From 6bce7867b234eeb0fade7a77f6337775cb4517a7 Mon Sep 17 00:00:00 2001 From: Michael Crosby Date: Fri, 20 Jun 2014 10:00:17 -0700 Subject: [PATCH 1/3] Add minimal sample configuration files for testing Docker-DCO-1.1-Signed-off-by: Michael Crosby (github: crosbymichael) --- sample_configs/README.md | 5 + .../attach_to_bridge.json | 0 sample_configs/minimal.json | 197 ++++++++++++++++++ 3 files changed, 202 insertions(+) create mode 100644 sample_configs/README.md rename container.json => sample_configs/attach_to_bridge.json (100%) create mode 100644 sample_configs/minimal.json diff --git a/sample_configs/README.md b/sample_configs/README.md new file mode 100644 index 00000000..4ccc6cde --- /dev/null +++ b/sample_configs/README.md @@ -0,0 +1,5 @@ +These configuration files can be used with `nsinit` to quickly develop, test, +and experiment with features of libcontainer. + +When consuming these configuration files, copy them into your rootfs and rename +the file to `container.json` for use with `nsinit`. diff --git a/container.json b/sample_configs/attach_to_bridge.json similarity index 100% rename from container.json rename to sample_configs/attach_to_bridge.json diff --git a/sample_configs/minimal.json b/sample_configs/minimal.json new file mode 100644 index 00000000..b0f6ffc0 --- /dev/null +++ b/sample_configs/minimal.json @@ -0,0 +1,197 @@ +{ + "capabilities": [ + "CHOWN", + "DAC_OVERRIDE", + "FOWNER", + "MKNOD", + "NET_RAW", + "SETGID", + "SETUID", + "SETFCAP", + "SETPCAP", + "NET_BIND_SERVICE", + "SYS_CHROOT", + "KILL" + ], + "cgroups": { + "allowed_devices": [ + { + "cgroup_permissions": "m", + "major_number": -1, + "minor_number": -1, + "type": 99 + }, + { + "cgroup_permissions": "m", + "major_number": -1, + "minor_number": -1, + "type": 98 + }, + { + "cgroup_permissions": "rwm", + "major_number": 5, + "minor_number": 1, + "path": "/dev/console", + "type": 99 + }, + { + "cgroup_permissions": "rwm", + "major_number": 4, + "path": "/dev/tty0", + "type": 99 + }, + { + "cgroup_permissions": "rwm", + "major_number": 4, + "minor_number": 1, + "path": "/dev/tty1", + "type": 99 + }, + { + "cgroup_permissions": "rwm", + "major_number": 136, + "minor_number": -1, + "type": 99 + }, + { + "cgroup_permissions": "rwm", + "major_number": 5, + "minor_number": 2, + "type": 99 + }, + { + "cgroup_permissions": "rwm", + "major_number": 10, + "minor_number": 200, + "type": 99 + }, + { + "cgroup_permissions": "rwm", + "file_mode": 438, + "major_number": 1, + "minor_number": 3, + "path": "/dev/null", + "type": 99 + }, + { + "cgroup_permissions": "rwm", + "file_mode": 438, + "major_number": 1, + "minor_number": 5, + "path": "/dev/zero", + "type": 99 + }, + { + "cgroup_permissions": "rwm", + "file_mode": 438, + "major_number": 1, + "minor_number": 7, + "path": "/dev/full", + "type": 99 + }, + { + "cgroup_permissions": "rwm", + "file_mode": 438, + "major_number": 5, + "path": "/dev/tty", + "type": 99 + }, + { + "cgroup_permissions": "rwm", + "file_mode": 438, + "major_number": 1, + "minor_number": 9, + "path": "/dev/urandom", + "type": 99 + }, + { + "cgroup_permissions": "rwm", + "file_mode": 438, + "major_number": 1, + "minor_number": 8, + "path": "/dev/random", + "type": 99 + } + ], + "name": "docker-koye", + "parent": "docker" + }, + "context": { + "mount_label": "", + "process_label": "", + "restrictions": "true" + }, + "device_nodes": [ + { + "cgroup_permissions": "rwm", + "file_mode": 438, + "major_number": 1, + "minor_number": 3, + "path": "/dev/null", + "type": 99 + }, + { + "cgroup_permissions": "rwm", + "file_mode": 438, + "major_number": 1, + "minor_number": 5, + "path": "/dev/zero", + "type": 99 + }, + { + "cgroup_permissions": "rwm", + "file_mode": 438, + "major_number": 1, + "minor_number": 7, + "path": "/dev/full", + "type": 99 + }, + { + "cgroup_permissions": "rwm", + "file_mode": 438, + "major_number": 5, + "path": "/dev/tty", + "type": 99 + }, + { + "cgroup_permissions": "rwm", + "file_mode": 438, + "major_number": 1, + "minor_number": 9, + "path": "/dev/urandom", + "type": 99 + }, + { + "cgroup_permissions": "rwm", + "file_mode": 438, + "major_number": 1, + "minor_number": 8, + "path": "/dev/random", + "type": 99 + } + ], + "environment": [ + "HOME=/", + "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "HOSTNAME=koye", + "TERM=xterm" + ], + "hostname": "koye", + "namespaces": { + "NEWIPC": true, + "NEWNET": true, + "NEWNS": true, + "NEWPID": true, + "NEWUTS": true + }, + "networks": [ + { + "address": "127.0.0.1/0", + "gateway": "localhost", + "mtu": 1500, + "type": "loopback" + } + ], + "tty": true, + "user": "daemon" +} From d28d8b67a956aa969c28f1d596fe7443fe7fd5df Mon Sep 17 00:00:00 2001 From: Michael Crosby Date: Fri, 20 Jun 2014 10:01:25 -0700 Subject: [PATCH 2/3] Update main readme with new configs folder Docker-DCO-1.1-Signed-off-by: Michael Crosby (github: crosbymichael) --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 068c66e6..16adbefb 100644 --- a/README.md +++ b/README.md @@ -13,7 +13,7 @@ a `container.json` file is placed with the runtime configuration for how the pro should be contained and run. Environment, networking, and different capabilities for the process are specified in this file. The configuration is used for each process executed inside the container. -See the `container.json` file for what the configuration should look like. +See the `sampel_configs` folder for examples of what the container configuration should look like. Using this configuration and the current directory holding the rootfs for a process, one can use libcontainer to exec the container. Running the life of the namespace, a `pid` file is written to the current directory with the pid of the namespaced process to the external world. A client can use this pid to wait, kill, or perform other operation with the container. If a user tries to run a new process inside an existing container with a live namespace, the namespace will be joined by the new process. From 746bd3b8ab5471781829b98a1adb69091f70759d Mon Sep 17 00:00:00 2001 From: Michael Crosby Date: Fri, 20 Jun 2014 10:39:50 -0700 Subject: [PATCH 3/3] Fix unit test path Docker-DCO-1.1-Signed-off-by: Michael Crosby (github: crosbymichael) --- container_test.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/container_test.go b/container_test.go index deb65aa8..a0008f35 100644 --- a/container_test.go +++ b/container_test.go @@ -17,7 +17,7 @@ func contains(expected string, values []string) bool { } func TestContainerJsonFormat(t *testing.T) { - f, err := os.Open("container.json") + f, err := os.Open("sample_configs/attach_to_bridge.json") if err != nil { t.Fatal("Unable to open container.json") }