e7663a673e
Merge pull request #70 from mheon/seccomp
...
Convert Seccomp support to use Libseccomp
2015-08-21 12:25:33 -07:00
6d0f60bb94
Merge pull request #205 from tonistiigi/exec
...
Add exec command
2015-08-21 10:45:28 -07:00
90e6d3763e
Merge pull request #212 from laijs/cleanup
...
Simple Cleanups
2015-08-19 20:16:21 -07:00
e98d8e8ae2
Merge pull request #213 from laijs/error-message
...
richer information error message for terminal
2015-08-19 20:15:19 -07:00
29ced936a6
richer information error message for terminal
...
When we use ```cat | runc``` or ```runc /dev/stdin < config.json```,
it will fail and output ```FATA[0000] Container start failed: inappropriate ioctl for device```.
It is hard for the users to find out the reason from the message:
the config.json enables the terminal but the user redirect the stdin
to an non-terminal file.
After this patch, the output will be
```FATA[0000] Container start failed: Failed to set the terminal from the stdin: inappropriate ioctl for device```
So the user can disable the terminal in the config.json.
See the #202
Cc: W. Trevor King <wking@tremily.us> (@wking)
Signed-off-by: Lai Jiangshan <jiangshanlai@gmail.com>
2015-08-20 08:25:40 +08:00
e48363d777
simplify a variable declaration
...
Signed-off-by: Lai Jiangshan <jiangshanlai@gmail.com>
2015-08-20 08:21:44 +08:00
47f294d0ed
Add exec command
...
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
2015-08-19 12:01:38 -07:00
2b9673deb9
Merge pull request #211 from mrunalp/sec_integration
...
Integrate security settings
2015-08-19 11:52:57 -07:00
0c0dedd73c
Restore container cleanup
...
Signed-off-by: rajasec <rajasec79@gmail.com>
2015-08-19 15:00:57 +05:30
31f88daf91
Integrate security settings
...
Signed-off-by: Mrunal Patel <mrunalp@gmail.com>
2015-08-18 20:10:23 -04:00
d6ae10ada4
Merge pull request #193 from tonistiigi/update-device-specs
...
Update device specs
2015-08-18 14:30:54 -07:00
ca8831fa75
Merge pull request #183 from rajasec/securityfs
...
Adding securityfs mount
2015-08-18 14:24:38 -07:00
c20bda3f71
Merge pull request #206 from mountkin/ensure-cleanup
...
Ensure the cleanup jobs in the deferrer are executed on error
2015-08-18 14:16:31 -07:00
b0ca535f75
Merge pull request #194 from LK4D4/fix_cgroups_again
...
Fix cgroups again
2015-08-18 13:49:31 -07:00
c6b6be21c5
Merge pull request #199 from clnperez/ifrdatabyte-sign-pr
...
Fixing netlink build error on ppc64le with gccgo
2015-08-18 13:48:59 -07:00
face52c223
Merge pull request #204 from tonistiigi/pause-unpause
...
Add pause/resume commands
2015-08-18 13:40:51 -07:00
bc38c9d1b0
Add pause/resume commands
...
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
2015-08-18 13:37:36 -07:00
4a478a9775
Merge pull request #209 from rajasec/tmpfsunmount
...
make localtest fills up /tmp with /tmp/libcontainer
2015-08-18 10:24:44 -07:00
ee3ebc9842
Merge pull request #197 from laijs/kill-default
...
Add the default signal (SIGTERM) for runc kill
2015-08-17 20:28:49 -07:00
8cdc409715
Fixing tmpfs
...
Signed-off-by: rajasec <rajasec79@gmail.com>
2015-08-17 06:22:48 +05:30
f0679089b9
Ensure the cleanup jobs in the deferrer are executed on error
...
Signed-off-by: Shijiang Wei <mountkin@gmail.com>
2015-08-16 12:29:04 +08:00
9bc81d1699
Fixing netlink build error on ppc64le with gccgo
...
Again. It looks like a build tag was somehow dropped between
the PR here: https://github.com/docker/libcontainer/pull/625
and the move to runc.
Signed-off-by: Christy Perez <clnperez@linux.vnet.ibm.com>
2015-08-13 17:52:47 -05:00
a6b73dbc73
Remove Seccomp build tag to fix godep
...
Signed-off-by: Matthew Heon <mheon@redhat.com>
2015-08-13 15:23:43 -04:00
6abd42c1b6
Add the default signal (SIGTERM) for runc kill
...
Signed-off-by: Lai Jiangshan <jiangshanlai@gmail.com>
2015-08-13 23:42:54 +08:00
59264040bd
Update tests to not error on library v2.2.0 and lower
...
As v2.1.0 is no longer required for successful testing, do not build it in the
Dockerfile - instead just use the version Ubuntu ships.
Signed-off-by: Matthew Heon <mheon@redhat.com>
2015-08-13 09:36:21 -04:00
8da24a5447
Update vendored Libseccomp bindings
...
Signed-off-by: Matthew Heon <mheon@redhat.com>
2015-08-13 09:36:09 -04:00
2ae581ae62
Convert Seccomp support to use Libseccomp
...
This removes the existing, native Go seccomp filter generation and replaces it
with Libseccomp. Libseccomp is a C library which provides architecture
independent generation of Seccomp filters for the Linux kernel.
This adds a dependency on v2.2.1 or above of Libseccomp.
Signed-off-by: Matthew Heon <mheon@redhat.com>
2015-08-13 07:56:27 -04:00
744a6b0e7b
Merge pull request #196 from laijs/simplify-return
...
Simplify the return on process wait
2015-08-12 21:17:35 -07:00
e8817e1104
Simplify the return on process wait
...
Simplify the code introduced by the commit d1f0d5705deb:
Return actual ProcessState on Wait error
Cc: Alexander Morozov <lk4d4@docker.com>
Signed-off-by: Lai Jiangshan <jiangshanlai@gmail.com>
2015-08-12 22:37:34 +08:00
2b28b3c276
Always use cgroup root of current process
...
Because for host PID namespace /proc/1/cgroup can point to whole other
world of cgroups.
Signed-off-by: Alexander Morozov <lk4d4@docker.com>
2015-08-11 18:04:59 -07:00
5aa6005498
Revert "Fix cgroup parent searching"
...
This reverts commit 2f9052ca29
2015-08-11 18:04:55 -07:00
b5eed4a246
Update runc to use device structs from updated spec
...
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
2015-08-11 14:24:00 -07:00
0f99c20fd0
Update specs
...
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
2015-08-11 13:50:57 -07:00
15c709ed73
Merge pull request #192 from fabiokung/cgroup-per-container
...
container id is the cgroup name
2015-08-10 20:40:57 -07:00
85f40c2bc7
container id is the cgroup name
...
Without this, multiple runc containers can accidentally share the same cgroup(s)
(and change each other's limits), when runc is invoked from the same directory
(i.e.: same cwd on multiple runc executions).
After these changes, each runc container will run on its own cgroup(s). Before,
the only workaround was to invoke runc from an unique (temporary?) cwd for each
container.
Common cgroup configuration (and hierarchical limits) can be set by having
multiple runc containers share the same cgroup parent, which is the cgroup of
the process executing runc.
Signed-off-by: Fabio Kung <fabio.kung@gmail.com>
2015-08-10 16:41:39 -07:00
d90058ced8
Merge pull request #188 from duglin/UpdateUsage
...
Minor update to usage/help text
2015-08-10 16:32:36 -07:00
a96723f922
Merge pull request #191 from LK4D4/fix_cgroup_parent
...
Fix cgroup parent searching
2015-08-10 17:41:24 -04:00
2f9052ca29
Fix cgroup parent searching
...
I had pretty convenient input data to miss this bug.
Signed-off-by: Alexander Morozov <lk4d4@docker.com>
2015-08-10 14:30:05 -07:00
88de2aee5a
Minor update to usage/help text
...
Seemed a little out of date
Signed-off-by: Doug Davis <dug@us.ibm.com>
2015-08-10 12:56:53 -07:00
9be9157fc5
Merge pull request #182 from willmtemple/master
...
Change example JSON to refer to "pid" namespace rather than "process."
2015-08-05 14:18:42 -04:00
a5d98a64e0
Changed README.md to refer to "pid" namespace rather than "process."
...
Signed-off-by: William Temple <wtemple@redhat.com>
2015-08-05 14:09:53 -04:00
24f7a10a93
Adding securityfs mount
...
Signed-off-by: rajasec <rajasec79@gmail.com>
2015-08-05 16:50:08 +05:30
bdd67b9029
Merge pull request #180 from LK4D4/rename_proc_ns
...
Rename process namespace to pid
2015-08-04 17:49:46 -04:00
765fa4a34e
Merge pull request #181 from mrunalp/fixes
...
Fix minor stylistic issues
2015-08-04 17:49:33 -04:00
f3a3025933
Fix minor stylistic issues
...
Signed-off-by: Mrunal Patel <mrunalp@gmail.com>
2015-08-04 17:44:45 -04:00
6d1e6a17e1
Rename process namespace to pid
...
It's "pid" in opencontainers/specs
Signed-off-by: Alexander Morozov <lk4d4@docker.com>
2015-08-04 14:12:21 -07:00
a28f627c39
Merge pull request #96 from mrunalp/dev_mount_fix
...
Don't make modifications to /dev when it is bind mounted
2015-08-04 17:07:03 -04:00
c9d5850629
Don't make modifications to /dev there are no devices in the configuration
...
Signed-off-by: Mrunal Patel <mrunalp@gmail.com>
2015-08-04 16:57:29 -04:00
aa6aa41205
Merge pull request #178 from crosbymichael/runc-kill
...
Runc kill
2015-08-04 11:47:27 -07:00
fbb8d3e8fe
Add parse signal function for runc kill
...
Signed-off-by: Michael Crosby <crosbymichael@gmail.com>
2015-08-04 11:35:13 -07:00
Mrunal Patel
Lai Jiangshan
Tonis Tiigi
Michael Crosby
rajasec
Mrunal Patel
Shijiang Wei
Michael Chase-Salerno
Matthew Heon
Alexander Morozov
Alexander Morozov
Fabio Kung
Doug Davis
William Temple