summaryrefslogtreecommitdiff
path: root/container
Commit message (Collapse)AuthorAgeFilesLines
* container: split security options to a SecurityOptions structSebastiaan van Stijn2023-04-291-10/+15
| | | | | | | - Split these options to a separate struct, so that we can handle them in isolation. - Change some tests to use subtests, and improve coverage Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* Resolve and store manifest when creating containerLaura Brehm2023-03-061-0/+2
| | | | | | | | This addresses the previous issue with the containerd store where, after a container is created, we can't deterministically resolve which image variant was used to run it (since we also don't store what platform the image was fetched for). This is required for things like `docker commit`, and computing the containers layer size later, since we need to resolve the specific image variant. Signed-off-by: Laura Brehm <laurabrehm@hey.com>
* Merge pull request #42264 from thaJeztah/update_the_updateSebastiaan van Stijn2023-01-101-9/+3
|\ | | | | restartmanager: Remove RestartManager interface, and unused error return
| * restartmanager: remove RestartManager interfaceSebastiaan van Stijn2022-12-281-2/+2
| | | | | | | | | | | | | | It only had a single implementation, so we may as well remove the added complexity of defining it as an interface. Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
| * restartmanager: add SetPolicy() to the RestartManager interfaceSebastiaan van Stijn2022-12-281-7/+1
| | | | | | | | Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* | Merge pull request #43787 from thaJeztah/memdb_nitsBrian Goff2023-01-061-57/+25
|\ \ | |/ |/| container: ViewDB: cleanup error-types
| * container: ViewDB: use logrus.WithError()Sebastiaan van Stijn2022-12-081-2/+2
| | | | | | | | Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
| * container: ViewDB: return typed system errorsSebastiaan van Stijn2022-12-081-6/+6
| | | | | | | | Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
| * container: ViewDB: GetByPrefix() return typed errorsSebastiaan van Stijn2022-12-081-18/+3
| | | | | | | | Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
| * container: ViewDB: use errdefs for non-existing containersSebastiaan van Stijn2022-12-081-16/+3
| | | | | | | | Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
| * container: use const for null-terminatorSebastiaan van Stijn2022-12-081-15/+11
| | | | | | | | | | | | | | Also using `bytes.TrimSuffix()`, which is slightly more readable, and makes sure we're only stripping the null terminator. Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* | pkg/ioutils: TempDir: move to pkg/longpathSebastiaan van Stijn2022-12-201-6/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This utility wasn't very related to all other utilities in pkg/ioutils. Moving it to longpath to also make it more clear what it does. It looks like there's only a single (public) external consumer of this utility, and only used in a test, and it's not 100% clear if it was intentional to use our package, of if it was a case of "I actually meant `io/ioutil.MkdirTemp`" so we could consider skipping the alias. While moving the package, I also renamed `TempDir` to `MkdirTemp`, which is the signature it matches in "os" from stdlib. Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* | pkg/system: move CheckSystemDriveAndRemoveDriveLetter to pkg/archiveSebastiaan van Stijn2022-11-291-3/+2
| | | | | | | | | | | | | | | | This one is a "bit" fuzzy, as it may not be _directly_ related to `archive`, but it's always used _in combination_ with the archive package, so moving it there. Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* | pkg/system: deprecate DefaultPathEnv, move to ociSebastiaan van Stijn2022-11-291-2/+2
|/ | | | | | | | | | This patch: - Deprecates pkg/system.DefaultPathEnv - Moves the implementation inside oci - Adds TODOs to align the default in the Builder with the one used elsewhere Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* container: make path resolution fns Windows-onlyCory Snider2022-10-271-1/+1
| | | | | | | | | The new daemon.containerFSView type covers all the use-cases on Linux with a much more intuitive API, but is not portable to Windows. Discourage people from using the old and busted functions in new Linux code by excluding them entirely from Linux builds. Signed-off-by: Cory Snider <csnider@mirantis.com>
* pkg/containerfs: drop ContainerFS type aliasCory Snider2022-09-231-4/+4
| | | | Signed-off-by: Cory Snider <csnider@mirantis.com>
* pkg/containerfs: alias ContainerFS to stringCory Snider2022-09-232-3/+3
| | | | | | Drop the constructor and redundant string() type-casts. Signed-off-by: Cory Snider <csnider@mirantis.com>
* pkg/containerfs: simplify ContainerFS typeCory Snider2022-09-232-10/+9
| | | | | | Iterate towards dropping the type entirely. Signed-off-by: Cory Snider <csnider@mirantis.com>
* pkg/containerfs: drop Driver abstractionCory Snider2022-09-231-1/+1
| | | | | | | | | | The Driver abstraction was needed for Linux Containers on Windows, support for which has since been removed. There is no direct equivalent to Lchmod() in the standard library so continue to use the containerd/continuity version. Signed-off-by: Cory Snider <csnider@mirantis.com>
* pkg/containerfs: drop PathDriver abstractionCory Snider2022-09-231-10/+8
| | | | | | | With LCOW support removed, there is no need to support non-native file paths any longer. Signed-off-by: Cory Snider <csnider@mirantis.com>
* pkg/containerfs: make ResolveScopedPath a free fnCory Snider2022-09-231-1/+1
| | | | Signed-off-by: Cory Snider <csnider@mirantis.com>
* container: remove ViewDB and View interfaces, use concrete typesSebastiaan van Stijn2022-09-213-43/+26
| | | | | | | | | | | | These interfaces were added in aacddda89df05b88a6d15fb33c42864760385ab2, with no clear motivation, other than "Also hide ViewDB behind an interface". This patch removes the interface in favor of using a concrete implementation; There's currently only one implementation of this interface, and if we would decide to change to an alternative implementation, we could define relevant interfaces on the receiver side. Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* Refactor libcontainerd to minimize c8d RPCsCory Snider2022-08-244-9/+222
| | | | | | | | | | | | | | | | | | | | | | | | The containerd client is very chatty at the best of times. Because the libcontained API is stateless and references containers and processes by string ID for every method call, the implementation is essentially forced to use the containerd client in a way which amplifies the number of redundant RPCs invoked to perform any operation. The libcontainerd remote implementation has to reload the containerd container, task and/or process metadata for nearly every operation. This in turn amplifies the number of context switches between dockerd and containerd to perform any container operation or handle a containerd event, increasing the load on the system which could otherwise be allocated to workloads. Overhaul the libcontainerd interface to reduce the impedance mismatch with the containerd client so that the containerd client can be used more efficiently. Split the API out into container, task and process interfaces which the consumer is expected to retain so that libcontainerd can retain state---especially the analogous containerd client objects---without having to manage any state-store inside the libcontainerd client. Signed-off-by: Cory Snider <csnider@mirantis.com>
* Update container OOMKilled flag immediatelyCory Snider2022-08-242-5/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | The OOMKilled flag on a container's state has historically behaved rather unintuitively: it is updated on container exit to reflect whether or not any process within the container has been OOM-killed during the preceding run of the container. The OOMKilled flag would be set to true when the container exits if any process within the container---including execs---was OOM-killed at any time while the container was running, whether or not the OOM-kill was the cause of the container exiting. The flag is "sticky," persisting through the next start of the container; only being cleared once the container exits without any processes having been OOM-killed that run. Alter the behavior of the OOMKilled flag such that it signals whether any process in the container had been OOM-killed since the most recent start of the container. Set the flag immediately upon any process being OOM-killed, and clear it when the container transitions to the "running" state. There is an ulterior motive for this change. It reduces the amount of state the libcontainerd client needs to keep track of and clean up on container exit. It's one less place the client could leak memory if a container was to be deleted without going through libcontainerd. Signed-off-by: Cory Snider <csnider@mirantis.com>
* state/Wait: Fix race when reading exit statusPaweł Gronowski2022-07-203-57/+88
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Before this change there was a race condition between State.Wait reading the exit code from State and the State being changed instantly after the change which ended the State.Wait. Now, each State.Wait has its own channel which is used to transmit the desired StateStatus at the time the state transitions to the awaited one. Wait no longer reads the status by itself so there is no race. The issue caused the `docker run --restart=always ...' to sometimes exit with 0 exit code, because the process was already restarted by the time State.Wait got the chance to read the exit code. Test run -------- Before: ``` $ go test -count 1 -run TestCorrectStateWaitResultAfterRestart . --- FAIL: TestCorrectStateWaitResultAfterRestart (0.00s) state_test.go:198: expected exit code 10, got 0 FAIL FAIL github.com/docker/docker/container 0.011s FAIL ``` After: ``` $ go test -count 1 -run TestCorrectStateWaitResultAfterRestart . ok github.com/docker/docker/container 0.011s ``` Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
* gofmt GoDoc comments with go1.19Sebastiaan van Stijn2022-07-081-8/+10
| | | | | | | | Older versions of Go don't format comments, so committing this as a separate commit, so that we can already make these changes before we upgrade to Go 1.19. Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* Use hashicorp/go-memdb instead of truncindexDjordje Lukic2022-05-202-0/+366
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | memdb already knows how to search by prefix so there is no need to keep a separate list of container ids in the truncindex Benchmarks: $ go test -benchmem -run=^$ -count 5 -tags linux -bench ^BenchmarkDBGetByPrefix100$ github.com/docker/docker/container goos: linux goarch: amd64 pkg: github.com/docker/docker/container cpu: Intel(R) Core(TM) i9-8950HK CPU @ 2.90GHz BenchmarkDBGetByPrefix100-6 16018 73935 ns/op 33888 B/op 1100 allocs/op BenchmarkDBGetByPrefix100-6 16502 73150 ns/op 33888 B/op 1100 allocs/op BenchmarkDBGetByPrefix100-6 16218 74014 ns/op 33856 B/op 1100 allocs/op BenchmarkDBGetByPrefix100-6 15733 73370 ns/op 33792 B/op 1100 allocs/op BenchmarkDBGetByPrefix100-6 16432 72546 ns/op 33744 B/op 1100 allocs/op PASS ok github.com/docker/docker/container 9.752s $ go test -benchmem -run=^$ -count 5 -tags linux -bench ^BenchmarkTruncIndexGet100$ github.com/docker/docker/pkg/truncindex goos: linux goarch: amd64 pkg: github.com/docker/docker/pkg/truncindex cpu: Intel(R) Core(TM) i9-8950HK CPU @ 2.90GHz BenchmarkTruncIndexGet100-6 16862 73732 ns/op 44776 B/op 1173 allocs/op BenchmarkTruncIndexGet100-6 16832 73629 ns/op 45184 B/op 1179 allocs/op BenchmarkTruncIndexGet100-6 17214 73571 ns/op 45160 B/op 1178 allocs/op BenchmarkTruncIndexGet100-6 16113 71680 ns/op 45360 B/op 1182 allocs/op BenchmarkTruncIndexGet100-6 16676 71246 ns/op 45056 B/op 1184 allocs/op PASS ok github.com/docker/docker/pkg/truncindex 9.759s $ go test -benchmem -run=^$ -count 5 -tags linux -bench ^BenchmarkDBGetByPrefix500$ github.com/docker/docker/container goos: linux goarch: amd64 pkg: github.com/docker/docker/container cpu: Intel(R) Core(TM) i9-8950HK CPU @ 2.90GHz BenchmarkDBGetByPrefix500-6 1539 753541 ns/op 169381 B/op 5500 allocs/op BenchmarkDBGetByPrefix500-6 1624 749975 ns/op 169458 B/op 5500 allocs/op BenchmarkDBGetByPrefix500-6 1635 761222 ns/op 169298 B/op 5500 allocs/op BenchmarkDBGetByPrefix500-6 1693 727856 ns/op 169297 B/op 5500 allocs/op BenchmarkDBGetByPrefix500-6 1874 710813 ns/op 169570 B/op 5500 allocs/op PASS ok github.com/docker/docker/container 6.711s $ go test -benchmem -run=^$ -count 5 -tags linux -bench ^BenchmarkTruncIndexGet500$ github.com/docker/docker/pkg/truncindex goos: linux goarch: amd64 pkg: github.com/docker/docker/pkg/truncindex cpu: Intel(R) Core(TM) i9-8950HK CPU @ 2.90GHz BenchmarkTruncIndexGet500-6 1934 780328 ns/op 224073 B/op 5929 allocs/op BenchmarkTruncIndexGet500-6 1713 713935 ns/op 225011 B/op 5937 allocs/op BenchmarkTruncIndexGet500-6 1780 702847 ns/op 224090 B/op 5943 allocs/op BenchmarkTruncIndexGet500-6 1736 711086 ns/op 224027 B/op 5929 allocs/op BenchmarkTruncIndexGet500-6 2448 508694 ns/op 222322 B/op 5914 allocs/op PASS ok github.com/docker/docker/pkg/truncindex 6.877s Signed-off-by: Djordje Lukic <djordje.lukic@docker.com>
* container: StopSignal(): return syscall.SignalSebastiaan van Stijn2022-05-052-4/+4
| | | | Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* Bump swarmkit to v2Cory Snider2022-04-211-1/+1
| | | | Signed-off-by: Cory Snider <csnider@mirantis.com>
* Merge pull request #42574 from charlesxsh/fix-deadlock-1Tianon Gravi2021-12-011-1/+1
|\ | | | | fix potential goroutine leak by making channel non-blocking
| * fix potential goroutine leak by making channel non-blockingShihao Xia2021-08-261-1/+1
| | | | | | | | Signed-off-by: Shihao Xia <charlesxsh@hotmail.com>
* | refactor: move from io/ioutil to io and os packageEng Zer Jun2021-08-274-10/+6
| | | | | | | | | | | | | | | | The io/ioutil package has been deprecated in Go 1.16. This commit replaces the existing io/ioutil functions with their new definitions in io and os packages. Signed-off-by: Eng Zer Jun <engzerjun@gmail.com>
* | Update to Go 1.17.0, and gofmt with Go 1.17Sebastiaan van Stijn2021-08-242-0/+2
| | | | | | | | Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* | pkg/signal: remove DefaultStopSignal constSebastiaan van Stijn2021-08-114-2/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This const was previously living in pkg/signal, but with that package being moved to its own module, it didn't make much sense to put docker's defaults in a generic module. The const from the "signal" package is currenlty used *both* by the CLI and the daemon as a default value when creating containers. This put up some questions: a. should the default be non-exported, and private to the container package? After all, it's a _default_ (so should be used if _NOT_ set). b. should the client actually setting a default, or instead just omit the value, unless specified by the user? having the client set a default also means that the daemon cannot change the default value because the client (or older clients) will override it. c. consider defaults from the client and defaults of the daemon to be separate things, and create a default const in the CLI. This patch implements option "a" (option "b" will be done separately, as it involves the CLI code). This still leaves "c" open as an option, if the CLI wants to set its own default. Unfortunately, this change means we'll have to drop the alias for the deprecated pkg/signal.DefaultStopSignal const, but a comment was left instead, which can assist consumers of the const to find why it's no longer there (a search showed the Docker CLI as the only consumer though). Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* | container: un-export DefaultStopTimeoutSebastiaan van Stijn2021-08-114-7/+7
| | | | | | | | | | | | It's not used outside of the package itself Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* | remove various LCOW bits (container, image, pkg/containerfs)Sebastiaan van Stijn2021-07-271-11/+5
| | | | | | | | Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* | Merge pull request #42616 from thaJeztah/migrate_pkg_signalBrian Goff2021-07-262-2/+2
|\ \ | | | | | | replace pkg/signal with moby/sys/signal v0.5.0
| * | replace pkg/signal with moby/sys/signal v0.5.0Sebastiaan van Stijn2021-07-232-2/+2
| |/ | | | | | | | | | | This code was moved to the moby/sys repository Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* | volume/mounts: remove "containerOS" argument from NewParser (LCOW code)Sebastiaan van Stijn2021-07-022-8/+4
|/ | | | | | | | | | | This changes mounts.NewParser() to create a parser for the current operatingsystem, instead of one specific to a (possibly non-matching, in case of LCOW) OS. With the OS-specific handling being removed, the "OS" parameter is also removed from `daemon.verifyContainerSettings()`, and various other container-related functions. Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* Remove LCOW code (step 1)Sebastiaan van Stijn2021-06-031-1/+1
| | | | | | | | | | | | The LCOW implementation in dockerd has been deprecated in favor of re-implementation in containerd (in progress). Microsoft started removing the LCOW V1 code from the build dependencies we use in Microsoft/opengcs (soon to be part of Microsoft/hcshhim), which means that we need to start removing this code. This first step removes the lcow graphdriver, the LCOW initialization code, and some LCOW-related utilities. Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* Swarm config: use absolute paths for mount destination stringsAkihiro Suda2021-05-113-2/+15
| | | | | | | | | Needed for runc >= 1.0.0-rc94. See runc issue 2928. Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp> Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* container: minor cleanup/refactorSebastiaan van Stijn2020-11-101-8/+9
| | | | Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* container: make hostconfig.json non-world-readable (0600)Sebastiaan van Stijn2020-11-101-1/+1
| | | | | | | | | | | | | | | | | | | | When writing container's `hostconfig.json`, permissions were set to 0644 (world- readable). While this is not a security concern (as the `/var/lib/docker/containers` directory has `0700` or `0701` permissions), there is no real need to have these permissions, as this file is only accessed by the daemon. Looking at history for file permissions; - 06b53e3fc7aca2b3dae32edab08c7662d3e9e7e8 (first implementation) used `0666` (world-writable) - cf1a6c08fa03aa7020f8f5b414bb9349a9c8371a refactored the code, and removed explicit permissions - ea3cbd3274664f5b16fce78d7df036f6b5c94e30 introduced atomic writes, and brought back the `0666` permissions - 3ec8fed7476704f061891d4c421c615da49e30c7 removed world-writable bits, but kept world-readable This patch updates the permissions to `0600`, matching what's used for `config.v2.json`, which was updated in ae52cea3ab46e1e728606349fb6baa9a8203f3ed, but forgot to update `hostconfig.json`. Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* replace pkg/symlink with github.com/moby/sys/symlinkSebastiaan van Stijn2020-11-031-1/+1
| | | | Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* Merge pull request #40856 from cpuguy83/reduce_allocs_on_env_repalceBrian Goff2020-05-123-12/+69
|\ | | | | Use strings.Index instead of strings.Split
| * Use strings.Index instead of strings.SplitBrian Goff2020-04-243-12/+69
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Since we don't need the actual split values, instead of calling `strings.Split`, which allocates new slices on each call, use `strings.Index`. This significantly reduces the allocations required when doing env value replacements. Additionally, pre-allocate the env var slice, even if we allocate a little more than we need, it keeps us from having to do multiple allocations while appending. ``` benchmark old ns/op new ns/op delta BenchmarkReplaceOrAppendEnvValues/0-8 486 313 -35.60% BenchmarkReplaceOrAppendEnvValues/100-8 10553 1535 -85.45% BenchmarkReplaceOrAppendEnvValues/1000-8 94275 12758 -86.47% BenchmarkReplaceOrAppendEnvValues/10000-8 1161268 129269 -88.87% benchmark old allocs new allocs delta BenchmarkReplaceOrAppendEnvValues/0-8 5 2 -60.00% BenchmarkReplaceOrAppendEnvValues/100-8 110 0 -100.00% BenchmarkReplaceOrAppendEnvValues/1000-8 1013 0 -100.00% BenchmarkReplaceOrAppendEnvValues/10000-8 10022 0 -100.00% benchmark old bytes new bytes delta BenchmarkReplaceOrAppendEnvValues/0-8 192 24 -87.50% BenchmarkReplaceOrAppendEnvValues/100-8 7360 0 -100.00% BenchmarkReplaceOrAppendEnvValues/1000-8 64832 0 -100.00% BenchmarkReplaceOrAppendEnvValues/10000-8 1146049 0 -100.00% ``` Signed-off-by: Brian Goff <cpuguy83@gmail.com>
* | SELinux: fix ENOTSUP errors not being detected when relabelingSebastiaan van Stijn2020-05-101-2/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commit 12c7541f1f2d616967f9eecce182789de7e2a238 updated the opencontainers/selinux dependency to v1.3.1, which had a breaking change in the errors that were returned. Before v1.3.1, the "raw" `syscall.ENOTSUP` was returned if the underlying filesystem did not support xattrs, but later versions wrapped the error, which caused our detection to fail. This patch uses `errors.Is()` to check for the underlying error. This requires github.com/pkg/errors v0.9.1 or above (older versions could use `errors.Cause()`, but are not compatible with "native" wrapping of errors in Go 1.13 and up, and could potentially cause these errors to not being detected again. Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* | Replace errors.Cause() with errors.Is() / errors.As()Sebastiaan van Stijn2020-04-291-2/+2
|/ | | | Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* remove uses of deprecated pkg/termSebastiaan van Stijn2020-04-211-1/+1
| | | | Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* Really switch to moby/sys/mount*Kir Kolyshkin2020-03-201-1/+1
| | | | | | | | | | | | | | | | | | | | Switch to moby/sys/mount and mountinfo. Keep the pkg/mount for potential outside users. This commit was generated by the following bash script: ``` set -e -u -o pipefail for file in $(git grep -l 'docker/docker/pkg/mount"' | grep -v ^pkg/mount); do sed -i -e 's#/docker/docker/pkg/mount"#/moby/sys/mount"#' \ -e 's#mount\.\(GetMounts\|Mounted\|Info\|[A-Za-z]*Filter\)#mountinfo.\1#g' \ $file goimports -w $file done ``` Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
View Lorry Controller Status