jasder
/
runc
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
416 Commits 5 Branches 25 Tags 17 MiB
Commit Graph

416 Commits

Author SHA1 Message Date
Rohit Jnagal 03b1a7b59e Updated sample config to be usable. We should change the namespace 
config to not need "value" later.

Docker-DCO-1.1-Signed-off-by: Rohit Jnagal <jnagal@google.com> (github: rjnagal)
 2014-04-25 21:10:23 +00:00
Rohit Jnagal 70b560a66d Updated sample config and README to match the default template for 
native execdriver.

Docker-DCO-1.1-Signed-off-by: Rohit Jnagal <jnagal@google.com> (github: rjnagal)
 2014-04-25 06:02:30 +00:00
Rohit Jnagal dd1f9b5346 Improved README formatting. 
Docker-DCO-1.1-Signed-off-by: Rohit Jnagal <jnagal@google.com> (github: rjnagal)
 2014-04-25 01:23:48 +00:00
Rohit Jnagal 9d4eb415ac Add enabled option to namespaces and capabilities spec in 
container.json. Although we don't yet check for enabled everywhere.

Docker-DCO-1.1-Signed-off-by: Rohit Jnagal <jnagal@google.com> (github: rjnagal)
 2014-04-25 01:10:11 +00:00
Rohit Jnagal 8593067f40 Fix typos in nsinit logs. 
Docker-DCO-1.1-Signed-off-by: Rohit Jnagal <jnagal@google.com> (github: rjnagal)
 2014-04-25 00:20:14 +00:00
Rohit Jnagal a20f60c5f9 Fix container.json sample to be loadable by nsinit. 
Docker-DCO-1.1-Signed-off-by: Rohit Jnagal <jnagal@google.com> (github: rjnagal)
 2014-04-25 00:17:45 +00:00
Michael Crosby 5d4927c9b1 Ignore isnot exists errors for proc paths 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-04-24 10:35:20 -07:00
Michael Crosby 1cac3510ce Update init for new apparmor import path 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-04-24 10:35:20 -07:00
Michael Crosby 3a5ecdb823 Update container.json and readme 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-04-24 10:35:20 -07:00
Michael Crosby 39efc20b0f Move capabilities into security pkg 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-04-24 10:35:20 -07:00
Michael Crosby a4989b28f9 Move mounts into types.go 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-04-24 10:35:20 -07:00
Michael Crosby d4ea33bf43 Move rest of console functions to pkg 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-04-24 10:35:20 -07:00
Michael Crosby 9cb39c7274 Refactor mounts into pkg to make changes easier 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-04-24 10:35:20 -07:00
Michael Crosby b589e619aa Move console into its own package 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-04-24 10:35:20 -07:00
Michael Crosby 772023089b Mount over dev and only copy allowed nodes in 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-04-24 10:35:20 -07:00
Michael Crosby d001be23ca No not mount sysfs by default for non privilged containers 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-04-24 10:35:20 -07:00
Michael Crosby 4d2d63546b Add restrictions to proc in libcontainer 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-04-24 10:35:19 -07:00
Michael Crosby 2ded58e3da Move apparmor into security sub dir 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-04-24 10:35:19 -07:00
Guillaume J. Charmes a10479fef7 Merge pull request #5328 from crosbymichael/refactor-cgroups 
Refactor cgroups into subsystems and support metrics
 2014-04-21 14:06:17 -07:00
Michael Crosby ad442c6e36 Move raw cgroups into fs package (filesystem) 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-04-18 21:34:26 -07:00
Michael Crosby 21d9b9a86a Move systemd code into pkg 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-04-18 21:30:08 -07:00
Michael Crosby 956cdea49f Refactor cgroups file locations 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-04-18 21:14:58 -07:00
Michael Crosby 613c48e3dd Move apparmor to top level pkg 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-04-13 23:33:25 +00:00
Michael Crosby 811700f9f4 Use apparmor_parser directly 
The current load script does alot of things.  If it does not find the
parser loaded on the system it will just exit 0 and not load the
profile.  We think it should fail loudly if it cannot load the profile
and apparmor is enabled on the system.
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-04-13 23:31:10 +00:00
Victor Vieux 0868f77370 Merge pull request #5143 from kzys/ns-nil 
Avoid "invalid memory address or nil pointer dereference" panic
 2014-04-10 11:07:35 -07:00
Guillaume J. Charmes 4a38c259c1 Merge pull request #5131 from crosbymichael/shm-mode 
Change shm mode to 1777
 2014-04-10 07:50:32 -07:00
Guillaume J. Charmes d2ef2bada1 Merge pull request #5115 from alexlarsson/fix-libcontainer-network-rhel6 
Fix libcontainer network support on rhel6
 2014-04-10 07:45:12 -07:00
Kato Kazuyoshi 62f9984e05 Avoid "invalid memory address or nil pointer dereference" panic 
libcontainer.GetNamespace returns nil on FreeBSD because
libcontainer.namespaceList is empty. In this case, Namespaces#Get should
return nil instead of being panic.

Docker-DCO-1.1-Signed-off-by: Kato Kazuyoshi <kato.kazuyoshi@gmail.com> (github: kzys)
 2014-04-10 22:07:29 +09:00
Alexander Larsson c2644a1bee Fix libcontainer network support on rhel6 
It seems that netlink in older kernels, including RHEL6, does not
support RTM_SETLINK with IFLA_MASTER. It just silently ignores it, reporting
no error, causing netlink.NetworkSetMaster() to not do anything yet
return no error.

We fix this by introducing and using AddToBridge() in a very similar manner
to CreateBridge(), which use the old ioctls directly.

This fixes https://github.com/dotcloud/docker/issues/4668

Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
 2014-04-09 15:44:18 +02:00
Michael Crosby c4222aca03 Change shm mode to 1777 
Fixes #5126
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-04-09 10:53:32 +00:00
Michael Crosby ca4ab79a9d Check for apparmor enabled on host to populate profile 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-04-09 10:22:17 +00:00
Guillaume J. Charmes ea96c1f436 Backup current docker apparmor profile and replace it with the new one 
Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume@charmes.net> (github: creack)
 2014-04-08 11:09:31 -07:00
Guillaume J. Charmes 6d5da8e354 Merge pull request #5049 from Supermathie/aa-fix 
apparmor: docker-default: Include base abstraction
 2014-04-07 21:34:01 -07:00
Guillaume J. Charmes 493d914edf Merge pull request #5025 from dstine/readme-fix 
fixed two readme typos
 2014-04-07 19:31:16 -07:00
Dan Stine e00e730152 fixed three more typos 2014-04-07 22:09:15 -04:00
Michael Crosby 471098f7cc Ensure that ro mounts are remounted 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-04-07 18:23:22 -07:00
Michael Brown e17f472e05 apparmor: pull in variables from tunables/global 
The variables that were defined at the top of the apparmor profile are best
pulled in via the <tunables/global> include.

Docker-DCO-1.1-Signed-off-by: Michael Brown <michael.brown@discourse.org> (github: Supermathie)
 2014-04-07 03:04:27 -04:00
Michael Brown d704e4a9c7 apparmor: abstractions/base expects pid variable 
Add 'pid' variable pointing to 'self' to allow parsing of profile to succeed

Docker-DCO-1.1-Signed-off-by: Michael Brown <michael.brown@discourse.org> (github: Supermathie)
 2014-04-07 02:47:43 -04:00
Michael Brown 7e43b7e4f4 apparmor: docker-default: Include base abstraction 
Encountered problems on 14.04 relating to signals between container
processes being blocked by apparmor. The base abstraction contains
appropriate rules to allow this communication.

Docker-DCO-1.1-Signed-off-by: Michael Brown <michael.brown@discourse.org> (github: Supermathie)
 2014-04-07 02:19:38 -04:00
Dan Stine c9b3867e05 fixed two readme typos 2014-04-04 08:12:17 -04:00
Michael Crosby 8e3e23d5ef Merge branch 'selinux' of https://github.com/rhatdan/docker into rhatdan-selinux 
Conflicts:
	pkg/selinux/selinux.go
	runtime/execdriver/lxc/lxc_template.go

Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-04-02 16:11:35 +00:00
Dan Walsh 476a799914 In certain cases, setting the process label will not happen. 
When the code attempts to set the ProcessLabel, it checks if SELinux Is
enabled.  We have seen a case with some of our patches where the code
is fooled by the container to think that SELinux is not enabled.  Calling
label.Init before setting up the rest of the container, tells the library that
SELinux is enabled and everything works fine.

Docker-DCO-1.1-Signed-off-by: Dan Walsh <dwalsh@redhat.com> (github: rhatdan)
 2014-04-03 09:32:29 -04:00
Michael Crosby 89db8365b8 Remove loopback setup for native driver 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-04-02 13:12:52 +00:00
Victor Vieux 23f80b4d97 Merge pull request #4953 from rhatdan/selinux 
These two patches should fix problems we see with running docker in the wild.
 2014-04-02 16:36:41 -07:00
unclejack b115316925 Merge pull request #4867 from crosbymichael/clean-shutdown 
Cleanly shutdown docker
 2014-04-02 01:48:03 +03:00
Michael Crosby 990c5638a3 Merge pull request #4942 from vieux/cleanup_dev_libcontainer 
remove setupDev from libcontainer
 2014-04-01 14:28:17 -07:00
Dan Walsh 30815cf423 In certain cases, setting the process label will not happen. 
When the code attempts to set the ProcessLabel, it checks if SELinux Is
enabled.  We have seen a case with some of our patches where the code
is fooled by the container to think that SELinux is not enabled.  Calling
label.Init before setting up the rest of the container, tells the library that
SELinux is enabled and everything works fine.

Docker-DCO-1.1-Signed-off-by: Dan Walsh <dwalsh@redhat.com> (github: rhatdan)
 2014-04-01 13:30:10 -04:00
Michael Crosby 69df6c423e Don't send prctl to be consistent with other drivers 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-04-01 07:12:50 +00:00
Michael Crosby 1716cbe806 Ensure a reliable way to kill ghost containers on reboot 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
 2014-04-01 07:11:41 +00:00
Victor Vieux f99f51db37 remove setupDev from libcontainer 
Docker-DCO-1.1-Signed-off-by: Victor Vieux <victor.vieux@docker.com> (github: vieux)
 2014-04-01 00:28:44 +00:00