summaryrefslogtreecommitdiff
path: root/container/container_windows.go
Commit message (Collapse)AuthorAgeFilesLines
* pkg/signal: remove DefaultStopSignal constSebastiaan van Stijn2021-08-111-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This const was previously living in pkg/signal, but with that package being moved to its own module, it didn't make much sense to put docker's defaults in a generic module. The const from the "signal" package is currenlty used *both* by the CLI and the daemon as a default value when creating containers. This put up some questions: a. should the default be non-exported, and private to the container package? After all, it's a _default_ (so should be used if _NOT_ set). b. should the client actually setting a default, or instead just omit the value, unless specified by the user? having the client set a default also means that the daemon cannot change the default value because the client (or older clients) will override it. c. consider defaults from the client and defaults of the daemon to be separate things, and create a default const in the CLI. This patch implements option "a" (option "b" will be done separately, as it involves the CLI code). This still leaves "c" open as an option, if the CLI wants to set its own default. Unfortunately, this change means we'll have to drop the alias for the deprecated pkg/signal.DefaultStopSignal const, but a comment was left instead, which can assist consumers of the const to find why it's no longer there (a search showed the Docker CLI as the only consumer though). Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* container: un-export DefaultStopTimeoutSebastiaan van Stijn2021-08-111-2/+2
| | | | | | It's not used outside of the package itself Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* Swarm config: use absolute paths for mount destination stringsAkihiro Suda2021-05-111-1/+2
| | | | | | | | | Needed for runc >= 1.0.0-rc94. See runc issue 2928. Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp> Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* container.ConfigFilePath: use same signature on WindowsSebastiaan van Stijn2019-09-031-2/+2
| | | | | | | | | | | This made my IDE unhappy; `ConfigFilePath` is an exported function, so it makes sense to use the same signature for both Linux and Windows. This patch also adds error handling (same as on Linux), even though the current implementation will never return an error (it's good practice to handle errors, so I assumed this would be the right approach) Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* Allow system.MkDirAll() to be used as drop-in for os.MkDirAll()Sebastiaan van Stijn2019-08-081-2/+2
| | | | | | | also renamed the non-windows variant of this file to be consistent with other files in this package Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* Remove DiskQouta field.Yash Murty2019-04-301-1/+0
| | | | Signed-off-by: Yash Murty <yashmurty@gmail.com>
* Move EnableServiceDiscoveryOnDefaultNetwork to container-operationsSebastiaan van Stijn2019-03-201-5/+0
| | | | Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* Add pids-limit support in docker updateSunny Gogoi2019-02-211-1/+1
| | | | | | | | - Adds updating PidsLimit in UpdateContainer(). - Adds setting PidsLimit in toContainerResources(). Signed-off-by: Sunny Gogoi <indiasuny000@gmail.com> Signed-off-by: Brian Goff <cpuguy83@gmail.com>
* UnmountIpcMount: simplifyKir Kolyshkin2018-12-101-1/+1
| | | | | | | | | | As standard mount.Unmount does what we need, let's use it. In addition, this adds ignoring "not mounted" condition, which was previously implemented (see PR#33329, commit cfa2591d3f26) via a very expensive call to mount.Mounted(). Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
* Merge configs/secrets in unix implementationBrian Goff2018-02-161-9/+16
| | | | | | | | | | | On unix, merge secrets/configs handling. This is important because configs can contain secrets (via templating) and potentially a config could just simply have secret information "by accident" from the user. This just make sure that configs are as secure as secrets and de-dups a lot of code. Generally this makes everything simpler and configs more secure. Signed-off-by: Brian Goff <cpuguy83@gmail.com>
* Add canonical import commentDaniel Nephin2018-02-051-1/+1
| | | | Signed-off-by: Daniel Nephin <dnephin@docker.com>
* Make container resource mounts unbindableBrian Goff2018-01-161-7/+19
| | | | | | | | | | | | | | | | | | | | | | It's a common scenario for admins and/or monitoring applications to mount in the daemon root dir into a container. When doing so all mounts get coppied into the container, often with private references. This can prevent removal of a container due to the various mounts that must be configured before a container is started (for example, for shared /dev/shm, or secrets) being leaked into another namespace, usually with private references. This is particularly problematic on older kernels (e.g. RHEL < 7.4) where a mount may be active in another namespace and attempting to remove a mountpoint which is active in another namespace fails. This change moves all container resource mounts into a common directory so that the directory can be made unbindable. What this does is prevents sub-mounts of this new directory from leaking into other namespaces when mounted with `rbind`... which is how all binds are handled for containers. Signed-off-by: Brian Goff <cpuguy83@gmail.com>
* Remove redundant build-tagsSebastiaan van Stijn2017-12-181-2/+0
| | | | | | | | Files that are suffixed with `_linux.go` or `_windows.go` are already only built on Linux / Windows, so these build-tags were redundant. Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* Increase container default shutdown timeout on WindowsDarren Stahl2017-10-231-0/+3
| | | | | | The shutdown timeout for containers in insufficient on Windows. If the daemon is shutting down, and a container takes longer than expected to shut down, this can cause the container to remain in a bad state after restart, and never be able to start again. Increasing the timeout makes this less likely to occur. Signed-off-by: Darren Stahl <darst@microsoft.com>
* Update libcontainerd to use containerd 1.0Kenfe-Mickael Laventure2017-10-201-6/+0
| | | | Signed-off-by: Kenfe-Mickael Laventure <mickael.laventure@gmail.com>
* LCOW: Implemented support for docker cp + buildAkash Gupta2017-09-141-12/+0
| | | | | | | | | | This enables docker cp and ADD/COPY docker build support for LCOW. Originally, the graphdriver.Get() interface returned a local path to the container root filesystem. This does not work for LCOW, so the Get() method now returns an interface that LCOW implements to support copying to and from the container. Signed-off-by: Akash Gupta <akagup@microsoft.com>
* Implement none, private, and shareable ipc modesKir Kolyshkin2017-08-141-2/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Since the commit d88fe447df0e8 ("Add support for sharing /dev/shm/ and /dev/mqueue between containers") container's /dev/shm is mounted on the host first, then bind-mounted inside the container. This is done that way in order to be able to share this container's IPC namespace (and the /dev/shm mount point) with another container. Unfortunately, this functionality breaks container checkpoint/restore (even if IPC is not shared). Since /dev/shm is an external mount, its contents is not saved by `criu checkpoint`, and so upon restore any application that tries to access data under /dev/shm is severily disappointed (which usually results in a fatal crash). This commit solves the issue by introducing new IPC modes for containers (in addition to 'host' and 'container:ID'). The new modes are: - 'shareable': enables sharing this container's IPC with others (this used to be the implicit default); - 'private': disables sharing this container's IPC. In 'private' mode, container's /dev/shm is truly mounted inside the container, without any bind-mounting from the host, which solves the issue. While at it, let's also implement 'none' mode. The motivation, as eloquently put by Justin Cormack, is: > I wondered a while back about having a none shm mode, as currently it is > not possible to have a totally unwriteable container as there is always > a /dev/shm writeable mount. It is a bit of a niche case (and clearly > should never be allowed to be daemon default) but it would be trivial to > add now so maybe we should... ...so here's yet yet another mode: - 'none': no /dev/shm mount inside the container (though it still has its own private IPC namespace). Now, to ultimately solve the abovementioned checkpoint/restore issue, we'd need to make 'private' the default mode, but unfortunately it breaks the backward compatibility. So, let's make the default container IPC mode per-daemon configurable (with the built-in default set to 'shareable' for now). The default can be changed either via a daemon CLI option (--default-shm-mode) or a daemon.json configuration file parameter of the same name. Note one can only set either 'shareable' or 'private' IPC modes as a daemon default (i.e. in this context 'host', 'container', or 'none' do not make much sense). Some other changes this patch introduces are: 1. A mount for /dev/shm is added to default OCI Linux spec. 2. IpcMode.Valid() is simplified to remove duplicated code that parsed 'container:ID' form. Note the old version used to check that ID does not contain a semicolon -- this is no longer the case (tests are modified accordingly). The motivation is we should either do a proper check for container ID validity, or don't check it at all (since it is checked in other places anyway). I chose the latter. 3. IpcMode.Container() is modified to not return container ID if the mode value does not start with "container:", unifying the check to be the same as in IpcMode.IsContainer(). 3. IPC mode unit tests (runconfig/hostconfig_test.go) are modified to add checks for newly added values. [v2: addressed review at https://github.com/moby/moby/pull/34087#pullrequestreview-51345997] [v3: addressed review at https://github.com/moby/moby/pull/34087#pullrequestreview-53902833] [v4: addressed the case of upgrading from older daemon, in this case container.HostConfig.IpcMode is unset and this is valid] [v5: document old and new IpcMode values in api/swagger.yaml] [v6: add the 'none' mode, changelog entry to docs/api/version-history.md] Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
* keep a consistent view of containers renderedFabio Kung2017-06-231-4/+1
| | | | | | | Replicate relevant mutations to the in-memory ACID store. Readers will then be able to query container state without locking. Signed-off-by: Fabio Kung <fabio.kung@gmail.com>
* Move platform specific mount data to ContainerFabio Kung2017-06-231-0/+17
| | | | | | | | The Solaris version (previously daemon/inspect_solaris.go) was apparently missing some fields that should be available on that platform. Signed-off-by: Fabio Kung <fabio.kung@gmail.com>
* LCOW: Create layer folders with correct ACLJohn Howard2017-06-201-2/+2
| | | | Signed-off-by: John Howard <jhoward@microsoft.com>
* LCOW: OCI Spec and Environment for container startJohn Howard2017-06-201-8/+0
| | | | Signed-off-by: John Howard <jhoward@microsoft.com>
* LCOW: Remove CommonContainer - just ContainerJohn Howard2017-06-201-9/+0
| | | | Signed-off-by: John Howard <jhoward@microsoft.com>
* Add Windows configs supportJohn Stephens2017-05-161-0/+38
| | | | Signed-off-by: John Stephens <johnstep@docker.com>
* Add Windows secrets supportJohn Stephens2017-05-161-4/+38
| | | | Signed-off-by: John Stephens <johnstep@docker.com>
* Use "local" secret paths based on the secretIDAaron Lehmann2017-05-101-1/+1
| | | | | | This prevents targets with the same basename from colliding. Signed-off-by: Aaron Lehmann <aaron.lehmann@docker.com>
* support custom paths for secretsEvan Hazlett2017-05-101-2/+6
| | | | | | This adds support to specify custom container paths for secrets. Signed-off-by: Evan Hazlett <ejhazlett@gmail.com>
* Add missing resources to update block for Windows containersDarren Stahl2017-03-071-6/+32
| | | | Signed-off-by: Darren Stahl <darst@microsoft.com>
* (*) Support --net:container:<containername/id> for windowsMadhan Raj Mookkandy2017-02-281-0/+1
| | | | | | | (*) (vdemeester) Removed duplicate code across Windows and Unix wrt Net:Containers (*) Return unsupported error for network sharing for hyperv isolation containers Signed-off-by: Madhan Raj Mookkandy <MadhanRaj.Mookkandy@microsoft.com>
* Windows: Unify workdir handlingJohn Howard2017-02-021-7/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Signed-off-by: John Howard <jhoward@microsoft.com> Working directory processing was handled differently for Hyper-V and Windows-Server containers, as annotated in the builder documentation (updated in this PR). For Hyper-V containers, the working directory set by WORKDIR was not created. This PR makes Hyper-V containers work the same as Windows Server containers (and the same as Linux). Example (only applies to Hyper-V containers, so not reproducible under CI environment) Dockerfile: FROM microsoft/nanoserver WORKDIR c:\installer ENV GOROOT=c:\installer ADD go.exe . RUN go --help Running on Windows Server 2016, using docker master without this change, but with daemon set to --exec-opt isolation=hyperv as it would be for Client operating systems. PS E:\go\src\github.com\docker\docker> dockerd -g c:\control --exec-opt isolation=hyperv time="2017-02-01T15:48:09.657286100-08:00" level=info msg="Windows default isolation mode: hyperv" time="2017-02-01T15:48:09.662720900-08:00" level=info msg="[graphdriver] using prior storage driver: windowsfilter" time="2017-02-01T15:48:10.011588000-08:00" level=info msg="Graph migration to content-addressability took 0.00 seconds" time="2017-02-01T15:48:10.016655800-08:00" level=info msg="Loading containers: start." time="2017-02-01T15:48:10.460820000-08:00" level=info msg="Loading containers: done." time="2017-02-01T15:48:10.509859600-08:00" level=info msg="Daemon has completed initialization" time="2017-02-01T15:48:10.509859600-08:00" level=info msg="Docker daemon" commit=3c64061 graphdriver=windowsfilter version=1.14.0-dev First with no explicit isolation: PS E:\docker\build\unifyworkdir> docker build --no-cache . Sending build context to Docker daemon 10.1 MB Step 1/5 : FROM microsoft/nanoserver ---> 89b8556cb9ca Step 2/5 : WORKDIR c:\installer ---> 7e0f41d08204 Removing intermediate container 236c7802042a Step 3/5 : ENV GOROOT c:\installer ---> Running in 8ea5237183c1 ---> 394b70435261 Removing intermediate container 8ea5237183c1 Step 4/5 : ADD go.exe . ---> e47401a1745c Removing intermediate container 88dcc28e74b1 Step 5/5 : RUN go --help ---> Running in efe90e1b6b8b container efe90e1b6b8b76586abc5c1dc0e2797b75adc26517c48733d90651e767c8463b encountered an error during CreateProcess: failure in a Windows system call: The directory name is invalid. (0x10b) extra info: {"ApplicationName":"","CommandLine":"cmd /S /C go --help","User":"","WorkingDirectory":"C:\\installer","Environment":{"GOROOT":"c:\\installer"},"EmulateConsole":false,"CreateStdInPipe":true,"CreateStdOutPipe":true,"CreateStdErrPipe":true,"ConsoleSize":[0,0]} PS E:\docker\build\unifyworkdir> Then forcing process isolation: PS E:\docker\build\unifyworkdir> docker build --isolation=process --no-cache . Sending build context to Docker daemon 10.1 MB Step 1/5 : FROM microsoft/nanoserver ---> 89b8556cb9ca Step 2/5 : WORKDIR c:\installer ---> 350c955980c8 Removing intermediate container 8339c1e9250c Step 3/5 : ENV GOROOT c:\installer ---> Running in bde511c5e3e0 ---> b8820063b5b6 Removing intermediate container bde511c5e3e0 Step 4/5 : ADD go.exe . ---> e4ac32f8902b Removing intermediate container d586e8492eda Step 5/5 : RUN go --help ---> Running in 9e1aa235af5f Cannot mkdir: C:\installer is not a directory PS E:\docker\build\unifyworkdir> Now compare the same results after this PR. Again, first with no explicit isolation (defaulting to Hyper-V containers as that's what the daemon it set to) - note it now succeeds 😄 PS E:\docker\build\unifyworkdir> docker build --no-cache . Sending build context to Docker daemon 10.1 MB Step 1/5 : FROM microsoft/nanoserver ---> 89b8556cb9ca Step 2/5 : WORKDIR c:\installer ---> 4f319f301c69 Removing intermediate container 61b9c0b1ff6f Step 3/5 : ENV GOROOT c:\installer ---> Running in c464a1d612d8 ---> 96a26ab9a7b5 Removing intermediate container c464a1d612d8 Step 4/5 : ADD go.exe . ---> 0290d61faf57 Removing intermediate container dc5a085fffe3 Step 5/5 : RUN go --help ---> Running in 60bd56042ff8 Go is a tool for managing Go source code. Usage: go command [arguments] The commands are: build compile packages and dependencies clean remove object files doc show documentation for package or symbol env print Go environment information fix run go tool fix on packages fmt run gofmt on package sources generate generate Go files by processing source get download and install packages and dependencies install compile and install packages and dependencies list list packages run compile and run Go program test test packages tool run specified go tool version print Go version vet run go tool vet on packages Use "go help [command]" for more information about a command. Additional help topics: c calling between Go and C buildmode description of build modes filetype file types gopath GOPATH environment variable environment environment variables importpath import path syntax packages description of package lists testflag description of testing flags testfunc description of testing functions Use "go help [topic]" for more information about that topic. The command 'cmd /S /C go --help' returned a non-zero code: 2 And the same with forcing process isolation. Also works 😄 PS E:\docker\build\unifyworkdir> docker build --isolation=process --no-cache . Sending build context to Docker daemon 10.1 MB Step 1/5 : FROM microsoft/nanoserver ---> 89b8556cb9ca Step 2/5 : WORKDIR c:\installer ---> f423b9cc3e78 Removing intermediate container 41330c88893d Step 3/5 : ENV GOROOT c:\installer ---> Running in 0b99a2d7bf19 ---> e051144bf8ec Removing intermediate container 0b99a2d7bf19 Step 4/5 : ADD go.exe . ---> 7072e32b7c37 Removing intermediate container a7a97aa37fd1 Step 5/5 : RUN go --help ---> Running in 7097438a54e5 Go is a tool for managing Go source code. Usage: go command [arguments] The commands are: build compile packages and dependencies clean remove object files doc show documentation for package or symbol env print Go environment information fix run go tool fix on packages fmt run gofmt on package sources generate generate Go files by processing source get download and install packages and dependencies install compile and install packages and dependencies list list packages run compile and run Go program test test packages tool run specified go tool version print Go version vet run go tool vet on packages Use "go help [command]" for more information about a command. Additional help topics: c calling between Go and C buildmode description of build modes filetype file types gopath GOPATH environment variable environment environment variables importpath import path syntax packages description of package lists testflag description of testing flags testfunc description of testing functions Use "go help [topic]" for more information about that topic. The command 'cmd /S /C go --help' returned a non-zero code: 2 PS E:\docker\build\unifyworkdir>
* Move ReplaceOrAppendEnvValues to container packageVincent Demeester2016-12-211-2/+1
| | | | Signed-off-by: Vincent Demeester <vincent@sbr.pm>
* Fix uneccessary calls to `volume.Unmount()`Brian Goff2016-11-101-43/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fixes #22564 When an error occurs on mount, there should not be any call later to unmount. This can throw off refcounting in the underlying driver unexpectedly. Consider these two cases: ``` $ docker run -v foo:/bar busybox true ``` ``` $ docker run -v foo:/bar -w /foo busybox true ``` In the first case, if mounting `foo` fails, the volume driver will not get a call to unmount (this is the incorrect behavior). In the second case, the volume driver will not get a call to unmount (correct behavior). This occurs because in the first case, `/bar` does not exist in the container, and as such there is no call to `volume.Mount()` during the `create` phase. It will error out during the `start` phase. In the second case `/bar` is created before dealing with the volume because of the `-w`. Because of this, when the volume is being setup docker will try to copy the image path contents in the volume, in which case it will attempt to mount the volume and fail. This happens during the `create` phase. This makes it so the container will not be created (or at least fully created) and the user gets the error on `create` instead of `start`. The error handling is different in these two phases. Changed to only send `unmount` if the volume is mounted. While investigating the cause of the reported issue I found some odd behavior in unmount calls so I've cleaned those up a bit here as well. Signed-off-by: Brian Goff <cpuguy83@gmail.com>
* add SecretMount and UnmountSecrets methods for non-LinuxEvan Hazlett2016-11-091-0/+10
| | | | Signed-off-by: Evan Hazlett <ejhazlett@gmail.com>
* api: add TypeTmpfs to api/types/mountAkihiro Suda2016-10-281-2/+2
| | | | Signed-off-by: Akihiro Suda <suda.akihiro@lab.ntt.co.jp>
* Windows: Factor out unused fields in containerJohn Howard2016-10-131-3/+0
| | | | Signed-off-by: John Howard <jhoward@microsoft.com>
* Merge pull request #27072 from Microsoft/jjh/fix26843Brian Goff2016-09-301-6/+4
|\ | | | | Windows: Don't resolve volume dest
| * Windows: Don't resolve volume destJohn Howard2016-09-301-6/+4
| | | | | | | | Signed-off-by: John Howard <jhoward@microsoft.com>
* | Fix missing hostname and links in exec envTonis Tiigi2016-09-291-1/+1
|/ | | Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
* Merge pull request #26843 from anusha-ragunathan/vol-unmount-winAnusha Ragunathan2016-09-231-0/+34
|\ | | | | Call "VolumeDriver.Unmount" during container stop.
| * Call "VolumeDriver.Unmount" during container stop.Anusha Ragunathan2016-09-221-0/+34
| | | | | | | | | | | | | | "VolumeDriver.Mount" is being called on container start. Make the symmetric call on container stop. Signed-off-by: Anusha Ragunathan <anusha@docker.com>
* | Changes required to support windows service discoverymsabansal2016-09-221-0/+5
|/ | | | Signed-off-by: msabansal <sabansal@microsoft.com>
* correct some nits in commentsallencloud2016-09-151-1/+1
| | | | Signed-off-by: allencloud <allen.sun@daocloud.io>
* Add engine-api types to dockerMichael Crosby2016-09-071-1/+1
| | | | | | | This moves the types for the `engine-api` repo to the existing types package. Signed-off-by: Michael Crosby <crosbymichael@gmail.com>
* Forbid update restart policy of container with AutoRemove flagZhang Wei2016-08-161-0/+3
| | | | | | | | "--restart" and "--rm" are conflict options, if a container is started with AutoRemove flag, we should forbid the update action for its Restart Policy. Signed-off-by: Zhang Wei <zhangwei555@huawei.com>
* daemon: allow tmpfs to trump over VOLUME(s)Antonio Murdaca2016-06-151-1/+2
| | | | Signed-off-by: Antonio Murdaca <runcom@redhat.com>
* Windows: Support ARG in builderJohn Howard2016-05-041-2/+5
| | | | Signed-off-by: John Howard <jhoward@microsoft.com>
* Windows libcontainerd implementationJohn Howard2016-03-181-3/+8
| | | | | | | Signed-off-by: John Howard <jhoward@microsoft.com> Signed-off-by: John Starks <jostarks@microsoft.com> Signed-off-by: Darren Stahl <darst@microsoft.com> Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
* Windows libnetwork integrationmsabansal2016-03-091-0/+8
| | | | Signed-off-by: msabansal <sabansal@microsoft.com>
* Windows: Don't create working dir for Hyper-V ContainersJohn Howard2016-03-011-2/+9
| | | | Signed-off-by: John Howard <jhoward@microsoft.com>
* Update RestartPolicy of containerZhang Wei2016-02-201-1/+16
| | | | | | | Add `--restart` flag for `update` command, so we can change restart policy for a container no matter it's running or stopped. Signed-off-by: Zhang Wei <zhangwei555@huawei.com>
* Combine SetupWorkingDirectory for Linux and WindowsDarren Stahl2016-02-051-6/+15
| | | | Signed-off-by: Darren Stahl <darst@microsoft.com>
View Lorry Controller Status