Граф коммитов

54 Коммитов

Автор SHA1 Сообщение Дата
Sebastiaan van Stijn f11ac963af Merge pull request #27915 from rhvgoyal/graph-create-opts
Pass all graphdriver create() parameters in a struct
2016-11-10 01:07:41 +01:00
Tibor Vass 5e3d777401 Merge pull request #28002 from Microsoft/jjh/noreexec
Windows: Allow a no-reexec option for importLayer
2016-11-09 14:46:21 -08:00
Vivek Goyal b937aa8e69 Pass all graphdriver create() parameters in a struct
This allows for easy extension of adding more parameters to existing
parameters list. Otherwise adding a single parameter changes code
at so many places.

Signed-off-by: Vivek Goyal <vgoyal@redhat.com>
2016-11-09 15:59:58 -05:00
John Howard d9294719b5 Windows: Allow a no-reexec option for importLayer
Signed-off-by: John Howard <jhoward@microsoft.com>
2016-11-08 17:57:43 -08:00
Darren Stahl c58e8dea6c Terminate template VMs on layer delete
Signed-off-by: Darren Stahl <darst@microsoft.com>
2016-11-08 15:39:25 -08:00
Darren Stahl be68006d19 Windows: Rename layers before deletion
Signed-off-by: Darren Stahl <darst@microsoft.com>
2016-11-01 18:05:09 -07:00
John Howard 4fac603682 Windows: support docker diff
Signed-off-by: John Howard <jhoward@microsoft.com>
2016-10-28 11:06:54 -07:00
Stephen J Day aa2cc18745
pkg/archive: remove unnecessary Archive and Reader type
The `archive` package defines aliases for `io.ReadCloser` and
`io.Reader`. These don't seem to provide an benefit other than type
decoration. Per this change, several unnecessary type cases were
removed.

Signed-off-by: Stephen J Day <stephen.day@docker.com>
2016-10-20 19:31:24 -07:00
Darren Stahl 0da31c68f1 Stop expanding sandbox size when no new size is specified
Signed-off-by: Darren Stahl <darst@microsoft.com>
2016-10-12 16:58:57 -07:00
John Starks 9c79b0efc0 Windows: Back up files mutated during layer import
The Windows BCD store for the utility VM is mutated during layer import,
which causes failures in docker save. Back up the BCD store and related
log files so that save has access to their original contents.

Fixes #25893.

Signed-off-by: John Starks <jostarks@microsoft.com>
2016-09-22 17:44:38 -07:00
John Howard f61315f0df Windows: Remove TP5 hack from graphdriver
Signed-off-by: John Howard <jhoward@microsoft.com>
2016-09-17 16:16:50 -07:00
Michael Crosby 34cc19f670 Merge pull request #25509 from Microsoft/jjh/23079
Windows: Block ReFS file systems
2016-08-12 09:32:22 -07:00
Sebastiaan van Stijn 04e021d751 Merge pull request #23391 from Microsoft/WindowsSandboxSize
Windows: Added support for storage-opt size
2016-08-09 15:34:39 +02:00
John Howard 1cb9e9b44e Windows: Block ReFS file systems
Signed-off-by: John Howard <jhoward@microsoft.com>
2016-08-08 14:30:37 -07:00
allencloud 4e959ef2f7 fix typos
Signed-off-by: allencloud <allen.sun@daocloud.io>
2016-07-23 11:32:23 +08:00
Stefan J. Wernli 3e109f349f Removing Custom Images support
Now that Windows base images can be loaded directly into docker via "docker load" of a specialized tar file (with docker pull support on the horizon) we no longer have need of the custom images code path that loads images from a shared central location.  Removing that code and it's call points.

Signed-off-by: Stefan J. Wernli <swernli@microsoft.com>
2016-07-07 14:56:37 -07:00
Darren Stahl 7e5ee6d176 Windows: Added support for storage-opt size
Signed-off-by: Darren Stahl <darst@microsoft.com>
2016-06-21 10:53:29 -07:00
Antonio Murdaca 44ccbb317c *: fix logrus.Warn[f]
Signed-off-by: Antonio Murdaca <runcom@redhat.com>
2016-06-11 19:42:38 +02:00
John Starks f182748b9b Windows: fix Windows graph driver name
Reverting "Windows filter storage driver" to "windowsfilter".

Signed-off-by: John Starks <jostarks@microsoft.com>
2016-05-27 16:24:02 -07:00
Nirmal Mehta 59bb86a964 Merge branch 'master' into b 2016-05-24 21:43:45 -04:00
Nirmal Mehta 36a9151b27 fixed spelling error in windows.go
Signed-off-by: Nirmal Mehta <nirmalkmehta@gmail.com>
2016-05-24 21:40:08 -04:00
Michael Crosby 8bb4d31b10 Remove mountedLayer Mount and Unmount
Signed-off-by: Michael Crosby <crosbymichael@gmail.com>
2016-05-23 16:52:58 -07:00
Michael Crosby 4bac8bce98 Add windows graph driver ref counter
Signed-off-by: Michael Crosby <crosbymichael@gmail.com>
2016-05-23 16:03:40 -07:00
John Howard dd0fc2be8b Windows: Remove windowsdiff driver
Signed-off-by: John Howard <jhoward@microsoft.com>
2016-05-20 16:18:19 -07:00
John Starks b3bc5e0fe4 Windows: reexec when importing layers
This improves reliability by doing parsing of potentially untrusted data
in a separate process. It opens the door for further security improvements
if we can lock down the reexec-ed process. It also improves import
performance by only taking the backup and restore privileges once, for the
whole process.

Signed-off-by: John Starks <jostarks@microsoft.com>
2016-05-13 18:16:11 -07:00
John Starks 6f8878872f Windows: Fix Hyper-V container ACLs for TP5 (#21974)
In TP5, Hyper-V containers need all image files ACLed so that the virtual
machine process can access them. This was fixed post-TP5 in Windows, but
for TP5 we need to explicitly add these ACLs.

Signed-off-by: John Starks <jostarks@microsoft.com>
2016-04-13 10:15:38 -07:00
John Howard fec6cd2eb9 Merge pull request #20525 from Microsoft/sjw/update-graphdriver-create
Adding readOnly parameter to graphdriver Create method
2016-04-08 20:44:03 -07:00
John Howard d5ef62f489 Merge pull request #21872 from Microsoft/sjw/nanoserver-fix
Fixing nanoserver image load bug.
2016-04-07 21:24:32 -07:00
John Starks cf7944bf6f Windows: Support ApplyDiff on a base layer
This adds support to the Windows graph driver for ApplyDiff on a base
layer. It also adds support for hard links, which are needed because the
Windows base layers double in size without hard link support.

Signed-off-by: John Starks <jostarks@microsoft.com>
2016-04-07 17:52:28 -07:00
Stefan J. Wernli a22092b136 Fixing nanoserver image load bug.
Fixes an issue that prevents nano server images from loading properly. Also updates logic for custom image loading to avoid preventing daemon start because an image failed to load.

Signed-off-by: Stefan J. Wernli <swernli@microsoft.com>
2016-04-07 16:44:51 -07:00
Stefan J. Wernli ef5bfad321 Adding readOnly parameter to graphdriver Create method
Since the layer store was introduced, the level above the graphdriver
now differentiates between read/write and read-only layers.  This
distinction is useful for graphdrivers that need to take special steps
when creating a layer based on whether it is read-only or not.
Adding this parameter allows the graphdrivers to differentiate, which
in the case of the Windows graphdriver, removes our dependence on parsing
the id of the parent for "-init" in order to infer this information.

This will also set the stage for unblocking some of the layer store
unit tests in the next preview build of Windows.

Signed-off-by: Stefan J. Wernli <swernli@microsoft.com>
2016-04-06 13:52:53 -07:00
John Howard 331c8a86d4 Windows: Remove TP4 support from main code
Signed-off-by: John Howard <jhoward@microsoft.com>
2016-04-06 12:12:20 -07:00
John Howard fc9912fd00 Merge pull request #21272 from Microsoft/jstarks/manifest_updates
Add os_version and os_features to Image
2016-04-05 16:16:25 -07:00
John Starks 194eaa5c0f Add os_version and os_features to Image
These fields are needed to specify the exact version of Windows that an
image can run on. They may be useful for other platforms in the future.

This also changes image.store.Create to validate that the loaded image is
supported on the current machine. This change affects Linux as well, since
it now validates the architecture and OS fields.

Signed-off-by: John Starks <jostarks@microsoft.com>
2016-04-04 13:14:57 -07:00
Shishir Mahajan b16decfccf CLI flag for docker create(run) to change block device size.
Signed-off-by: Shishir Mahajan <shishir.mahajan@redhat.com>
2016-03-28 10:05:18 -04:00
Brian Goff 65d79e3e5e Move layer mount refcounts to mountedLayer
Instead of implementing refcounts at each graphdriver, implement this in
the layer package which is what the engine actually interacts with now.
This means interacting directly with the graphdriver is no longer
explicitly safe with regard to Get/Put calls being refcounted.

In addition, with the containerd, layers may still be mounted after
a daemon restart since we will no longer explicitly kill containers when
we shutdown or startup engine.
Because of this ref counts would need to be repopulated.

Signed-off-by: Brian Goff <cpuguy83@gmail.com>
2016-03-23 14:42:52 -07:00
Tonis Tiigi e91de9fb9d Revert "Move layer mount refcounts to mountedLayer"
This reverts commit 563d0711f8.

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
2016-03-23 00:33:02 -07:00
Brian Goff 563d0711f8 Move layer mount refcounts to mountedLayer
Instead of implementing refcounts at each graphdriver, implement this in
the layer package which is what the engine actually interacts with now.
This means interacting directly with the graphdriver is no longer
explicitly safe with regard to Get/Put calls being refcounted.

In addition, with the containerd, layers may still be mounted after
a daemon restart since we will no longer explicitly kill containers when
we shutdown or startup engine.
Because of this ref counts would need to be repopulated.

Signed-off-by: Brian Goff <cpuguy83@gmail.com>
2016-03-22 11:36:28 -04:00
John Starks 5649030e25 Write Windows layer diffs to tar in standard format
Previously, Windows layer diffs were written using a Windows-internal
format based on the BackupRead/BackupWrite Win32 APIs. This caused
problems with tar-split and tarsum and led to performance problems
in implementing methods such as DiffPath. It also was just an
unnecessary differentiation point between Windows and Linux.

With this change, Windows layer diffs look much more like their
Linux counterparts. They use AUFS-style whiteout files for files
that have been removed, and they encode all metadata directly in
the tar file.

This change only affects Windows post-TP4, since changes to the Windows
container storage APIs were necessary to make this possible.

Signed-off-by: John Starks <jostarks@microsoft.com>
2016-03-02 16:13:40 -08:00
John Starks 58bec40d16 graphdriver: Replace DiffPath with DiffGetter
This allows a graph driver to provide a custom FileGetter for tar-split
to use. Windows will use this to provide a more efficient implementation
in a follow-up change.

Signed-off-by: John Starks <jostarks@microsoft.com>
2016-03-01 10:25:33 -08:00
Stefan J. Wernli 041a9510c6 Fixing 'docker save' on Windows.
Save was failing file integrity checksums due to bugs in both
Windows and Docker. This commit includes fixes to file time handling
in tarexport and system.chtimes that are necessary along with
the Windows platform fixes to correctly support save. With this
change, sysfile_backups for windowsfilter driver are no longer
needed, so that code is removed.

Signed-off-by: Stefan J. Wernli <swernli@microsoft.com>
2016-02-08 18:08:49 -08:00
Tonis Tiigi b9a395c85d Remove case sensitive duplicate dir in vendor
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
2016-02-03 13:06:32 -08:00
Tonis Tiigi 4352da7803 Update daemon and docker core to use new content addressable storage
Add distribution package for managing pulls and pushes. This is based on
the old code in the graph package, with major changes to work with the
new image/layer model.

Add v1 migration code.

Update registry, api/*, and daemon packages to use the reference
package's types where applicable.

Update daemon package to use image/layer/tag stores instead of the graph
package

Signed-off-by: Aaron Lehmann <aaron.lehmann@docker.com>
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
2015-11-24 09:40:25 -08:00
Dan Walsh 1716d497a4 Relabel BTRFS Content on container Creation
This change will allow us to run SELinux in a container with
BTRFS back end.  We continue to work on fixing the kernel/BTRFS
but this change will allow SELinux Security separation on BTRFS.

It basically relabels the content on container creation.

Just relabling -init directory in BTRFS use case. Everything looks like it
works. I don't believe tar/achive stores the SELinux labels, so we are good
as far as docker commit.

Tested Speed on startup with BTRFS on top of loopback directory. BTRFS
not on loopback should get even better perfomance on startup time.  The
more inodes inside of the container image will increase the relabel time.

This patch will give people who care more about security the option of
runnin BTRFS with SELinux.  Those who don't want to take the slow down
can disable SELinux either in individual containers or for all containers
by continuing to disable SELinux in the daemon.

Without relabel:

> time docker run --security-opt label:disable fedora echo test
test

real    0m0.918s
user    0m0.009s
sys    0m0.026s

With Relabel

test

real    0m1.942s
user    0m0.007s
sys    0m0.030s

Signed-off-by: Dan Walsh <dwalsh@redhat.com>

Signed-off-by: Dan Walsh <dwalsh@redhat.com>
2015-11-11 14:49:27 -05:00
Vincent Demeester 8054a30387 dockerversion placeholder for library import
- Add a *version* file placeholder.
- Update autogen and builds to use it and an autogen build flag

Signed-off-by: Vincent Demeester <vincent@sbr.pm>
2015-11-09 19:32:46 +01:00
Brian Goff b78ca243d9 Revert "dockerversion placeholder for library-import"
This reverts commit d5cd032a86.

Commit caused issues on systems with case-insensitive filesystems.
Revert for now

Signed-off-by: Brian Goff <cpuguy83@gmail.com>
2015-10-27 21:23:53 -04:00
Vincent Demeester d5cd032a86 dockerversion placeholder for library-import
- Move autogen/dockerversion to version
- Update autogen and "builds" to use this package and a build flag

Signed-off-by: Vincent Demeester <vincent@sbr.pm>
2015-10-27 20:36:07 +01:00
Tonis Tiigi 504e67b867 Calculate hash based image IDs on pull
Generate a hash chain involving the image configuration, layer digests,
and parent image hashes. Use the digests to compute IDs for each image
in a manifest, instead of using the remotely specified IDs.

To avoid breaking users' caches, check for images already in the graph
under old IDs, and avoid repulling an image if the version on disk under
the legacy ID ends up with the same digest that was computed from the
manifest for that image.

When a calculated ID already exists in the graph but can't be verified,
continue trying SHA256(digest) until a suitable ID is found.

"save" and "load" are not changed to use a similar scheme. "load" will
preserve the IDs present in the tar file.

Signed-off-by: Aaron Lehmann <aaron.lehmann@docker.com>
2015-10-12 10:51:28 -07:00
Phil Estes 442b45628e Add user namespace (mapping) support to the Docker engine
Adds support for the daemon to handle user namespace maps as a
per-daemon setting.

Support for handling uid/gid mapping is added to the builder,
archive/unarchive packages and functions, all graphdrivers (except
Windows), and the test suite is updated to handle user namespace daemon
rootgraph changes.

Docker-DCO-1.1-Signed-off-by: Phil Estes <estesp@linux.vnet.ibm.com> (github: estesp)
2015-10-09 17:47:37 -04:00
David Calavera 1fffc7a89d Fix golint issues on the windows graph driver.
Signed-off-by: David Calavera <david.calavera@gmail.com>
2015-09-29 18:32:45 -04:00