summaryrefslogtreecommitdiff
path: root/cmd/dockerd/config_unix.go
Commit message (Collapse)AuthorAgeFilesLines
* daemon: remove handling for deprecated "oom-score-adjust", and produce errorSebastiaan van Stijn2023-05-061-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | This option was deprecated in 5a922dc162bbe0a03450165da4e6aceca55073d4, which is part of the v24.0.0 release, so we can remove it from master. This patch; - adds a check to ValidatePlatformConfig, and produces a fatal error if oom-score-adjust is set - removes the deprecated libcontainerd/supervisor.WithOOMScore - removes the warning from docker info With this patch: dockerd --oom-score-adjust=-500 --validate Flag --oom-score-adjust has been deprecated, and will be removed in the next release. unable to configure the Docker daemon with file /etc/docker/daemon.json: merged configuration validation from file and command line flags failed: DEPRECATED: The "oom-score-adjust" config parameter and the dockerd "--oom-score-adjust" options have been removed. And when using `daemon.json`: dockerd --validate unable to configure the Docker daemon with file /etc/docker/daemon.json: merged configuration validation from file and command line flags failed: DEPRECATED: The "oom-score-adjust" config parameter and the dockerd "--oom-score-adjust" options have been removed. Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* Merge pull request #45315 from thaJeztah/deprecate_oom_score_adjustSebastiaan van Stijn2023-04-141-1/+2
|\ | | | | daemon: deprecate --oom-score-adjust for the daemon
| * daemon: deprecate --oom-score-adjust for the daemonSebastiaan van Stijn2023-04-131-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The `oom-score-adjust` option was added in a894aec8d81de5484152a76d76b80809df9edd71, to prevent the daemon from being OOM-killed before other processes. This option was mostly added as a "convenience", as running the daemon as a systemd unit was not yet common. Having the daemon set its own limits is not best-practice, and something better handled by the process-manager starting the daemon. Commit cf7a5be0f2ee8bb4a3f7961682e13b89bc625299 fixed this option to allow disabling it, and 2b8e68ef06ca3daf2b0e17e51ba72999773b6270 removed the default score adjust. This patch deprecates the option altogether, recommending users to set these limits through the process manager used, such as the "OOMScoreAdjust" option in systemd units. With this patch: dockerd --oom-score-adjust=-500 --validate Flag --oom-score-adjust has been deprecated, and will be removed in the next release. configuration OK echo '{"oom-score-adjust":-500}' > /etc/docker/daemon.json dockerd INFO[2023-04-12T21:34:51.133389627Z] Starting up INFO[2023-04-12T21:34:51.135607544Z] containerd not running, starting managed containerd WARN[2023-04-12T21:34:51.135629086Z] DEPRECATED: The "oom-score-adjust" config parameter and the dockerd "--oom-score-adjust" option will be removed in the next release. docker info Client: Context: default Debug Mode: false ... DEPRECATED: The "oom-score-adjust" config parameter and the dockerd "--oom-score-adjust" option will be removed in the next release Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* | daemon: touch-up flag description for --seccomp-profileSebastiaan van Stijn2023-04-131-1/+1
|/ | | | Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* rootless: move ./rootless to ./pkg/rootlessJan Garcia2023-01-091-1/+1
| | | | Signed-off-by: Jan Garcia <github-public@n-garcia.com>
* daemon/config: New(): initialize config with platform-specific defaultsSebastiaan van Stijn2022-08-171-63/+6
| | | | | | | | This centralizes more defaults, to be part of the config struct that's created, instead of interweaving the defaults with other code in various places. Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* daemon/config: New(): set more defaultsSebastiaan van Stijn2022-06-291-1/+0
| | | | | | | Set the defaults when constructing the config, instead of setting them indirectly through the command-line flags. Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* cmd/dockerd: use flags.IPVar() instead of custom typeSebastiaan van Stijn2022-04-271-3/+4
| | | | | | | spf13/pflag now provides this out of the box, so no need to implement and use our own value-type for this. Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* cmd/dockerd: remove config_common_unix.goSebastiaan van Stijn2022-04-271-0/+33
| | | | | | | This file was originally part of the work to support Solaris, and there's nothing "not common unix" anymmore, so merging the files. Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* cmd/dockerd: combine installUnixConfigFlags with installConfigFlagsSebastiaan van Stijn2022-04-271-3/+11
| | | | | | | installConfigFlags already has separate implementations for Linux and Windows, so no need to further differentiate. Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* cmd/dockerd: move storage-driver flag to unix-only fileSebastiaan van Stijn2022-04-271-0/+1
| | | | | | | The installCommonConfigFlags() function is meant for flags that are supported by all platforms, so removing it from that function. Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* cmd/dockerd: don't call registry.SetCertsDir() twiceSebastiaan van Stijn2022-04-251-5/+0
| | | | | | | | | This was introduced in 85572cac14168f9dc3fc3d9daa5eae1ba00eddf4, where I probably forgot to remove this code from an earlier iteration (I decided that having an explicit `configureCertsDir()` function call for this would make it more transparent that we're re-configuring a default). Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* cmd/dockerd: update --ip6tables description to include "experimental"Sebastiaan van Stijn2022-04-041-1/+1
| | | | | | | This feature requires experimental mode to be enabled, so mentioning that in the flag description. Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* registry: remove dependency on rootlesskit, add `SetCertsDir()`Sebastiaan van Stijn2022-03-251-0/+19
| | | | | | | | | | | | | | | | | | The registry package contained code to automatically set the CertsDir() path, based on wether or not the daemon was running in rootlessmode. In doing so, it made use of the `pkg/rootless.RunningWithRootlessKit()` utility. A recent change in de6732a403af49a18c754bb9de0abf18ad48e3c8 added additional functionality in the `pkg/rootless` package, introducing a dependency on `github.com/rootless-containers/rootlesskit`. Unfortunately, the extra dependency also made its way into the docker cli, which also uses the registry package. This patch introduces a new `SetCertsDir()` function, which allows the default certs-directory to be overridden, and updates the daemon to configure this location during startup. Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* daemon: move check for CPU-realtime daemon optionsSebastiaan van Stijn2022-03-031-2/+2
| | | | | | | Perform the validation when the daemon starts instead of performing these validations for each individual container, so that we can fail early. Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* Merge pull request #40084 from thaJeztah/hostconfig_const_cleanupAkihiro Suda2021-08-281-5/+5
|\ | | | | api/types: hostconfig: add some constants/enums and minor code cleanup
| * api/types: hostconfig: create enum for CgroupnsModeSebastiaan van Stijn2021-08-061-4/+4
| | | | | | | | Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
| * api/types: hostconfig: define consts for IpcModeSebastiaan van Stijn2021-08-061-1/+1
| | | | | | | | Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* | Update to Go 1.17.0, and gofmt with Go 1.17Sebastiaan van Stijn2021-08-241-0/+1
| | | | | | | | Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* | Fix daemon.json and daemon --seccomp-profile not accepting "unconfined"Sebastiaan van Stijn2021-08-071-1/+1
|/ | | | | | | | | | | | | | | | | | | | | | Commit b237189e6c8a4f97be59f08c63cdcb1f2f4680a8 implemented an option to set the default seccomp profile in the daemon configuration. When that PR was reviewed, it was discussed to have the option accept the path to a custom profile JSON file; https://github.com/moby/moby/pull/26276#issuecomment-253546966 However, in the implementation, the special "unconfined" value was not taken into account. The "unconfined" value is meant to disable seccomp (more factually: run with an empty profile). While it's likely possible to achieve this by creating a file with an an empty (`{}`) profile, and passing the path to that file, it's inconsistent with the `--security-opt seccomp=unconfined` option on `docker run` and `docker create`, which is both confusing, and makes it harder to use (especially on Docker Desktop, where there's no direct access to the VM's filesystem). This patch adds the missing check for the special "unconfined" value. Co-authored-by: Tianon Gravi <admwiggin@gmail.com> Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* Merge pull request #41622 from bboehmke/ipv6_natSebastiaan van Stijn2020-12-071-0/+1
|\ | | | | IPv6 iptables config option
| * Added ip6tables config optionBenjamin Böhmke2020-11-051-0/+1
| | | | | | | | Signed-off-by: Benjamin Böhmke <benjamin@boehmke.net>
* | use containerd/cgroups to detect cgroups v2Sebastiaan van Stijn2020-11-091-2/+2
|/ | | | | | | | | | libcontainer does not guarantee a stable API, and is not intended for external consumers. this patch replaces some uses of libcontainer/cgroups with containerd/cgroups. Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* dockerd: remove default -500 oom-score-adjustSebastiaan van Stijn2020-10-161-1/+1
| | | | | | | | | | | | dockerd currently sets the oom-score-adjust itself. This functionality was added when we did not yet run dockerd as a systemd service. Now that we do, it's better to instead have systemd handle this. Keeping the option itself for situations where dockerd is started manually or without using systemd. Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* cmd/dockerd: remove outdated "experimental" annotationAkihiro Suda2020-04-291-1/+1
| | | | | | Follow up to #40759 Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
* cgroup2: enable cgroup namespace by defaultAkihiro Suda2020-01-011-1/+6
| | | | | | | | | | | | | | | For cgroup v1, we were unable to change the default because of compatibility issue. For cgroup v2, we should change the default right now because switching to cgroup v2 is already breaking change. See also containers/libpod#4363 containers/libpod#4374 Privileged containers also use cgroupns=private by default. https://github.com/containers/libpod/pull/4374#issuecomment-549776387 Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
* goimports: fix importsSebastiaan van Stijn2019-09-181-1/+1
| | | | | | | Format the source according to latest goimports. Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com> Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* Improve description for cpu-rt-period,runtime daemon flagsSebastiaan van Stijn2019-06-211-2/+2
| | | | | | | | | | | These options configure the parent cgroup, not the default for containers, nor the daemon itself, so adding that information to the flag description to make this slightly more clear. relates to 56f77d5ade945b3b8816a6c8acb328b7c6dce9a7 (#23430) which implemented these flags. Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* Make cgroup namespaces configurableRob Gulewich2019-05-071-0/+1
| | | | | | | | | | | | | | This adds both a daemon-wide flag and a container creation property: - Set the `CgroupnsMode: "host|private"` HostConfig property at container creation time to control what cgroup namespace the container is created in - Set the `--default-cgroupns-mode=host|private` daemon flag to control what cgroup namespace containers are created in by default - Set the default if the daemon flag is unset to "host", for backward compatibility - Default to CgroupnsMode: "host" for client versions < 1.40 Signed-off-by: Rob Gulewich <rgulewich@netflix.com>
* dockerd: fix rootless detection (alternative to #39024)Akihiro Suda2019-04-251-3/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | The `--rootless` flag had a couple of issues: * #38702: euid=0, $USER="root" but no access to cgroup ("rootful" Docker in rootless Docker) * #39009: euid=0 but $USER="docker" (rootful boot2docker) To fix #38702, XDG dirs are ignored as in rootful Docker, unless the dockerd is directly running under RootlessKit namespaces. RootlessKit detection is implemented by checking whether `$ROOTLESSKIT_STATE_DIR` is set. To fix #39009, the non-robust `$USER` check is now completely removed. The entire logic can be illustrated as follows: ``` withRootlessKit := getenv("ROOTLESSKIT_STATE_DIR") rootlessMode := withRootlessKit || cliFlag("--rootless") honorXDG := withRootlessKit useRootlessKitDockerProxy := withRootlessKit removeCgroupSpec := rootlessMode adjustOOMScoreAdj := rootlessMode ``` Close #39024 Fix #38702 #39009 Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
* allow running `dockerd` in an unprivileged user namespace (rootless mode)Akihiro Suda2019-02-041-3/+8
| | | | | | | | | | | Please refer to `docs/rootless.md`. TLDR: * Make sure `/etc/subuid` and `/etc/subgid` contain the entry for you * `dockerd-rootless.sh --experimental` * `docker -H unix://$XDG_RUNTIME_DIR/docker.sock run ...` Signed-off-by: Akihiro Suda <suda.akihiro@lab.ntt.co.jp>
* Various code-cleanupSebastiaan van Stijn2018-05-231-1/+1
| | | | | | remove unnescessary import aliases, brackets, and so on. Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* Allow user to control the default address poolsAlessandro Boch2018-04-301-0/+3
| | | | | | - Via daemon flag --default-address-pools base=<CIDR>,size=<int> Signed-off-by: Elango Siva <elango@docker.com>
* Remove unused experimental codeSebastiaan van Stijn2017-12-181-2/+0
| | | | Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* Remove solaris build tag and `contrib/mkimage/solarisYong Tang2017-11-021-1/+1
| | | | Signed-off-by: Yong Tang <yong.tang.github@outlook.com>
* Update libcontainerd to use containerd 1.0Kenfe-Mickael Laventure2017-10-201-2/+0
| | | | Signed-off-by: Kenfe-Mickael Laventure <mickael.laventure@gmail.com>
* Remove deprecated --enable-api-cors flagSebastiaan van Stijn2017-09-121-2/+0
| | | | | | | | | The `--enable-api-cors` flag was deprecated in f3dd2db4ff7de1399a49af928cd3eae4fccf8764, and marked for removal in docker 17.09 through 85f92ef3590b386ea17e3948262725a2d3ce4db5. This patch removes the deprecated flag. Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* Implement none, private, and shareable ipc modesKir Kolyshkin2017-08-141-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Since the commit d88fe447df0e8 ("Add support for sharing /dev/shm/ and /dev/mqueue between containers") container's /dev/shm is mounted on the host first, then bind-mounted inside the container. This is done that way in order to be able to share this container's IPC namespace (and the /dev/shm mount point) with another container. Unfortunately, this functionality breaks container checkpoint/restore (even if IPC is not shared). Since /dev/shm is an external mount, its contents is not saved by `criu checkpoint`, and so upon restore any application that tries to access data under /dev/shm is severily disappointed (which usually results in a fatal crash). This commit solves the issue by introducing new IPC modes for containers (in addition to 'host' and 'container:ID'). The new modes are: - 'shareable': enables sharing this container's IPC with others (this used to be the implicit default); - 'private': disables sharing this container's IPC. In 'private' mode, container's /dev/shm is truly mounted inside the container, without any bind-mounting from the host, which solves the issue. While at it, let's also implement 'none' mode. The motivation, as eloquently put by Justin Cormack, is: > I wondered a while back about having a none shm mode, as currently it is > not possible to have a totally unwriteable container as there is always > a /dev/shm writeable mount. It is a bit of a niche case (and clearly > should never be allowed to be daemon default) but it would be trivial to > add now so maybe we should... ...so here's yet yet another mode: - 'none': no /dev/shm mount inside the container (though it still has its own private IPC namespace). Now, to ultimately solve the abovementioned checkpoint/restore issue, we'd need to make 'private' the default mode, but unfortunately it breaks the backward compatibility. So, let's make the default container IPC mode per-daemon configurable (with the built-in default set to 'shareable' for now). The default can be changed either via a daemon CLI option (--default-shm-mode) or a daemon.json configuration file parameter of the same name. Note one can only set either 'shareable' or 'private' IPC modes as a daemon default (i.e. in this context 'host', 'container', or 'none' do not make much sense). Some other changes this patch introduces are: 1. A mount for /dev/shm is added to default OCI Linux spec. 2. IpcMode.Valid() is simplified to remove duplicated code that parsed 'container:ID' form. Note the old version used to check that ID does not contain a semicolon -- this is no longer the case (tests are modified accordingly). The motivation is we should either do a proper check for container ID validity, or don't check it at all (since it is checked in other places anyway). I chose the latter. 3. IpcMode.Container() is modified to not return container ID if the mode value does not start with "container:", unifying the check to be the same as in IpcMode.IsContainer(). 3. IPC mode unit tests (runconfig/hostconfig_test.go) are modified to add checks for newly added values. [v2: addressed review at https://github.com/moby/moby/pull/34087#pullrequestreview-51345997] [v3: addressed review at https://github.com/moby/moby/pull/34087#pullrequestreview-53902833] [v4: addressed the case of upgrading from older daemon, in this case container.HostConfig.IpcMode is unset and this is valid] [v5: document old and new IpcMode values in api/swagger.yaml] [v6: add the 'none' mode, changelog entry to docs/api/version-history.md] Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
* add NamedUlimitOpt implement NamedOption to fix 32528allencloud2017-06-161-1/+1
| | | | Signed-off-by: allencloud <allen.sun@daocloud.io>
* Add no-new-privileg flagBrian Goff2017-05-011-0/+1
| | | | | | | | | The daemon config for defaulting to no-new-privileges for containers was added in d7fda019bb7e24f42f8ae1ddecb3fd52df3c48bf, but somehow we managed to omit the flag itself, but also documented the flag. This just adds the actual flag. Signed-off-by: Brian Goff <cpuguy83@gmail.com>
* Extract daemon configuration and discovery to their own packageVincent Demeester2017-02-081-0/+51
This also moves some cli specific in `cmd/dockerd` as it does not really belong to the `daemon/config` package. Signed-off-by: Vincent Demeester <vincent@sbr.pm>
View Lorry Controller Status