c32dde5b |
package daemon
import (
"io"
"os" |
f950de57 |
"strings" |
c32dde5b |
|
91e197d6 |
"github.com/docker/docker/api/types" |
6bb0d181 |
"github.com/docker/docker/container" |
d453fe35 |
"github.com/docker/docker/errdefs" |
c32dde5b |
"github.com/docker/docker/pkg/archive"
"github.com/docker/docker/pkg/chrootarchive"
"github.com/docker/docker/pkg/ioutils" |
7f665985 |
"github.com/docker/docker/pkg/system" |
f95f5828 |
"github.com/pkg/errors" |
c32dde5b |
)
// ErrExtractPointNotDirectory is used to convey that the operation to extract
// a tar archive to a directory in a container has failed because the specified
// path does not refer to a directory.
var ErrExtractPointNotDirectory = errors.New("extraction point is not a directory")
|
7a7357da |
// The daemon will use the following interfaces if the container fs implements
// these for optimized copies to and from the container.
type extractor interface {
ExtractArchive(src io.Reader, dst string, opts *archive.TarOptions) error
}
type archiver interface {
ArchivePath(src string, opts *archive.TarOptions) (io.ReadCloser, error)
}
// helper functions to extract or archive
func extractArchive(i interface{}, src io.Reader, dst string, opts *archive.TarOptions) error {
if ea, ok := i.(extractor); ok {
return ea.ExtractArchive(src, dst, opts)
}
return chrootarchive.Untar(src, dst, opts)
}
func archivePath(i interface{}, src string, opts *archive.TarOptions) (io.ReadCloser, error) {
if ap, ok := i.(archiver); ok {
return ap.ArchivePath(src, opts)
}
return archive.TarWithOptions(src, opts)
}
|
47c56e43 |
// ContainerCopy performs a deprecated operation of archiving the resource at |
927b334e |
// the specified path in the container identified by the given name. |
b08f071e |
func (daemon *Daemon) ContainerCopy(name string, res string) (io.ReadCloser, error) { |
d7d512bb |
container, err := daemon.GetContainer(name) |
c32dde5b |
if err != nil {
return nil, err
}
|
481d2633 |
// Make sure an online file-system operation is permitted.
if err := daemon.isOnlineFSOperationPermitted(container); err != nil { |
87a12421 |
return nil, errdefs.System(err) |
ebcb7d6b |
}
data, err := daemon.containerCopy(container, res)
if err == nil {
return data, nil |
481d2633 |
}
|
ebcb7d6b |
if os.IsNotExist(err) {
return nil, containerFileNotFound{res, name}
} |
87a12421 |
return nil, errdefs.System(err) |
c32dde5b |
}
// ContainerStatPath stats the filesystem resource at the specified path in the
// container identified by the given name. |
b08f071e |
func (daemon *Daemon) ContainerStatPath(name string, path string) (stat *types.ContainerPathStat, err error) { |
d7d512bb |
container, err := daemon.GetContainer(name) |
c32dde5b |
if err != nil {
return nil, err
}
|
481d2633 |
// Make sure an online file-system operation is permitted.
if err := daemon.isOnlineFSOperationPermitted(container); err != nil { |
87a12421 |
return nil, errdefs.System(err) |
481d2633 |
}
|
ebcb7d6b |
stat, err = daemon.containerStatPath(container, path)
if err == nil {
return stat, nil
}
if os.IsNotExist(err) {
return nil, containerFileNotFound{path, name}
} |
87a12421 |
return nil, errdefs.System(err) |
c32dde5b |
}
// ContainerArchivePath creates an archive of the filesystem resource at the
// specified path in the container identified by the given name. Returns a
// tar archive of the resource and whether it was a directory or a single file. |
b08f071e |
func (daemon *Daemon) ContainerArchivePath(name string, path string) (content io.ReadCloser, stat *types.ContainerPathStat, err error) { |
d7d512bb |
container, err := daemon.GetContainer(name) |
c32dde5b |
if err != nil {
return nil, nil, err
}
|
481d2633 |
// Make sure an online file-system operation is permitted.
if err := daemon.isOnlineFSOperationPermitted(container); err != nil { |
87a12421 |
return nil, nil, errdefs.System(err) |
ebcb7d6b |
}
content, stat, err = daemon.containerArchivePath(container, path)
if err == nil {
return content, stat, nil |
481d2633 |
}
|
ebcb7d6b |
if os.IsNotExist(err) {
return nil, nil, containerFileNotFound{path, name}
} |
87a12421 |
return nil, nil, errdefs.System(err) |
c32dde5b |
}
// ContainerExtractToDir extracts the given archive to the specified location
// in the filesystem of the container identified by the given name. The given
// path must be of a directory in the container. If it is not, the error will
// be ErrExtractPointNotDirectory. If noOverwriteDirNonDir is true then it will
// be an error if unpacking the given content would cause an existing directory
// to be replaced with a non-directory and vice versa. |
8a7ff5ff |
func (daemon *Daemon) ContainerExtractToDir(name, path string, copyUIDGID, noOverwriteDirNonDir bool, content io.Reader) error { |
d7d512bb |
container, err := daemon.GetContainer(name) |
c32dde5b |
if err != nil {
return err
}
|
481d2633 |
// Make sure an online file-system operation is permitted.
if err := daemon.isOnlineFSOperationPermitted(container); err != nil { |
87a12421 |
return errdefs.System(err) |
481d2633 |
}
|
ebcb7d6b |
err = daemon.containerExtractToDir(container, path, copyUIDGID, noOverwriteDirNonDir, content)
if err == nil {
return nil
}
if os.IsNotExist(err) {
return containerFileNotFound{path, name}
} |
87a12421 |
return errdefs.System(err) |
c32dde5b |
}
|
3a497650 |
// containerStatPath stats the filesystem resource at the specified path in this |
c32dde5b |
// container. Returns stat info about the resource. |
6bb0d181 |
func (daemon *Daemon) containerStatPath(container *container.Container, path string) (stat *types.ContainerPathStat, err error) { |
c32dde5b |
container.Lock()
defer container.Unlock()
|
3a497650 |
if err = daemon.Mount(container); err != nil { |
c32dde5b |
return nil, err
} |
3a497650 |
defer daemon.Unmount(container) |
c32dde5b |
|
63efc120 |
err = daemon.mountVolumes(container) |
9a2d0bc3 |
defer container.DetachAndUnmount(daemon.LogVolumeEvent) |
c32dde5b |
if err != nil {
return nil, err
}
|
7a7357da |
// Normalize path before sending to rootfs
path = container.BaseFS.FromSlash(path)
|
6bb0d181 |
resolvedPath, absPath, err := container.ResolvePath(path) |
c32dde5b |
if err != nil {
return nil, err
}
|
6bb0d181 |
return container.StatPath(resolvedPath, absPath) |
c32dde5b |
}
|
3a497650 |
// containerArchivePath creates an archive of the filesystem resource at the specified |
c32dde5b |
// path in this container. Returns a tar archive of the resource and stat info
// about the resource. |
6bb0d181 |
func (daemon *Daemon) containerArchivePath(container *container.Container, path string) (content io.ReadCloser, stat *types.ContainerPathStat, err error) { |
c32dde5b |
container.Lock()
defer func() {
if err != nil {
// Wait to unlock the container until the archive is fully read
// (see the ReadCloseWrapper func below) or if there is an error
// before that occurs.
container.Unlock()
}
}()
|
3a497650 |
if err = daemon.Mount(container); err != nil { |
c32dde5b |
return nil, nil, err
}
defer func() {
if err != nil {
// unmount any volumes |
9a2d0bc3 |
container.DetachAndUnmount(daemon.LogVolumeEvent) |
c32dde5b |
// unmount the container's rootfs |
3a497650 |
daemon.Unmount(container) |
c32dde5b |
}
}()
|
63efc120 |
if err = daemon.mountVolumes(container); err != nil { |
c32dde5b |
return nil, nil, err
}
|
7a7357da |
// Normalize path before sending to rootfs
path = container.BaseFS.FromSlash(path)
|
6bb0d181 |
resolvedPath, absPath, err := container.ResolvePath(path) |
c32dde5b |
if err != nil {
return nil, nil, err
}
|
6bb0d181 |
stat, err = container.StatPath(resolvedPath, absPath) |
c32dde5b |
if err != nil {
return nil, nil, err
}
|
75f6929b |
// We need to rebase the archive entries if the last element of the
// resolved path was a symlink that was evaluated and is now different
// than the requested path. For example, if the given path was "/foo/bar/",
// but it resolved to "/var/lib/docker/containers/{id}/foo/baz/", we want
// to ensure that the archive entries start with "bar" and not "baz". This
// also catches the case when the root directory of the container is
// requested: we want the archive entries to start with "/" and not the
// container ID. |
7a7357da |
driver := container.BaseFS
// Get the source and the base paths of the container resolved path in order
// to get the proper tar options for the rebase tar.
resolvedPath = driver.Clean(resolvedPath)
if driver.Base(resolvedPath) == "." {
resolvedPath += string(driver.Separator()) + "."
}
sourceDir, sourceBase := driver.Dir(resolvedPath), driver.Base(resolvedPath)
opts := archive.TarResourceRebaseOpts(sourceBase, driver.Base(absPath))
data, err := archivePath(driver, sourceDir, opts) |
c32dde5b |
if err != nil {
return nil, nil, err
}
content = ioutils.NewReadCloserWrapper(data, func() error {
err := data.Close() |
9a2d0bc3 |
container.DetachAndUnmount(daemon.LogVolumeEvent) |
3a497650 |
daemon.Unmount(container) |
c32dde5b |
container.Unlock()
return err
})
|
ca5ede2d |
daemon.LogContainerEvent(container, "archive-path") |
c32dde5b |
return content, stat, nil
}
|
3a497650 |
// containerExtractToDir extracts the given tar archive to the specified location in the |
c32dde5b |
// filesystem of this container. The given path must be of a directory in the
// container. If it is not, the error will be ErrExtractPointNotDirectory. If
// noOverwriteDirNonDir is true then it will be an error if unpacking the
// given content would cause an existing directory to be replaced with a non-
// directory and vice versa. |
8a7ff5ff |
func (daemon *Daemon) containerExtractToDir(container *container.Container, path string, copyUIDGID, noOverwriteDirNonDir bool, content io.Reader) (err error) { |
c32dde5b |
container.Lock()
defer container.Unlock()
|
3a497650 |
if err = daemon.Mount(container); err != nil { |
c32dde5b |
return err
} |
3a497650 |
defer daemon.Unmount(container) |
c32dde5b |
|
63efc120 |
err = daemon.mountVolumes(container) |
9a2d0bc3 |
defer container.DetachAndUnmount(daemon.LogVolumeEvent) |
c32dde5b |
if err != nil {
return err
}
|
7a7357da |
// Normalize path before sending to rootfs'
path = container.BaseFS.FromSlash(path)
driver := container.BaseFS
|
7f665985 |
// Check if a drive letter supplied, it must be the system drive. No-op except on Windows |
7a7357da |
path, err = system.CheckSystemDriveAndRemoveDriveLetter(path, driver) |
7f665985 |
if err != nil {
return err
}
|
75f6929b |
// The destination path needs to be resolved to a host path, with all
// symbolic links followed in the scope of the container's rootfs. Note |
6bb0d181 |
// that we do not use `container.ResolvePath(path)` here because we need |
75f6929b |
// to also evaluate the last path element if it is a symlink. This is so
// that you can extract an archive to a symlink that points to a directory.
|
c32dde5b |
// Consider the given path as an absolute path in the container. |
7a7357da |
absPath := archive.PreserveTrailingDotOrSeparator(
driver.Join(string(driver.Separator()), path),
path,
driver.Separator()) |
c32dde5b |
|
75f6929b |
// This will evaluate the last path element if it is a symlink. |
c32dde5b |
resolvedPath, err := container.GetResourcePath(absPath)
if err != nil {
return err
}
|
7a7357da |
stat, err := driver.Lstat(resolvedPath) |
c32dde5b |
if err != nil {
return err
}
if !stat.IsDir() {
return ErrExtractPointNotDirectory
}
|
75f6929b |
// Need to check if the path is in a volume. If it is, it cannot be in a
// read-only volume. If it is not in a volume, the container cannot be
// configured with a read-only rootfs.
// Use the resolved path relative to the container rootfs as the new
// absPath. This way we fully follow any symlinks in a volume that may
// lead back outside the volume. |
f950de57 |
//
// The Windows implementation of filepath.Rel in golang 1.4 does not
// support volume style file path semantics. On Windows when using the
// filter driver, we are guaranteed that the path will always be
// a volume file path.
var baseRel string
if strings.HasPrefix(resolvedPath, `\\?\Volume{`) { |
7a7357da |
if strings.HasPrefix(resolvedPath, driver.Path()) {
baseRel = resolvedPath[len(driver.Path()):] |
f950de57 |
if baseRel[:1] == `\` {
baseRel = baseRel[1:]
}
}
} else { |
7a7357da |
baseRel, err = driver.Rel(driver.Path(), resolvedPath) |
f950de57 |
} |
c32dde5b |
if err != nil {
return err
} |
75f6929b |
// Make it an absolute path. |
7a7357da |
absPath = driver.Join(string(driver.Separator()), baseRel) |
c32dde5b |
|
7a7357da |
// @ TODO: gupta-ak: Technically, this works since it no-ops
// on Windows and the file system is local anyway on linux.
// But eventually, it should be made driver aware. |
47c56e43 |
toVolume, err := checkIfPathIsInAVolume(container, absPath)
if err != nil {
return err |
c32dde5b |
}
|
6bb0d181 |
if !toVolume && container.HostConfig.ReadonlyRootfs { |
abd72d40 |
return ErrRootFSReadOnly |
c32dde5b |
}
|
8a7ff5ff |
options := daemon.defaultTarCopyOptions(noOverwriteDirNonDir)
if copyUIDGID {
var err error
// tarCopyOptions will appropriately pull in the right uid/gid for the
// user/group and will set the options.
options, err = daemon.tarCopyOptions(container, noOverwriteDirNonDir)
if err != nil {
return err
} |
c32dde5b |
} |
8a7ff5ff |
|
7a7357da |
if err := extractArchive(driver, content, resolvedPath, options); err != nil { |
c32dde5b |
return err
}
|
ca5ede2d |
daemon.LogContainerEvent(container, "extract-to-dir") |
c32dde5b |
return nil
} |
ebf707ec |
|
6bb0d181 |
func (daemon *Daemon) containerCopy(container *container.Container, resource string) (rc io.ReadCloser, err error) { |
ebcb7d6b |
if resource[0] == '/' || resource[0] == '\\' {
resource = resource[1:]
} |
ebf707ec |
container.Lock()
defer func() {
if err != nil {
// Wait to unlock the container until the archive is fully read
// (see the ReadCloseWrapper func below) or if there is an error
// before that occurs.
container.Unlock()
}
}()
if err := daemon.Mount(container); err != nil {
return nil, err
}
defer func() {
if err != nil {
// unmount any volumes |
9a2d0bc3 |
container.DetachAndUnmount(daemon.LogVolumeEvent) |
ebf707ec |
// unmount the container's rootfs
daemon.Unmount(container)
}
}()
|
63efc120 |
if err := daemon.mountVolumes(container); err != nil { |
ebf707ec |
return nil, err
}
|
7a7357da |
// Normalize path before sending to rootfs
resource = container.BaseFS.FromSlash(resource)
driver := container.BaseFS
|
ebf707ec |
basePath, err := container.GetResourcePath(resource)
if err != nil {
return nil, err
} |
7a7357da |
stat, err := driver.Stat(basePath) |
ebf707ec |
if err != nil {
return nil, err
}
var filter []string
if !stat.IsDir() { |
7a7357da |
d, f := driver.Split(basePath) |
ebf707ec |
basePath = d
filter = []string{f}
} else { |
7a7357da |
filter = []string{driver.Base(basePath)}
basePath = driver.Dir(basePath) |
ebf707ec |
} |
7a7357da |
archive, err := archivePath(driver, basePath, &archive.TarOptions{ |
ebf707ec |
Compression: archive.Uncompressed,
IncludeFiles: filter,
})
if err != nil {
return nil, err
}
reader := ioutils.NewReadCloserWrapper(archive, func() error {
err := archive.Close() |
9a2d0bc3 |
container.DetachAndUnmount(daemon.LogVolumeEvent) |
ebf707ec |
daemon.Unmount(container)
container.Unlock()
return err
}) |
ca5ede2d |
daemon.LogContainerEvent(container, "copy") |
ebf707ec |
return reader, nil |
51360965 |
} |