Signed-off-by: John Howard <jhoward@microsoft.com>
| ... | ... |
@@ -1,17 +1,7 @@ |
| 1 | 1 |
package sysinfo |
| 2 | 2 |
|
| 3 |
-import ( |
|
| 4 |
- "io/ioutil" |
|
| 5 |
- "os" |
|
| 6 |
- "path" |
|
| 7 |
- "strconv" |
|
| 8 |
- "strings" |
|
| 9 |
- |
|
| 10 |
- "github.com/Sirupsen/logrus" |
|
| 11 |
- "github.com/docker/libcontainer/cgroups" |
|
| 12 |
-) |
|
| 13 |
- |
|
| 14 | 3 |
// SysInfo stores information about which features a kernel supports. |
| 4 |
+// TODO Windows: Factor out platform specific capabilities. |
|
| 15 | 5 |
type SysInfo struct {
|
| 16 | 6 |
MemoryLimit bool |
| 17 | 7 |
SwapLimit bool |
| ... | ... |
@@ -21,70 +11,3 @@ type SysInfo struct {
|
| 21 | 21 |
AppArmor bool |
| 22 | 22 |
OomKillDisable bool |
| 23 | 23 |
} |
| 24 |
- |
|
| 25 |
-// New returns a new SysInfo, using the filesystem to detect which features the kernel supports. |
|
| 26 |
-func New(quiet bool) *SysInfo {
|
|
| 27 |
- sysInfo := &SysInfo{}
|
|
| 28 |
- if cgroupMemoryMountpoint, err := cgroups.FindCgroupMountpoint("memory"); err != nil {
|
|
| 29 |
- if !quiet {
|
|
| 30 |
- logrus.Warnf("Your kernel does not support cgroup memory limit: %v", err)
|
|
| 31 |
- } |
|
| 32 |
- } else {
|
|
| 33 |
- // If memory cgroup is mounted, MemoryLimit is always enabled. |
|
| 34 |
- sysInfo.MemoryLimit = true |
|
| 35 |
- |
|
| 36 |
- _, err1 := ioutil.ReadFile(path.Join(cgroupMemoryMountpoint, "memory.memsw.limit_in_bytes")) |
|
| 37 |
- sysInfo.SwapLimit = err1 == nil |
|
| 38 |
- if !sysInfo.SwapLimit && !quiet {
|
|
| 39 |
- logrus.Warn("Your kernel does not support swap memory limit.")
|
|
| 40 |
- } |
|
| 41 |
- |
|
| 42 |
- _, err = ioutil.ReadFile(path.Join(cgroupMemoryMountpoint, "memory.oom_control")) |
|
| 43 |
- sysInfo.OomKillDisable = err == nil |
|
| 44 |
- if !sysInfo.OomKillDisable && !quiet {
|
|
| 45 |
- logrus.Warnf("Your kernel does not support oom control.")
|
|
| 46 |
- } |
|
| 47 |
- } |
|
| 48 |
- |
|
| 49 |
- if cgroupCpuMountpoint, err := cgroups.FindCgroupMountpoint("cpu"); err != nil {
|
|
| 50 |
- if !quiet {
|
|
| 51 |
- logrus.Warnf("%v", err)
|
|
| 52 |
- } |
|
| 53 |
- } else {
|
|
| 54 |
- _, err := ioutil.ReadFile(path.Join(cgroupCpuMountpoint, "cpu.cfs_period_us")) |
|
| 55 |
- sysInfo.CpuCfsPeriod = err == nil |
|
| 56 |
- if !sysInfo.CpuCfsPeriod && !quiet {
|
|
| 57 |
- logrus.Warn("Your kernel does not support cgroup cfs period")
|
|
| 58 |
- } |
|
| 59 |
- _, err = ioutil.ReadFile(path.Join(cgroupCpuMountpoint, "cpu.cfs_quota_us")) |
|
| 60 |
- sysInfo.CpuCfsQuota = err == nil |
|
| 61 |
- if !sysInfo.CpuCfsQuota && !quiet {
|
|
| 62 |
- logrus.Warn("Your kernel does not support cgroup cfs quotas")
|
|
| 63 |
- } |
|
| 64 |
- } |
|
| 65 |
- |
|
| 66 |
- // Checek if ipv4_forward is disabled. |
|
| 67 |
- if data, err := ioutil.ReadFile("/proc/sys/net/ipv4/ip_forward"); os.IsNotExist(err) {
|
|
| 68 |
- sysInfo.IPv4ForwardingDisabled = true |
|
| 69 |
- } else {
|
|
| 70 |
- if enabled, _ := strconv.Atoi(strings.TrimSpace(string(data))); enabled == 0 {
|
|
| 71 |
- sysInfo.IPv4ForwardingDisabled = true |
|
| 72 |
- } else {
|
|
| 73 |
- sysInfo.IPv4ForwardingDisabled = false |
|
| 74 |
- } |
|
| 75 |
- } |
|
| 76 |
- |
|
| 77 |
- // Check if AppArmor is supported. |
|
| 78 |
- if _, err := os.Stat("/sys/kernel/security/apparmor"); os.IsNotExist(err) {
|
|
| 79 |
- sysInfo.AppArmor = false |
|
| 80 |
- } else {
|
|
| 81 |
- sysInfo.AppArmor = true |
|
| 82 |
- } |
|
| 83 |
- |
|
| 84 |
- // Check if Devices cgroup is mounted, it is hard requirement for container security. |
|
| 85 |
- if _, err := cgroups.FindCgroupMountpoint("devices"); err != nil {
|
|
| 86 |
- logrus.Fatalf("Error mounting devices cgroup: %v", err)
|
|
| 87 |
- } |
|
| 88 |
- |
|
| 89 |
- return sysInfo |
|
| 90 |
-} |
| 91 | 24 |
new file mode 100644 |
| ... | ... |
@@ -0,0 +1,79 @@ |
| 0 |
+package sysinfo |
|
| 1 |
+ |
|
| 2 |
+import ( |
|
| 3 |
+ "io/ioutil" |
|
| 4 |
+ "os" |
|
| 5 |
+ "path" |
|
| 6 |
+ "strconv" |
|
| 7 |
+ "strings" |
|
| 8 |
+ |
|
| 9 |
+ "github.com/Sirupsen/logrus" |
|
| 10 |
+ "github.com/docker/libcontainer/cgroups" |
|
| 11 |
+) |
|
| 12 |
+ |
|
| 13 |
+// New returns a new SysInfo, using the filesystem to detect which features the kernel supports. |
|
| 14 |
+func New(quiet bool) *SysInfo {
|
|
| 15 |
+ sysInfo := &SysInfo{}
|
|
| 16 |
+ if cgroupMemoryMountpoint, err := cgroups.FindCgroupMountpoint("memory"); err != nil {
|
|
| 17 |
+ if !quiet {
|
|
| 18 |
+ logrus.Warnf("Your kernel does not support cgroup memory limit: %v", err)
|
|
| 19 |
+ } |
|
| 20 |
+ } else {
|
|
| 21 |
+ // If memory cgroup is mounted, MemoryLimit is always enabled. |
|
| 22 |
+ sysInfo.MemoryLimit = true |
|
| 23 |
+ |
|
| 24 |
+ _, err1 := ioutil.ReadFile(path.Join(cgroupMemoryMountpoint, "memory.memsw.limit_in_bytes")) |
|
| 25 |
+ sysInfo.SwapLimit = err1 == nil |
|
| 26 |
+ if !sysInfo.SwapLimit && !quiet {
|
|
| 27 |
+ logrus.Warn("Your kernel does not support swap memory limit.")
|
|
| 28 |
+ } |
|
| 29 |
+ |
|
| 30 |
+ _, err = ioutil.ReadFile(path.Join(cgroupMemoryMountpoint, "memory.oom_control")) |
|
| 31 |
+ sysInfo.OomKillDisable = err == nil |
|
| 32 |
+ if !sysInfo.OomKillDisable && !quiet {
|
|
| 33 |
+ logrus.Warnf("Your kernel does not support oom control.")
|
|
| 34 |
+ } |
|
| 35 |
+ } |
|
| 36 |
+ |
|
| 37 |
+ if cgroupCpuMountpoint, err := cgroups.FindCgroupMountpoint("cpu"); err != nil {
|
|
| 38 |
+ if !quiet {
|
|
| 39 |
+ logrus.Warnf("%v", err)
|
|
| 40 |
+ } |
|
| 41 |
+ } else {
|
|
| 42 |
+ _, err := ioutil.ReadFile(path.Join(cgroupCpuMountpoint, "cpu.cfs_period_us")) |
|
| 43 |
+ sysInfo.CpuCfsPeriod = err == nil |
|
| 44 |
+ if !sysInfo.CpuCfsPeriod && !quiet {
|
|
| 45 |
+ logrus.Warn("Your kernel does not support cgroup cfs period")
|
|
| 46 |
+ } |
|
| 47 |
+ _, err = ioutil.ReadFile(path.Join(cgroupCpuMountpoint, "cpu.cfs_quota_us")) |
|
| 48 |
+ sysInfo.CpuCfsQuota = err == nil |
|
| 49 |
+ if !sysInfo.CpuCfsQuota && !quiet {
|
|
| 50 |
+ logrus.Warn("Your kernel does not support cgroup cfs quotas")
|
|
| 51 |
+ } |
|
| 52 |
+ } |
|
| 53 |
+ |
|
| 54 |
+ // Checek if ipv4_forward is disabled. |
|
| 55 |
+ if data, err := ioutil.ReadFile("/proc/sys/net/ipv4/ip_forward"); os.IsNotExist(err) {
|
|
| 56 |
+ sysInfo.IPv4ForwardingDisabled = true |
|
| 57 |
+ } else {
|
|
| 58 |
+ if enabled, _ := strconv.Atoi(strings.TrimSpace(string(data))); enabled == 0 {
|
|
| 59 |
+ sysInfo.IPv4ForwardingDisabled = true |
|
| 60 |
+ } else {
|
|
| 61 |
+ sysInfo.IPv4ForwardingDisabled = false |
|
| 62 |
+ } |
|
| 63 |
+ } |
|
| 64 |
+ |
|
| 65 |
+ // Check if AppArmor is supported. |
|
| 66 |
+ if _, err := os.Stat("/sys/kernel/security/apparmor"); os.IsNotExist(err) {
|
|
| 67 |
+ sysInfo.AppArmor = false |
|
| 68 |
+ } else {
|
|
| 69 |
+ sysInfo.AppArmor = true |
|
| 70 |
+ } |
|
| 71 |
+ |
|
| 72 |
+ // Check if Devices cgroup is mounted, it is hard requirement for container security. |
|
| 73 |
+ if _, err := cgroups.FindCgroupMountpoint("devices"); err != nil {
|
|
| 74 |
+ logrus.Fatalf("Error mounting devices cgroup: %v", err)
|
|
| 75 |
+ } |
|
| 76 |
+ |
|
| 77 |
+ return sysInfo |
|
| 78 |
+} |