Files
podman/libpod/sql_state_internal.go
Matthew Heon 2e48c60bc5 Add DNS and security fields to DB
Also moves port mappings out of the SQL DB and into a file on
disk. These could get very sizable (hundred to thousands of
ports) so moving them out to a file will keep the DB small and
fast.

Finally, add a foreign key reference from container ID to
container state ID. This ensures we never get into an
inconsistent state where we have data in one table but not the
other.

Signed-off-by: Matthew Heon <matthew.heon@gmail.com>

Closes: #225
Approved by: baude
2018-01-15 19:50:59 +00:00

618 lines
18 KiB
Go

package libpod
import (
"database/sql"
"encoding/json"
"io/ioutil"
"os"
"path/filepath"
"time"
"github.com/containers/storage"
spec "github.com/opencontainers/runtime-spec/specs-go"
"github.com/pkg/errors"
"github.com/sirupsen/logrus"
// Use SQLite backend for sql package
_ "github.com/mattn/go-sqlite3"
)
// Checks that the DB configuration matches the runtime's configuration
func checkDB(db *sql.DB, r *Runtime) (err error) {
// Create a table to hold runtime information
// TODO: Include UID/GID mappings
const runtimeTable = `
CREATE TABLE runtime(
Id INTEGER NOT NULL PRIMARY KEY,
SchemaVersion INTEGER NOT NULL,
StaticDir TEXT NOT NULL,
TmpDir TEXT NOT NULL,
RunRoot TEXT NOT NULL,
GraphRoot TEXT NOT NULL,
GraphDriverName TEXT NOT NULL,
CHECK (Id=0)
);
`
const fillRuntimeTable = `INSERT INTO runtime VALUES (
?, ?, ?, ?, ?, ?, ?
);`
const selectRuntimeTable = `SELECT SchemaVersion,
StaticDir,
TmpDir,
RunRoot,
GraphRoot,
GraphDriverName
FROM runtime WHERE id=0;`
const checkRuntimeExists = "SELECT name FROM sqlite_master WHERE type='table' AND name='runtime';"
tx, err := db.Begin()
if err != nil {
return errors.Wrapf(err, "error beginning database transaction")
}
defer func() {
if err != nil {
if err2 := tx.Rollback(); err2 != nil {
logrus.Errorf("Error rolling back transaction to check runtime table: %v", err2)
}
}
}()
row := tx.QueryRow(checkRuntimeExists)
var table string
if err := row.Scan(&table); err != nil {
// There is no runtime table
// Create and populate the runtime table
if err == sql.ErrNoRows {
if _, err := tx.Exec(runtimeTable); err != nil {
return errors.Wrapf(err, "error creating runtime table in database")
}
_, err := tx.Exec(fillRuntimeTable,
0,
DBSchema,
r.config.StaticDir,
r.config.TmpDir,
r.config.StorageConfig.RunRoot,
r.config.StorageConfig.GraphRoot,
r.config.StorageConfig.GraphDriverName)
if err != nil {
return errors.Wrapf(err, "error populating runtime table in database")
}
if err := tx.Commit(); err != nil {
return errors.Wrapf(err, "error committing runtime table transaction in database")
}
return nil
}
return errors.Wrapf(err, "error checking for presence of runtime table in database")
}
// There is a runtime table
// Retrieve its contents
var (
schemaVersion int
staticDir string
tmpDir string
runRoot string
graphRoot string
graphDriverName string
)
row = tx.QueryRow(selectRuntimeTable)
err = row.Scan(
&schemaVersion,
&staticDir,
&tmpDir,
&runRoot,
&graphRoot,
&graphDriverName)
if err != nil {
return errors.Wrapf(err, "error retrieving runtime information from database")
}
// Compare the information in the database against our runtime config
if schemaVersion != DBSchema {
return errors.Wrapf(ErrDBBadConfig, "database schema version %d does not match our schema version %d",
schemaVersion, DBSchema)
}
if staticDir != r.config.StaticDir {
return errors.Wrapf(ErrDBBadConfig, "database static directory %s does not match our static directory %s",
staticDir, r.config.StaticDir)
}
if tmpDir != r.config.TmpDir {
return errors.Wrapf(ErrDBBadConfig, "database temp directory %s does not match our temp directory %s",
tmpDir, r.config.TmpDir)
}
if runRoot != r.config.StorageConfig.RunRoot {
return errors.Wrapf(ErrDBBadConfig, "database runroot directory %s does not match our runroot directory %s",
runRoot, r.config.StorageConfig.RunRoot)
}
if graphRoot != r.config.StorageConfig.GraphRoot {
return errors.Wrapf(ErrDBBadConfig, "database graph root directory %s does not match our graph root directory %s",
graphRoot, r.config.StorageConfig.GraphRoot)
}
if graphDriverName != r.config.StorageConfig.GraphDriverName {
return errors.Wrapf(ErrDBBadConfig, "database runroot directory %s does not match our runroot directory %s",
graphDriverName, r.config.StorageConfig.GraphDriverName)
}
if err := tx.Commit(); err != nil {
return errors.Wrapf(err, "error committing runtime table transaction in database")
}
return nil
}
// Performs database setup including by not limited to initializing tables in
// the database
func prepareDB(db *sql.DB) (err error) {
// TODO create pod tables
// TODO add Pod ID to CreateStaticContainer as a FOREIGN KEY referencing podStatic(Id)
// TODO add ctr shared namespaces information - A separate table, probably? So we can FOREIGN KEY the ID
// TODO schema migration might be necessary and should be handled here
// TODO maybe make a port mappings table instead of JSONing the array and storing it?
// TODO prepared statements for common queries for performance
// Enable foreign keys in SQLite
if _, err := db.Exec("PRAGMA foreign_keys = ON;"); err != nil {
return errors.Wrapf(err, "error enabling foreign key support in database")
}
// Create a table for unchanging container data
const createCtr = `
CREATE TABLE IF NOT EXISTS containers(
Id TEXT NOT NULL PRIMARY KEY,
Name TEXT NOT NULL UNIQUE,
Pod TEXT,
RootfsImageID TEXT NOT NULL,
RootfsImageName TEXT NOT NULL,
ImageVolumes INTEGER NOT NULL,
ReadOnly INTEGER NOT NULL,
ShmDir TEXT NOT NULL,
ShmSize INTEGER NOT NULL,
StaticDir TEXT NOT NULL,
Mounts TEXT NOT NULL,
Privileged INTEGER NOT NULL,
NoNewPrivs INTEGER NOT NULL,
ProcessLabel TEXT NOT NULL,
MountLabel TEXT NOT NULL,
User TEXT NOT NULL,
IPCNsCtr TEXT,
MountNsCtr TEXT,
NetNsCtr TEXT,
PIDNsCtr TEXT,
UserNsCtr TEXT,
UTSNsCtr TEXT,
CgroupNsCtr TEXT,
CreateNetNS INTEGER NOT NULL,
DNSServer TEXT NOT NULL,
DNSSearch TEXT NOT NULL,
DNSOption TEXT NOT NULL,
HostAdd TEXT NOT NULL,
Stdin INTEGER NOT NULL,
LabelsJSON TEXT NOT NULL,
StopSignal INTEGER NOT NULL,
StopTimeout INTEGER NOT NULL,
CreatedTime TEXT NOT NULL,
CgroupParent TEXT NOT NULL,
CHECK (ImageVolumes IN (0, 1)),
CHECK (ReadOnly IN (0, 1)),
CHECK (SHMSize>=0),
CHECK (Privileged IN (0, 1)),
CHECK (NoNewPrivs IN (0, 1)),
CHECK (CreateNetNS IN (0, 1)),
CHECK (Stdin IN (0, 1)),
CHECK (StopSignal>=0),
FOREIGN KEY (Id) REFERENCES containerState(Id) DEFERRABLE INITIALLY DEFERRED
FOREIGN KEY (Pod) REFERENCES pod(Id) DEFERRABLE INITIALLY DEFERRED,
FOREIGN KEY (IPCNsCtr) REFERENCES containers(Id) DEFERRABLE INITIALLY DEFERRED,
FOREIGN KEY (MountNsCtr) REFERENCES containers(Id) DEFERRABLE INITIALLY DEFERRED,
FOREIGN KEY (NetNsCtr) REFERENCES containers(Id) DEFERRABLE INITIALLY DEFERRED,
FOREIGN KEY (PIDNsCtr) REFERENCES containers(Id) DEFERRABLE INITIALLY DEFERRED,
FOREIGN KEY (UserNsCtr) REFERENCES containers(Id) DEFERRABLE INITIALLY DEFERRED,
FOREIGN KEY (UTSNsCtr) REFERENCES containers(Id) DEFERRABLE INITIALLY DEFERRED,
FOREIGN KEY (CgroupNsCtr) REFERENCES containers(Id) DEFERRABLE INITIALLY DEFERRED
);
`
// Create a table for changing container state
const createCtrState = `
CREATE TABLE IF NOT EXISTS containerState(
Id TEXT NOT NULL PRIMARY KEY,
State INTEGER NOT NULL,
ConfigPath TEXT NOT NULL,
RunDir TEXT NOT NULL,
Mountpoint TEXT NOT NULL,
StartedTime TEXT NUT NULL,
FinishedTime TEXT NOT NULL,
ExitCode INTEGER NOT NULL,
OomKilled INTEGER NOT NULL,
Pid INTEGER NOT NULL,
NetNSPath TEXT NOT NULL,
IPAddress TEXT NOT NULL,
SubnetMask TEXT NOT NULL,
CHECK (State>0),
CHECK (OomKilled IN (0, 1)),
FOREIGN KEY (Id) REFERENCES containers(Id) DEFERRABLE INITIALLY DEFERRED
);
`
// Create a table for pod config
const createPod = `
CREATE TABLE IF NOT EXISTS pod(
Id TEXT NOT NULL PRIMARY KEY,
Name TEXT NOT NULL UNIQUE,
Labels TEXT NOT NULL
);
`
// Create the tables
tx, err := db.Begin()
if err != nil {
return errors.Wrapf(err, "error beginning database transaction")
}
defer func() {
if err != nil {
if err2 := tx.Rollback(); err2 != nil {
logrus.Errorf("Error rolling back transaction to create tables: %v", err2)
}
}
}()
if _, err := tx.Exec(createCtr); err != nil {
return errors.Wrapf(err, "error creating containers table in database")
}
if _, err := tx.Exec(createCtrState); err != nil {
return errors.Wrapf(err, "error creating container state table in database")
}
if _, err := tx.Exec(createPod); err != nil {
return errors.Wrapf(err, "error creating pods table in database")
}
if err := tx.Commit(); err != nil {
return errors.Wrapf(err, "error committing table creation transaction in database")
}
return nil
}
// Get filename for OCI spec on disk
func getSpecPath(specsDir, id string) string {
return filepath.Join(specsDir, id)
}
// Get filename for container port mappings on disk
func getPortsPath(specsDir, id string) string {
return filepath.Join(specsDir, id+"_ports")
}
// Convert a bool into SQL-readable format
func boolToSQL(b bool) int {
if b {
return 1
}
return 0
}
// Convert a null string from SQL-readable format
func stringFromNullString(s sql.NullString) string {
if s.Valid {
return s.String
}
return ""
}
// Convert a string to a SQL nullable string
func stringToNullString(s string) sql.NullString {
if s == "" {
return sql.NullString{}
}
return sql.NullString{
String: s,
Valid: true,
}
}
// Convert a bool from SQL-readable format
func boolFromSQL(i int) bool {
return i != 0
}
// Convert a time.Time into SQL-readable format
func timeToSQL(t time.Time) string {
return t.Format(time.RFC3339Nano)
}
// Convert a SQL-readable time back to a time.Time
func timeFromSQL(s string) (time.Time, error) {
return time.Parse(time.RFC3339Nano, s)
}
// Interface to abstract sql.Rows and sql.Row so they can both be used
type scannable interface {
Scan(dest ...interface{}) error
}
// Read a single container from a single row result in the database
func (s *SQLState) ctrFromScannable(row scannable) (*Container, error) {
var (
id string
name string
pod sql.NullString
rootfsImageID string
rootfsImageName string
imageVolumes int
readOnly int
shmDir string
shmSize int64
staticDir string
mounts string
privileged int
noNewPrivs int
processLabel string
mountLabel string
user string
ipcNsCtrNullStr sql.NullString
mountNsCtrNullStr sql.NullString
netNsCtrNullStr sql.NullString
pidNsCtrNullStr sql.NullString
userNsCtrNullStr sql.NullString
utsNsCtrNullStr sql.NullString
cgroupNsCtrNullStr sql.NullString
createNetNS int
dnsServerJSON string
dnsSearchJSON string
dnsOptionJSON string
hostAddJSON string
stdin int
labelsJSON string
stopSignal uint
stopTimeout uint
createdTimeString string
cgroupParent string
state int
configPath string
runDir string
mountpoint string
startedTimeString string
finishedTimeString string
exitCode int32
oomKilled int
pid int
netNSPath string
ipAddress string
subnetMask string
)
err := row.Scan(
&id,
&name,
&pod,
&rootfsImageID,
&rootfsImageName,
&imageVolumes,
&readOnly,
&shmDir,
&shmSize,
&staticDir,
&mounts,
&privileged,
&noNewPrivs,
&processLabel,
&mountLabel,
&user,
&ipcNsCtrNullStr,
&mountNsCtrNullStr,
&netNsCtrNullStr,
&pidNsCtrNullStr,
&userNsCtrNullStr,
&utsNsCtrNullStr,
&cgroupNsCtrNullStr,
&createNetNS,
&dnsServerJSON,
&dnsSearchJSON,
&dnsOptionJSON,
&hostAddJSON,
&stdin,
&labelsJSON,
&stopSignal,
&stopTimeout,
&createdTimeString,
&cgroupParent,
&state,
&configPath,
&runDir,
&mountpoint,
&startedTimeString,
&finishedTimeString,
&exitCode,
&oomKilled,
&pid,
&netNSPath,
&ipAddress,
&subnetMask)
if err != nil {
if err == sql.ErrNoRows {
return nil, ErrNoSuchCtr
}
return nil, errors.Wrapf(err, "error parsing database row into container")
}
ctr := new(Container)
ctr.config = new(ContainerConfig)
ctr.state = new(containerRuntimeInfo)
ctr.config.ID = id
ctr.config.Name = name
ctr.config.Pod = stringFromNullString(pod)
ctr.config.RootfsImageID = rootfsImageID
ctr.config.RootfsImageName = rootfsImageName
ctr.config.ImageVolumes = boolFromSQL(imageVolumes)
ctr.config.ReadOnly = boolFromSQL(readOnly)
ctr.config.ShmDir = shmDir
ctr.config.ShmSize = shmSize
ctr.config.StaticDir = staticDir
ctr.config.Privileged = boolFromSQL(privileged)
ctr.config.NoNewPrivs = boolFromSQL(noNewPrivs)
ctr.config.ProcessLabel = processLabel
ctr.config.MountLabel = mountLabel
ctr.config.User = user
ctr.config.IPCNsCtr = stringFromNullString(ipcNsCtrNullStr)
ctr.config.MountNsCtr = stringFromNullString(mountNsCtrNullStr)
ctr.config.NetNsCtr = stringFromNullString(netNsCtrNullStr)
ctr.config.PIDNsCtr = stringFromNullString(pidNsCtrNullStr)
ctr.config.UserNsCtr = stringFromNullString(userNsCtrNullStr)
ctr.config.UTSNsCtr = stringFromNullString(utsNsCtrNullStr)
ctr.config.CgroupNsCtr = stringFromNullString(cgroupNsCtrNullStr)
ctr.config.CreateNetNS = boolFromSQL(createNetNS)
ctr.config.Stdin = boolFromSQL(stdin)
ctr.config.StopSignal = stopSignal
ctr.config.StopTimeout = stopTimeout
ctr.config.CgroupParent = cgroupParent
ctr.state.State = ContainerState(state)
ctr.state.ConfigPath = configPath
ctr.state.RunDir = runDir
ctr.state.Mountpoint = mountpoint
ctr.state.ExitCode = exitCode
ctr.state.OOMKilled = boolFromSQL(oomKilled)
ctr.state.PID = pid
ctr.state.IPAddress = ipAddress
ctr.state.SubnetMask = subnetMask
// TODO should we store this in the database separately instead?
if ctr.state.Mountpoint != "" {
ctr.state.Mounted = true
}
if err := json.Unmarshal([]byte(mounts), &ctr.config.Mounts); err != nil {
return nil, errors.Wrapf(err, "error parsing container %s mounts JSON", id)
}
if err := json.Unmarshal([]byte(dnsServerJSON), &ctr.config.DNSServer); err != nil {
return nil, errors.Wrapf(err, "error parsing container %s DNS server JSON", id)
}
if err := json.Unmarshal([]byte(dnsSearchJSON), &ctr.config.DNSSearch); err != nil {
return nil, errors.Wrapf(err, "error parsing container %s DNS search JSON", id)
}
if err := json.Unmarshal([]byte(dnsOptionJSON), &ctr.config.DNSOption); err != nil {
return nil, errors.Wrapf(err, "error parsing container %s DNS option JSON", id)
}
if err := json.Unmarshal([]byte(hostAddJSON), &ctr.config.HostAdd); err != nil {
return nil, errors.Wrapf(err, "error parsing container %s DNS server JSON", id)
}
labels := make(map[string]string)
if err := json.Unmarshal([]byte(labelsJSON), &labels); err != nil {
return nil, errors.Wrapf(err, "error parsing container %s labels JSON", id)
}
ctr.config.Labels = labels
createdTime, err := timeFromSQL(createdTimeString)
if err != nil {
return nil, errors.Wrapf(err, "error parsing container %s created time", id)
}
ctr.config.CreatedTime = createdTime
startedTime, err := timeFromSQL(startedTimeString)
if err != nil {
return nil, errors.Wrapf(err, "error parsing container %s started time", id)
}
ctr.state.StartedTime = startedTime
finishedTime, err := timeFromSQL(finishedTimeString)
if err != nil {
return nil, errors.Wrapf(err, "error parsing container %s finished time", id)
}
ctr.state.FinishedTime = finishedTime
// Join the network namespace, if there is one
if netNSPath != "" {
netNS, err := joinNetNS(netNSPath)
if err != nil {
return nil, errors.Wrapf(err, "error joining network namespace for container %s", id)
}
ctr.state.NetNS = netNS
}
ctr.valid = true
ctr.runtime = s.runtime
// Open and set the lockfile
lockPath := filepath.Join(s.lockDir, id)
lock, err := storage.GetLockfile(lockPath)
if err != nil {
return nil, errors.Wrapf(err, "error retrieving lockfile for container %s", id)
}
ctr.lock = lock
// Retrieve the spec from disk
ociSpec := new(spec.Spec)
specPath := getSpecPath(s.specsDir, id)
fileContents, err := ioutil.ReadFile(specPath)
if err != nil {
return nil, errors.Wrapf(err, "error reading container %s OCI spec", id)
}
if err := json.Unmarshal(fileContents, ociSpec); err != nil {
return nil, errors.Wrapf(err, "error parsing container %s OCI spec", id)
}
ctr.config.Spec = ociSpec
// Retrieve the ports from disk
// They may not exist - if they don't, this container just doesn't have ports
portPath := getPortsPath(s.specsDir, id)
_, err = os.Stat(portPath)
if err != nil {
if !os.IsNotExist(err) {
return nil, errors.Wrapf(err, "error stating container %s JSON ports", id)
}
}
if err == nil {
// The file exists, read it
fileContents, err := ioutil.ReadFile(portPath)
if err != nil {
return nil, errors.Wrapf(err, "error reading container %s JSON ports", id)
}
if err := json.Unmarshal(fileContents, &ctr.config.PortMappings); err != nil {
return nil, errors.Wrapf(err, "error parsing container %s JSON ports", id)
}
}
return ctr, nil
}