// +build daemon
 
 package main
 
 import (

 	"crypto/tls"

 	"fmt"
 	"io"
 	"os"
 	"path/filepath"

 	"strings"

 	"time"

 	"github.com/Sirupsen/logrus"

 	"github.com/docker/distribution/uuid"

 	apiserver "github.com/docker/docker/api/server"

 	"github.com/docker/docker/cli"

 	"github.com/docker/docker/cliconfig"

 	"github.com/docker/docker/daemon"

 	"github.com/docker/docker/daemon/logger"

 	"github.com/docker/docker/dockerversion"

 	"github.com/docker/docker/opts"

 	"github.com/docker/docker/pkg/jsonlog"

 	flag "github.com/docker/docker/pkg/mflag"

 	"github.com/docker/docker/pkg/pidfile"

 	"github.com/docker/docker/pkg/signal"

 	"github.com/docker/docker/pkg/system"

 	"github.com/docker/docker/registry"

 	"github.com/docker/docker/utils"

 	"github.com/docker/go-connections/tlsconfig"

 )
 

 const (
 	daemonUsage          = "       docker daemon [ --help | ... ]\n"
 	daemonConfigFileFlag = "-config-file"
 )

 var (

 	daemonCli cli.Handler = NewDaemonCli()

 )
 

 // DaemonCli represents the daemon CLI.
 type DaemonCli struct {
 	*daemon.Config
 	registryOptions *registry.Options
 	flags           *flag.FlagSet
 }
 

 func presentInHelp(usage string) string { return usage }
 func absentFromHelp(string) string      { return "" }
 
 // NewDaemonCli returns a pre-configured daemon CLI
 func NewDaemonCli() *DaemonCli {

 	daemonFlags := cli.Subcmd("daemon", nil, "Enable daemon mode", true)

 
 	// TODO(tiborvass): remove InstallFlags?
 	daemonConfig := new(daemon.Config)

 	daemonConfig.LogConfig.Config = make(map[string]string)

 	daemonConfig.ClusterOpts = make(map[string]string)

 	daemonConfig.InstallFlags(daemonFlags, presentInHelp)
 	daemonConfig.InstallFlags(flag.CommandLine, absentFromHelp)
 	registryOptions := new(registry.Options)
 	registryOptions.InstallFlags(daemonFlags, presentInHelp)
 	registryOptions.InstallFlags(flag.CommandLine, absentFromHelp)
 	daemonFlags.Require(flag.Exact, 0)
 
 	return &DaemonCli{
 		Config:          daemonConfig,
 		registryOptions: registryOptions,

 		flags:           daemonFlags,

 	}

 }
 

 func migrateKey() (err error) {

 	// Migrate trust key if exists at ~/.docker/key.json and owned by current user

 	oldPath := filepath.Join(cliconfig.ConfigDir(), defaultTrustKeyFile)

 	newPath := filepath.Join(getDaemonConfDir(), defaultTrustKeyFile)

 	if _, statErr := os.Stat(newPath); os.IsNotExist(statErr) && currentUserIsOwner(oldPath) {

 		defer func() {
 			// Ensure old path is removed if no error occurred
 			if err == nil {
 				err = os.Remove(oldPath)
 			} else {

 				logrus.Warnf("Key migration failed, key file not removed at %s", oldPath)

 				os.Remove(newPath)

 			}
 		}()
 

 		if err := system.MkdirAll(getDaemonConfDir(), os.FileMode(0644)); err != nil {

 			return fmt.Errorf("Unable to create daemon configuration directory: %s", err)

 		}
 
 		newFile, err := os.OpenFile(newPath, os.O_RDWR|os.O_CREATE|os.O_TRUNC, 0600)
 		if err != nil {
 			return fmt.Errorf("error creating key file %q: %s", newPath, err)
 		}
 		defer newFile.Close()
 
 		oldFile, err := os.Open(oldPath)
 		if err != nil {

 			return fmt.Errorf("error opening key file %q: %s", oldPath, err)

 		}

 		defer oldFile.Close()

 
 		if _, err := io.Copy(newFile, oldFile); err != nil {
 			return fmt.Errorf("error copying key: %s", err)
 		}
 

 		logrus.Infof("Migrated key from %s to %s", oldPath, newPath)

 	}
 
 	return nil
 }
 

 func getGlobalFlag() (globalFlag *flag.Flag) {
 	defer func() {
 		if x := recover(); x != nil {
 			switch f := x.(type) {
 			case *flag.Flag:
 				globalFlag = f
 			default:
 				panic(x)
 			}
 		}
 	}()
 	visitor := func(f *flag.Flag) { panic(f) }
 	commonFlags.FlagSet.Visit(visitor)
 	clientFlags.FlagSet.Visit(visitor)
 	return
 }
 
 // CmdDaemon is the daemon command, called the raw arguments after `docker daemon`.
 func (cli *DaemonCli) CmdDaemon(args ...string) error {

 	// warn from uuid package when running the daemon
 	uuid.Loggerf = logrus.Warnf
 

 	if !commonFlags.FlagSet.IsEmpty() || !clientFlags.FlagSet.IsEmpty() {

 		// deny `docker -D daemon`
 		illegalFlag := getGlobalFlag()
 		fmt.Fprintf(os.Stderr, "invalid flag '-%s'.\nSee 'docker daemon --help'.\n", illegalFlag.Names[0])
 		os.Exit(1)
 	} else {
 		// allow new form `docker daemon -D`

 		flag.Merge(cli.flags, commonFlags.FlagSet)

 	}
 

 	configFile := cli.flags.String([]string{daemonConfigFileFlag}, defaultDaemonConfigFile, "Daemon configuration file")
 
 	cli.flags.ParseFlags(args, true)

 	commonFlags.PostParse()
 
 	if commonFlags.TrustKey == "" {
 		commonFlags.TrustKey = filepath.Join(getDaemonConfDir(), defaultTrustKeyFile)

 	}

 	cliConfig, err := loadDaemonCliConfig(cli.Config, cli.flags, commonFlags, *configFile)
 	if err != nil {
 		fmt.Fprint(os.Stderr, err)
 		os.Exit(1)
 	}
 	cli.Config = cliConfig
 
 	if cli.Config.Debug {
 		utils.EnableDebug()
 	}

 	if utils.ExperimentalBuild() {
 		logrus.Warn("Running experimental build")

 	}

 	logrus.SetFormatter(&logrus.TextFormatter{TimestampFormat: jsonlog.RFC3339NanoFixed})

 	if err := setDefaultUmask(); err != nil {
 		logrus.Fatalf("Failed to set umask: %v", err)
 	}
 

 	if len(cli.LogConfig.Config) > 0 {
 		if err := logger.ValidateLogOpts(cli.LogConfig.Type, cli.LogConfig.Config); err != nil {

 			logrus.Fatalf("Failed to set log opts: %v", err)
 		}
 	}
 

 	var pfile *pidfile.PIDFile

 	if cli.Pidfile != "" {
 		pf, err := pidfile.New(cli.Pidfile)

 		if err != nil {
 			logrus.Fatalf("Error starting daemon: %v", err)
 		}
 		pfile = pf
 		defer func() {
 			if err := pfile.Remove(); err != nil {
 				logrus.Error(err)
 			}
 		}()
 	}

 	serverConfig := &apiserver.Config{

 		AuthorizationPluginNames: cli.Config.AuthorizationPlugins,
 		Logging:                  true,
 		Version:                  dockerversion.Version,

 	}

 	serverConfig = setPlatformServerConfig(serverConfig, cli.Config)

 	defaultHost := opts.DefaultHost

 	if cli.Config.TLS {
 		tlsOptions := tlsconfig.Options{

 			CAFile:   cli.Config.CommonTLSOptions.CAFile,
 			CertFile: cli.Config.CommonTLSOptions.CertFile,
 			KeyFile:  cli.Config.CommonTLSOptions.KeyFile,

 		}
 
 		if cli.Config.TLSVerify {

 			// server requires and verifies client's certificate

 			tlsOptions.ClientAuth = tls.RequireAndVerifyClientCert

 		}

 		tlsConfig, err := tlsconfig.Server(tlsOptions)

 		if err != nil {

 			logrus.Fatal(err)

 		}
 		serverConfig.TLSConfig = tlsConfig

 		defaultHost = opts.DefaultTLSHost

 	}
 

 	if len(cli.Config.Hosts) == 0 {
 		cli.Config.Hosts = make([]string, 1)

 	}

 	for i := 0; i < len(cli.Config.Hosts); i++ {

 		var err error

 		if cli.Config.Hosts[i], err = opts.ParseHost(defaultHost, cli.Config.Hosts[i]); err != nil {
 			logrus.Fatalf("error parsing -H %s : %v", cli.Config.Hosts[i], err)

 		}

 
 		protoAddr := cli.Config.Hosts[i]

 		protoAddrParts := strings.SplitN(protoAddr, "://", 2)
 		if len(protoAddrParts) != 2 {
 			logrus.Fatalf("bad format %s, expected PROTO://ADDR", protoAddr)
 		}
 		serverConfig.Addrs = append(serverConfig.Addrs, apiserver.Addr{Proto: protoAddrParts[0], Addr: protoAddrParts[1]})
 	}

 	api, err := apiserver.New(serverConfig)
 	if err != nil {
 		logrus.Fatal(err)
 	}

 	if err := migrateKey(); err != nil {
 		logrus.Fatal(err)
 	}

 	cli.TrustKeyPath = commonFlags.TrustKey

 	registryService := registry.NewService(cli.registryOptions)

 	d, err := daemon.NewDaemon(cli.Config, registryService)

 	if err != nil {
 		if pfile != nil {
 			if err := pfile.Remove(); err != nil {
 				logrus.Error(err)
 			}
 		}
 		logrus.Fatalf("Error starting daemon: %v", err)
 	}
 
 	logrus.Info("Daemon has completed initialization")
 
 	logrus.WithFields(logrus.Fields{

 		"version":     dockerversion.Version,
 		"commit":      dockerversion.GitCommit,

 		"execdriver":  d.ExecutionDriver().Name(),

 		"graphdriver": d.GraphDriverName(),

 	}).Info("Docker daemon")
 

 	api.InitRouters(d)
 

 	reload := func(config *daemon.Config) {
 		if err := d.Reload(config); err != nil {
 			logrus.Errorf("Error reconfiguring the daemon: %v", err)
 			return
 		}
 		api.Reload(config)
 	}
 
 	setupConfigReloadTrap(*configFile, cli.flags, reload)
 

 	// The serve API routine never exits unless an error occurs
 	// We need to start it as a goroutine and wait on it so
 	// daemon doesn't exit
 	serveAPIWait := make(chan error)

 	go api.Wait(serveAPIWait)

 	signal.Trap(func() {
 		api.Close()
 		<-serveAPIWait

 		shutdownDaemon(d, 15)

 		if pfile != nil {
 			if err := pfile.Remove(); err != nil {
 				logrus.Error(err)
 			}
 		}
 	})

 	// after the daemon is done setting up we can notify systemd api

 	notifySystem()

 	// Daemon is fully initialized and handling API traffic

 	// Wait for serve API to complete

 	errAPI := <-serveAPIWait

 	shutdownDaemon(d, 15)

 	if errAPI != nil {

 		if pfile != nil {
 			if err := pfile.Remove(); err != nil {
 				logrus.Error(err)
 			}
 		}

 		logrus.Fatalf("Shutting down due to ServeAPI error: %v", errAPI)

 	}

 	return nil

 }

 // shutdownDaemon just wraps daemon.Shutdown() to handle a timeout in case
 // d.Shutdown() is waiting too long to kill container or worst it's
 // blocked there

 func shutdownDaemon(d *daemon.Daemon, timeout time.Duration) {

 	ch := make(chan struct{})
 	go func() {

 		d.Shutdown()

 		close(ch)
 	}()
 	select {
 	case <-ch:

 		logrus.Debug("Clean shutdown succeeded")

 	case <-time.After(timeout * time.Second):
 		logrus.Error("Force shutdown daemon")
 	}
 }

 
 func loadDaemonCliConfig(config *daemon.Config, daemonFlags *flag.FlagSet, commonConfig *cli.CommonFlags, configFile string) (*daemon.Config, error) {
 	config.Debug = commonConfig.Debug
 	config.Hosts = commonConfig.Hosts
 	config.LogLevel = commonConfig.LogLevel
 	config.TLS = commonConfig.TLS
 	config.TLSVerify = commonConfig.TLSVerify

 	config.CommonTLSOptions = daemon.CommonTLSOptions{}

 
 	if commonConfig.TLSOptions != nil {

 		config.CommonTLSOptions.CAFile = commonConfig.TLSOptions.CAFile
 		config.CommonTLSOptions.CertFile = commonConfig.TLSOptions.CertFile
 		config.CommonTLSOptions.KeyFile = commonConfig.TLSOptions.KeyFile

 	}
 
 	if configFile != "" {
 		c, err := daemon.MergeDaemonConfigurations(config, daemonFlags, configFile)
 		if err != nil {
 			if daemonFlags.IsSet(daemonConfigFileFlag) || !os.IsNotExist(err) {
 				return nil, fmt.Errorf("unable to configure the Docker daemon with file %s: %v\n", configFile, err)
 			}
 		}
 		// the merged configuration can be nil if the config file didn't exist.
 		// leave the current configuration as it is if when that happens.
 		if c != nil {
 			config = c
 		}
 	}
 

 	// Regardless of whether the user sets it to true or false, if they
 	// specify TLSVerify at all then we need to turn on TLS

 	if config.IsValueSet(tlsVerifyKey) {

 		config.TLS = true
 	}
 
 	// ensure that the log level is the one set after merging configurations
 	setDaemonLogLevel(config.LogLevel)
 

 	return config, nil
 }