jasder
/
runc
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Move linux specific options to linux spec 

This moves some of the linux specific options like namespaces and
devices to the linux config document.  It also removes processes as an
array and replaces it with a single process.

It adds the "platform" struct for OS and Arch and updates many of the
examples to match the changes.  I also remove some of the redundant
windows examples on the portable spec document because they did not add
any extra value and many values were the same.

Signed-off-by: Michael Crosby <crosbymichael@gmail.com>
This commit is contained in:
Michael Crosby 2015-06-29 11:54:10 -07:00
parent 25e30fef38
commit 9eb09f9593
2 changed files with 56 additions and 102 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
config-linux.md
View File

@ -1,8 +1,7 @@
# Linux # Linux
## Linux Namespaces ## Linux Namespaces
```json
```
"namespaces": [ "namespaces": [
"process", "process",
"network", "network",
@ -10,7 +9,7 @@
"ipc", "ipc",
"uts", "uts",
"user" "user"
], ]
``` ```
Namespaces for the container are specified as an array of strings under the namespaces key. The list of constants that can be used is portable across operating systems. Here is a table mapping these names to native OS equivalent. Namespaces for the container are specified as an array of strings under the namespaces key. The list of constants that can be used is portable across operating systems. Here is a table mapping these names to native OS equivalent.
@ -29,18 +28,34 @@ For Linux the mapping is
* user -> user uids/gids on the host are mapped to different uids/gids in the container, so root in a container could be a non-root, unprivileged uid on the host * user -> user uids/gids on the host are mapped to different uids/gids in the container, so root in a container could be a non-root, unprivileged uid on the host
### Access to devices
```json
"devices": [
"null",
"random",
"full",
"tty",
"zero",
"urandom"
]
```
Devices is an array specifying the list of devices from the host to make available in the container.
The array contains names: for each name, the device /dev/<name> will be made available inside the container.
## Linux Control groups ## Linux Control groups
## Linux Seccomp ## Linux Seccomp
## Linux Process Capabilities ## Linux Process Capabilities
``` ```json
"capabilities": [ "capabilities": [
"AUDIT_WRITE", "AUDIT_WRITE",
"KILL", "KILL",
"NET_BIND_SERVICE" "NET_BIND_SERVICE"
], ]
``` ```
capabilities is an array of Linux process capabilities. Valid values are the string after `CAP_` for capabilities defined in http://linux.die.net/man/7/capabilities capabilities is an array of Linux process capabilities. Valid values are the string after `CAP_` for capabilities defined in http://linux.die.net/man/7/capabilities
@ -49,4 +64,3 @@ capabilities is an array of Linux process capabilities. Valid values are the str
## Apparmor ## Apparmor

108
config.md
View File

@ -2,7 +2,7 @@
The container’s top-level directory MUST contain a configuration file called config.json. The configuration file MUST comply with the Open Container Configuration JSON Schema attached to this document. For now the schema is defined in [spec.go](https://github.com/opencontainers/runc/blob/master/spec.go) and [spec_linux.go](https://github.com/opencontainers/runc/blob/master/spec_linux.go), this will be moved to a JSON schema overtime. The container’s top-level directory MUST contain a configuration file called config.json. The configuration file MUST comply with the Open Container Configuration JSON Schema attached to this document. For now the schema is defined in [spec.go](https://github.com/opencontainers/runc/blob/master/spec.go) and [spec_linux.go](https://github.com/opencontainers/runc/blob/master/spec_linux.go), this will be moved to a JSON schema overtime.
The configuration file contains metadata necessary to implement standard operations against the container. This includes processes to run, environment variables to inject, sandboxing features to use, etc. The configuration file contains metadata necessary to implement standard operations against the container. This includes process to run, environment variables to inject, sandboxing features to use, etc.
Below is a detailed description of each field defined in the configuration format. Below is a detailed description of each field defined in the configuration format.
@ -10,10 +10,9 @@ Below is a detailed description of each field defined in the configuration forma
The `version` element specifies the version of the OCF specification which the container complies with. If the container is compliant with multiple versions, it SHOULD advertise the most recent known version to be supported. The `version` element specifies the version of the OCF specification which the container complies with. If the container is compliant with multiple versions, it SHOULD advertise the most recent known version to be supported.
*Linux example* *Example*
```json
``` "version": "1"
"version": "1",
``` ```
## File system configuration ## File system configuration
@ -24,18 +23,12 @@ The rootfs string element specifies the path to the root file system for the con
The readonlyRootfs is an optional boolean element which defaults to false. If it is true, access to the root file system MUST be read-only for all processes running inside it, whether you want the root file system to be readonly or not for the processes running on it. The readonlyRootfs is an optional boolean element which defaults to false. If it is true, access to the root file system MUST be read-only for all processes running inside it, whether you want the root file system to be readonly or not for the processes running on it.
*Example (Linux)* *Example*
```json
``` "root": {
"rootfs": "rootfs", "rootfs": "rootfs",
"readonlyRootfs": true, "readonlyRootfs": true
``` }
*Example (Windows)*
```
"rootfs": "My Fancy Root FS",
"readonlyRootfs": true,
``` ```
Additional file systems can be declared as "mounts", declared by the array element mounts. The parameters are similar to the ones in Linux mount system call. [http://linux.die.net/man/2/mount](http://linux.die.net/man/2/mount) Additional file systems can be declared as "mounts", declared by the array element mounts. The parameters are similar to the ones in Linux mount system call. [http://linux.die.net/man/2/mount](http://linux.die.net/man/2/mount)
@ -50,7 +43,7 @@ options: in the fstab format [https://wiki.archlinux.org/index.php/Fstab](https:
*Example (Linux)* *Example (Linux)*
``` ```json
"mounts": [ "mounts": [
{ {
"type": "proc", "type": "proc",
@ -80,16 +73,15 @@ options: in the fstab format [https://wiki.archlinux.org/index.php/Fstab](https:
``` ```
*Example (Windows)* *Example (Windows)*
``` ```json
"mounts": [ "mounts": [
{ {
"type": "ntfs", "type": "ntfs",
"source": "\\?\Volume\{2eca078d-5cbc-43d3-aff8-7e8511f60d0e}\ "source": "\\?\Volume\{2eca078d-5cbc-43d3-aff8-7e8511f60d0e}\",
",
"destination": "C:\Users\crosbymichael\My Fancy Mount Point\", "destination": "C:\Users\crosbymichael\My Fancy Mount Point\",
"options": "" "options": ""
} }
]
``` ```
See links for details about mountvol in Windows. See links for details about mountvol in Windows.
@ -106,11 +98,10 @@ See links for details about mountvol in Windows.
- Environment variables - Environment variables
- Working directory - Working directory
*Example (Linux)* *Example*
``` ```json
"processes": [ "process": {
{ "terminal": true,
"tty": true,
"user": "daemon", "user": "daemon",
"args": [ "args": [
"sh" "sh"
@ -121,13 +112,6 @@ See links for details about mountvol in Windows.
], ],
"cwd": "" "cwd": ""
} }
],
```
The processes to be created inside the container are specified in a processes array. They are started in order.
```
"processes": [...]
``` ```
The command to start a process is specified in an array of args. It will be run in the working directory specified in the string cwd. The command to start a process is specified in an array of args. It will be run in the working directory specified in the string cwd.
@ -138,66 +122,22 @@ Elements in the array are specified as Strings in the form "KEY=value"
The user inside the container under which the process is running is specified under the user key. The user inside the container under which the process is running is specified under the user key.
tty is a boolean that lets you specify whether you want a terminal attached to that process. tty cannot be set to true for more than one process in the array, else oc returns the error code THERE_CAN_BE_ONLY_ONE_TTY. terminal is a boolean that lets you specify whether you want a terminal attached to that process.
*Example (Windows)*
```
"processes": [
{
"tty": true,
"user": "Contoso\ScottGu",
"args": [
"cmd.exe"
],
"env": [
"PATH=D:\Windows\Microsoft.NET\Framework\v4.0.30319;D:\Program Files (x86)\Git\bin",
"TERM=cygwin"
],
"cwd": ""
}
],
```
hostname is a string specifying the hostname for that container as it is accessible to processes running in it. hostname is a string specifying the hostname for that container as it is accessible to processes running in it.
*Example* *Example*
```json
"hostname": "mrsdalloway"
``` ```
"hostname": "mrsdalloway",
```
### Resource Constraints
The number of CPUs is specified as a positive decimal under the key cpus.
The amount of memory allocated to this container is specified under the memory key, as an integer and is expressed in MB.
If the cpu or memory requested are too high for the underlying environment capabilities, an error code NOT_ENOUGH_CPU or NOT_ENOUGH_MEM will be returned.
### Access to devices
```
"devices": [
"null",
"random",
"full",
"tty",
"zero",
"urandom"
],
```
Devices is an array specifying the list of devices from the host to make available in the container.
The array contains names: for each name, the device /dev/<name> will be made available inside the container.
## Machine-specific configuration ## Machine-specific configuration
``` ```json
"platform": {
"os": "linux", "os": "linux",
"arch": "amd64", "arch": "amd64"
}
``` ```
os specifies the operating system family this image must run on. os specifies the operating system family this image must run on.