Browse code
Windows: Balk on --privileged
Signed-off-by: John Howard (VM) <jhoward@ntdev.microsoft.com>
John Howard (VM) authored on 2017/03/11 02:39:22Showing 7 changed files
- runconfig/config.go
- runconfig/hostconfig.go
- runconfig/hostconfig_solaris.go
- runconfig/hostconfig_test.go
- runconfig/hostconfig_unix.go
- runconfig/hostconfig_windows.go
- runconfig/hostconfig_windows_test.go
| ... | ... |
@@ -55,24 +55,30 @@ func DecodeContainerConfig(src io.Reader) (*container.Config, *container.HostCon |
| 55 | 55 |
|
| 56 | 56 |
// Certain parameters need daemon-side validation that cannot be done |
| 57 | 57 |
// on the client, as only the daemon knows what is valid for the platform. |
| 58 |
- if err := ValidateNetMode(w.Config, hc); err != nil {
|
|
| 58 |
+ if err := validateNetMode(w.Config, hc); err != nil {
|
|
| 59 | 59 |
return nil, nil, nil, err |
| 60 | 60 |
} |
| 61 | 61 |
|
| 62 | 62 |
// Validate isolation |
| 63 |
- if err := ValidateIsolation(hc); err != nil {
|
|
| 63 |
+ if err := validateIsolation(hc); err != nil {
|
|
| 64 | 64 |
return nil, nil, nil, err |
| 65 | 65 |
} |
| 66 | 66 |
|
| 67 | 67 |
// Validate QoS |
| 68 |
- if err := ValidateQoS(hc); err != nil {
|
|
| 68 |
+ if err := validateQoS(hc); err != nil {
|
|
| 69 | 69 |
return nil, nil, nil, err |
| 70 | 70 |
} |
| 71 | 71 |
|
| 72 | 72 |
// Validate Resources |
| 73 |
- if err := ValidateResources(hc, sysinfo.New(true)); err != nil {
|
|
| 73 |
+ if err := validateResources(hc, sysinfo.New(true)); err != nil {
|
|
| 74 | 74 |
return nil, nil, nil, err |
| 75 | 75 |
} |
| 76 |
+ |
|
| 77 |
+ // Validate Privileged |
|
| 78 |
+ if err := validatePrivileged(hc); err != nil {
|
|
| 79 |
+ return nil, nil, nil, err |
|
| 80 |
+ } |
|
| 81 |
+ |
|
| 76 | 82 |
return w.Config, hc, w.NetworkingConfig, nil |
| 77 | 83 |
} |
| 78 | 84 |
|
| ... | ... |
@@ -35,9 +35,9 @@ func SetDefaultNetModeIfBlank(hc *container.HostConfig) {
|
| 35 | 35 |
} |
| 36 | 36 |
} |
| 37 | 37 |
|
| 38 |
-// ValidateNetContainerMode ensures that the various combinations of requested |
|
| 38 |
+// validateNetContainerMode ensures that the various combinations of requested |
|
| 39 | 39 |
// network settings wrt container mode are valid. |
| 40 |
-func ValidateNetContainerMode(c *container.Config, hc *container.HostConfig) error {
|
|
| 40 |
+func validateNetContainerMode(c *container.Config, hc *container.HostConfig) error {
|
|
| 41 | 41 |
// We may not be passed a host config, such as in the case of docker commit |
| 42 | 42 |
if hc == nil {
|
| 43 | 43 |
return nil |
| ... | ... |
@@ -16,26 +16,31 @@ func IsPreDefinedNetwork(network string) bool {
|
| 16 | 16 |
return false |
| 17 | 17 |
} |
| 18 | 18 |
|
| 19 |
-// ValidateNetMode ensures that the various combinations of requested |
|
| 19 |
+// validateNetMode ensures that the various combinations of requested |
|
| 20 | 20 |
// network settings are valid. |
| 21 |
-func ValidateNetMode(c *container.Config, hc *container.HostConfig) error {
|
|
| 21 |
+func validateNetMode(c *container.Config, hc *container.HostConfig) error {
|
|
| 22 | 22 |
// We may not be passed a host config, such as in the case of docker commit |
| 23 | 23 |
return nil |
| 24 | 24 |
} |
| 25 | 25 |
|
| 26 |
-// ValidateIsolation performs platform specific validation of the |
|
| 26 |
+// validateIsolation performs platform specific validation of the |
|
| 27 | 27 |
// isolation level in the hostconfig structure. |
| 28 | 28 |
// This setting is currently discarded for Solaris so this is a no-op. |
| 29 |
-func ValidateIsolation(hc *container.HostConfig) error {
|
|
| 29 |
+func validateIsolation(hc *container.HostConfig) error {
|
|
| 30 | 30 |
return nil |
| 31 | 31 |
} |
| 32 | 32 |
|
| 33 |
-// ValidateQoS performs platform specific validation of the QoS settings |
|
| 34 |
-func ValidateQoS(hc *container.HostConfig) error {
|
|
| 33 |
+// validateQoS performs platform specific validation of the QoS settings |
|
| 34 |
+func validateQoS(hc *container.HostConfig) error {
|
|
| 35 | 35 |
return nil |
| 36 | 36 |
} |
| 37 | 37 |
|
| 38 |
-// ValidateResources performs platform specific validation of the resource settings |
|
| 39 |
-func ValidateResources(hc *container.HostConfig, si *sysinfo.SysInfo) error {
|
|
| 38 |
+// validateResources performs platform specific validation of the resource settings |
|
| 39 |
+func validateResources(hc *container.HostConfig, si *sysinfo.SysInfo) error {
|
|
| 40 |
+ return nil |
|
| 41 |
+} |
|
| 42 |
+ |
|
| 43 |
+// validatePrivileged performs platform specific validation of the Privileged setting |
|
| 44 |
+func validatePrivileged(hc *container.HostConfig) error {
|
|
| 40 | 45 |
return nil |
| 41 | 46 |
} |
| ... | ... |
@@ -276,7 +276,7 @@ func TestValidateResources(t *testing.T) {
|
| 276 | 276 |
si.CPURealtimePeriod = rt.SysInfoCPURealtimePeriod |
| 277 | 277 |
si.CPURealtimeRuntime = rt.SysInfoCPURealtimeRuntime |
| 278 | 278 |
|
| 279 |
- if err := ValidateResources(&hc, &si); (err != nil) != rt.ErrorExpected {
|
|
| 279 |
+ if err := validateResources(&hc, &si); (err != nil) != rt.ErrorExpected {
|
|
| 280 | 280 |
t.Fatal(rt.FailureMsg, err) |
| 281 | 281 |
} |
| 282 | 282 |
} |
| ... | ... |
@@ -22,15 +22,15 @@ func IsPreDefinedNetwork(network string) bool {
|
| 22 | 22 |
return n.IsBridge() || n.IsHost() || n.IsNone() || n.IsDefault() || network == "ingress" |
| 23 | 23 |
} |
| 24 | 24 |
|
| 25 |
-// ValidateNetMode ensures that the various combinations of requested |
|
| 25 |
+// validateNetMode ensures that the various combinations of requested |
|
| 26 | 26 |
// network settings are valid. |
| 27 |
-func ValidateNetMode(c *container.Config, hc *container.HostConfig) error {
|
|
| 27 |
+func validateNetMode(c *container.Config, hc *container.HostConfig) error {
|
|
| 28 | 28 |
// We may not be passed a host config, such as in the case of docker commit |
| 29 | 29 |
if hc == nil {
|
| 30 | 30 |
return nil |
| 31 | 31 |
} |
| 32 | 32 |
|
| 33 |
- err := ValidateNetContainerMode(c, hc) |
|
| 33 |
+ err := validateNetContainerMode(c, hc) |
|
| 34 | 34 |
if err != nil {
|
| 35 | 35 |
return err |
| 36 | 36 |
} |
| ... | ... |
@@ -46,10 +46,10 @@ func ValidateNetMode(c *container.Config, hc *container.HostConfig) error {
|
| 46 | 46 |
return nil |
| 47 | 47 |
} |
| 48 | 48 |
|
| 49 |
-// ValidateIsolation performs platform specific validation of |
|
| 49 |
+// validateIsolation performs platform specific validation of |
|
| 50 | 50 |
// isolation in the hostconfig structure. Linux only supports "default" |
| 51 | 51 |
// which is LXC container isolation |
| 52 |
-func ValidateIsolation(hc *container.HostConfig) error {
|
|
| 52 |
+func validateIsolation(hc *container.HostConfig) error {
|
|
| 53 | 53 |
// We may not be passed a host config, such as in the case of docker commit |
| 54 | 54 |
if hc == nil {
|
| 55 | 55 |
return nil |
| ... | ... |
@@ -60,8 +60,8 @@ func ValidateIsolation(hc *container.HostConfig) error {
|
| 60 | 60 |
return nil |
| 61 | 61 |
} |
| 62 | 62 |
|
| 63 |
-// ValidateQoS performs platform specific validation of the QoS settings |
|
| 64 |
-func ValidateQoS(hc *container.HostConfig) error {
|
|
| 63 |
+// validateQoS performs platform specific validation of the QoS settings |
|
| 64 |
+func validateQoS(hc *container.HostConfig) error {
|
|
| 65 | 65 |
// We may not be passed a host config, such as in the case of docker commit |
| 66 | 66 |
if hc == nil {
|
| 67 | 67 |
return nil |
| ... | ... |
@@ -77,9 +77,9 @@ func ValidateQoS(hc *container.HostConfig) error {
|
| 77 | 77 |
return nil |
| 78 | 78 |
} |
| 79 | 79 |
|
| 80 |
-// ValidateResources performs platform specific validation of the resource settings |
|
| 80 |
+// validateResources performs platform specific validation of the resource settings |
|
| 81 | 81 |
// cpu-rt-runtime and cpu-rt-period can not be greater than their parent, cpu-rt-runtime requires sys_nice |
| 82 |
-func ValidateResources(hc *container.HostConfig, si *sysinfo.SysInfo) error {
|
|
| 82 |
+func validateResources(hc *container.HostConfig, si *sysinfo.SysInfo) error {
|
|
| 83 | 83 |
// We may not be passed a host config, such as in the case of docker commit |
| 84 | 84 |
if hc == nil {
|
| 85 | 85 |
return nil |
| ... | ... |
@@ -98,3 +98,8 @@ func ValidateResources(hc *container.HostConfig, si *sysinfo.SysInfo) error {
|
| 98 | 98 |
} |
| 99 | 99 |
return nil |
| 100 | 100 |
} |
| 101 |
+ |
|
| 102 |
+// validatePrivileged performs platform specific validation of the Privileged setting |
|
| 103 |
+func validatePrivileged(hc *container.HostConfig) error {
|
|
| 104 |
+ return nil |
|
| 105 |
+} |
| ... | ... |
@@ -18,14 +18,14 @@ func IsPreDefinedNetwork(network string) bool {
|
| 18 | 18 |
return !container.NetworkMode(network).IsUserDefined() |
| 19 | 19 |
} |
| 20 | 20 |
|
| 21 |
-// ValidateNetMode ensures that the various combinations of requested |
|
| 21 |
+// validateNetMode ensures that the various combinations of requested |
|
| 22 | 22 |
// network settings are valid. |
| 23 |
-func ValidateNetMode(c *container.Config, hc *container.HostConfig) error {
|
|
| 23 |
+func validateNetMode(c *container.Config, hc *container.HostConfig) error {
|
|
| 24 | 24 |
if hc == nil {
|
| 25 | 25 |
return nil |
| 26 | 26 |
} |
| 27 | 27 |
|
| 28 |
- err := ValidateNetContainerMode(c, hc) |
|
| 28 |
+ err := validateNetContainerMode(c, hc) |
|
| 29 | 29 |
if err != nil {
|
| 30 | 30 |
return err |
| 31 | 31 |
} |
| ... | ... |
@@ -37,10 +37,10 @@ func ValidateNetMode(c *container.Config, hc *container.HostConfig) error {
|
| 37 | 37 |
return nil |
| 38 | 38 |
} |
| 39 | 39 |
|
| 40 |
-// ValidateIsolation performs platform specific validation of the |
|
| 40 |
+// validateIsolation performs platform specific validation of the |
|
| 41 | 41 |
// isolation in the hostconfig structure. Windows supports 'default' (or |
| 42 | 42 |
// blank), 'process', or 'hyperv'. |
| 43 |
-func ValidateIsolation(hc *container.HostConfig) error {
|
|
| 43 |
+func validateIsolation(hc *container.HostConfig) error {
|
|
| 44 | 44 |
// We may not be passed a host config, such as in the case of docker commit |
| 45 | 45 |
if hc == nil {
|
| 46 | 46 |
return nil |
| ... | ... |
@@ -51,18 +51,17 @@ func ValidateIsolation(hc *container.HostConfig) error {
|
| 51 | 51 |
return nil |
| 52 | 52 |
} |
| 53 | 53 |
|
| 54 |
-// ValidateQoS performs platform specific validation of the Qos settings |
|
| 55 |
-func ValidateQoS(hc *container.HostConfig) error {
|
|
| 54 |
+// validateQoS performs platform specific validation of the Qos settings |
|
| 55 |
+func validateQoS(hc *container.HostConfig) error {
|
|
| 56 | 56 |
return nil |
| 57 | 57 |
} |
| 58 | 58 |
|
| 59 |
-// ValidateResources performs platform specific validation of the resource settings |
|
| 60 |
-func ValidateResources(hc *container.HostConfig, si *sysinfo.SysInfo) error {
|
|
| 59 |
+// validateResources performs platform specific validation of the resource settings |
|
| 60 |
+func validateResources(hc *container.HostConfig, si *sysinfo.SysInfo) error {
|
|
| 61 | 61 |
// We may not be passed a host config, such as in the case of docker commit |
| 62 | 62 |
if hc == nil {
|
| 63 | 63 |
return nil |
| 64 | 64 |
} |
| 65 |
- |
|
| 66 | 65 |
if hc.Resources.CPURealtimePeriod != 0 {
|
| 67 | 66 |
return fmt.Errorf("invalid --cpu-rt-period: Windows does not support this feature")
|
| 68 | 67 |
} |
| ... | ... |
@@ -71,3 +70,15 @@ func ValidateResources(hc *container.HostConfig, si *sysinfo.SysInfo) error {
|
| 71 | 71 |
} |
| 72 | 72 |
return nil |
| 73 | 73 |
} |
| 74 |
+ |
|
| 75 |
+// validatePrivileged performs platform specific validation of the Privileged setting |
|
| 76 |
+func validatePrivileged(hc *container.HostConfig) error {
|
|
| 77 |
+ // We may not be passed a host config, such as in the case of docker commit |
|
| 78 |
+ if hc == nil {
|
|
| 79 |
+ return nil |
|
| 80 |
+ } |
|
| 81 |
+ if hc.Privileged {
|
|
| 82 |
+ return fmt.Errorf("invalid --privileged: Windows does not support this feature")
|
|
| 83 |
+ } |
|
| 84 |
+ return nil |
|
| 85 |
+} |
| 74 | 86 |
new file mode 100644 |
| ... | ... |
@@ -0,0 +1,17 @@ |
| 0 |
+// +build windows |
|
| 1 |
+ |
|
| 2 |
+package runconfig |
|
| 3 |
+ |
|
| 4 |
+import ( |
|
| 5 |
+ "testing" |
|
| 6 |
+ |
|
| 7 |
+ "github.com/docker/docker/api/types/container" |
|
| 8 |
+) |
|
| 9 |
+ |
|
| 10 |
+func TestValidatePrivileged(t *testing.T) {
|
|
| 11 |
+ expected := "invalid --privileged: Windows does not support this feature" |
|
| 12 |
+ err := validatePrivileged(&container.HostConfig{Privileged: true})
|
|
| 13 |
+ if err == nil || err.Error() != expected {
|
|
| 14 |
+ t.Fatalf("Expected %s", expected)
|
|
| 15 |
+ } |
|
| 16 |
+} |