Browse code
refactor(libcontainer): rename to CapabilitiesMask
The Capabilities field on libcontainer is actually used as a mask.
Rename the field so that this is more clear.
Docker-DCO-1.1-Signed-off-by: Brandon Philips <brandon.philips@coreos.com> (github: philips)
Brandon Philips authored on 2014/03/18 02:16:34Showing 5 changed files
- execdriver/native/default_template.go
- pkg/libcontainer/README.md
- pkg/libcontainer/capabilities/capabilities.go
- pkg/libcontainer/container.go
- pkg/libcontainer/container.json
| ... | ... |
@@ -36,7 +36,7 @@ func createContainer(c *execdriver.Command) *libcontainer.Container {
|
| 36 | 36 |
|
| 37 | 37 |
container.Cgroups.Name = c.ID |
| 38 | 38 |
if c.Privileged {
|
| 39 |
- container.Capabilities = nil |
|
| 39 |
+ container.CapabilitiesMask = nil |
|
| 40 | 40 |
container.Cgroups.DeviceAccess = true |
| 41 | 41 |
container.Context["apparmor_profile"] = "unconfined" |
| 42 | 42 |
} |
| ... | ... |
@@ -59,7 +59,7 @@ func createContainer(c *execdriver.Command) *libcontainer.Container {
|
| 59 | 59 |
// the libcontainer configuration file |
| 60 | 60 |
func getDefaultTemplate() *libcontainer.Container {
|
| 61 | 61 |
return &libcontainer.Container{
|
| 62 |
- Capabilities: libcontainer.Capabilities{
|
|
| 62 |
+ CapabilitiesMask: libcontainer.Capabilities{
|
|
| 63 | 63 |
libcontainer.GetCapability("SETPCAP"),
|
| 64 | 64 |
libcontainer.GetCapability("SYS_MODULE"),
|
| 65 | 65 |
libcontainer.GetCapability("SYS_RAWIO"),
|
| ... | ... |
@@ -9,7 +9,7 @@ import ( |
| 9 | 9 |
// DropCapabilities drops capabilities for the current process based |
| 10 | 10 |
// on the container's configuration. |
| 11 | 11 |
func DropCapabilities(container *libcontainer.Container) error {
|
| 12 |
- if drop := getCapabilities(container); len(drop) > 0 {
|
|
| 12 |
+ if drop := getCapabilitiesMask(container); len(drop) > 0 {
|
|
| 13 | 13 |
c, err := capability.NewPid(os.Getpid()) |
| 14 | 14 |
if err != nil {
|
| 15 | 15 |
return err |
| ... | ... |
@@ -23,10 +23,10 @@ func DropCapabilities(container *libcontainer.Container) error {
|
| 23 | 23 |
return nil |
| 24 | 24 |
} |
| 25 | 25 |
|
| 26 |
-// getCapabilities returns the specific cap values for the libcontainer types |
|
| 27 |
-func getCapabilities(container *libcontainer.Container) []capability.Cap {
|
|
| 26 |
+// getCapabilitiesMask returns the specific cap mask values for the libcontainer types |
|
| 27 |
+func getCapabilitiesMask(container *libcontainer.Container) []capability.Cap {
|
|
| 28 | 28 |
drop := []capability.Cap{}
|
| 29 |
- for _, c := range container.Capabilities {
|
|
| 29 |
+ for _, c := range container.CapabilitiesMask {
|
|
| 30 | 30 |
drop = append(drop, c.Value) |
| 31 | 31 |
} |
| 32 | 32 |
return drop |
| ... | ... |
@@ -11,19 +11,19 @@ type Context map[string]string |
| 11 | 11 |
// Container defines configuration options for how a |
| 12 | 12 |
// container is setup inside a directory and how a process should be executed |
| 13 | 13 |
type Container struct {
|
| 14 |
- Hostname string `json:"hostname,omitempty"` // hostname |
|
| 15 |
- ReadonlyFs bool `json:"readonly_fs,omitempty"` // set the containers rootfs as readonly |
|
| 16 |
- NoPivotRoot bool `json:"no_pivot_root,omitempty"` // this can be enabled if you are running in ramdisk |
|
| 17 |
- User string `json:"user,omitempty"` // user to execute the process as |
|
| 18 |
- WorkingDir string `json:"working_dir,omitempty"` // current working directory |
|
| 19 |
- Env []string `json:"environment,omitempty"` // environment to set |
|
| 20 |
- Tty bool `json:"tty,omitempty"` // setup a proper tty or not |
|
| 21 |
- Namespaces Namespaces `json:"namespaces,omitempty"` // namespaces to apply |
|
| 22 |
- Capabilities Capabilities `json:"capabilities,omitempty"` // capabilities to drop |
|
| 23 |
- Networks []*Network `json:"networks,omitempty"` // nil for host's network stack |
|
| 24 |
- Cgroups *cgroups.Cgroup `json:"cgroups,omitempty"` // cgroups |
|
| 25 |
- Context Context `json:"context,omitempty"` // generic context for specific options (apparmor, selinux) |
|
| 26 |
- Mounts []Mount `json:"mounts,omitempty"` |
|
| 14 |
+ Hostname string `json:"hostname,omitempty"` // hostname |
|
| 15 |
+ ReadonlyFs bool `json:"readonly_fs,omitempty"` // set the containers rootfs as readonly |
|
| 16 |
+ NoPivotRoot bool `json:"no_pivot_root,omitempty"` // this can be enabled if you are running in ramdisk |
|
| 17 |
+ User string `json:"user,omitempty"` // user to execute the process as |
|
| 18 |
+ WorkingDir string `json:"working_dir,omitempty"` // current working directory |
|
| 19 |
+ Env []string `json:"environment,omitempty"` // environment to set |
|
| 20 |
+ Tty bool `json:"tty,omitempty"` // setup a proper tty or not |
|
| 21 |
+ Namespaces Namespaces `json:"namespaces,omitempty"` // namespaces to apply |
|
| 22 |
+ CapabilitiesMask Capabilities `json:"capabilities_mask,omitempty"` // capabilities to drop |
|
| 23 |
+ Networks []*Network `json:"networks,omitempty"` // nil for host's network stack |
|
| 24 |
+ Cgroups *cgroups.Cgroup `json:"cgroups,omitempty"` // cgroups |
|
| 25 |
+ Context Context `json:"context,omitempty"` // generic context for specific options (apparmor, selinux) |
|
| 26 |
+ Mounts []Mount `json:"mounts,omitempty"` |
|
| 27 | 27 |
} |
| 28 | 28 |
|
| 29 | 29 |
// Network defines configuration for a container's networking stack |