4ddfffcab3
Join memory and cpu cgroup in systemd too
...
Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: crosbymichael)
2014-04-11 17:29:40 +00:00
505184d2dc
Join cpuacct, freezer, perf_event, and blkio groups
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-04-11 17:28:27 +00:00
031fcb31d3
Setup cgroups for all subsystems
...
Fixes #5117
Fixes #5118
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-04-11 17:28:27 +00:00
b8c10d8af2
Merge pull request #5143 from kzys/ns-nil
...
Avoid "invalid memory address or nil pointer dereference" panic
2014-04-10 11:07:35 -07:00
042a50a8fe
Merge pull request #5131 from crosbymichael/shm-mode
...
Change shm mode to 1777
2014-04-10 07:50:32 -07:00
5b242c95da
Merge pull request #5115 from alexlarsson/fix-libcontainer-network-rhel6
...
Fix libcontainer network support on rhel6
2014-04-10 07:45:12 -07:00
c5226d94fa
Avoid "invalid memory address or nil pointer dereference" panic
...
libcontainer.GetNamespace returns nil on FreeBSD because
libcontainer.namespaceList is empty. In this case, Namespaces#Get should
return nil instead of being panic.
Docker-DCO-1.1-Signed-off-by: Kato Kazuyoshi <kato.kazuyoshi@gmail.com> (github: kzys)
2014-04-10 22:07:29 +09:00
1c90a4dd9a
Support FreeBSD on pkg/system/utimes_*.go
...
Implement system.LUtimesNano and system.UtimesNano. The latter might be
removed in future because it's basically same as os.Chtimes. That's why
the test is mainly focusing LUtimesNano.
Docker-DCO-1.1-Signed-off-by: Kato Kazuyoshi <kato.kazuyoshi@gmail.com> (github: kzys)
2014-04-10 07:34:37 +09:00
59c1b2880b
Fix libcontainer network support on rhel6
...
It seems that netlink in older kernels, including RHEL6, does not
support RTM_SETLINK with IFLA_MASTER. It just silently ignores it, reporting
no error, causing netlink.NetworkSetMaster() to not do anything yet
return no error.
We fix this by introducing and using AddToBridge() in a very similar manner
to CreateBridge(), which use the old ioctls directly.
This fixes https://github.com/dotcloud/docker/issues/4668
Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
2014-04-09 15:44:18 +02:00
63c303eecd
Revert "Support hairpin NAT without going through docker server"
...
This reverts commit b39d02b611
2014-04-09 11:55:08 +00:00
986cf931c3
Change shm mode to 1777
...
Fixes #5126
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-04-09 10:53:32 +00:00
87f0d63fb2
Check for apparmor enabled on host to populate profile
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-04-09 10:22:17 +00:00
4f828d67f0
Backup current docker apparmor profile and replace it with the new one
...
Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume@charmes.net> (github: creack)
2014-04-08 11:09:31 -07:00
8cfbc44661
Merge pull request #5049 from Supermathie/aa-fix
...
apparmor: docker-default: Include base abstraction
2014-04-07 21:34:01 -07:00
1d2126be6c
Merge pull request #5025 from dstine/readme-fix
...
fixed two readme typos
2014-04-07 19:31:16 -07:00
9c4d10b9a9
fixed three more typos
2014-04-07 22:09:15 -04:00
b6042f252d
Ensure that ro mounts are remounted
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-04-07 18:23:22 -07:00
028d44d126
Remove and unexport selinux functions
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-04-07 14:59:44 -07:00
82f37b874e
Ensure that selinux is disabled by default
...
This also includes some portability changes so that the package can be
imported with the top level runtime.
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-04-07 14:44:53 -07:00
aaf018017c
Add more label checks for selinux enabled
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-04-07 14:44:53 -07:00
726206f2aa
apparmor: pull in variables from tunables/global
...
The variables that were defined at the top of the apparmor profile are best
pulled in via the <tunables/global> include.
Docker-DCO-1.1-Signed-off-by: Michael Brown <michael.brown@discourse.org> (github: Supermathie)
2014-04-07 03:04:27 -04:00
320b3e0d21
apparmor: abstractions/base expects pid variable
...
Add 'pid' variable pointing to 'self' to allow parsing of profile to succeed
Docker-DCO-1.1-Signed-off-by: Michael Brown <michael.brown@discourse.org> (github: Supermathie)
2014-04-07 02:47:43 -04:00
e35c23311f
apparmor: docker-default: Include base abstraction
...
Encountered problems on 14.04 relating to signals between container
processes being blocked by apparmor. The base abstraction contains
appropriate rules to allow this communication.
Docker-DCO-1.1-Signed-off-by: Michael Brown <michael.brown@discourse.org> (github: Supermathie)
2014-04-07 02:19:38 -04:00
bea71245c8
fixed two readme typos
2014-04-04 08:12:17 -04:00
a255849129
Merge pull request #5002 from crosbymichael/rhatdan-selinux
...
Improve selinux label handling
2014-04-04 04:43:16 +03:00
a278656330
Merge pull request #4991 from ruphin/fix_name_typo
...
Fix typo in names-generator
2014-04-03 16:24:14 -07:00
6cf1378601
Fix typo in names-generator
...
Docker-DCO-1.1-Signed-off-by: Goffert van Gool <ruphin@ruphin.net> (github: ruphin)
2014-04-04 00:57:43 +02:00
9687c087ab
Merge pull request #4953 from rhatdan/selinux
...
These two patches should fix problems we see with running docker in the wild.
2014-04-02 16:36:41 -07:00
94233a204f
Fix lxc label handleing
...
This also improves the logic around formatting the labels for selinux
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-04-02 16:52:49 +00:00
6e7a93628b
Merge branch 'selinux' of https://github.com/rhatdan/docker into rhatdan-selinux
...
Conflicts:
pkg/selinux/selinux.go
runtime/execdriver/lxc/lxc_template.go
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-04-02 16:11:35 +00:00
d76ac4d429
In certain cases, setting the process label will not happen.
...
When the code attempts to set the ProcessLabel, it checks if SELinux Is
enabled. We have seen a case with some of our patches where the code
is fooled by the container to think that SELinux is not enabled. Calling
label.Init before setting up the rest of the container, tells the library that
SELinux is enabled and everything works fine.
Docker-DCO-1.1-Signed-off-by: Dan Walsh <dwalsh@redhat.com> (github: rhatdan)
2014-04-03 09:32:29 -04:00
32ad78b043
Remove hard coding of SELinux labels on systems without proper selinux policy.
...
If a system is configured for SELinux but does not know about docker or
containers, then we want the transitions of the policy to work. Hard coding
the labels causes docker to break on older Fedora and RHEL systems
Docker-DCO-1.1-Signed-off-by: Dan Walsh <dwalsh@redhat.com> (github: rhatdan)
2014-04-03 09:32:29 -04:00
18ef3cc24a
Remove loopback setup for native driver
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-04-02 13:12:52 +00:00
c94111b619
Allow non-privileged containers to create device nodes.
...
Such nodes could already be created by importing a tarball to a container; now
they can be created from within the container itself.
This gives non-privileged containers the mknod kernel capability, and modifies
their cgroup settings to allow creation of *any* node, not just whitelisted
ones. Use of such nodes is still controlled by the existing cgroup whitelist.
Docker-DCO-1.1-Signed-off-by: Kevin Wallace <kevin@pentabarf.net> (github: kevinwallace)
2014-04-03 18:44:13 +00:00
93bb208164
Merge pull request #4961 from creack/update_version_pkg
...
Update Version to not use string anymore
2014-04-01 18:37:25 -07:00
431046e0f5
Merge pull request #4902 from shykes/wozniak_is_not_boring
...
Steve Wozniak is not boring.
2014-04-01 16:49:56 -07:00
ceed9382d0
Merge pull request #4931 from crosbymichael/gen-mac-addr-for-bridge
...
Set bridge mac addr on supported kernels
2014-04-02 02:47:56 +03:00
30ff3fa954
Merge pull request #4867 from crosbymichael/clean-shutdown
...
Cleanly shutdown docker
2014-04-02 01:48:03 +03:00
3ee37f547f
Update Version to not use string anymore
...
Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume@charmes.net> (github: creack)
2014-04-01 15:46:52 -07:00
9cf89f8542
Merge pull request #4942 from vieux/cleanup_dev_libcontainer
...
remove setupDev from libcontainer
2014-04-01 14:28:17 -07:00
b4b87413d8
Merge pull request #4833 from crosbymichael/pluginflag
...
Add opts flag for fine grained control over drivers
2014-04-01 13:34:08 -07:00
2224e0d65a
In certain cases, setting the process label will not happen.
...
When the code attempts to set the ProcessLabel, it checks if SELinux Is
enabled. We have seen a case with some of our patches where the code
is fooled by the container to think that SELinux is not enabled. Calling
label.Init before setting up the rest of the container, tells the library that
SELinux is enabled and everything works fine.
Docker-DCO-1.1-Signed-off-by: Dan Walsh <dwalsh@redhat.com> (github: rhatdan)
2014-04-01 13:30:10 -04:00
f9b8161c60
Remove hard coding of SELinux labels on systems without proper selinux policy.
...
If a system is configured for SELinux but does not know about docker or
containers, then we want the transitions of the policy to work. Hard coding
the labels causes docker to break on older Fedora and RHEL systems
Docker-DCO-1.1-Signed-off-by: Dan Walsh <dwalsh@redhat.com> (github: rhatdan)
2014-04-01 13:29:54 -04:00
283daced0c
Don't send prctl to be consistent with other drivers
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-04-01 07:12:50 +00:00
5bb82f6313
Ensure a reliable way to kill ghost containers on reboot
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-04-01 07:11:41 +00:00
d52d24dd80
remove setupDev from libcontainer
...
Docker-DCO-1.1-Signed-off-by: Victor Vieux <victor.vieux@docker.com> (github: vieux)
2014-04-01 00:28:44 +00:00
4cdcea2047
Set bridge mac addr on supported kernels
...
Fixes #3200
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-03-31 22:56:23 +00:00
7808886744
Add more women
...
Added Adele Goldstine, Erna Schneider Hoover, Grace Hopper, Jean Bartik,
Jean E. Sammet, Karen Spärck Jones, Radia Perlman and Sophie Wilson.
Thanks to @jamtur01 for Sophie Kowalevski, Hypatia, Jane Goodall, Maria
Mayer, Rosalind Franklin, Gertrude Elion, Elizabeth Blackwell,
Marie-Jeanne de Lalande, Maria Kirch, Maria Ardinghelli, Jane Colden,
June Almeida, Mary Leakey, Lise Meitner, Johanna Mestorf.
Thanks to @xamebax for Françoise Barré-Sinoussi, Rachel Carson, Barbara
McClintock, Ada Yonath.
Docker-DCO-1.1-Signed-off-by: Johannes 'fish' Ziemke <github@freigeist.org> (github: discordianfish)
2014-03-31 19:44:57 +02:00
04f5c75239
Steve Wozniak is not boring.
...
Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
2014-03-29 00:48:47 +00:00
d2327006d6
Merge pull request #4442 from ibuildthecloud/hairpin-nat
...
Support hairpin NAT without going through docker server
2014-03-27 18:09:42 -07:00
6c7835050e
cgroups: Add systemd implementation of cgroups
...
This implements cgroup.Apply() using the systemd apis.
We create a transient unit called "docker-$id.scope" that contains
the container processes. We also have a way to set unit specific
properties, currently only defining the Slice to put the
scope in.
Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
2014-03-27 22:44:31 +01:00
1296d5ce9a
Add systemd.SdBooted()
...
This is a conversion of sd_booted() from libsystemd to go and checks
if the system was booted with systemd.
Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
2014-03-27 22:44:31 +01:00
cb43fd0071
pkg/systemd: Drop our copy-pasted version of go-systemd/activation
...
Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
2014-03-27 22:44:31 +01:00
9294d7f2af
cgroups: Join groups by writing to cgroups.procs, not tasks
...
cgroups.procs moves all the threads of the process, and "tasks" just
the one thread. I believe there is a risk that we move the main thread,
but then we accidentally fork off one of the other threads if the go
scheduler randomly switched to another thread. So, it seems safer (and
more correct) to use cgroups.procs.
Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
2014-03-27 21:47:47 +01:00
7f7d8419a7
cgroups: Splity out Apply/Cleanup to separate file/interface
...
This leaves only the generic cgroup helper functions in cgroups.go and
will allow easy implementations of other cgroup managers.
This also wires up the call to Cleanup the cgroup which was missing
before.
Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
2014-03-27 21:47:47 +01:00
2d270c4f06
Fix compile and unit test errors after merge
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-03-27 08:25:01 +00:00
eab56ac007
Merge branch 'master' into pluginflag
...
Conflicts:
pkg/cgroups/cgroups.go
pkg/libcontainer/nsinit/exec.go
pkg/libcontainer/nsinit/init.go
pkg/libcontainer/nsinit/mount.go
runconfig/hostconfig.go
runconfig/parse.go
runtime/execdriver/driver.go
runtime/execdriver/lxc/lxc_template.go
runtime/execdriver/lxc/lxc_template_unit_test.go
runtime/execdriver/native/default_template.go
runtime/execdriver/native/driver.go
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-03-27 08:00:18 +00:00
4c43566925
This patch adds SELinux labeling support.
...
docker will run the process(es) within the container with an SELinux label and will label
all of the content within the container with mount label. Any temporary file systems
created within the container need to be mounted with the same mount label.
The user can override the process label by specifying
-Z With a string of space separated options.
-Z "user=unconfined_u role=unconfined_r type=unconfined_t level=s0"
Would cause the process label to run with unconfined_u:unconfined_r:unconfined_t:s0"
By default the processes will run execute within the container as svirt_lxc_net_t.
All of the content in the container as svirt_sandbox_file_t.
The process mcs level is based of the PID of the docker process that is creating the container.
If you run the container in --priv mode, the labeling will be disabled.
Docker-DCO-1.1-Signed-off-by: Dan Walsh <dwalsh@redhat.com> (github: rhatdan)
2014-03-26 15:30:40 -04:00
9a7be1b015
Add cpuset.cpus to cgroups and native driver options
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-03-24 05:33:11 +00:00
2c58a1e288
Change placement of readonly filesystem
...
We need to change it to read only at the very end so that bound,
copy dev nodes and other ops do not fail.
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-03-21 14:17:17 +00:00
be5538d8a8
Allow containers to join the net namespace of other conatiners
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-03-21 00:48:17 +00:00
1bedae9107
Merge branch 'proppy-nsinit' into pluginflag
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-03-21 00:36:23 +00:00
70f3b9f4ce
Add ability to work with individual namespaces
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-03-21 00:23:34 +00:00
443a75d5f6
Allow caps to be toggled in native driver with plugin flag
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-03-21 00:10:24 +00:00
c5f9c4bd69
Dont use custom marshaling for caps and namespaces
...
This also adds an enabled field to the types so that they
can be easily toggled.
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-03-20 23:09:01 +00:00
5dbfe310fe
libcontainer: remove duplicate imports
...
Docker-DCO-1.1-Signed-off-by: Johan Euphrosine <proppy@google.com> (github: proppy)
2014-03-18 16:25:26 -07:00
f58757a699
libcontainer: goimports
...
Docker-DCO-1.1-Signed-off-by: Johan Euphrosine <proppy@google.com> (github: proppy)
2014-03-18 16:18:34 -07:00
b10b950b11
libcontainer/nsinit/init: move mount namespace after network
...
Docker-DCO-1.1-Signed-off-by: Johan Euphrosine <proppy@google.com> (github: proppy)
2014-03-18 16:18:04 -07:00
f52b2fdcbb
libcontainer/network: add netns strategy
...
Docker-DCO-1.1-Signed-off-by: Johan Euphrosine <proppy@google.com> (github: proppy)
2014-03-18 16:17:28 -07:00
4b1513f9c3
Only unshare the mount namespace for execin
...
Fixes #4728
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-03-17 18:52:56 -07:00
fb503da34e
Merge pull request #4710 from jimenez/4680-timeout_flag-fix
...
Disable timeout
2014-03-18 00:38:39 +02:00
25218f9b23
adding configuration for timeout and disable it by default
...
Docker-DCO-1.1-Signed-off-by: Isabel Jimenez <contact@isabeljimenez.com> (github: jimenez)
2014-03-17 15:12:02 -07:00
353df19ab7
Fix issue #4681 - No loopback interface within container when networking is disabled.
...
Docker-DCO-1.1-Signed-off-by: Timothy Hobbs <timothyhobbs@seznam.cz> (github: https://github.com/timthelion )
Remove loopback code from veth strategy
Docker-DCO-1.1-Signed-off-by: Timothy Hobbs <timothyhobbs@seznam.cz> (github: https://github.com/timthelion )
Looback strategy: Get rid of uneeded code in Create
Docker-DCO-1.1-Signed-off-by: Timothy Hobbs <timothyhobbs@seznam.cz> (github: https://github.com/timthelion )
Use append when building network strategy list
Docker-DCO-1.1-Signed-off-by: Timothy Hobbs <timothyhobbs@seznam.cz> (github: https://github.com/timthelion )
Swap loopback and veth strategies in Networks list
Docker-DCO-1.1-Signed-off-by: Timothy Hobbs <timothyhobbs@seznam.cz> (github: https://github.com/timthelion )
Revert "Swap loopback and veth strategies in Networks list"
This reverts commit 3b8b2c8454171d79bed5e9a80165172617e92fc7.
Docker-DCO-1.1-Signed-off-by: Timothy Hobbs <timothyhobbs@seznam.cz> (github: https://github.com/timthelion )
When initializing networks, only return from the loop if there is an error
Docker-DCO-1.1-Signed-off-by: Timothy Hobbs <timothyhobbs@seznam.cz> (github: https://github.com/timthelion )
2014-03-17 22:01:24 +01:00
597e0812fb
Merge pull request #4645 from crosbymichael/add-logger
...
Add logger to libcontainer
2014-03-17 11:30:14 -07:00
73f5aa87af
Merge pull request #4719 from philips/Capabilities-to-CapabilitiesMask
...
refactor(libcontainer): rename to CapabilitiesMask
2014-03-17 11:15:29 -07:00
ad7e7d6123
chore(libcontainer): small grammar fix in types_test
...
Someone probably got really used to typing er on the end of contain :)
Docker-DCO-1.1-Signed-off-by: Brandon Philips <brandon.philips@coreos.com> (github: philips)
2014-03-17 11:07:29 -07:00
128381e0f0
refactor(libcontainer): rename to CapabilitiesMask
...
The Capabilities field on libcontainer is actually used as a mask.
Rename the field so that this is more clear.
Docker-DCO-1.1-Signed-off-by: Brandon Philips <brandon.philips@coreos.com> (github: philips)
2014-03-17 11:07:12 -07:00
555c1ef670
Merge pull request #4672 from vieux/update_godoc_mflags
...
update godoc and add MAINTAINERS for mflags
2014-03-17 19:30:58 +02:00
39037a91f8
Send sigterm to child instead of sigkill
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-03-14 15:42:05 -07:00
a41f6d9367
update godoc and add MAINTAINERS for mflags
...
Docker-DCO-1.1-Signed-off-by: Victor Vieux <victor.vieux@docker.com> (github: vieux)
2014-03-14 17:35:41 +00:00
0e863a584a
Add stderr log ouput if in debug
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-03-14 09:55:05 -07:00
7294392c72
Add initial logging to libcontainer
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-03-14 09:55:05 -07:00
cbd2a30cd6
Update libcontainer readme and todo list
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-03-13 15:18:08 -07:00
28994f86ee
Merge pull request #4656 from crosbymichael/fix-ptmx-link
...
Always symlink /dev/ptmx for libcontainer
2014-03-13 14:57:17 -07:00
c7ea6e5da8
Merge pull request #4422 from alexlarsson/internal-mounts
...
Move all bind-mounts in the container inside the namespace
2014-03-13 14:55:29 -07:00
747275d30c
Always symlink /dev/ptmx for libcontainer
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-03-13 14:31:09 -07:00
192917a1cb
Merge pull request #4624 from creack/fix_apparmor_init
...
Fix issue when /etc/apparmor.d does not exists
2014-03-13 14:04:13 -07:00
6c266c4b42
Move all bind-mounts in the container inside the namespace
...
This moves the bind mounts like /.dockerinit, /etc/hostname, volumes,
etc into the container namespace, by setting them up using lxc.
This is useful to avoid littering the global namespace with a lot of
mounts that are internal to each container and are not generally
needed on the outside. In particular, it seems that having a lot of
mounts is problematic wrt scaling to a lot of containers on systems
where the root filesystem is mounted --rshared.
Note that the "private" option is only supported by the native driver, as
lxc doesn't support setting this. This is not a huge problem, but it does
mean that some mounts are unnecessarily shared inside the container if you're
using the lxc driver.
Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
2014-03-13 20:01:29 +01:00
029aac9639
Use BSD raw mode on darwin. Fixes nano, tmux and others
...
Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume@charmes.net> (github: creack)
2014-03-13 11:11:02 -07:00
6a325f1c7a
Fix issue when /etc/apparmor.d does not exists
...
Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume@charmes.net> (github: creack)
2014-03-12 11:13:24 -07:00
f0eb227548
improve deprecation message
...
Docker-DCO-1.1-Signed-off-by: Victor Vieux <victor.vieux@docker.com> (github: vieux)
2014-03-12 00:51:46 +00:00
915d967f55
Update email + add self to pkg/signal
...
Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume@charmes.net> (github: creack)
2014-03-10 20:26:45 -07:00
b2cd89056f
Like signal_linux.go, we don't have import os and os/signal
...
Docker-DCO-1.1-Signed-off-by: Kato Kazuyoshi <kato.kazuyoshi@gmail.com> (github: kzys)
2014-03-11 23:14:58 +09:00
b5a544b02e
Merge pull request #4563 from creack/signal-improvment
...
Signal improvments
2014-03-10 17:59:17 -07:00
923962a4b5
Merge pull request #4515 from vieux/improve_sort_flags
...
improve alpha sort in mflag
2014-03-10 17:45:41 -07:00
157f24ca77
Make docker use the signal pkg with strings
...
Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume@charmes.net> (github: creack)
2014-03-10 17:36:47 -07:00
10dc16dcd3
Create portable signalMap
...
Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume@charmes.net> (github: creack)
2014-03-10 17:36:41 -07:00
c563262239
Move signal to pkg
...
Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume@charmes.net> (github: creack)
2014-03-10 17:36:32 -07:00
03211ecce0
nsinit: prefix errors with their source
...
Docker-DCO-1.1-Signed-off-by: Sridhar Ratnakumar <github@srid.name> (github: srid)
2014-03-10 17:08:50 -07:00
8bcb156694
Merge pull request #3985 from creack/add_freebsd_support
...
Add freebsd client support
2014-03-11 00:58:30 +02:00
6ccfb7fb9a
Update bsd specs
...
Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume.charmes@docker.com> (github: creack)
2014-03-10 15:19:08 -07:00
fde5f573d3
move opts out of pkg because it's related to docker
...
Docker-DCO-1.1-Signed-off-by: Victor Vieux <victor.vieux@docker.com> (github: vieux)
2014-03-10 21:10:23 +00:00
d648708d02
remove utils.go
...
Docker-DCO-1.1-Signed-off-by: Victor Vieux <victor.vieux@docker.com> (github: vieux)
2014-03-10 21:06:27 +00:00
bb43761940
Merge branch 'master' into add_freebsd_support
...
Conflicts:
archive/archive.go
archive/start_unsupported.go
2014-03-10 13:20:49 -07:00
7da37fec13
handle capital
...
Docker-DCO-1.1-Signed-off-by: Victor Vieux <victor.vieux@docker.com> (github: vieux)
2014-03-07 23:40:45 +00:00
36dd124b16
Add env var to toggle pivot root or ms_move
...
Use the DOCKER_RAMDISK env var to tell the native driver not to use
a pivot root when setting up the rootfs of a container.
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-03-06 19:30:52 -08:00
3729ece2ea
improve alpha sort in mflag
...
Docker-DCO-1.1-Signed-off-by: Victor Vieux <victor.vieux@docker.com> (github: vieux)
2014-03-07 02:20:59 +00:00
c38635020a
Revert "Revert "libcontainer: Use pivot_root instead of chroot""
...
This reverts commit 82f797f140
2014-03-06 17:19:59 -08:00
557e4fef44
Revert "Revert "libcontainer: Use MS_PRIVATE instead of MS_SLAVE""
...
This reverts commit bd263f5b15
2014-03-06 17:19:47 -08:00
78dc1ede52
Merge pull request #4512 from crosbymichael/no-pivot-root
...
No pivot root because of ramdisk
2014-03-07 02:54:03 +02:00
bd263f5b15
Revert "libcontainer: Use MS_PRIVATE instead of MS_SLAVE"
...
This reverts commit 757b577572
2014-03-06 16:41:03 -08:00
82f797f140
Revert "libcontainer: Use pivot_root instead of chroot"
...
This reverts commit 5b5c884cc8
2014-03-06 16:32:06 -08:00
ea9bce8724
Ensure that native containers die with the parent
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-03-06 16:30:56 -08:00
772ef99d28
Remove the ghosts and kill everything
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-03-06 15:30:26 -08:00
b722aa21b7
Merge pull request #4506 from creack/fix_apparmor
...
Use CGO for apparmor profile switch
2014-03-06 13:37:34 -08:00
0b23393ba1
Update build tags such that we can properly compile on all platforms (especially for packagers), and updated hack/PACKAGERS.md to mention the DOCKER_BUILDTAGS variable that will need to be set for binaries that might be used on AppArmor (such as Debian and especially Ubuntu)
...
Docker-DCO-1.1-Signed-off-by: Andrew Page <admwiggin@gmail.com> (github: tianon)
2014-03-06 13:39:17 -07:00
c89fa6645e
Add buildflags to allow crosscompilation for apparmor
...
Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume.charmes@docker.com> (github: creack)
2014-03-06 12:05:03 -08:00
31f62b934b
Merge pull request #4503 from unclejack/attempt_to_fix_apparmor_profile
...
remove dbus from apparmor profile for Ubuntu 12.04
2014-03-06 11:20:06 -08:00
f0f833c6d7
Use CGO for apparmor profile switch
...
Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume.charmes@docker.com> (github: creack)
2014-03-06 11:10:58 -08:00
46fdb6af8e
remove dbus from apparmor profile
...
This removes the dbus entry from the apparmor profile Docker creates.
Docker-DCO-1.1-Signed-off-by: Cristian Staretu <cristian.staretu@gmail.com> (github: unclejack)
2014-03-06 19:47:03 +02:00
5c9b28db18
libcontainer: Don't use UsetCloseOnExec, it is racy
...
We can't keep file descriptors without close-on-exec except with
syscall.ForkLock held, as otherwise they could leak by accident into
other children from forks in other threads.
Instead we just use Cmd.ExtraFiles which handles all this for us.
This fixes https://github.com/dotcloud/docker/issues/4493
Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
2014-03-06 14:10:32 +01:00
920a6ca54c
Generate and load custom docker profile for apparmor
...
Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume.charmes@docker.com> (github: creack)
2014-03-05 15:02:11 -08:00
37f137c822
Some cleanup around logs
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-03-05 13:50:49 -08:00
cb4189a292
Add AppArmor support to native driver + change pipe/dup logic
...
Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume.charmes@docker.com> (github: creack)
2014-03-05 13:08:24 -08:00
069dc7f8c7
fix panic with only long flags or only one deprecatd
...
Docker-DCO-1.1-Signed-off-by: Victor Vieux <victor.vieux@docker.com> (github: vieux)
2014-03-05 19:45:57 +00:00
089bf5e11e
fix usage for completly deprecated flag
...
Docker-DCO-1.1-Signed-off-by: Victor Vieux <victor.vieux@docker.com> (github: vieux)
2014-03-05 19:27:39 +00:00
858d0356fd
Merge pull request #4278 from alexlarsson/system
...
Create pkg/system and move stuff there from archive
2014-03-05 12:32:35 -05:00
d6114c0da0
Create pkg/system and move stuff there from archive
...
This is a package for generic system calls etc that for some reason
is not yet supported by "syscall", or where it is different enough
for the different ports to need portability wrappers.
Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
2014-03-05 14:05:32 +01:00
757b577572
libcontainer: Use MS_PRIVATE instead of MS_SLAVE
...
Now that we unmount all the mounts from the global namespace we can
use a private namespace rather than a slave one (as we have no need
for unmounts of inherited global mounts to propagate into the
container).
Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
2014-03-05 09:40:54 +01:00
b07708c8de
Add shm size cap to mount
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-03-04 14:18:40 -08:00
57a47f5bbf
Remove /dev tmpfs mountpoint
...
Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume.charmes@docker.com> (github: creack)
2014-03-04 13:21:22 -08:00
c74a8b28cd
remove /run mountpoint
...
Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume.charmes@docker.com> (github: creack)
2014-03-04 12:32:17 -08:00
39d58129c3
Remove loopback mount bind
...
Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume.charmes@docker.com> (github: creack)
2014-03-04 12:30:52 -08:00
b63709c1f1
Merge pull request #4452 from crosbymichael/small-fixes-to-libcontainer
...
Add find tests and remove panic in DEBUG
2014-03-04 14:37:41 -05:00
7e52445f2f
Add find tests and remove panic in DEBUG
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-03-04 08:55:12 -08:00
5b5c884cc8
libcontainer: Use pivot_root instead of chroot
...
Instead of keeping all the old mounts in the container namespace and
just using subtree as root we pivot_root so that the actual root in
the namespace is the root we want, and then we unmount the previous
mounts.
This has multiple advantages:
* The namespace mount tree is smaller (in the kernel)
* If you break out of the chroot you could previously access the host
filesystem. Now the host filesystem is fully invisible to the namespace.
* We get rid of all unrelated mounts from the parent namespace, which means
we don't hog these. This is important if we later switch to MS_PRIVATE instead
of MS_SLAVE as otherwise these mounts would be impossible to unmount from the
parent namespace.
Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
2014-03-04 12:44:08 +01:00
b39d02b611
Support hairpin NAT without going through docker server
...
Hairpin NAT is currently done by passing through the docker server. If
two containers on the same box try to access each other through exposed
ports and using the host IP the current iptables rules will not match the
DNAT and thus the traffic goes to 'docker -d'
This change drops the restriction that DNAT traffic must not originate
from docker0. It should be safe to drop this restriction because the
DOCKER chain is already gated by jumps that check for the destination
address to be a local address.
Docker-DCO-1.1-Signed-off-by: Darren Shepherd <darren.s.shepherd@gmail.com> (github: ibuildthecloud)
2014-03-03 21:53:57 -07:00
69c69059fc
Merge pull request #4327 from crosbymichael/add-libcontainer
...
Add native execution driver to docker and make it the default
2014-03-03 16:34:20 -08:00
2e71adac9f
very minor spelling
...
Docker-DCO-1.1-Signed-off-by: Sven Dowideit <SvenDowideit@home.org.au> (github: SvenDowideit)
2014-03-04 10:12:12 +10:00
5465fdf00f
Factor out finalize namespace
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-03-03 12:15:47 -08:00
bb5ed45224
add warning for deprecatd flags
...
Docker-DCO-1.1-Signed-off-by: Victor Vieux <victor.vieux@docker.com> (github: vieux)
2014-03-03 19:57:05 +00:00
2f35f8e2a8
Update readme to remove .nspid
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-03-03 11:31:37 -08:00
cb3d27d01b
prevent flag grouping with --
...
Docker-DCO-1.1-Signed-off-by: Victor Vieux <victor.vieux@docker.com> (github: vieux)
2014-03-03 19:17:28 +00:00
7531f82c70
Merge pull request #4321 from vieux/docker_run_-it
...
Add support for docker run -it or docker images -qa
2014-03-03 20:52:10 +02:00
e8af7fcf6d
runtime: Fix unique constraint error checks
...
The sqlite3 version in fedora (3.8) returns a different error string in the unique constraints
failure case than the one in hack/ (3.7). This updates the check to detect both, fixing
one integration check failure on Fedora.
Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
2014-03-03 15:10:52 +01:00
fdeea90fc8
Allow child process to live if daemon dies
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-02-27 09:33:36 -08:00
fb08b8b221
Code review updates
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-02-26 19:21:46 -08:00
7cd2245947
Ensure that loopback devices are mounted inside the conatiner
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-02-26 17:21:09 -08:00
70820b69ec
Make network a slice to support multiple types
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-02-26 14:20:41 -08:00
ce08083f9c
Merge branch 'master' into add-libcontainer
...
Conflicts:
execdriver/termconsole.go
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-02-26 12:55:24 -08:00
6016126c71
Fix cgroups swap issue when it is not supported
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-02-25 19:45:57 -08:00
93ed15075c
Fix cross compile for make cross
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-02-25 15:19:13 -08:00
8dad771daa
add version pkg
...
Docker-DCO-1.1-Signed-off-by: Victor Vieux <victor.vieux@docker.com> (github: vieux)
2014-02-25 21:08:38 +00:00
96e33a7646
Move container.json and pid file into a root specific driver dir
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-02-25 12:41:31 -08:00
ca42758368
Merge branch 'add-libcontainer' of https://github.com/crosbymichael/docker into add-libcontainer
...
Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume.charmes@docker.com> (github: creack)
2014-02-25 11:42:15 -08:00
de083400b8
Address initial feedback from pr
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-02-25 10:54:41 -08:00
91bf120c51
Better capability/namespace management
...
Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume.charmes@docker.com> (github: creack)
2014-02-24 21:52:29 -08:00
f8453cd049
Refactor and improve libcontainer and driver
...
Remove logging for now because it is complicating things
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-02-24 21:11:52 -08:00
9cb4573d33
Improve logging for nsinit
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-02-24 18:38:36 -08:00
a76407ac61
Cgroups allow devices for privileged containers
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-02-24 15:47:23 -08:00
3839e3a0f6
enable docker run -it
...
Docker-DCO-1.1-Signed-off-by: Victor Vieux <victor.vieux@docker.com> (github: vieux)
2014-02-24 22:53:00 +00:00
1c79b747bb
Honor user passed on container in nsinit
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-02-24 13:52:56 -08:00
01f9815b55
Fix tests with dockerinit lookup path
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-02-24 13:40:17 -08:00
a08e78a78c
Look for cpu subsystem instead of memory
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-02-24 10:46:20 -08:00
fac41af25b
Refactor driver to use Exec function from nsini
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-02-22 01:21:26 -08:00
ae423a036e
Abstract out diff implementations for importing
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-02-22 00:29:21 -08:00
2412656ef5
Add syncpipe for passing context
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-02-21 22:58:30 -08:00
dd59f7fb28
Refactor exec method
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-02-21 22:37:09 -08:00
5a4069f3aa
Refactor network creation and initialization into strategies
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-02-21 22:26:07 -08:00
9876e5b890
Export functions of nsinit
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-02-21 21:14:21 -08:00
2419e63d24
Initial commit of libcontainer running docker
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-02-21 17:23:49 -08:00
332755b99d
Pass tty master to Exec
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-02-21 16:40:32 -08:00
c8fd81c278
Pass pipes into Exec function
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-02-21 16:28:43 -08:00
a352ecb01a
Use lookup path for init
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-02-21 16:17:18 -08:00
ba025cb75c
User os.Args[0] as name to reexec
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-02-21 15:32:50 -08:00
50c752fcb0
Add good logging support to both sides
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-02-21 14:56:17 -08:00
7f247e7006
Move tty into container.json
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-02-21 14:56:17 -08:00
6b2e963ce0
Refactor the flag management for main
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-02-21 14:56:17 -08:00
1316007e54
Make nsinit a proper go pkg and add the main in another dir
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-02-21 14:56:17 -08:00
66baa0653b
Make sure to close the pipe upon ctrl-d
...
Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume.charmes@docker.com> (github: creack)
2014-02-21 14:56:17 -08:00
1a4fb09219
Handle non-tty mode
...
Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume.charmes@docker.com> (github: creack)
2014-02-21 14:56:17 -08:00
83dfdd1d95
Minor cleanup
...
Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume.charmes@docker.com> (github: creack)
2014-02-21 14:56:17 -08:00
8dec4adcb3
Use a custom pipe instead of stdin for sync net namespace
...
Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume.charmes@docker.com> (github: creack)
2014-02-21 14:56:16 -08:00
b519d3ea5a
Use flag for init
...
Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume.charmes@docker.com> (github: creack)
2014-02-21 14:56:16 -08:00
7020e208c7
Move rest of cgroups functions into cgroups pkg
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-02-21 14:56:16 -08:00
3cb698125d
Change IP to address because it includes the subnet
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-02-21 14:56:16 -08:00
c442586305
Refactory cgroups into general pkg
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-02-21 14:56:16 -08:00
f00f374138
Remove clone_vfork
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-02-21 14:56:16 -08:00
5f84738ef1
Revert "WIP for setup kmsg"
...
This reverts commit 80db9a918337c4ae80ffa9a001da13bd24e848c8.
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-02-21 14:56:16 -08:00
664fc54e65
libcontainer: Initial version of cgroups support
...
This is a minimal version of raw cgroup support for libcontainer.
It has only enough for what docker needs, and it has no support
for systemd yet.
Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
2014-02-21 14:56:16 -08:00
f0b4dd6e58
WIP for setup kmsg
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-02-21 14:56:16 -08:00
e133d895a6
Remove privileged.json config
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-02-21 14:56:16 -08:00
70593be139
Add comments to many functions
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-02-21 14:56:16 -08:00
e0ff0f4dd6
Add CAP_NET_ADMIN
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-02-21 14:56:16 -08:00
3a97fe27d8
Update readme and add TODO
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-02-21 14:56:16 -08:00
d84feb8fe5
Refactor to remove cmd from container
...
Pass the container's command via args
Remove execin function and just look for an
existing nspid file to join the namespace
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-02-21 14:56:16 -08:00
420b5eb211
Add execin function to running a process in a namespace
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-02-21 14:56:16 -08:00
5d62916c48
Refactor large funcs
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-02-21 14:56:16 -08:00
f3c48ec584
OSX compilation
...
Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume.charmes@dotcloud.com> (github: creack)
2014-02-21 14:56:16 -08:00
61a119220d
General cleanup of libcontainer
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-02-21 14:56:16 -08:00
5428964400
Add dynamic veth name
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-02-21 14:56:16 -08:00
34671f2010
Implement init veth creation
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-02-21 14:56:15 -08:00
7bc3c01250
Simplify namespaces with only nsinit
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-02-21 14:56:15 -08:00
e25065a6b1
Use nsinit as app
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-02-21 14:56:15 -08:00
18f06b8d16
Fix ptmx issue on libcontainer
...
Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume.charmes@docker.com> (github: creack)
2014-02-21 14:56:15 -08:00
93d41e53ae
Improve general quality of libcontainer
...
Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume.charmes@docker.com> (github: creack)
2014-02-21 14:56:15 -08:00
1142945769
Use nsinit for setting up namespace
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-02-21 14:56:15 -08:00
72e65b654b
WIP moving to nsini
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-02-21 14:56:15 -08:00
68b049aed4
Make separate nsinit pkg for a dockerinit like init
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-02-21 14:56:15 -08:00
e8abaf217b
Initial commit of libcontainer
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-02-21 14:56:15 -08:00
113629efb1
Merge pull request #4011 from crosbymichael/add-netlink-functions
...
Add more netlink functions
2014-02-18 19:37:52 -05:00
4187f4e750
Merge pull request #4168 from crosbymichael/add-listenbuffer
...
Hold connections until the daemon has fully loaded
2014-02-17 16:04:49 -08:00
518670f3d8
Merge pull request #4153 from crosbymichael/move-proxy
...
Move proxy into pkg
2014-02-17 14:51:16 -08:00
055f1a1f81
Remove verbose logging for non errors
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-02-17 13:31:13 -08:00
a75c6907b4
Make crosbymichael and creack netlink maintainers
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-02-17 11:17:05 -08:00
d5e41c1cb6
Change name to listenbuffer
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-02-15 21:10:37 -08:00
cfb7711a74
Add socket activation for go apps
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-02-15 20:18:47 -08:00
8c39db8f96
Move proxy into pkg
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-02-14 15:48:05 -08:00
17719cab91
Add new functions to unsupported file
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-02-14 12:12:35 -08:00
38e5b4e70f
Simplify code + Allow more generic attr children + remove prefix
...
Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume.charmes@docker.com> (github: creack)
2014-02-12 09:29:06 -08:00
dce7b6a69c
Merge remote-tracking branch 'mike/add-netlink-functions' into implement_create_veth
...
Conflicts:
pkg/netlink/netlink_linux.go
Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume.charmes@docker.com> (github: creack)
2014-02-12 04:17:12 -08:00
2d2c237f50
Implement create veth
...
Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume.charmes@docker.com> (github: creack)
2014-02-12 04:09:56 -08:00
e6e320acc7
pkg/opts: a collection of custom value parsers implementing flag.Value
...
This facilitates the refactoring of commands.go.
Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
2014-02-11 19:59:52 -08:00
34f5d94b2c
Merge branch 'add-netlink-functions' of github.com:crosbymichael/docker into add-netlink-functions
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-02-11 03:33:18 -08:00
c626349f65
Add comment clarifying null termination
...
Docker-DCO-1.1-Signed-off-by: Andrew Page <admwiggin@gmail.com> (github: tianon)
2014-02-11 10:32:31 -07:00
27ed9a9f98
Exec out to ip right now for creating the veth pair
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-02-11 03:32:35 -08:00
f9cd1be6ff
Add more netlink functions for set ns by fd and bring iface down
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-02-10 22:32:07 -08:00
4dec36d1ee
Allow add of empty name
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-02-10 16:41:16 -08:00
2dcb48af0f
Merge pull request #3524 from tianon/supplementary-groups
...
Add supplementary groups lookup in sysinit
2014-02-10 14:42:14 -08:00
38eabfa65c
Create veth pair via netlink
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-02-10 13:37:16 -08:00
27df18ff11
Improve get if socket loop
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-02-10 11:36:23 -08:00
3a7c144e99
Update NetworkChangeName to be more similar to my original (moving IFNAMSIZ constant outside the function like it should've been)
...
Docker-DCO-1.1-Signed-off-by: Andrew Page <admwiggin@gmail.com> (github: tianon)
2014-02-09 18:14:17 -07:00
524416560a
Replace my C code with tianons Go code
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-02-09 05:54:13 -08:00
ee39033073
Use c to change interface name
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-02-08 20:44:04 -08:00
e3762e8d69
Add network set interface in namespace by pid
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-02-08 10:03:16 -08:00
a6c791e8a9
Add set master for interface
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-02-08 09:53:04 -08:00
547ac42199
Add Freebsd client support
...
Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume.charmes@docker.com> (github: creack)
2014-02-06 16:40:39 -08:00
15711ed670
pkg: systemd: add initial MAINTAINERS
...
I volunteered for pkg/systemd MAINTAINER and there were no objections
during the #docker-dev meeting. For context I wrote most of the stuff in
here and wrote the dependent calls in api.go. Plus, I actively test the
code via CoreOS.
Docker-DCO-1.1-Signed-off-by: Brandon Philips <brandon.philips@coreos.com> (github: philips)
2014-02-06 12:04:35 -08:00
ea63ade772
iptables: use dest_addr and dest_port for public port FORWARD rule
...
Docker-DCO-1.1-Signed-off-by: Josh Poimboeuf <jpoimboe@redhat.com> (github: jpoimboe)
2014-02-04 11:32:50 -06:00
4ffc52385c
Use type switch instead of reflection
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-01-31 20:15:24 -07:00
ee93f6185b
Move UserLookup functionality into a separate pkg/user submodule that implements proper parsing of /etc/passwd and /etc/group, and use that to add support for "docker run -u user:group" and for getting supplementary groups (if ":group" is not specified)
...
Docker-DCO-1.1-Signed-off-by: Andrew Page <admwiggin@gmail.com> (github: tianon)
2014-01-31 20:15:24 -07:00
78189c9bcf
Merge pull request #3876 from dotcloud/fix_panic_mflag
...
fix panic in mflag
2014-01-31 14:43:16 -08:00
53ee1daa69
Merge pull request #3841 from alexlarsson/separate-base-fs
...
Separate out graphdriver mount and container root
2014-01-31 11:49:14 -08:00
65794a2c49
fix panic in mflag
...
Docker-DCO-1.1-Signed-off-by: Victor Vieux <victor.vieux@docker.com> (github: vieux)
2014-01-31 11:39:29 -08:00
065dd231dd
Update/fix build tags, Dockerfile, and release.sh for proper building and releasing of linux/386 and linux/arm cross-compiled client binaries
...
Docker-DCO-1.1-Signed-off-by: Andrew Page <admwiggin@gmail.com> (github: tianon)
2014-01-31 03:16:42 -07:00
45dd051e8e
Remove all darwin specific files and use more generic _unsupported with build tags.
...
Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume.charmes@docker.com> (github: creack)
2014-01-30 23:10:56 +00:00
fc1169a220
pkg/mount: Add "private" flag
...
This allows "mount --make-private" functionallity.
Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
2014-01-30 16:41:45 +01:00
6013cbdce8
Merge pull request #3810 from jpoimboe/iptables-forward-public-ports
...
network: add publicly mapped ports to FORWARD table
2014-01-29 11:53:26 -08:00
c00cb1aca1
Merge pull request #3808 from alexlarsson/execdriver-get-pids-for-container
...
execdriver: Make GetPidsForContainer() a driver call
2014-01-29 10:38:10 -08:00
2723133a69
Merge pull request #3105 from philips/add-socket-activation
...
Add socket activation
2014-01-28 11:38:25 -08:00
ef6c0d5341
remove ip_forward warning
...
Now that docker sets /proc/sys/net/ipv4/ip_forward by default (unless
the user manually specifies "-ip-forward=false"), there's no need to
warn if its disabled.
Docker-DCO-1.1-Signed-off-by: Josh Poimboeuf <jpoimboe@redhat.com> (github: jpoimboe)
2014-01-28 13:27:56 -06:00
db250f709a
network: add publicly mapped ports to FORWARD table
...
Allow publicly mapped ports to be made public beyond the host. This is
needed for distros like Fedora and RHEL which have a reject all rule at
the end of their FORWARD table.
Docker-DCO-1.1-Signed-off-by: Josh Poimboeuf <jpoimboe@redhat.com> (github: jpoimboe)
2014-01-28 13:11:49 -06:00
335bc39c9a
execdriver: Make GetPidsForContainer() a driver call
...
The current implementation is lxc specific.
Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
2014-01-28 16:21:49 +01:00
7839350dd5
chore(coreos/go-systemd): copy to github.com/dotcloud/docker/systemd/pkg/activation
...
Via https://github.com/dotcloud/docker/pull/3105#issuecomment-32807547
Docker-DCO-1.1-Signed-off-by: Brandon Philips <brandon.philips@coreos.com> (github: philips)
2014-01-27 17:18:09 -08:00
def0952606
chore(systemd): use activation.Listeners instead of Files
...
Use this Listeners() API that was exposed to save a few more lines of
boiler plate code.
Docker-DCO-1.1-Signed-off-by: Brandon Philips <brandon.philips@coreos.com> (github: philips)
2014-01-27 17:18:09 -08:00
7f9d3268bf
Allow fd:// like unix:// and tcp://
...
Somthing like 20605eb310
2014-01-27 17:18:09 -08:00
566fb31c88
Move listenfd to utility package
...
Docker-DCO-1.1-Signed-off-by: Brandon Philips <brandon.philips@coreos.com> (github: philips)
2014-01-27 17:18:09 -08:00
c4e7b0e4d5
fix mflag import
...
Docker-DCO-1.1-Signed-off-by: Victor Vieux <victor.vieux@docker.com> (github: vieux)
2014-01-27 23:29:56 +00:00
da30eb7c20
Remove std sort and use custom sort for performances
...
Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume.charmes@docker.com> (github: creack)
2014-01-26 14:01:38 -08:00
303ed3c830
Add port allocator and move ipset into orderedintset
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-01-26 14:01:38 -08:00
f60eee4894
Fix mflag test issue with "ResetForTesting" (which only showed up under dyntest for some odd reason)
...
Docker-DCO-1.1-Signed-off-by: Andrew Page <admwiggin@gmail.com> (github: tianon)
2014-01-23 13:03:17 -07:00
be6aeda1e4
Merge pull request #3640 from proppy/networkgetroutes-add-default
...
netlink: add default Route to NetworkGetRoutes
2014-01-21 15:20:16 -08:00
71c1646ba3
Don't expose cgroups via the execdriver API.
...
Use Resources to represent container limits rather than a cgroup specific field.
Docker-DCO-1.1-Signed-off-by: Paul Nasrat <pnasrat@gmail.com> (github: pnasrat)
2014-01-20 17:06:24 -05:00
2553029959
Extract cgroups pkg.
...
Initial move before enhancing cgroups package.
Docker-DCO-1.1-Signed-off-by: Paul Nasrat <pnasrat@gmail.com> (github: pnasrat)
2014-01-20 14:15:44 -05:00
0f0e582490
Merge pull request #3680 from pnasrat/extract-mount-pkg
...
Extract mount into pkg.
2014-01-20 11:04:16 -08:00
2e094db639
Extract mount into pkg.
...
Mount is self contained and generic, it should be in pkg, to allow other pkg modules to use it.
Docker-DCO-1.1-Signed-off-by: Paul Nasrat <pnasrat@gmail.com> (github: pnasrat)
2014-01-20 13:59:29 -05:00
ff662446f7
Add MAINTAINER and remove docker/utils dep from pkg/sysinfo
...
Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume.charmes@docker.com> (github: creack)
2014-01-20 10:20:29 -08:00
9e9f4b925b
Rename Capabilities in sysinfo and move it to its own subpackage
...
Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume.charmes@docker.com> (github: creack)
Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume.charmes@docker.com> (github: crosbymichael)
2014-01-17 17:42:58 -08:00
e71dbf4ee5
update commands.go
...
update docker.go
move to pkg
update docs
update name and copyright
change --sinceId to --since-id, update completion and docs
Docker-DCO-1.1-Signed-off-by: Victor Vieux <victor@docker.com> (github: vieux)
2014-01-17 17:33:15 -08:00
77d9fd2628
netlink: make darwin happy
...
Docker-DCO-1.1-Signed-off-by: Johan Euphrosine <proppy@google.com> (github: proppy)
2014-01-17 16:55:42 -08:00
dadd54dba3
netlink: move Route type to common arch file
...
Docker-DCO-1.1-Signed-off-by: Johan Euphrosine <proppy@google.com> (github: proppy)
2014-01-17 14:04:11 -08:00
26726dc9ff
netlink: add default Route to NetworkGetRoutes
...
Docker-DCO-1.1-Signed-off-by: Johan Euphrosine <proppy@google.com> (github: proppy)
2014-01-17 11:09:50 -08:00
7a7c3d87d8
Fix misspelled Hawkings -> Hawking, Archimede -> Archimedes, Euclide -> Euclid
...
Docker-DCO-1.0-Signed-off-by: Cory Forsyth <cory.forsyth@gmail.com> (github: bantic)
2014-01-09 10:02:55 -05:00
98193a397e
Fix misspelling of Richard Feynman's last name
...
Docker-DCO-1.0-Signed-off-by: Cory Forsyth <cory.forsyth@gmail.com> (github: bantic)
2014-01-08 19:02:15 -05:00
e525ad3f9b
Fix a few miscellaneous typos (Unkown -> Unknown, Recieve -> Receive)
...
Docker-DCO-1.0-Signed-off-by: Andrew Page <admwiggin@gmail.com> (github: tianon)
2014-01-07 22:15:53 -07:00
7799ae27ca
Move utility package 'iptables' to pkg/iptables
2014-01-06 15:41:24 -08:00
2b4bb67ce0
Merge pull request #3327 from shykes/pkg-graphdb
...
Move utility package 'graphdb' to pkg/graphdb
2013-12-23 16:33:11 -08:00
6155f07561
Merge pull request #3331 from shykes/pkg-names
...
Move utility package 'namesgenerator' to pkg/namesgenerator
2013-12-23 16:15:26 -08:00
e6e35e5984
Merge pull request #3330 from shykes/pkg-term
...
Move utility package 'term' to pkg/term
2013-12-23 16:11:42 -08:00
a009d4ae8d
Move utility package 'namesgenerator' to pkg/namesgenerator
2013-12-23 23:45:18 +00:00
7ce7516c12
Move utility package 'term' to pkg/term
2013-12-23 23:42:37 +00:00
f6b91262a7
Move utility package 'netlink' to pkg/netlink
2013-12-23 23:39:39 +00:00
d16d748132
Move utility package 'graphdb' to pkg/graphdb
2013-12-23 23:33:06 +00:00
652c2c2a80
Add README to pkg
2013-12-23 23:12:19 +00:00
8e7db0432e
Move utility package 'systemd' to pkg/systemd
2013-12-23 23:07:01 +00:00
Alexander Larsson
Michael Crosby
Victor Vieux
Guillaume J. Charmes
Kato Kazuyoshi
Guillaume J. Charmes
Dan Stine
Michael Brown
unclejack
Goffert van Gool
Dan Walsh
Kevin Wallace
Michael Crosby
Johannes 'fish' Ziemke
Solomon Hykes
Johan Euphrosine
Isabel Jimenez
Timothy Hobbs
Brandon Philips
srid
Tianon Gravi
Guillaume J. Charmes
unclejack
Darren Shepherd
Sven Dowideit
Guillaume J. Charmes
Josh Poimboeuf
Victor Vieux
Paul Nasrat
Victor Vieux
Cory Forsyth