_mode": 438, + "major_number": 1, + "minor_number": 3, + "path": "/dev/null", + "type": 99 + }, + { + "cgroup_permissions": "rwm", + "file_mode": 438, + "major_number": 1, + "minor_number": 5, + "path": "/dev/zero", + "type": 99 + }, + { + "cgroup_permissions": "rwm", + "file_mode": 438, + "major_number": 1, + "minor_number": 7, + "path": "/dev/full", + "type": 99 + }, + { + "cgroup_permissions": "rwm", + "file_mode": 438, + "major_number": 5, + "path": "/dev/tty", + "type": 99 + }, + { + "cgroup_permissions": "rwm", + "file_mode": 438, + "major_number": 1, + "minor_number": 9, + "path": "/dev/urandom", + "type": 99 + }, + { + "cgroup_permissions": "rwm", + "file_mode": 438, + "major_number": 1, + "minor_number": 8, + "path": "/dev/random", + "type": 99 + } + ], + "environment": [ + "HOME=/", + "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "HOSTNAME=2d388ea3bd92", + "TERM=xterm" + ], + "hostname": "koye", + "namespaces": { + "NEWIPC": true, + "NEWNET": true, + "NEWNS": true, + "NEWPID": true, + "NEWUTS": true + }, + "networks": [ + { + "address": "127.0.0.1/0", + "gateway": "localhost", + "mtu": 1500, + "type": "loopback" + }, + { + "address": "172.17.0.101/16", + "context": { + "bridge": "docker0", + "prefix": "veth" + }, + "gateway": "172.17.42.1", + "mtu": 1500, + "type": "veth" + } + ], + "tty": true } diff --git a/vendor/src/github.com/docker/libcontainer/container_test.go b/vendor/src/github.com/docker/libcontainer/container_test.go index 838281833f..deb65aa835 100644 --- a/vendor/src/github.com/docker/libcontainer/container_test.go +++ b/vendor/src/github.com/docker/libcontainer/container_test.go @@ -37,11 +37,6 @@ func TestContainerJsonFormat(t *testing.T) { t.Fail() } - if len(container.Routes) != 2 { - t.Log("should have found 2 routes") - t.Fail() - } - if !container.Namespaces["NEWNET"] { t.Log("namespaces should contain NEWNET") t.Fail() @@ -62,8 +57,8 @@ func TestContainerJsonFormat(t *testing.T) { t.Fail() } - if contains("SYS_CHROOT", container.Capabilities) { - t.Log("capabilities mask should not contain SYS_CHROOT") + if !contains("SYS_CHROOT", container.Capabilities) { + t.Log("capabilities mask should contain SYS_CHROOT") t.Fail() } } diff --git a/vendor/src/github.com/docker/libcontainer/namespaces/execin.go b/vendor/src/github.com/docker/libcontainer/namespaces/execin.go index 97bbb5f79d..f44e92abe5 100644 --- a/vendor/src/github.com/docker/libcontainer/namespaces/execin.go +++ b/vendor/src/github.com/docker/libcontainer/namespaces/execin.go @@ -21,14 +21,8 @@ func ExecIn(container *libcontainer.Container, nspid int, args []string) error { return err } - // TODO(vmarmol): Move this to the container JSON. - processLabel, err := label.GetPidCon(nspid) - if err != nil { - return err - } - // Enter the namespace and then finish setup - finalArgs := []string{os.Args[0], "nsenter", strconv.Itoa(nspid), processLabel, string(containerJson)} + finalArgs := []string{os.Args[0], "nsenter", "--nspid", strconv.Itoa(nspid), "--containerjson", string(containerJson), "--"} finalArgs = append(finalArgs, args...) if err := system.Execv(finalArgs[0], finalArgs[0:], os.Environ()); err != nil { return err @@ -37,7 +31,7 @@ func ExecIn(container *libcontainer.Container, nspid int, args []string) error { } // NsEnter is run after entering the namespace. -func NsEnter(container *libcontainer.Container, processLabel string, nspid int, args []string) error { +func NsEnter(container *libcontainer.Container, nspid int, args []string) error { // clear the current processes env and replace it with the environment // defined on the container if err := LoadContainerEnvironment(container); err != nil { @@ -46,9 +40,13 @@ func NsEnter(container *libcontainer.Container, processLabel string, nspid int, if err := FinalizeNamespace(container); err != nil { return err } - if err := label.SetProcessLabel(processLabel); err != nil { - return err + + if process_label, ok := container.Context["process_label"]; ok { + if err := label.SetProcessLabel(process_label); err != nil { + return err + } } + if err := system.Execv(args[0], args[0:], container.Env); err != nil { return err } diff --git a/vendor/src/github.com/docker/libcontainer/namespaces/nsenter.go b/vendor/src/github.com/docker/libcontainer/namespaces/nsenter.go index acf3d435ba..d5eaa27143 100644 --- a/vendor/src/github.com/docker/libcontainer/namespaces/nsenter.go +++ b/vendor/src/github.com/docker/libcontainer/namespaces/nsenter.go @@ -15,6 +15,7 @@ package namespaces #include #include #include +#include static const kBufSize = 256; @@ -64,6 +65,10 @@ int setns(int fd, int nstype) { #endif #endif +void print_usage() { + fprintf(stderr, " nsenter --nspid --containerjson -- cmd1 arg1 arg2...\n"); +} + void nsenter() { int argc; char **argv; @@ -79,11 +84,40 @@ void nsenter() { fprintf(stderr, "nsenter: Incorrect usage, not enough arguments\n"); exit(1); } - pid_t init_pid = strtol(argv[2], NULL, 10); - if (errno != 0 || init_pid <= 0) { - fprintf(stderr, "nsenter: Failed to parse PID from \"%s\" with error: \"%s\"\n", argv[2], strerror(errno)); + + static const struct option longopts[] = { + { "nspid", required_argument, NULL, 'n' }, + { "containerjson", required_argument, NULL, 'c' }, + { NULL, 0, NULL, 0 } + }; + + int c; + pid_t init_pid = -1; + char *init_pid_str = NULL; + char *container_json = NULL; + while ((c = getopt_long_only(argc, argv, "n:s:c:", longopts, NULL)) != -1) { + switch (c) { + case 'n': + init_pid_str = optarg; + break; + case 'c': + container_json = optarg; + break; + } + } + + if (container_json == NULL || init_pid_str == NULL) { + print_usage(); exit(1); } + + init_pid = strtol(init_pid_str, NULL, 10); + if (errno != 0 || init_pid <= 0) { + fprintf(stderr, "nsenter: Failed to parse PID from \"%s\" with error: \"%s\"\n", init_pid_str, strerror(errno)); + print_usage(); + exit(1); + } + argc -= 3; argv += 3; diff --git a/vendor/src/github.com/docker/libcontainer/nsinit/nsenter.go b/vendor/src/github.com/docker/libcontainer/nsinit/nsenter.go index 8a9caa75f4..faa61315e0 100644 --- a/vendor/src/github.com/docker/libcontainer/nsinit/nsenter.go +++ b/vendor/src/github.com/docker/libcontainer/nsinit/nsenter.go @@ -2,7 +2,6 @@ package main import ( "log" - "strconv" "github.com/codegangsta/cli" "github.com/docker/libcontainer/namespaces" @@ -12,29 +11,30 @@ var nsenterCommand = cli.Command{ Name: "nsenter", Usage: "init process for entering an existing namespace", Action: nsenterAction, + Flags: []cli.Flag{ + cli.IntFlag{Name: "nspid"}, + cli.StringFlag{Name: "containerjson"}, + }, } func nsenterAction(context *cli.Context) { args := context.Args() - if len(args) < 4 { - log.Fatalf("incorrect usage: ...") + + if len(args) == 0 { + args = []string{"/bin/bash"} } - container, err := loadContainerFromJson(args.Get(2)) + container, err := loadContainerFromJson(context.String("containerjson")) if err != nil { log.Fatalf("unable to load container: %s", err) } - nspid, err := strconv.Atoi(args.Get(0)) - if err != nil { - log.Fatalf("unable to read pid: %s from %q", err, args.Get(0)) - } - + nspid := context.Int("nspid") if nspid <= 0 { log.Fatalf("cannot enter into namespaces without valid pid: %q", nspid) } - if err := namespaces.NsEnter(container, args.Get(1), nspid, args[3:]); err != nil { + if err := namespaces.NsEnter(container, nspid, args); err != nil { log.Fatalf("failed to nsenter: %s", err) } }