summaryrefslogtreecommitdiff
path: root/daemon/daemon.go
Commit message (Collapse)AuthorAgeFilesLines
* daemon: remove handling for deprecated "oom-score-adjust", and produce errorSebastiaan van Stijn2023-05-061-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | This option was deprecated in 5a922dc162bbe0a03450165da4e6aceca55073d4, which is part of the v24.0.0 release, so we can remove it from master. This patch; - adds a check to ValidatePlatformConfig, and produces a fatal error if oom-score-adjust is set - removes the deprecated libcontainerd/supervisor.WithOOMScore - removes the warning from docker info With this patch: dockerd --oom-score-adjust=-500 --validate Flag --oom-score-adjust has been deprecated, and will be removed in the next release. unable to configure the Docker daemon with file /etc/docker/daemon.json: merged configuration validation from file and command line flags failed: DEPRECATED: The "oom-score-adjust" config parameter and the dockerd "--oom-score-adjust" options have been removed. And when using `daemon.json`: dockerd --validate unable to configure the Docker daemon with file /etc/docker/daemon.json: merged configuration validation from file and command line flags failed: DEPRECATED: The "oom-score-adjust" config parameter and the dockerd "--oom-score-adjust" options have been removed. Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* split GetRepository from ImageServiceSebastiaan van Stijn2023-04-091-0/+31
| | | | | | | | | | | | | | | | | | | | | The GetRepository method interacts directly with the registry, and does not depend on the snapshotter, but is used for two purposes; For the GET /distribution/{name:.*}/json route; https://github.com/moby/moby/blob/dd3b71d17c614f837c4bba18baed9fa2cb31f1a4/api/server/router/distribution/backend.go#L11-L15 And to satisfy the "executor.ImageBackend" interface as used by Swarm; https://github.com/moby/moby/blob/58c027ac8ba19a3fa339c65274ea6704ccbec977/daemon/cluster/executor/backend.go#L77 This patch removes the method from the ImageService interface, and instead implements it through an composite struct that satisfies both interfaces, and an ImageBackend() method is added to the daemon. Signed-off-by: Sebastiaan van Stijn <github@gone.nl> remove GetRepository from ImageService Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* Add the events services to the containerd image serviceDjordje Lukic2023-03-301-1/+8
| | | | | | No events are sent yet, these will come at a later stage. Signed-off-by: Djordje Lukic <djordje.lukic@docker.com>
* registry: return concrete service typeCory Snider2023-03-101-2/+2
| | | | | | | | | Move interface definitions to the packages which use the registry service. https://github.com/golang/go/wiki/CodeReviewComments#interfaces Signed-off-by: Cory Snider <csnider@mirantis.com>
* Move filtered registry search out of image serviceCory Snider2023-03-101-0/+5
| | | | | | | | | | | | | | | | | | | | | | | SearchRegistryForImages does not make sense as part of the image service interface. The implementation just wraps the search API of the registry service to filter the results client-side. It has nothing to do with local image storage, and the implementation of search does not need to change when changing which backend (graph driver vs. containerd snapshotter) is used for local image storage. Filtering of the search results is an implementation detail: the consumer of the results does not care which actor does the filtering so long as the results are filtered as requested. Move filtering into the exported API of the registry service to hide the implementation details. Only one thing---the registry service implementation---would need to change in order to support server-side filtering of search results if Docker Hub or other registry servers were to add support for it to their APIs. Use a fake registry server in the search unit tests to avoid having to mock out the registry API client. Signed-off-by: Cory Snider <csnider@mirantis.com>
* remove GetLayerByID from ImageService interfaceNicolas De Loof2023-03-101-5/+12
| | | | | | Co-authored-by: Nicolas De Loof <nicolas.deloof@gmail.com> Co-authored-by: Paweł Gronowski <pawel.gronowski@docker.com> Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* Introduce support for docker commitNicolas De Loof2023-03-061-1/+1
| | | | | | | | Signed-off-by: Laura Brehm <laurabrehm@hey.com> Co-authored-by: Laura Brehm <laurabrehm@hey.com> Co-authored-by: Sebastiaan van Stijn <github@gone.nl> Co-authored-by: Paweł Gronowski <pawel.gronowski@docker.com> Co-authored-by: Nicolas De Loof <nicolas.deloof@gmail.com>
* Merge pull request #45032 from corhere/shim-optsSebastiaan van Stijn2023-03-021-4/+6
|\ | | | | daemon: allow shimv2 runtimes to be configured
| * daemon: allow shimv2 runtimes to be configuredCory Snider2023-02-171-4/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Kubernetes only permits RuntimeClass values which are valid lowercase RFC 1123 labels, which disallows the period character. This prevents cri-dockerd from being able to support configuring alternative shimv2 runtimes for a pod as shimv2 runtime names must contain at least one period character. Add support for configuring named shimv2 runtimes in daemon.json so that runtime names can be aliased to Kubernetes-compatible names. Allow options to be set on shimv2 runtimes in daemon.json. The names of the new daemon runtime config fields have been selected to correspond with the equivalent field names in cri-containerd's configuration so that users can more easily follow documentation from the runtime vendor written for cri-containerd and apply it to daemon.json. Signed-off-by: Cory Snider <csnider@mirantis.com>
* | daemon/config: remove AuthzMiddleware fieldCory Snider2023-03-011-2/+3
|/ | | | | | | | | | The authorization.Middleware contains a sync.Mutex field, making it non-copyable. Remove one of the barriers to allowing deep copies of config.Config values. Inject the middleware into Daemon as a constructor argument instead. Signed-off-by: Cory Snider <csnider@mirantis.com>
* Implement run using the containerd snapshotterDjordje Lukic2023-02-061-31/+2
| | | | | | | | | | | | | | | | | | | | | Signed-off-by: Djordje Lukic <djordje.lukic@docker.com> c8d/daemon: Mount root and fill BaseFS This fixes things that were broken due to nil BaseFS like `docker cp` and running a container with workdir override. This is more of a temporary hack than a real solution. The correct fix would be to refactor the code to make BaseFS and LayerRW an implementation detail of the old image store implementation and use the temporary mounts for the c8d implementation instead. That requires more work though. Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com> daemon/images: Don't unset BaseFS Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
* libnetwork: return concrete-typed *ControllerCory Snider2023-01-131-1/+1
| | | | | | | | | libnetwork.NetworkController is an interface with a single implementation. https://github.com/golang/go/wiki/CodeReviewComments#interfaces Signed-off-by: Cory Snider <csnider@mirantis.com>
* Merge pull request #44756 from rumpl/containerd-image-pullBjorn Neergaard2023-01-111-1/+9
|\ | | | | containerd integration: image pull
| * c8d/resolver: Fallback to http for insecure registriesPaweł Gronowski2023-01-111-1/+9
| | | | | | | | Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
| * c8d/resolver: Use hosts from daemon configurationNicolas De Loof2023-01-111-1/+1
| | | | | | | | | | Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com> Signed-off-by: Nicolas De Loof <nicolas.deloof@gmail.com>
* | container: ViewDB: return typed system errorsSebastiaan van Stijn2022-12-081-1/+1
|/ | | | Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* Merge pull request #44329 from thaJeztah/remove_trustkey_id_migrationTianon Gravi2022-12-011-22/+1
|\ | | | | Remove trustkey id migration and config.TrustKeyPath
| * use ad-hoc libtrust keySebastiaan van Stijn2022-11-281-13/+0
| | | | | | | | | | | | | | | | This is only used for tests, and the key is not verified anymore, so instead of creating a key and storing it, we can just use an ad-hoc one. Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
| * daemon/config: remove TrustKeyPath, and local utilitiesSebastiaan van Stijn2022-11-281-4/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | Turned out that the loadOrCreateTrustKey() utility was doing exactly the same as libtrust.LoadOrCreateTrustKey(), so making it a thin wrapped. I kept the tests to verify the behavior, but we could remove them as we only need this for our integration tests. The storage location for the generated key was changed (again as we only need this for some integration tests), so we can remove the TrustKeyPath from the config. Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
| * daemon: remove migrateTrustKeyID()Sebastiaan van Stijn2022-11-281-9/+1
| | | | | | | | | | | | | | | | The migration code is in the 22.06 branch, and if we don't migrate the only side-effect is the daemon's ID being regenerated (as a UUID). Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* | daemon/disk_usage: Use context aware singleflightPaweł Gronowski2022-11-291-2/+6
|/ | | | | | | | | | | | The singleflight function was capturing the context.Context of the first caller that invoked the `singleflight.Do`. This could cause all concurrent calls to be cancelled when the first request is cancelled. singleflight calls were also moved from the ImageService to Daemon, to avoid having to implement this logic in both graphdriver and containerd based image services. Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
* imageservice: Add context to various methodsNicolas De Loof2022-11-031-6/+7
| | | | | Co-authored-by: Paweł Gronowski <pawel.gronowski@docker.com> Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
* Merge pull request #44309 from thaJeztah/daemon_check_requirementsSebastiaan van Stijn2022-11-011-8/+4
|\ | | | | daemon: NewDaemon(): check system requirements early
| * daemon: NewDaemon(): check system requirements earlySebastiaan van Stijn2022-10-171-8/+4
| | | | | | | | Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* | Merge pull request #44317 from thaJeztah/daemon_mkdirSebastiaan van Stijn2022-11-011-12/+12
|\ \ | | | | | | daemon: NewDaemon(): replace system.MkdirAll for os.Mkdir where possible
| * | daemon: NewDaemon() fix import colliding with local variableSebastiaan van Stijn2022-10-181-2/+2
| | | | | | | | | | | | Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
| * | daemon: NewDaemon(): replace system.MkdirAll for os.Mkdir where possibleSebastiaan van Stijn2022-10-181-10/+10
| |/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `system.MkdirAll()` is a special version of os.Mkdir to handle creating directories using Windows volume paths (`"\\?\Volume{4c1b02c1-d990-11dc-99ae-806e6f6e6963}"`). This may be important when `MkdirAll` is used, which traverses all parent paths to create them if missing (ultimately landing on the "volume" path). The daemon.NewDaemon() function used `system.MkdirAll()` in various places where a subdirectory within `daemon.Root` was created. This appeared to be mostly out of convenience (to not have to handle `os.ErrExist` errors). The `daemon.Root` directory should already be set up in these locations, and should be set up with correct permissions. Using `system.MkdirAll()` would potentially mask errors if the root directory is missing, and instead set up parent directories (possibly with incorrect permissions). Because of the above, this patch changes `system.MkdirAll` to `os.Mkdir`. As we are changing these lines, this patch also changes the legacy octal notation (`0700`) to the now preferred `0o700`. One location continues to use `system.MkdirAll`, as the temp-directory may be configured to be outside of `daemon.Root`, but a redundant `os.Stat(realTmp)` was removed, as `system.MkdirAll` is expected to handle this. As we are changing these lines, this patch also changes the legacy octal notation (`0700`) to the now preferred `0o700`. Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* | Merge pull request #44310 from thaJeztah/daemon_getPluginExecRootBrian Goff2022-10-251-2/+2
|\ \ | | | | | | daemon: getPluginExecRoot(): pass config
| * | daemon: getPluginExecRoot(): pass configSebastiaan van Stijn2022-10-171-2/+2
| |/ | | | | | | | | | | | | | | This makes it more transparent that it's unused for Linux, and we don't pass "root", which has no relation with the path on Linux. Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* | daemon: add TEST_INTEGRATION_USE_SNAPSHOTTER for CISebastiaan van Stijn2022-10-171-0/+7
| | | | | | | | | | | | | | | | | | | | This allows us to run CI with the containerd snapshotter enabled, without patching the daemon.json, or changing how tests set up daemon flags. A warning log is added during startup, to inform if this variable is set, as it should only be used for our integration tests. Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* | daemon: NewDaemon(): log message if containerd snapshotter is enabledSebastiaan van Stijn2022-10-171-0/+2
|/ | | | Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* Fix live-restore w/ restart policies + volume refsBrian Goff2022-09-301-0/+3
| | | | | | | | | | | | | Before this change restarting the daemon in live-restore with running containers + a restart policy meant that volume refs were not restored. This specifically happens when the container is still running *and* there is a restart policy that would make sure the container was running again on restart. The bug allows volumes to be removed even though containers are referencing them. 😱 Signed-off-by: Brian Goff <cpuguy83@gmail.com>
* Merge pull request #44193 from thaJeztah/libnetwork_cleanupSebastiaan van Stijn2022-09-271-1/+0
|\ | | | | libnetwork: cleanup config package, remove old integration tests
| * libnetwork/config: remove "Experimental" and "Debug" optionsSebastiaan van Stijn2022-09-261-1/+0
| | | | | | | | | | | | These were no longer used. Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* | pkg/containerfs: simplify ContainerFS typeCory Snider2022-09-231-1/+1
|/ | | | | | Iterate towards dropping the type entirely. Signed-off-by: Cory Snider <csnider@mirantis.com>
* container: remove ViewDB and View interfaces, use concrete typesSebastiaan van Stijn2022-09-211-1/+1
| | | | | | | | | | | | These interfaces were added in aacddda89df05b88a6d15fb33c42864760385ab2, with no clear motivation, other than "Also hide ViewDB behind an interface". This patch removes the interface in favor of using a concrete implementation; There's currently only one implementation of this interface, and if we would decide to change to an alternative implementation, we could define relevant interfaces on the receiver side. Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* Merge pull request #44091 from rumpl/fix-local-contextSebastiaan van Stijn2022-09-061-1/+1
|\ | | | | Wrap local calls to the content and lease service
| * Wrap local calls to the content and lease serviceDjordje Lukic2022-09-061-1/+1
| | | | | | | | | | | | | | | | | | The wrapper sets the default namespace in the context if none is provided, this is needed because we are calling these services directly and not trough GRPC that has an interceptor to set the default namespace to all calls. Signed-off-by: Djordje Lukic <djordje.lukic@docker.com>
* | daemon: set containerd default snapshotter if none is configuredSebastiaan van Stijn2022-09-011-0/+5
|/ | | | | | | This is a temporary workaround for the daemon not yet having automatic selection of snapshotters. Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* Refactor libcontainerd to minimize c8d RPCsCory Snider2022-08-241-53/+53
| | | | | | | | | | | | | | | | | | | | | | | | The containerd client is very chatty at the best of times. Because the libcontained API is stateless and references containers and processes by string ID for every method call, the implementation is essentially forced to use the containerd client in a way which amplifies the number of redundant RPCs invoked to perform any operation. The libcontainerd remote implementation has to reload the containerd container, task and/or process metadata for nearly every operation. This in turn amplifies the number of context switches between dockerd and containerd to perform any container operation or handle a containerd event, increasing the load on the system which could otherwise be allocated to workloads. Overhaul the libcontainerd interface to reduce the impedance mismatch with the containerd client so that the containerd client can be used more efficiently. Split the API out into container, task and process interfaces which the consumer is expected to retain so that libcontainerd can retain state---especially the analogous containerd client objects---without having to manage any state-store inside the libcontainerd client. Signed-off-by: Cory Snider <csnider@mirantis.com>
* daemon: make the snapshotter configurableDjordje Lukic2022-08-221-55/+56
| | | | | | | | | | | | Treat (storage/graph)Driver as snapshotter Also moved some layerStore related initialization to the non-c8d case because otherwise they get treated as a graphdriver plugins. Co-authored-by: Sebastiaan van Stijn <github@gone.nl> Signed-off-by: Djordje Lukic <djordje.lukic@docker.com> Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com> Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* daemon: remove daemon.graphdriverSebastiaan van Stijn2022-08-181-12/+9
| | | | | | | It was only used as an intermediate variable to store what's returned by layerstore.DriverName() / ImageService.StorageDriver() Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* daemon: Mount(): use container's driver information for error-messageSebastiaan van Stijn2022-08-161-2/+2
| | | | | | | Use the information stored as part of the container for the error-message, instead of querying the current storage driver from the daemon. Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* daemon: restore(): remove fallback for legacy containersSebastiaan van Stijn2022-08-161-18/+18
| | | | | | | | | The check was accounting for old containers that did not have a storage-driver set in their config, and was added in 4908d7f81db91f4a28be152ec0cacb0cf711b403 for docker v0.7.0-rc6 - nearly 9 Years ago, so very likely nobody is still depending on this ;-) Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* daemon: restore(): remove platform-check (was used for LCOW)Sebastiaan van Stijn2022-08-161-4/+0
| | | | | | | | This was added in 0cba7740d41369eee33b671f26276325580bc07b, as part of the LCOW implementation. LCOW support has been removed, so we can remove this check. Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* Create the containerd image serviceDjordje Lukic2022-07-141-55/+62
| | | | | | | | Initial pull/ls works Build is deactivated if the feature is active Signed-off-by: Djordje Lukic <djordje.lukic@docker.com> Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* daemon: NewDaemon(): fail early on non-supported platformsSebastiaan van Stijn2022-07-121-9/+5
| | | | Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* Extract ImageService interface from the image serviceDjordje Lukic2022-07-081-3/+3
| | | | | Signed-off-by: Djordje Lukic <djordje.lukic@docker.com> Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* Merge pull request #43624 from rumpl/feat-memdb-prefixSebastiaan van Stijn2022-07-081-3/+0
|\ | | | | Use hashicorp/go-memdb instead of truncindex
| * Use hashicorp/go-memdb instead of truncindexDjordje Lukic2022-05-201-3/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | memdb already knows how to search by prefix so there is no need to keep a separate list of container ids in the truncindex Benchmarks: $ go test -benchmem -run=^$ -count 5 -tags linux -bench ^BenchmarkDBGetByPrefix100$ github.com/docker/docker/container goos: linux goarch: amd64 pkg: github.com/docker/docker/container cpu: Intel(R) Core(TM) i9-8950HK CPU @ 2.90GHz BenchmarkDBGetByPrefix100-6 16018 73935 ns/op 33888 B/op 1100 allocs/op BenchmarkDBGetByPrefix100-6 16502 73150 ns/op 33888 B/op 1100 allocs/op BenchmarkDBGetByPrefix100-6 16218 74014 ns/op 33856 B/op 1100 allocs/op BenchmarkDBGetByPrefix100-6 15733 73370 ns/op 33792 B/op 1100 allocs/op BenchmarkDBGetByPrefix100-6 16432 72546 ns/op 33744 B/op 1100 allocs/op PASS ok github.com/docker/docker/container 9.752s $ go test -benchmem -run=^$ -count 5 -tags linux -bench ^BenchmarkTruncIndexGet100$ github.com/docker/docker/pkg/truncindex goos: linux goarch: amd64 pkg: github.com/docker/docker/pkg/truncindex cpu: Intel(R) Core(TM) i9-8950HK CPU @ 2.90GHz BenchmarkTruncIndexGet100-6 16862 73732 ns/op 44776 B/op 1173 allocs/op BenchmarkTruncIndexGet100-6 16832 73629 ns/op 45184 B/op 1179 allocs/op BenchmarkTruncIndexGet100-6 17214 73571 ns/op 45160 B/op 1178 allocs/op BenchmarkTruncIndexGet100-6 16113 71680 ns/op 45360 B/op 1182 allocs/op BenchmarkTruncIndexGet100-6 16676 71246 ns/op 45056 B/op 1184 allocs/op PASS ok github.com/docker/docker/pkg/truncindex 9.759s $ go test -benchmem -run=^$ -count 5 -tags linux -bench ^BenchmarkDBGetByPrefix500$ github.com/docker/docker/container goos: linux goarch: amd64 pkg: github.com/docker/docker/container cpu: Intel(R) Core(TM) i9-8950HK CPU @ 2.90GHz BenchmarkDBGetByPrefix500-6 1539 753541 ns/op 169381 B/op 5500 allocs/op BenchmarkDBGetByPrefix500-6 1624 749975 ns/op 169458 B/op 5500 allocs/op BenchmarkDBGetByPrefix500-6 1635 761222 ns/op 169298 B/op 5500 allocs/op BenchmarkDBGetByPrefix500-6 1693 727856 ns/op 169297 B/op 5500 allocs/op BenchmarkDBGetByPrefix500-6 1874 710813 ns/op 169570 B/op 5500 allocs/op PASS ok github.com/docker/docker/container 6.711s $ go test -benchmem -run=^$ -count 5 -tags linux -bench ^BenchmarkTruncIndexGet500$ github.com/docker/docker/pkg/truncindex goos: linux goarch: amd64 pkg: github.com/docker/docker/pkg/truncindex cpu: Intel(R) Core(TM) i9-8950HK CPU @ 2.90GHz BenchmarkTruncIndexGet500-6 1934 780328 ns/op 224073 B/op 5929 allocs/op BenchmarkTruncIndexGet500-6 1713 713935 ns/op 225011 B/op 5937 allocs/op BenchmarkTruncIndexGet500-6 1780 702847 ns/op 224090 B/op 5943 allocs/op BenchmarkTruncIndexGet500-6 1736 711086 ns/op 224027 B/op 5929 allocs/op BenchmarkTruncIndexGet500-6 2448 508694 ns/op 222322 B/op 5914 allocs/op PASS ok github.com/docker/docker/pkg/truncindex 6.877s Signed-off-by: Djordje Lukic <djordje.lukic@docker.com>
View Lorry Controller Status