55ae447a9d
Export more functions from libcontainer
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-04-30 17:18:07 -07:00
68690eecdb
Split term files to make it easier to manage
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-04-30 17:04:24 -07:00
b4f098e706
Export syncpipe fields
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-04-30 17:02:45 -07:00
dcd57b8b41
Remove statewriter interface, export more libcontainer funcs
...
This temp. expands the Exec method's signature but adds a more robust
way to know when the container's process is actually released and begins
to run. The network interfaces are not guaranteed to be up yet but this
provides a more accurate view with a single callback at this time.
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-04-30 15:52:40 -07:00
44b79ef817
Export SetupUser
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-04-30 15:27:59 -07:00
30da95051a
Remove logger from nsinit struct
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-04-30 15:24:18 -07:00
3ceb5e32c5
Merge pull request #5448 from crosbymichael/selinux-defaults
...
Add selinux label support for processes and mount
2014-04-30 14:14:39 -07:00
d8554248b0
Merge pull request #5464 from tianon/close-leftover-fds
2014-04-30 12:27:52 -07:00
187b637515
Close extraneous file descriptors in containers
...
Without this patch, containers inherit the open file descriptors of the daemon, so my "exec 42>&2" allows us to "echo >&42 some nasty error with some bad advice" directly into the daemon log. :)
Also, "hack/dind" was already doing this due to issues caused by the inheritance, so I'm removing that hack too since this patch obsoletes it by generalizing it for all containers.
Docker-DCO-1.1-Signed-off-by: Andrew Page <admwiggin@gmail.com> (github: tianon)
2014-04-29 16:45:28 -06:00
f6bccef4d7
Add mountlabel to dev
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-04-29 03:41:44 -07:00
71bac2ca67
Initial work on selinux patch
...
This has every container using the docker daemon's pid for the processes
label so it does not work correctly.
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-04-29 03:40:05 -07:00
d5951041df
Merge pull request #5449 from tianon/remove-libcontainer-root-special-case
...
Remove "root" and "" special cases in libcontainer
2014-04-28 16:29:08 -07:00
eb9c9cabcb
Merge branch 'master' into libcontainer-fixes
...
Conflicts:
pkg/libcontainer/README.md
pkg/libcontainer/container.json
Docker-DCO-1.1-Signed-off-by: Rohit Jnagal <jnagal@google.com> (github: rjnagal)
2014-04-28 23:04:04 +00:00
a2efe18fb8
Remove "root" and "" special cases in libcontainer
...
These are unnecessary since the user package handles these cases properly already (as evidenced by the LXC backend not having these special cases).
I also updated the errors returned to match the other libcontainer error messages in this same file.
Also, switching from Setresuid to Setuid directly isn't a problem, because the "setuid" system call will automatically do that if our own effective UID is root currently: (from `man 2 setuid`)
setuid() sets the effective user ID of the calling process. If the
effective UID of the caller is root, the real UID and saved set-user-
ID are also set.
Docker-DCO-1.1-Signed-off-by: Andrew Page <admwiggin@gmail.com> (github: tianon)
2014-04-28 16:46:03 -06:00
03b1a7b59e
Updated sample config to be usable. We should change the namespace
...
config to not need "value" later.
Docker-DCO-1.1-Signed-off-by: Rohit Jnagal <jnagal@google.com> (github: rjnagal)
2014-04-25 21:10:23 +00:00
70b560a66d
Updated sample config and README to match the default template for
...
native execdriver.
Docker-DCO-1.1-Signed-off-by: Rohit Jnagal <jnagal@google.com> (github: rjnagal)
2014-04-25 06:02:30 +00:00
dd1f9b5346
Improved README formatting.
...
Docker-DCO-1.1-Signed-off-by: Rohit Jnagal <jnagal@google.com> (github: rjnagal)
2014-04-25 01:23:48 +00:00
9d4eb415ac
Add enabled option to namespaces and capabilities spec in
...
container.json. Although we don't yet check for enabled everywhere.
Docker-DCO-1.1-Signed-off-by: Rohit Jnagal <jnagal@google.com> (github: rjnagal)
2014-04-25 01:10:11 +00:00
8593067f40
Fix typos in nsinit logs.
...
Docker-DCO-1.1-Signed-off-by: Rohit Jnagal <jnagal@google.com> (github: rjnagal)
2014-04-25 00:20:14 +00:00
a20f60c5f9
Fix container.json sample to be loadable by nsinit.
...
Docker-DCO-1.1-Signed-off-by: Rohit Jnagal <jnagal@google.com> (github: rjnagal)
2014-04-25 00:17:45 +00:00
5d4927c9b1
Ignore isnot exists errors for proc paths
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-04-24 10:35:20 -07:00
1cac3510ce
Update init for new apparmor import path
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-04-24 10:35:20 -07:00
3a5ecdb823
Update container.json and readme
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-04-24 10:35:20 -07:00
39efc20b0f
Move capabilities into security pkg
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-04-24 10:35:20 -07:00
a4989b28f9
Move mounts into types.go
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-04-24 10:35:20 -07:00
d4ea33bf43
Move rest of console functions to pkg
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-04-24 10:35:20 -07:00
9cb39c7274
Refactor mounts into pkg to make changes easier
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-04-24 10:35:20 -07:00
b589e619aa
Move console into its own package
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-04-24 10:35:20 -07:00
772023089b
Mount over dev and only copy allowed nodes in
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-04-24 10:35:20 -07:00
d001be23ca
No not mount sysfs by default for non privilged containers
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-04-24 10:35:20 -07:00
4d2d63546b
Add restrictions to proc in libcontainer
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-04-24 10:35:19 -07:00
2ded58e3da
Move apparmor into security sub dir
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-04-24 10:35:19 -07:00
a10479fef7
Merge pull request #5328 from crosbymichael/refactor-cgroups
...
Refactor cgroups into subsystems and support metrics
2014-04-21 14:06:17 -07:00
ad442c6e36
Move raw cgroups into fs package (filesystem)
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-04-18 21:34:26 -07:00
21d9b9a86a
Move systemd code into pkg
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-04-18 21:30:08 -07:00
956cdea49f
Refactor cgroups file locations
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-04-18 21:14:58 -07:00
613c48e3dd
Move apparmor to top level pkg
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-04-13 23:33:25 +00:00
811700f9f4
Use apparmor_parser directly
...
The current load script does alot of things. If it does not find the
parser loaded on the system it will just exit 0 and not load the
profile. We think it should fail loudly if it cannot load the profile
and apparmor is enabled on the system.
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-04-13 23:31:10 +00:00
0868f77370
Merge pull request #5143 from kzys/ns-nil
...
Avoid "invalid memory address or nil pointer dereference" panic
2014-04-10 11:07:35 -07:00
4a38c259c1
Merge pull request #5131 from crosbymichael/shm-mode
...
Change shm mode to 1777
2014-04-10 07:50:32 -07:00
d2ef2bada1
Merge pull request #5115 from alexlarsson/fix-libcontainer-network-rhel6
...
Fix libcontainer network support on rhel6
2014-04-10 07:45:12 -07:00
62f9984e05
Avoid "invalid memory address or nil pointer dereference" panic
...
libcontainer.GetNamespace returns nil on FreeBSD because
libcontainer.namespaceList is empty. In this case, Namespaces#Get should
return nil instead of being panic.
Docker-DCO-1.1-Signed-off-by: Kato Kazuyoshi <kato.kazuyoshi@gmail.com> (github: kzys)
2014-04-10 22:07:29 +09:00
c2644a1bee
Fix libcontainer network support on rhel6
...
It seems that netlink in older kernels, including RHEL6, does not
support RTM_SETLINK with IFLA_MASTER. It just silently ignores it, reporting
no error, causing netlink.NetworkSetMaster() to not do anything yet
return no error.
We fix this by introducing and using AddToBridge() in a very similar manner
to CreateBridge(), which use the old ioctls directly.
This fixes https://github.com/dotcloud/docker/issues/4668
Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
2014-04-09 15:44:18 +02:00
c4222aca03
Change shm mode to 1777
...
Fixes #5126
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-04-09 10:53:32 +00:00
ca4ab79a9d
Check for apparmor enabled on host to populate profile
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-04-09 10:22:17 +00:00
ea96c1f436
Backup current docker apparmor profile and replace it with the new one
...
Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume@charmes.net> (github: creack)
2014-04-08 11:09:31 -07:00
6d5da8e354
Merge pull request #5049 from Supermathie/aa-fix
...
apparmor: docker-default: Include base abstraction
2014-04-07 21:34:01 -07:00
493d914edf
Merge pull request #5025 from dstine/readme-fix
...
fixed two readme typos
2014-04-07 19:31:16 -07:00
e00e730152
fixed three more typos
2014-04-07 22:09:15 -04:00
471098f7cc
Ensure that ro mounts are remounted
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-04-07 18:23:22 -07:00
Michael Crosby
Guillaume J. Charmes
Michael Crosby
Tianon Gravi
Victor Vieux
Rohit Jnagal
Kato Kazuyoshi
Alexander Larsson
Guillaume J. Charmes
Dan Stine