// +build linux freebsd
 
 package daemon
 
 import (
 	"fmt"

 	"io/ioutil"

 	"os"
 	"path/filepath"
 	"strconv"
 	"syscall"
 	"time"
 
 	"github.com/Sirupsen/logrus"

 	"github.com/cloudflare/cfssl/log"

 	"github.com/docker/docker/container"
 	"github.com/docker/docker/daemon/links"
 	"github.com/docker/docker/pkg/idtools"

 	"github.com/docker/docker/pkg/mount"

 	"github.com/docker/docker/pkg/stringid"
 	"github.com/docker/docker/runconfig"

 	"github.com/docker/libnetwork"

 	"github.com/opencontainers/runc/libcontainer/label"

 	"github.com/pkg/errors"

 )
 
 func (daemon *Daemon) setupLinkedContainers(container *container.Container) ([]string, error) {
 	var env []string

 	children := daemon.children(container)

 	bridgeSettings := container.NetworkSettings.Networks[runconfig.DefaultDaemonNetworkMode().NetworkName()]

 	if bridgeSettings == nil || bridgeSettings.EndpointSettings == nil {

 		return nil, nil
 	}
 

 	for linkAlias, child := range children {
 		if !child.IsRunning() {

 			return nil, fmt.Errorf("Cannot link to a non running container: %s AS %s", child.Name, linkAlias)

 		}

 		childBridgeSettings := child.NetworkSettings.Networks[runconfig.DefaultDaemonNetworkMode().NetworkName()]

 		if childBridgeSettings == nil || childBridgeSettings.EndpointSettings == nil {

 			return nil, fmt.Errorf("container %s not attached to default bridge network", child.ID)
 		}

 		link := links.NewLink(
 			bridgeSettings.IPAddress,
 			childBridgeSettings.IPAddress,
 			linkAlias,
 			child.Config.Env,
 			child.Config.ExposedPorts,
 		)

 		env = append(env, link.ToEnv()...)

 	}

 	return env, nil
 }
 
 func (daemon *Daemon) getIpcContainer(container *container.Container) (*container.Container, error) {
 	containerID := container.HostConfig.IpcMode.Container()

 	c, err := daemon.GetContainer(containerID)

 	if err != nil {
 		return nil, err
 	}
 	if !c.IsRunning() {

 		return nil, fmt.Errorf("cannot join IPC of a non running container: %s", containerID)

 	}

 	if c.IsRestarting() {

 		return nil, errContainerIsRestarting(container.ID)

 	}

 	return c, nil
 }
 

 func (daemon *Daemon) getPidContainer(container *container.Container) (*container.Container, error) {
 	containerID := container.HostConfig.PidMode.Container()
 	c, err := daemon.GetContainer(containerID)
 	if err != nil {
 		return nil, err
 	}
 	if !c.IsRunning() {
 		return nil, fmt.Errorf("cannot join PID of a non running container: %s", containerID)
 	}
 	if c.IsRestarting() {
 		return nil, errContainerIsRestarting(container.ID)
 	}
 	return c, nil
 }
 

 func (daemon *Daemon) setupIpcDirs(c *container.Container) error {

 	var err error
 
 	c.ShmPath, err = c.ShmResourcePath()
 	if err != nil {
 		return err
 	}
 
 	if c.HostConfig.IpcMode.IsContainer() {
 		ic, err := daemon.getIpcContainer(c)

 		if err != nil {
 			return err
 		}

 		c.ShmPath = ic.ShmPath
 	} else if c.HostConfig.IpcMode.IsHost() {
 		if _, err := os.Stat("/dev/shm"); err != nil {
 			return fmt.Errorf("/dev/shm is not mounted, but must be for --ipc=host")

 		}

 		c.ShmPath = "/dev/shm"
 	} else {
 		rootUID, rootGID := daemon.GetRemappedUIDGID()
 		if !c.HasMountFor("/dev/shm") {
 			shmPath, err := c.ShmResourcePath()
 			if err != nil {
 				return err
 			}

 			if err := idtools.MkdirAllAs(shmPath, 0700, rootUID, rootGID); err != nil {
 				return err
 			}
 
 			shmSize := container.DefaultSHMSize
 			if c.HostConfig.ShmSize != 0 {
 				shmSize = c.HostConfig.ShmSize
 			}
 			shmproperty := "mode=1777,size=" + strconv.FormatInt(shmSize, 10)
 			if err := syscall.Mount("shm", shmPath, "tmpfs", uintptr(syscall.MS_NOEXEC|syscall.MS_NOSUID|syscall.MS_NODEV), label.FormatMountLabel(shmproperty, c.GetMountLabel())); err != nil {
 				return fmt.Errorf("mounting shm tmpfs: %s", err)
 			}
 			if err := os.Chown(shmPath, rootUID, rootGID); err != nil {
 				return err
 			}

 		}

 	}
 
 	return nil
 }

 func (daemon *Daemon) setupSecretDir(c *container.Container) (setupErr error) {

 	if len(c.SecretReferences) == 0 {

 		return nil
 	}
 

 	localMountPath := c.SecretMountPath()
 	logrus.Debugf("secrets: setting up secret dir: %s", localMountPath)
 

 	defer func() {
 		if setupErr != nil {

 			// cleanup
 			_ = detachMounted(localMountPath)
 
 			if err := os.RemoveAll(localMountPath); err != nil {
 				log.Errorf("error cleaning up secret mount: %s", err)
 			}
 		}

 	}()

 	// retrieve possible remapped range start for root UID, GID
 	rootUID, rootGID := daemon.GetRemappedUIDGID()

 	// create tmpfs

 	if err := idtools.MkdirAllAs(localMountPath, 0700, rootUID, rootGID); err != nil {

 		return errors.Wrap(err, "error creating secret local mount path")

 	}

 	tmpfsOwnership := fmt.Sprintf("uid=%d,gid=%d", rootUID, rootGID)
 	if err := mount.Mount("tmpfs", localMountPath, "tmpfs", "nodev,nosuid,noexec,"+tmpfsOwnership); err != nil {

 		return errors.Wrap(err, "unable to setup secret mount")

 	}
 

 	for _, s := range c.SecretReferences {
 		if c.SecretStore == nil {
 			return fmt.Errorf("secret store is not initialized")
 		}
 
 		// TODO (ehazlett): use type switch when more are supported
 		if s.File == nil {
 			return fmt.Errorf("secret target type is not a file target")
 		}
 
 		targetPath := filepath.Clean(s.File.Name)

 		// ensure that the target is a filename only; no paths allowed

 		if targetPath != filepath.Base(targetPath) {
 			return fmt.Errorf("error creating secret: secret must not be a path")

 		}
 

 		fPath := filepath.Join(localMountPath, targetPath)

 		if err := idtools.MkdirAllAs(filepath.Dir(fPath), 0700, rootUID, rootGID); err != nil {

 			return errors.Wrap(err, "error creating secret mount path")

 		}
 

 		logrus.WithFields(logrus.Fields{

 			"name": s.File.Name,

 			"path": fPath,
 		}).Debug("injecting secret")

 		secret := c.SecretStore.Get(s.SecretID)
 		if secret == nil {
 			return fmt.Errorf("unable to get secret from secret store")
 		}
 		if err := ioutil.WriteFile(fPath, secret.Spec.Data, s.File.Mode); err != nil {

 			return errors.Wrap(err, "error injecting secret")

 		}
 

 		uid, err := strconv.Atoi(s.File.UID)

 		if err != nil {
 			return err
 		}

 		gid, err := strconv.Atoi(s.File.GID)

 		if err != nil {
 			return err
 		}
 

 		if err := os.Chown(fPath, rootUID+uid, rootGID+gid); err != nil {

 			return errors.Wrap(err, "error setting ownership for secret")

 		}
 	}
 
 	// remount secrets ro

 	if err := mount.Mount("tmpfs", localMountPath, "tmpfs", "remount,ro,"+tmpfsOwnership); err != nil {

 		return errors.Wrap(err, "unable to remount secret dir as readonly")

 	}
 

 	return nil

 }
 

 func killProcessDirectly(container *container.Container) error {
 	if _, err := container.WaitStop(10 * time.Second); err != nil {
 		// Ensure that we don't kill ourselves
 		if pid := container.GetPID(); pid != 0 {
 			logrus.Infof("Container %s failed to exit within 10 seconds of kill - trying direct SIGKILL", stringid.TruncateID(container.ID))
 			if err := syscall.Kill(pid, 9); err != nil {
 				if err != syscall.ESRCH {
 					return err
 				}

 				e := errNoSuchProcess{pid, 9}
 				logrus.Debug(e)
 				return e

 			}
 		}
 	}
 	return nil
 }
 
 func detachMounted(path string) error {
 	return syscall.Unmount(path, syscall.MNT_DETACH)
 }
 
 func isLinkable(child *container.Container) bool {
 	// A container is linkable only if it belongs to the default network

 	_, ok := child.NetworkSettings.Networks[runconfig.DefaultDaemonNetworkMode().NetworkName()]

 	return ok
 }

 func enableIPOnPredefinedNetwork() bool {
 	return false
 }

 
 func (daemon *Daemon) isNetworkHotPluggable() bool {
 	return true
 }

 
 func setupPathsAndSandboxOptions(container *container.Container, sboxOptions *[]libnetwork.SandboxOption) error {
 	var err error
 
 	container.HostsPath, err = container.GetRootResourcePath("hosts")
 	if err != nil {
 		return err
 	}
 	*sboxOptions = append(*sboxOptions, libnetwork.OptionHostsPath(container.HostsPath))
 
 	container.ResolvConfPath, err = container.GetRootResourcePath("resolv.conf")
 	if err != nil {
 		return err
 	}
 	*sboxOptions = append(*sboxOptions, libnetwork.OptionResolvConfPath(container.ResolvConfPath))
 	return nil
 }
 
 func initializeNetworkingPaths(container *container.Container, nc *container.Container) {
 	container.HostnamePath = nc.HostnamePath
 	container.HostsPath = nc.HostsPath
 	container.ResolvConfPath = nc.ResolvConfPath
 }