mirror of
https://github.com/containers/podman.git
synced 2025-06-01 17:17:47 +08:00
355 lines
10 KiB
Go
355 lines
10 KiB
Go
package generate
|
|
|
|
import (
|
|
"os"
|
|
|
|
"github.com/containers/libpod/libpod"
|
|
"github.com/containers/libpod/pkg/specgen"
|
|
"github.com/cri-o/ocicni/pkg/ocicni"
|
|
spec "github.com/opencontainers/runtime-spec/specs-go"
|
|
"github.com/opencontainers/runtime-tools/generate"
|
|
"github.com/pkg/errors"
|
|
"github.com/sirupsen/logrus"
|
|
)
|
|
|
|
func GenerateNamespaceContainerOpts(s *specgen.SpecGenerator, rt *libpod.Runtime) ([]libpod.CtrCreateOption, error) {
|
|
var portBindings []ocicni.PortMapping
|
|
options := make([]libpod.CtrCreateOption, 0)
|
|
|
|
// Cgroups
|
|
switch {
|
|
case s.CgroupNS.IsPrivate():
|
|
ns := s.CgroupNS.Value
|
|
if _, err := os.Stat(ns); err != nil {
|
|
return nil, err
|
|
}
|
|
case s.CgroupNS.IsContainer():
|
|
connectedCtr, err := rt.LookupContainer(s.CgroupNS.Value)
|
|
if err != nil {
|
|
return nil, errors.Wrapf(err, "container %q not found", s.CgroupNS.Value)
|
|
}
|
|
options = append(options, libpod.WithCgroupNSFrom(connectedCtr))
|
|
// TODO
|
|
//default:
|
|
// return nil, errors.New("cgroup name only supports private and container")
|
|
}
|
|
|
|
if s.CgroupParent != "" {
|
|
options = append(options, libpod.WithCgroupParent(s.CgroupParent))
|
|
}
|
|
|
|
if s.CgroupsMode != "" {
|
|
options = append(options, libpod.WithCgroupsMode(s.CgroupsMode))
|
|
}
|
|
|
|
// ipc
|
|
switch {
|
|
case s.IpcNS.IsHost():
|
|
options = append(options, libpod.WithShmDir("/dev/shm"))
|
|
case s.IpcNS.IsContainer():
|
|
connectedCtr, err := rt.LookupContainer(s.IpcNS.Value)
|
|
if err != nil {
|
|
return nil, errors.Wrapf(err, "container %q not found", s.IpcNS.Value)
|
|
}
|
|
options = append(options, libpod.WithIPCNSFrom(connectedCtr))
|
|
options = append(options, libpod.WithShmDir(connectedCtr.ShmDir()))
|
|
}
|
|
|
|
// pid
|
|
if s.PidNS.IsContainer() {
|
|
connectedCtr, err := rt.LookupContainer(s.PidNS.Value)
|
|
if err != nil {
|
|
return nil, errors.Wrapf(err, "container %q not found", s.PidNS.Value)
|
|
}
|
|
options = append(options, libpod.WithPIDNSFrom(connectedCtr))
|
|
}
|
|
|
|
// uts
|
|
switch {
|
|
case s.UtsNS.IsPod():
|
|
connectedPod, err := rt.LookupPod(s.UtsNS.Value)
|
|
if err != nil {
|
|
return nil, errors.Wrapf(err, "pod %q not found", s.UtsNS.Value)
|
|
}
|
|
options = append(options, libpod.WithUTSNSFromPod(connectedPod))
|
|
case s.UtsNS.IsContainer():
|
|
connectedCtr, err := rt.LookupContainer(s.UtsNS.Value)
|
|
if err != nil {
|
|
return nil, errors.Wrapf(err, "container %q not found", s.UtsNS.Value)
|
|
}
|
|
|
|
options = append(options, libpod.WithUTSNSFrom(connectedCtr))
|
|
}
|
|
|
|
if s.UseImageHosts {
|
|
options = append(options, libpod.WithUseImageHosts())
|
|
} else if len(s.HostAdd) > 0 {
|
|
options = append(options, libpod.WithHosts(s.HostAdd))
|
|
}
|
|
|
|
// User
|
|
|
|
switch {
|
|
case s.UserNS.IsPath():
|
|
ns := s.UserNS.Value
|
|
if ns == "" {
|
|
return nil, errors.Errorf("invalid empty user-defined user namespace")
|
|
}
|
|
_, err := os.Stat(ns)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
if s.IDMappings != nil {
|
|
options = append(options, libpod.WithIDMappings(*s.IDMappings))
|
|
}
|
|
case s.UserNS.IsContainer():
|
|
connectedCtr, err := rt.LookupContainer(s.UserNS.Value)
|
|
if err != nil {
|
|
return nil, errors.Wrapf(err, "container %q not found", s.UserNS.Value)
|
|
}
|
|
options = append(options, libpod.WithUserNSFrom(connectedCtr))
|
|
default:
|
|
if s.IDMappings != nil {
|
|
options = append(options, libpod.WithIDMappings(*s.IDMappings))
|
|
}
|
|
}
|
|
|
|
options = append(options, libpod.WithUser(s.User))
|
|
options = append(options, libpod.WithGroups(s.Groups))
|
|
|
|
if len(s.PortMappings) > 0 {
|
|
portBindings = s.PortMappings
|
|
}
|
|
|
|
switch {
|
|
case s.NetNS.IsPath():
|
|
ns := s.NetNS.Value
|
|
if ns == "" {
|
|
return nil, errors.Errorf("invalid empty user-defined network namespace")
|
|
}
|
|
_, err := os.Stat(ns)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
case s.NetNS.IsContainer():
|
|
connectedCtr, err := rt.LookupContainer(s.NetNS.Value)
|
|
if err != nil {
|
|
return nil, errors.Wrapf(err, "container %q not found", s.NetNS.Value)
|
|
}
|
|
options = append(options, libpod.WithNetNSFrom(connectedCtr))
|
|
case !s.NetNS.IsHost() && s.NetNS.NSMode != specgen.NoNetwork:
|
|
postConfigureNetNS := !s.UserNS.IsHost()
|
|
options = append(options, libpod.WithNetNS(portBindings, postConfigureNetNS, string(s.NetNS.NSMode), s.CNINetworks))
|
|
}
|
|
|
|
if len(s.DNSSearch) > 0 {
|
|
options = append(options, libpod.WithDNSSearch(s.DNSSearch))
|
|
}
|
|
|
|
if s.UseImageResolvConf {
|
|
options = append(options, libpod.WithUseImageResolvConf())
|
|
} else {
|
|
var dnsServers []string
|
|
for _, d := range s.DNSServers {
|
|
dnsServers = append(dnsServers, d.String())
|
|
}
|
|
options = append(options, libpod.WithDNS(dnsServers))
|
|
}
|
|
|
|
if len(s.DNSOptions) > 0 {
|
|
options = append(options, libpod.WithDNSOption(s.DNSOptions))
|
|
}
|
|
if s.StaticIP != nil {
|
|
options = append(options, libpod.WithStaticIP(*s.StaticIP))
|
|
}
|
|
|
|
if s.StaticMAC != nil {
|
|
options = append(options, libpod.WithStaticMAC(*s.StaticMAC))
|
|
}
|
|
return options, nil
|
|
}
|
|
|
|
func pidConfigureGenerator(s *specgen.SpecGenerator, g *generate.Generator) error {
|
|
if s.PidNS.IsPath() {
|
|
return g.AddOrReplaceLinuxNamespace(string(spec.PIDNamespace), s.PidNS.Value)
|
|
}
|
|
if s.PidNS.IsHost() {
|
|
return g.RemoveLinuxNamespace(string(spec.PIDNamespace))
|
|
}
|
|
if s.PidNS.IsContainer() {
|
|
logrus.Debugf("using container %s pidmode", s.PidNS.Value)
|
|
}
|
|
if s.PidNS.IsPod() {
|
|
logrus.Debug("using pod pidmode")
|
|
}
|
|
return nil
|
|
}
|
|
|
|
func utsConfigureGenerator(s *specgen.SpecGenerator, g *generate.Generator, runtime *libpod.Runtime) error {
|
|
hostname := s.Hostname
|
|
var err error
|
|
if hostname == "" {
|
|
switch {
|
|
case s.UtsNS.IsContainer():
|
|
utsCtr, err := runtime.LookupContainer(s.UtsNS.Value)
|
|
if err != nil {
|
|
return errors.Wrapf(err, "unable to retrieve hostname from dependency container %s", s.UtsNS.Value)
|
|
}
|
|
hostname = utsCtr.Hostname()
|
|
case s.NetNS.IsHost() || s.UtsNS.IsHost():
|
|
hostname, err = os.Hostname()
|
|
if err != nil {
|
|
return errors.Wrap(err, "unable to retrieve hostname of the host")
|
|
}
|
|
default:
|
|
logrus.Debug("No hostname set; container's hostname will default to runtime default")
|
|
}
|
|
}
|
|
g.RemoveHostname()
|
|
if s.Hostname != "" || !s.UtsNS.IsHost() {
|
|
// Set the hostname in the OCI configuration only
|
|
// if specified by the user or if we are creating
|
|
// a new UTS namespace.
|
|
g.SetHostname(hostname)
|
|
}
|
|
g.AddProcessEnv("HOSTNAME", hostname)
|
|
|
|
if s.UtsNS.IsPath() {
|
|
return g.AddOrReplaceLinuxNamespace(string(spec.UTSNamespace), s.UtsNS.Value)
|
|
}
|
|
if s.UtsNS.IsHost() {
|
|
return g.RemoveLinuxNamespace(string(spec.UTSNamespace))
|
|
}
|
|
if s.UtsNS.IsContainer() {
|
|
logrus.Debugf("using container %s utsmode", s.UtsNS.Value)
|
|
}
|
|
return nil
|
|
}
|
|
|
|
func ipcConfigureGenerator(s *specgen.SpecGenerator, g *generate.Generator) error {
|
|
if s.IpcNS.IsPath() {
|
|
return g.AddOrReplaceLinuxNamespace(string(spec.IPCNamespace), s.IpcNS.Value)
|
|
}
|
|
if s.IpcNS.IsHost() {
|
|
return g.RemoveLinuxNamespace(s.IpcNS.Value)
|
|
}
|
|
if s.IpcNS.IsContainer() {
|
|
logrus.Debugf("Using container %s ipcmode", s.IpcNS.Value)
|
|
}
|
|
return nil
|
|
}
|
|
|
|
func cgroupConfigureGenerator(s *specgen.SpecGenerator, g *generate.Generator) error {
|
|
if s.CgroupNS.IsPath() {
|
|
return g.AddOrReplaceLinuxNamespace(string(spec.CgroupNamespace), s.CgroupNS.Value)
|
|
}
|
|
if s.CgroupNS.IsHost() {
|
|
return g.RemoveLinuxNamespace(s.CgroupNS.Value)
|
|
}
|
|
if s.CgroupNS.IsPrivate() {
|
|
return g.AddOrReplaceLinuxNamespace(string(spec.CgroupNamespace), "")
|
|
}
|
|
if s.CgroupNS.IsContainer() {
|
|
logrus.Debugf("Using container %s cgroup mode", s.CgroupNS.Value)
|
|
}
|
|
return nil
|
|
}
|
|
|
|
func networkConfigureGenerator(s *specgen.SpecGenerator, g *generate.Generator) error {
|
|
switch {
|
|
case s.NetNS.IsHost():
|
|
logrus.Debug("Using host netmode")
|
|
if err := g.RemoveLinuxNamespace(string(spec.NetworkNamespace)); err != nil {
|
|
return err
|
|
}
|
|
|
|
case s.NetNS.NSMode == specgen.NoNetwork:
|
|
logrus.Debug("Using none netmode")
|
|
case s.NetNS.NSMode == specgen.Bridge:
|
|
logrus.Debug("Using bridge netmode")
|
|
case s.NetNS.IsContainer():
|
|
logrus.Debugf("using container %s netmode", s.NetNS.Value)
|
|
case s.NetNS.IsPath():
|
|
logrus.Debug("Using ns netmode")
|
|
if err := g.AddOrReplaceLinuxNamespace(string(spec.NetworkNamespace), s.NetNS.Value); err != nil {
|
|
return err
|
|
}
|
|
case s.NetNS.IsPod():
|
|
logrus.Debug("Using pod netmode, unless pod is not sharing")
|
|
case s.NetNS.NSMode == specgen.Slirp:
|
|
logrus.Debug("Using slirp4netns netmode")
|
|
default:
|
|
return errors.Errorf("unknown network mode")
|
|
}
|
|
|
|
if g.Config.Annotations == nil {
|
|
g.Config.Annotations = make(map[string]string)
|
|
}
|
|
|
|
if s.PublishImagePorts {
|
|
g.Config.Annotations[libpod.InspectAnnotationPublishAll] = libpod.InspectResponseTrue
|
|
} else {
|
|
g.Config.Annotations[libpod.InspectAnnotationPublishAll] = libpod.InspectResponseFalse
|
|
}
|
|
|
|
return nil
|
|
}
|
|
|
|
func userConfigureGenerator(s *specgen.SpecGenerator, g *generate.Generator) error {
|
|
if s.UserNS.IsPath() {
|
|
if err := g.AddOrReplaceLinuxNamespace(string(spec.UserNamespace), s.UserNS.Value); err != nil {
|
|
return err
|
|
}
|
|
// runc complains if no mapping is specified, even if we join another ns. So provide a dummy mapping
|
|
g.AddLinuxUIDMapping(uint32(0), uint32(0), uint32(1))
|
|
g.AddLinuxGIDMapping(uint32(0), uint32(0), uint32(1))
|
|
}
|
|
|
|
if s.IDMappings != nil {
|
|
if (len(s.IDMappings.UIDMap) > 0 || len(s.IDMappings.GIDMap) > 0) && !s.UserNS.IsHost() {
|
|
if err := g.AddOrReplaceLinuxNamespace(string(spec.UserNamespace), ""); err != nil {
|
|
return err
|
|
}
|
|
}
|
|
for _, uidmap := range s.IDMappings.UIDMap {
|
|
g.AddLinuxUIDMapping(uint32(uidmap.HostID), uint32(uidmap.ContainerID), uint32(uidmap.Size))
|
|
}
|
|
for _, gidmap := range s.IDMappings.GIDMap {
|
|
g.AddLinuxGIDMapping(uint32(gidmap.HostID), uint32(gidmap.ContainerID), uint32(gidmap.Size))
|
|
}
|
|
}
|
|
return nil
|
|
}
|
|
|
|
// GetNamespaceOptions transforms a slice of kernel namespaces
|
|
// into a slice of pod create options. Currently, not all
|
|
// kernel namespaces are supported, and they will be returned in an error
|
|
func GetNamespaceOptions(ns []string) ([]libpod.PodCreateOption, error) {
|
|
var options []libpod.PodCreateOption
|
|
var erroredOptions []libpod.PodCreateOption
|
|
for _, toShare := range ns {
|
|
switch toShare {
|
|
case "cgroup":
|
|
options = append(options, libpod.WithPodCgroups())
|
|
case "net":
|
|
options = append(options, libpod.WithPodNet())
|
|
case "mnt":
|
|
return erroredOptions, errors.Errorf("Mount sharing functionality not supported on pod level")
|
|
case "pid":
|
|
options = append(options, libpod.WithPodPID())
|
|
case "user":
|
|
return erroredOptions, errors.Errorf("User sharing functionality not supported on pod level")
|
|
case "ipc":
|
|
options = append(options, libpod.WithPodIPC())
|
|
case "uts":
|
|
options = append(options, libpod.WithPodUTS())
|
|
case "":
|
|
case "none":
|
|
return erroredOptions, nil
|
|
default:
|
|
return erroredOptions, errors.Errorf("Invalid kernel namespace to share: %s. Options are: net, pid, ipc, uts or none", toShare)
|
|
}
|
|
}
|
|
return options, nil
|
|
}
|