d6558ad6 |
// +build !windows |
6bb0d181 |
|
4f0d95fa |
package container // import "github.com/docker/docker/container" |
6bb0d181 |
import (
"io/ioutil"
"os" |
c0217180 |
"path/filepath" |
d0192ae1 |
"syscall" |
6bb0d181 |
|
b3aab5e3 |
"github.com/containerd/continuity/fs" |
cfc404a3 |
"github.com/docker/docker/api/types" |
91e197d6 |
containertypes "github.com/docker/docker/api/types/container" |
18768fdc |
mounttypes "github.com/docker/docker/api/types/mount" |
c0217180 |
swarmtypes "github.com/docker/docker/api/types/swarm" |
cfa2591d |
"github.com/docker/docker/pkg/mount" |
2b6bc294 |
"github.com/docker/docker/pkg/stringid" |
6bb0d181 |
"github.com/docker/docker/volume" |
6a70fd22 |
volumemounts "github.com/docker/docker/volume/mounts" |
abbbf914 |
"github.com/opencontainers/selinux/go-selinux/label" |
d69968d6 |
"github.com/pkg/errors" |
1009e6a4 |
"github.com/sirupsen/logrus" |
6bb0d181 |
)
|
3716ec25 |
const ( |
69b4fe40 |
// DefaultStopTimeout sets the default time, in seconds, to wait
// for the graceful container stop before forcefully terminating it. |
ed74ee12 |
DefaultStopTimeout = 10
|
db575ef6 |
containerSecretMountPath = "/run/secrets" |
3716ec25 |
) |
6bb0d181 |
// TrySetNetworkMount attempts to set the network mounts given a provided destination and
// the path to use for it; return true if the given destination was a network mount file
func (container *Container) TrySetNetworkMount(destination string, path string) bool {
if destination == "/etc/resolv.conf" {
container.ResolvConfPath = path
return true
}
if destination == "/etc/hostname" {
container.HostnamePath = path
return true
}
if destination == "/etc/hosts" {
container.HostsPath = path
return true
}
return false
}
// BuildHostnameFile writes the container's hostname file.
func (container *Container) BuildHostnameFile() error {
hostnamePath, err := container.GetRootResourcePath("hostname")
if err != nil {
return err
}
container.HostnamePath = hostnamePath
return ioutil.WriteFile(container.HostnamePath, []byte(container.Config.Hostname+"\n"), 0644)
}
// NetworkMounts returns the list of network mounts. |
9c4570a9 |
func (container *Container) NetworkMounts() []Mount {
var mounts []Mount |
6bb0d181 |
shared := container.HostConfig.NetworkMode.IsContainer() |
6a70fd22 |
parser := volumemounts.NewParser(container.OS) |
6bb0d181 |
if container.ResolvConfPath != "" {
if _, err := os.Stat(container.ResolvConfPath); err != nil {
logrus.Warnf("ResolvConfPath set to %q, but can't stat this filename (err = %v); skipping", container.ResolvConfPath, err)
} else {
writable := !container.HostConfig.ReadonlyRootfs
if m, exists := container.MountPoints["/etc/resolv.conf"]; exists {
writable = m.RW |
eab3ac3e |
} else {
label.Relabel(container.ResolvConfPath, container.MountLabel, shared) |
6bb0d181 |
} |
9c4570a9 |
mounts = append(mounts, Mount{ |
6bb0d181 |
Source: container.ResolvConfPath,
Destination: "/etc/resolv.conf",
Writable: writable, |
e89b6e8c |
Propagation: string(parser.DefaultPropagationMode()), |
6bb0d181 |
})
}
}
if container.HostnamePath != "" {
if _, err := os.Stat(container.HostnamePath); err != nil {
logrus.Warnf("HostnamePath set to %q, but can't stat this filename (err = %v); skipping", container.HostnamePath, err)
} else {
writable := !container.HostConfig.ReadonlyRootfs
if m, exists := container.MountPoints["/etc/hostname"]; exists {
writable = m.RW |
eab3ac3e |
} else {
label.Relabel(container.HostnamePath, container.MountLabel, shared) |
6bb0d181 |
} |
9c4570a9 |
mounts = append(mounts, Mount{ |
6bb0d181 |
Source: container.HostnamePath,
Destination: "/etc/hostname",
Writable: writable, |
e89b6e8c |
Propagation: string(parser.DefaultPropagationMode()), |
6bb0d181 |
})
}
}
if container.HostsPath != "" {
if _, err := os.Stat(container.HostsPath); err != nil {
logrus.Warnf("HostsPath set to %q, but can't stat this filename (err = %v); skipping", container.HostsPath, err)
} else {
writable := !container.HostConfig.ReadonlyRootfs
if m, exists := container.MountPoints["/etc/hosts"]; exists {
writable = m.RW |
eab3ac3e |
} else {
label.Relabel(container.HostsPath, container.MountLabel, shared) |
6bb0d181 |
} |
9c4570a9 |
mounts = append(mounts, Mount{ |
6bb0d181 |
Source: container.HostsPath,
Destination: "/etc/hosts",
Writable: writable, |
e89b6e8c |
Propagation: string(parser.DefaultPropagationMode()), |
6bb0d181 |
})
}
}
return mounts
}
// CopyImagePathContent copies files in destination to the volume.
func (container *Container) CopyImagePathContent(v volume.Volume, destination string) error { |
7a7357da |
rootfs, err := container.GetResourcePath(destination) |
6bb0d181 |
if err != nil {
return err
}
|
e4b6adc8 |
if _, err := os.Stat(rootfs); err != nil { |
6bb0d181 |
if os.IsNotExist(err) {
return nil
}
return err
}
|
510e79eb |
id := stringid.GenerateRandomID() |
2b6bc294 |
path, err := v.Mount(id) |
6bb0d181 |
if err != nil {
return err
} |
2b6bc294 |
defer func() {
if err := v.Unmount(id); err != nil {
logrus.Warnf("error while unmounting volume %s: %v", v.Name(), err)
}
}() |
57f6c9a0 |
if err := label.Relabel(path, container.MountLabel, true); err != nil && !errors.Is(err, syscall.ENOTSUP) { |
5a277c8a |
return err
} |
b0ac69b6 |
return copyExistingContents(rootfs, path) |
6bb0d181 |
}
// ShmResourcePath returns path to shm
func (container *Container) ShmResourcePath() (string, error) { |
eaa51928 |
return container.MountsResourcePath("shm") |
6bb0d181 |
}
// HasMountFor checks if path is a mountpoint
func (container *Container) HasMountFor(path string) bool {
_, exists := container.MountPoints[path] |
1861abdc |
if exists {
return true
}
// Also search among the tmpfs mounts
for dest := range container.HostConfig.Tmpfs {
if dest == path {
return true
}
}
return false |
6bb0d181 |
}
|
77bc327e |
// UnmountIpcMount unmounts shm if it was mounted
func (container *Container) UnmountIpcMount() error { |
7120976d |
if container.HasMountFor("/dev/shm") {
return nil |
6bb0d181 |
}
|
7120976d |
// container.ShmPath should not be used here as it may point
// to the host's or other container's /dev/shm
shmPath, err := container.ShmResourcePath()
if err != nil {
return err |
6bb0d181 |
} |
7120976d |
if shmPath == "" {
return nil
} |
d17c56f6 |
if err = mount.Unmount(shmPath); err != nil && !os.IsNotExist(errors.Cause(err)) { |
65331369 |
return err |
6bb0d181 |
} |
7120976d |
return nil |
6bb0d181 |
}
// IpcMounts returns the list of IPC mounts |
9c4570a9 |
func (container *Container) IpcMounts() []Mount {
var mounts []Mount |
6a70fd22 |
parser := volumemounts.NewParser(container.OS) |
6bb0d181 |
|
7120976d |
if container.HasMountFor("/dev/shm") {
return mounts |
6bb0d181 |
} |
7120976d |
if container.ShmPath == "" {
return mounts
}
label.SetFileLabel(container.ShmPath, container.MountLabel)
mounts = append(mounts, Mount{
Source: container.ShmPath,
Destination: "/dev/shm",
Writable: true, |
e89b6e8c |
Propagation: string(parser.DefaultPropagationMode()), |
7120976d |
}) |
6bb0d181 |
|
9c4570a9 |
return mounts |
8799c4fc |
}
|
37ce91dd |
// SecretMounts returns the mounts for the secret path. |
eaa51928 |
func (container *Container) SecretMounts() ([]Mount, error) { |
67d282a5 |
var mounts []Mount
for _, r := range container.SecretReferences { |
37ce91dd |
if r.File == nil {
continue
} |
eaa51928 |
src, err := container.SecretFilePath(*r)
if err != nil {
return nil, err
} |
67d282a5 |
mounts = append(mounts, Mount{ |
eaa51928 |
Source: src, |
67d282a5 |
Destination: getSecretTargetPath(r), |
3716ec25 |
Writable: false, |
67d282a5 |
}) |
3716ec25 |
} |
cd3d0486 |
for _, r := range container.ConfigReferences { |
c0217180 |
fPath, err := container.ConfigFilePath(*r) |
cd3d0486 |
if err != nil {
return nil, err
}
mounts = append(mounts, Mount{
Source: fPath,
Destination: r.File.Name,
Writable: false,
})
} |
3716ec25 |
|
eaa51928 |
return mounts, nil |
3716ec25 |
}
// UnmountSecrets unmounts the local tmpfs for secrets
func (container *Container) UnmountSecrets() error { |
eaa51928 |
p, err := container.SecretMountPath()
if err != nil {
return err
}
if _, err := os.Stat(p); err != nil { |
643ae8b4 |
if os.IsNotExist(err) {
return nil
} |
baffa793 |
return err |
643ae8b4 |
}
|
eaa51928 |
return mount.RecursiveUnmount(p) |
3716ec25 |
}
|
ebcb7d6b |
type conflictingUpdateOptions string
func (e conflictingUpdateOptions) Error() string {
return string(e)
}
func (e conflictingUpdateOptions) Conflict() {}
|
eed4c7b7 |
// UpdateContainer updates configuration of a container. Callers must hold a Lock on the Container. |
da9eadb0 |
func (container *Container) UpdateContainer(hostConfig *containertypes.HostConfig) error { |
ff3ea4c9 |
// update resources of container |
8799c4fc |
resources := hostConfig.Resources
cResources := &container.HostConfig.Resources |
61022436 |
// validate NanoCPUs, CPUPeriod, and CPUQuota |
39bcaee4 |
// Because NanoCPU effectively updates CPUPeriod/CPUQuota, |
61022436 |
// once NanoCPU is already set, updating CPUPeriod/CPUQuota will be blocked, and vice versa.
// In the following we make sure the intended update (resources) does not conflict with the existing (cResource).
if resources.NanoCPUs > 0 && cResources.CPUPeriod > 0 { |
ebcb7d6b |
return conflictingUpdateOptions("Conflicting options: Nano CPUs cannot be updated as CPU Period has already been set") |
61022436 |
}
if resources.NanoCPUs > 0 && cResources.CPUQuota > 0 { |
ebcb7d6b |
return conflictingUpdateOptions("Conflicting options: Nano CPUs cannot be updated as CPU Quota has already been set") |
61022436 |
}
if resources.CPUPeriod > 0 && cResources.NanoCPUs > 0 { |
ebcb7d6b |
return conflictingUpdateOptions("Conflicting options: CPU Period cannot be updated as NanoCPUs has already been set") |
61022436 |
}
if resources.CPUQuota > 0 && cResources.NanoCPUs > 0 { |
ebcb7d6b |
return conflictingUpdateOptions("Conflicting options: CPU Quota cannot be updated as NanoCPUs has already been set") |
61022436 |
}
|
8799c4fc |
if resources.BlkioWeight != 0 {
cResources.BlkioWeight = resources.BlkioWeight
}
if resources.CPUShares != 0 {
cResources.CPUShares = resources.CPUShares
} |
61022436 |
if resources.NanoCPUs != 0 {
cResources.NanoCPUs = resources.NanoCPUs
} |
8799c4fc |
if resources.CPUPeriod != 0 {
cResources.CPUPeriod = resources.CPUPeriod
}
if resources.CPUQuota != 0 {
cResources.CPUQuota = resources.CPUQuota
}
if resources.CpusetCpus != "" {
cResources.CpusetCpus = resources.CpusetCpus
}
if resources.CpusetMems != "" {
cResources.CpusetMems = resources.CpusetMems
}
if resources.Memory != 0 { |
92394785 |
// if memory limit smaller than already set memoryswap limit and doesn't
// update the memoryswap limit, then error out.
if resources.Memory > cResources.MemorySwap && resources.MemorySwap == 0 { |
ebcb7d6b |
return conflictingUpdateOptions("Memory limit should be smaller than already set memoryswap limit, update the memoryswap at the same time") |
92394785 |
} |
8799c4fc |
cResources.Memory = resources.Memory
}
if resources.MemorySwap != 0 {
cResources.MemorySwap = resources.MemorySwap
}
if resources.MemoryReservation != 0 {
cResources.MemoryReservation = resources.MemoryReservation
}
if resources.KernelMemory != 0 {
cResources.KernelMemory = resources.KernelMemory
} |
dca82b9e |
if resources.CPURealtimePeriod != 0 {
cResources.CPURealtimePeriod = resources.CPURealtimePeriod
}
if resources.CPURealtimeRuntime != 0 {
cResources.CPURealtimeRuntime = resources.CPURealtimeRuntime
} |
74eb258f |
if resources.PidsLimit != nil {
cResources.PidsLimit = resources.PidsLimit
} |
ff3ea4c9 |
// update HostConfig of container
if hostConfig.RestartPolicy.Name != "" { |
4754c64a |
if container.HostConfig.AutoRemove && !hostConfig.RestartPolicy.IsNone() { |
ebcb7d6b |
return conflictingUpdateOptions("Restart policy cannot be updated because AutoRemove is enabled for the container") |
4754c64a |
} |
ff3ea4c9 |
container.HostConfig.RestartPolicy = hostConfig.RestartPolicy
} |
8799c4fc |
return nil
}
|
9a2d0bc3 |
// DetachAndUnmount uses a detached mount on all mount destinations, then
// unmounts each volume normally.
// This is used from daemon/archive for `docker cp`
func (container *Container) DetachAndUnmount(volumeEventLog func(name, action string, attributes map[string]string)) error {
networkMounts := container.NetworkMounts()
mountPaths := make([]string, 0, len(container.MountPoints)+len(networkMounts)) |
6bb0d181 |
for _, mntPoint := range container.MountPoints {
dest, err := container.GetResourcePath(mntPoint.Destination)
if err != nil { |
9a2d0bc3 |
logrus.Warnf("Failed to get volume destination path for container '%s' at '%s' while lazily unmounting: %v", container.ID, mntPoint.Destination, err)
continue |
6bb0d181 |
} |
9a2d0bc3 |
mountPaths = append(mountPaths, dest) |
6bb0d181 |
}
|
9a2d0bc3 |
for _, m := range networkMounts {
dest, err := container.GetResourcePath(m.Destination)
if err != nil {
logrus.Warnf("Failed to get volume destination path for container '%s' at '%s' while lazily unmounting: %v", container.ID, m.Destination, err)
continue |
6bb0d181 |
} |
9a2d0bc3 |
mountPaths = append(mountPaths, dest)
} |
6bb0d181 |
|
9a2d0bc3 |
for _, mountPath := range mountPaths { |
d6558ad6 |
if err := mount.Unmount(mountPath); err != nil { |
65331369 |
logrus.WithError(err).WithField("container", container.ID).
Warn("Unable to unmount") |
6bb0d181 |
}
} |
9a2d0bc3 |
return container.UnmountVolumes(volumeEventLog) |
6bb0d181 |
}
|
d0192ae1 |
// ignoreUnsupportedXAttrs ignores errors when extended attributes
// are not supported
func ignoreUnsupportedXAttrs() fs.CopyDirOpt {
xeh := func(dst, src, xattrKey string, err error) error {
if errors.Cause(err) != syscall.ENOTSUP {
return err
}
return nil
}
return fs.WithXAttrErrorHandler(xeh)
}
|
6bb0d181 |
// copyExistingContents copies from the source to the destination and
// ensures the ownership is appropriately set.
func copyExistingContents(source, destination string) error { |
b3aab5e3 |
dstList, err := ioutil.ReadDir(destination) |
6bb0d181 |
if err != nil {
return err
} |
b3aab5e3 |
if len(dstList) != 0 {
// destination is not empty, do not copy
return nil |
f05a0237 |
} |
d0192ae1 |
return fs.CopyDir(destination, source, ignoreUnsupportedXAttrs()) |
6bb0d181 |
}
// TmpfsMounts returns the list of tmpfs mounts |
18768fdc |
func (container *Container) TmpfsMounts() ([]Mount, error) { |
6a70fd22 |
parser := volumemounts.NewParser(container.OS) |
9c4570a9 |
var mounts []Mount |
6bb0d181 |
for dest, data := range container.HostConfig.Tmpfs { |
9c4570a9 |
mounts = append(mounts, Mount{ |
6bb0d181 |
Source: "tmpfs",
Destination: dest,
Data: data,
})
} |
18768fdc |
for dest, mnt := range container.MountPoints {
if mnt.Type == mounttypes.TypeTmpfs { |
e89b6e8c |
data, err := parser.ConvertTmpfsOptions(mnt.Spec.TmpfsOptions, mnt.Spec.ReadOnly) |
18768fdc |
if err != nil {
return nil, err
}
mounts = append(mounts, Mount{
Source: "tmpfs",
Destination: dest,
Data: data,
})
}
}
return mounts, nil |
6bb0d181 |
} |
67912303 |
|
cfc404a3 |
// GetMountPoints gives a platform specific transformation to types.MountPoint. Callers must hold a Container lock.
func (container *Container) GetMountPoints() []types.MountPoint {
mountPoints := make([]types.MountPoint, 0, len(container.MountPoints))
for _, m := range container.MountPoints {
mountPoints = append(mountPoints, types.MountPoint{
Type: m.Type,
Name: m.Name,
Source: m.Path(),
Destination: m.Destination,
Driver: m.Driver,
Mode: m.Mode,
RW: m.RW,
Propagation: m.Propagation,
})
}
return mountPoints
} |
c0217180 |
// ConfigFilePath returns the path to the on-disk location of a config.
// On unix, configs are always considered secret
func (container *Container) ConfigFilePath(configRef swarmtypes.ConfigReference) (string, error) {
mounts, err := container.SecretMountPath()
if err != nil {
return "", err
}
return filepath.Join(mounts, configRef.ConfigID), nil
} |