Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
| ... | ... |
@@ -59,7 +59,8 @@ clone git github.com/miekg/pkcs11 df8ae6ca730422dba20c768ff38ef7d79077a59f |
| 59 | 59 |
clone git github.com/docker/go v1.5.1-1-1-gbaf439e |
| 60 | 60 |
clone git github.com/agl/ed25519 d2b94fd789ea21d12fac1a4443dd3a3f79cda72c |
| 61 | 61 |
|
| 62 |
-clone git github.com/opencontainers/runc 2c3115481ee1782ad687a9e0b4834f89533c2acf # libcontainer |
|
| 62 |
+clone git github.com/opencontainers/runc 7b6c4c418d5090f4f11eee949fdf49afd15838c9 # libcontainer |
|
| 63 |
+clone git github.com/opencontainers/specs 3ce138b1934bf227a418e241ead496c383eaba1c # specs |
|
| 63 | 64 |
clone git github.com/seccomp/libseccomp-golang 1b506fc7c24eec5a3693cdcbed40d9c226cfc6a1 |
| 64 | 65 |
# libcontainer deps (see src/github.com/opencontainers/runc/Godeps/Godeps.json) |
| 65 | 66 |
clone git github.com/coreos/go-systemd v4 |
| ... | ... |
@@ -87,4 +88,6 @@ clone git golang.org/x/oauth2 2baa8a1b9338cf13d9eeb27696d761155fa480be https://g |
| 87 | 87 |
clone git google.golang.org/api dc6d2353af16e2a2b0ff6986af051d473a4ed468 https://code.googlesource.com/google-api-go-client |
| 88 | 88 |
clone git google.golang.org/cloud dae7e3d993bc3812a2185af60552bb6b847e52a0 https://code.googlesource.com/gocloud |
| 89 | 89 |
|
| 90 |
+# containerd |
|
| 91 |
+clone git github.com/docker/containerd ab5eae56bf3a800e062c6d63fb94f766a732813f |
|
| 90 | 92 |
clean |
| 91 | 93 |
new file mode 100644 |
| ... | ... |
@@ -0,0 +1,191 @@ |
| 0 |
+ |
|
| 1 |
+ Apache License |
|
| 2 |
+ Version 2.0, January 2004 |
|
| 3 |
+ https://www.apache.org/licenses/ |
|
| 4 |
+ |
|
| 5 |
+ TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION |
|
| 6 |
+ |
|
| 7 |
+ 1. Definitions. |
|
| 8 |
+ |
|
| 9 |
+ "License" shall mean the terms and conditions for use, reproduction, |
|
| 10 |
+ and distribution as defined by Sections 1 through 9 of this document. |
|
| 11 |
+ |
|
| 12 |
+ "Licensor" shall mean the copyright owner or entity authorized by |
|
| 13 |
+ the copyright owner that is granting the License. |
|
| 14 |
+ |
|
| 15 |
+ "Legal Entity" shall mean the union of the acting entity and all |
|
| 16 |
+ other entities that control, are controlled by, or are under common |
|
| 17 |
+ control with that entity. For the purposes of this definition, |
|
| 18 |
+ "control" means (i) the power, direct or indirect, to cause the |
|
| 19 |
+ direction or management of such entity, whether by contract or |
|
| 20 |
+ otherwise, or (ii) ownership of fifty percent (50%) or more of the |
|
| 21 |
+ outstanding shares, or (iii) beneficial ownership of such entity. |
|
| 22 |
+ |
|
| 23 |
+ "You" (or "Your") shall mean an individual or Legal Entity |
|
| 24 |
+ exercising permissions granted by this License. |
|
| 25 |
+ |
|
| 26 |
+ "Source" form shall mean the preferred form for making modifications, |
|
| 27 |
+ including but not limited to software source code, documentation |
|
| 28 |
+ source, and configuration files. |
|
| 29 |
+ |
|
| 30 |
+ "Object" form shall mean any form resulting from mechanical |
|
| 31 |
+ transformation or translation of a Source form, including but |
|
| 32 |
+ not limited to compiled object code, generated documentation, |
|
| 33 |
+ and conversions to other media types. |
|
| 34 |
+ |
|
| 35 |
+ "Work" shall mean the work of authorship, whether in Source or |
|
| 36 |
+ Object form, made available under the License, as indicated by a |
|
| 37 |
+ copyright notice that is included in or attached to the work |
|
| 38 |
+ (an example is provided in the Appendix below). |
|
| 39 |
+ |
|
| 40 |
+ "Derivative Works" shall mean any work, whether in Source or Object |
|
| 41 |
+ form, that is based on (or derived from) the Work and for which the |
|
| 42 |
+ editorial revisions, annotations, elaborations, or other modifications |
|
| 43 |
+ represent, as a whole, an original work of authorship. For the purposes |
|
| 44 |
+ of this License, Derivative Works shall not include works that remain |
|
| 45 |
+ separable from, or merely link (or bind by name) to the interfaces of, |
|
| 46 |
+ the Work and Derivative Works thereof. |
|
| 47 |
+ |
|
| 48 |
+ "Contribution" shall mean any work of authorship, including |
|
| 49 |
+ the original version of the Work and any modifications or additions |
|
| 50 |
+ to that Work or Derivative Works thereof, that is intentionally |
|
| 51 |
+ submitted to Licensor for inclusion in the Work by the copyright owner |
|
| 52 |
+ or by an individual or Legal Entity authorized to submit on behalf of |
|
| 53 |
+ the copyright owner. For the purposes of this definition, "submitted" |
|
| 54 |
+ means any form of electronic, verbal, or written communication sent |
|
| 55 |
+ to the Licensor or its representatives, including but not limited to |
|
| 56 |
+ communication on electronic mailing lists, source code control systems, |
|
| 57 |
+ and issue tracking systems that are managed by, or on behalf of, the |
|
| 58 |
+ Licensor for the purpose of discussing and improving the Work, but |
|
| 59 |
+ excluding communication that is conspicuously marked or otherwise |
|
| 60 |
+ designated in writing by the copyright owner as "Not a Contribution." |
|
| 61 |
+ |
|
| 62 |
+ "Contributor" shall mean Licensor and any individual or Legal Entity |
|
| 63 |
+ on behalf of whom a Contribution has been received by Licensor and |
|
| 64 |
+ subsequently incorporated within the Work. |
|
| 65 |
+ |
|
| 66 |
+ 2. Grant of Copyright License. Subject to the terms and conditions of |
|
| 67 |
+ this License, each Contributor hereby grants to You a perpetual, |
|
| 68 |
+ worldwide, non-exclusive, no-charge, royalty-free, irrevocable |
|
| 69 |
+ copyright license to reproduce, prepare Derivative Works of, |
|
| 70 |
+ publicly display, publicly perform, sublicense, and distribute the |
|
| 71 |
+ Work and such Derivative Works in Source or Object form. |
|
| 72 |
+ |
|
| 73 |
+ 3. Grant of Patent License. Subject to the terms and conditions of |
|
| 74 |
+ this License, each Contributor hereby grants to You a perpetual, |
|
| 75 |
+ worldwide, non-exclusive, no-charge, royalty-free, irrevocable |
|
| 76 |
+ (except as stated in this section) patent license to make, have made, |
|
| 77 |
+ use, offer to sell, sell, import, and otherwise transfer the Work, |
|
| 78 |
+ where such license applies only to those patent claims licensable |
|
| 79 |
+ by such Contributor that are necessarily infringed by their |
|
| 80 |
+ Contribution(s) alone or by combination of their Contribution(s) |
|
| 81 |
+ with the Work to which such Contribution(s) was submitted. If You |
|
| 82 |
+ institute patent litigation against any entity (including a |
|
| 83 |
+ cross-claim or counterclaim in a lawsuit) alleging that the Work |
|
| 84 |
+ or a Contribution incorporated within the Work constitutes direct |
|
| 85 |
+ or contributory patent infringement, then any patent licenses |
|
| 86 |
+ granted to You under this License for that Work shall terminate |
|
| 87 |
+ as of the date such litigation is filed. |
|
| 88 |
+ |
|
| 89 |
+ 4. Redistribution. You may reproduce and distribute copies of the |
|
| 90 |
+ Work or Derivative Works thereof in any medium, with or without |
|
| 91 |
+ modifications, and in Source or Object form, provided that You |
|
| 92 |
+ meet the following conditions: |
|
| 93 |
+ |
|
| 94 |
+ (a) You must give any other recipients of the Work or |
|
| 95 |
+ Derivative Works a copy of this License; and |
|
| 96 |
+ |
|
| 97 |
+ (b) You must cause any modified files to carry prominent notices |
|
| 98 |
+ stating that You changed the files; and |
|
| 99 |
+ |
|
| 100 |
+ (c) You must retain, in the Source form of any Derivative Works |
|
| 101 |
+ that You distribute, all copyright, patent, trademark, and |
|
| 102 |
+ attribution notices from the Source form of the Work, |
|
| 103 |
+ excluding those notices that do not pertain to any part of |
|
| 104 |
+ the Derivative Works; and |
|
| 105 |
+ |
|
| 106 |
+ (d) If the Work includes a "NOTICE" text file as part of its |
|
| 107 |
+ distribution, then any Derivative Works that You distribute must |
|
| 108 |
+ include a readable copy of the attribution notices contained |
|
| 109 |
+ within such NOTICE file, excluding those notices that do not |
|
| 110 |
+ pertain to any part of the Derivative Works, in at least one |
|
| 111 |
+ of the following places: within a NOTICE text file distributed |
|
| 112 |
+ as part of the Derivative Works; within the Source form or |
|
| 113 |
+ documentation, if provided along with the Derivative Works; or, |
|
| 114 |
+ within a display generated by the Derivative Works, if and |
|
| 115 |
+ wherever such third-party notices normally appear. The contents |
|
| 116 |
+ of the NOTICE file are for informational purposes only and |
|
| 117 |
+ do not modify the License. You may add Your own attribution |
|
| 118 |
+ notices within Derivative Works that You distribute, alongside |
|
| 119 |
+ or as an addendum to the NOTICE text from the Work, provided |
|
| 120 |
+ that such additional attribution notices cannot be construed |
|
| 121 |
+ as modifying the License. |
|
| 122 |
+ |
|
| 123 |
+ You may add Your own copyright statement to Your modifications and |
|
| 124 |
+ may provide additional or different license terms and conditions |
|
| 125 |
+ for use, reproduction, or distribution of Your modifications, or |
|
| 126 |
+ for any such Derivative Works as a whole, provided Your use, |
|
| 127 |
+ reproduction, and distribution of the Work otherwise complies with |
|
| 128 |
+ the conditions stated in this License. |
|
| 129 |
+ |
|
| 130 |
+ 5. Submission of Contributions. Unless You explicitly state otherwise, |
|
| 131 |
+ any Contribution intentionally submitted for inclusion in the Work |
|
| 132 |
+ by You to the Licensor shall be under the terms and conditions of |
|
| 133 |
+ this License, without any additional terms or conditions. |
|
| 134 |
+ Notwithstanding the above, nothing herein shall supersede or modify |
|
| 135 |
+ the terms of any separate license agreement you may have executed |
|
| 136 |
+ with Licensor regarding such Contributions. |
|
| 137 |
+ |
|
| 138 |
+ 6. Trademarks. This License does not grant permission to use the trade |
|
| 139 |
+ names, trademarks, service marks, or product names of the Licensor, |
|
| 140 |
+ except as required for reasonable and customary use in describing the |
|
| 141 |
+ origin of the Work and reproducing the content of the NOTICE file. |
|
| 142 |
+ |
|
| 143 |
+ 7. Disclaimer of Warranty. Unless required by applicable law or |
|
| 144 |
+ agreed to in writing, Licensor provides the Work (and each |
|
| 145 |
+ Contributor provides its Contributions) on an "AS IS" BASIS, |
|
| 146 |
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or |
|
| 147 |
+ implied, including, without limitation, any warranties or conditions |
|
| 148 |
+ of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A |
|
| 149 |
+ PARTICULAR PURPOSE. You are solely responsible for determining the |
|
| 150 |
+ appropriateness of using or redistributing the Work and assume any |
|
| 151 |
+ risks associated with Your exercise of permissions under this License. |
|
| 152 |
+ |
|
| 153 |
+ 8. Limitation of Liability. In no event and under no legal theory, |
|
| 154 |
+ whether in tort (including negligence), contract, or otherwise, |
|
| 155 |
+ unless required by applicable law (such as deliberate and grossly |
|
| 156 |
+ negligent acts) or agreed to in writing, shall any Contributor be |
|
| 157 |
+ liable to You for damages, including any direct, indirect, special, |
|
| 158 |
+ incidental, or consequential damages of any character arising as a |
|
| 159 |
+ result of this License or out of the use or inability to use the |
|
| 160 |
+ Work (including but not limited to damages for loss of goodwill, |
|
| 161 |
+ work stoppage, computer failure or malfunction, or any and all |
|
| 162 |
+ other commercial damages or losses), even if such Contributor |
|
| 163 |
+ has been advised of the possibility of such damages. |
|
| 164 |
+ |
|
| 165 |
+ 9. Accepting Warranty or Additional Liability. While redistributing |
|
| 166 |
+ the Work or Derivative Works thereof, You may choose to offer, |
|
| 167 |
+ and charge a fee for, acceptance of support, warranty, indemnity, |
|
| 168 |
+ or other liability obligations and/or rights consistent with this |
|
| 169 |
+ License. However, in accepting such obligations, You may act only |
|
| 170 |
+ on Your own behalf and on Your sole responsibility, not on behalf |
|
| 171 |
+ of any other Contributor, and only if You agree to indemnify, |
|
| 172 |
+ defend, and hold each Contributor harmless for any liability |
|
| 173 |
+ incurred by, or claims asserted against, such Contributor by reason |
|
| 174 |
+ of your accepting any such warranty or additional liability. |
|
| 175 |
+ |
|
| 176 |
+ END OF TERMS AND CONDITIONS |
|
| 177 |
+ |
|
| 178 |
+ Copyright 2013-2015 Docker, Inc. |
|
| 179 |
+ |
|
| 180 |
+ Licensed under the Apache License, Version 2.0 (the "License"); |
|
| 181 |
+ you may not use this file except in compliance with the License. |
|
| 182 |
+ You may obtain a copy of the License at |
|
| 183 |
+ |
|
| 184 |
+ https://www.apache.org/licenses/LICENSE-2.0 |
|
| 185 |
+ |
|
| 186 |
+ Unless required by applicable law or agreed to in writing, software |
|
| 187 |
+ distributed under the License is distributed on an "AS IS" BASIS, |
|
| 188 |
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
|
| 189 |
+ See the License for the specific language governing permissions and |
|
| 190 |
+ limitations under the License. |
| 0 | 191 |
new file mode 100644 |
| ... | ... |
@@ -0,0 +1,425 @@ |
| 0 |
+Attribution-ShareAlike 4.0 International |
|
| 1 |
+ |
|
| 2 |
+======================================================================= |
|
| 3 |
+ |
|
| 4 |
+Creative Commons Corporation ("Creative Commons") is not a law firm and
|
|
| 5 |
+does not provide legal services or legal advice. Distribution of |
|
| 6 |
+Creative Commons public licenses does not create a lawyer-client or |
|
| 7 |
+other relationship. Creative Commons makes its licenses and related |
|
| 8 |
+information available on an "as-is" basis. Creative Commons gives no |
|
| 9 |
+warranties regarding its licenses, any material licensed under their |
|
| 10 |
+terms and conditions, or any related information. Creative Commons |
|
| 11 |
+disclaims all liability for damages resulting from their use to the |
|
| 12 |
+fullest extent possible. |
|
| 13 |
+ |
|
| 14 |
+Using Creative Commons Public Licenses |
|
| 15 |
+ |
|
| 16 |
+Creative Commons public licenses provide a standard set of terms and |
|
| 17 |
+conditions that creators and other rights holders may use to share |
|
| 18 |
+original works of authorship and other material subject to copyright |
|
| 19 |
+and certain other rights specified in the public license below. The |
|
| 20 |
+following considerations are for informational purposes only, are not |
|
| 21 |
+exhaustive, and do not form part of our licenses. |
|
| 22 |
+ |
|
| 23 |
+ Considerations for licensors: Our public licenses are |
|
| 24 |
+ intended for use by those authorized to give the public |
|
| 25 |
+ permission to use material in ways otherwise restricted by |
|
| 26 |
+ copyright and certain other rights. Our licenses are |
|
| 27 |
+ irrevocable. Licensors should read and understand the terms |
|
| 28 |
+ and conditions of the license they choose before applying it. |
|
| 29 |
+ Licensors should also secure all rights necessary before |
|
| 30 |
+ applying our licenses so that the public can reuse the |
|
| 31 |
+ material as expected. Licensors should clearly mark any |
|
| 32 |
+ material not subject to the license. This includes other CC- |
|
| 33 |
+ licensed material, or material used under an exception or |
|
| 34 |
+ limitation to copyright. More considerations for licensors: |
|
| 35 |
+ wiki.creativecommons.org/Considerations_for_licensors |
|
| 36 |
+ |
|
| 37 |
+ Considerations for the public: By using one of our public |
|
| 38 |
+ licenses, a licensor grants the public permission to use the |
|
| 39 |
+ licensed material under specified terms and conditions. If |
|
| 40 |
+ the licensor's permission is not necessary for any reason--for |
|
| 41 |
+ example, because of any applicable exception or limitation to |
|
| 42 |
+ copyright--then that use is not regulated by the license. Our |
|
| 43 |
+ licenses grant only permissions under copyright and certain |
|
| 44 |
+ other rights that a licensor has authority to grant. Use of |
|
| 45 |
+ the licensed material may still be restricted for other |
|
| 46 |
+ reasons, including because others have copyright or other |
|
| 47 |
+ rights in the material. A licensor may make special requests, |
|
| 48 |
+ such as asking that all changes be marked or described. |
|
| 49 |
+ Although not required by our licenses, you are encouraged to |
|
| 50 |
+ respect those requests where reasonable. More_considerations |
|
| 51 |
+ for the public: |
|
| 52 |
+ wiki.creativecommons.org/Considerations_for_licensees |
|
| 53 |
+ |
|
| 54 |
+======================================================================= |
|
| 55 |
+ |
|
| 56 |
+Creative Commons Attribution-ShareAlike 4.0 International Public |
|
| 57 |
+License |
|
| 58 |
+ |
|
| 59 |
+By exercising the Licensed Rights (defined below), You accept and agree |
|
| 60 |
+to be bound by the terms and conditions of this Creative Commons |
|
| 61 |
+Attribution-ShareAlike 4.0 International Public License ("Public
|
|
| 62 |
+License"). To the extent this Public License may be interpreted as a |
|
| 63 |
+contract, You are granted the Licensed Rights in consideration of Your |
|
| 64 |
+acceptance of these terms and conditions, and the Licensor grants You |
|
| 65 |
+such rights in consideration of benefits the Licensor receives from |
|
| 66 |
+making the Licensed Material available under these terms and |
|
| 67 |
+conditions. |
|
| 68 |
+ |
|
| 69 |
+ |
|
| 70 |
+Section 1 -- Definitions. |
|
| 71 |
+ |
|
| 72 |
+ a. Adapted Material means material subject to Copyright and Similar |
|
| 73 |
+ Rights that is derived from or based upon the Licensed Material |
|
| 74 |
+ and in which the Licensed Material is translated, altered, |
|
| 75 |
+ arranged, transformed, or otherwise modified in a manner requiring |
|
| 76 |
+ permission under the Copyright and Similar Rights held by the |
|
| 77 |
+ Licensor. For purposes of this Public License, where the Licensed |
|
| 78 |
+ Material is a musical work, performance, or sound recording, |
|
| 79 |
+ Adapted Material is always produced where the Licensed Material is |
|
| 80 |
+ synched in timed relation with a moving image. |
|
| 81 |
+ |
|
| 82 |
+ b. Adapter's License means the license You apply to Your Copyright |
|
| 83 |
+ and Similar Rights in Your contributions to Adapted Material in |
|
| 84 |
+ accordance with the terms and conditions of this Public License. |
|
| 85 |
+ |
|
| 86 |
+ c. BY-SA Compatible License means a license listed at |
|
| 87 |
+ creativecommons.org/compatiblelicenses, approved by Creative |
|
| 88 |
+ Commons as essentially the equivalent of this Public License. |
|
| 89 |
+ |
|
| 90 |
+ d. Copyright and Similar Rights means copyright and/or similar rights |
|
| 91 |
+ closely related to copyright including, without limitation, |
|
| 92 |
+ performance, broadcast, sound recording, and Sui Generis Database |
|
| 93 |
+ Rights, without regard to how the rights are labeled or |
|
| 94 |
+ categorized. For purposes of this Public License, the rights |
|
| 95 |
+ specified in Section 2(b)(1)-(2) are not Copyright and Similar |
|
| 96 |
+ Rights. |
|
| 97 |
+ |
|
| 98 |
+ e. Effective Technological Measures means those measures that, in the |
|
| 99 |
+ absence of proper authority, may not be circumvented under laws |
|
| 100 |
+ fulfilling obligations under Article 11 of the WIPO Copyright |
|
| 101 |
+ Treaty adopted on December 20, 1996, and/or similar international |
|
| 102 |
+ agreements. |
|
| 103 |
+ |
|
| 104 |
+ f. Exceptions and Limitations means fair use, fair dealing, and/or |
|
| 105 |
+ any other exception or limitation to Copyright and Similar Rights |
|
| 106 |
+ that applies to Your use of the Licensed Material. |
|
| 107 |
+ |
|
| 108 |
+ g. License Elements means the license attributes listed in the name |
|
| 109 |
+ of a Creative Commons Public License. The License Elements of this |
|
| 110 |
+ Public License are Attribution and ShareAlike. |
|
| 111 |
+ |
|
| 112 |
+ h. Licensed Material means the artistic or literary work, database, |
|
| 113 |
+ or other material to which the Licensor applied this Public |
|
| 114 |
+ License. |
|
| 115 |
+ |
|
| 116 |
+ i. Licensed Rights means the rights granted to You subject to the |
|
| 117 |
+ terms and conditions of this Public License, which are limited to |
|
| 118 |
+ all Copyright and Similar Rights that apply to Your use of the |
|
| 119 |
+ Licensed Material and that the Licensor has authority to license. |
|
| 120 |
+ |
|
| 121 |
+ j. Licensor means the individual(s) or entity(ies) granting rights |
|
| 122 |
+ under this Public License. |
|
| 123 |
+ |
|
| 124 |
+ k. Share means to provide material to the public by any means or |
|
| 125 |
+ process that requires permission under the Licensed Rights, such |
|
| 126 |
+ as reproduction, public display, public performance, distribution, |
|
| 127 |
+ dissemination, communication, or importation, and to make material |
|
| 128 |
+ available to the public including in ways that members of the |
|
| 129 |
+ public may access the material from a place and at a time |
|
| 130 |
+ individually chosen by them. |
|
| 131 |
+ |
|
| 132 |
+ l. Sui Generis Database Rights means rights other than copyright |
|
| 133 |
+ resulting from Directive 96/9/EC of the European Parliament and of |
|
| 134 |
+ the Council of 11 March 1996 on the legal protection of databases, |
|
| 135 |
+ as amended and/or succeeded, as well as other essentially |
|
| 136 |
+ equivalent rights anywhere in the world. |
|
| 137 |
+ |
|
| 138 |
+ m. You means the individual or entity exercising the Licensed Rights |
|
| 139 |
+ under this Public License. Your has a corresponding meaning. |
|
| 140 |
+ |
|
| 141 |
+ |
|
| 142 |
+Section 2 -- Scope. |
|
| 143 |
+ |
|
| 144 |
+ a. License grant. |
|
| 145 |
+ |
|
| 146 |
+ 1. Subject to the terms and conditions of this Public License, |
|
| 147 |
+ the Licensor hereby grants You a worldwide, royalty-free, |
|
| 148 |
+ non-sublicensable, non-exclusive, irrevocable license to |
|
| 149 |
+ exercise the Licensed Rights in the Licensed Material to: |
|
| 150 |
+ |
|
| 151 |
+ a. reproduce and Share the Licensed Material, in whole or |
|
| 152 |
+ in part; and |
|
| 153 |
+ |
|
| 154 |
+ b. produce, reproduce, and Share Adapted Material. |
|
| 155 |
+ |
|
| 156 |
+ 2. Exceptions and Limitations. For the avoidance of doubt, where |
|
| 157 |
+ Exceptions and Limitations apply to Your use, this Public |
|
| 158 |
+ License does not apply, and You do not need to comply with |
|
| 159 |
+ its terms and conditions. |
|
| 160 |
+ |
|
| 161 |
+ 3. Term. The term of this Public License is specified in Section |
|
| 162 |
+ 6(a). |
|
| 163 |
+ |
|
| 164 |
+ 4. Media and formats; technical modifications allowed. The |
|
| 165 |
+ Licensor authorizes You to exercise the Licensed Rights in |
|
| 166 |
+ all media and formats whether now known or hereafter created, |
|
| 167 |
+ and to make technical modifications necessary to do so. The |
|
| 168 |
+ Licensor waives and/or agrees not to assert any right or |
|
| 169 |
+ authority to forbid You from making technical modifications |
|
| 170 |
+ necessary to exercise the Licensed Rights, including |
|
| 171 |
+ technical modifications necessary to circumvent Effective |
|
| 172 |
+ Technological Measures. For purposes of this Public License, |
|
| 173 |
+ simply making modifications authorized by this Section 2(a) |
|
| 174 |
+ (4) never produces Adapted Material. |
|
| 175 |
+ |
|
| 176 |
+ 5. Downstream recipients. |
|
| 177 |
+ |
|
| 178 |
+ a. Offer from the Licensor -- Licensed Material. Every |
|
| 179 |
+ recipient of the Licensed Material automatically |
|
| 180 |
+ receives an offer from the Licensor to exercise the |
|
| 181 |
+ Licensed Rights under the terms and conditions of this |
|
| 182 |
+ Public License. |
|
| 183 |
+ |
|
| 184 |
+ b. Additional offer from the Licensor -- Adapted Material. |
|
| 185 |
+ Every recipient of Adapted Material from You |
|
| 186 |
+ automatically receives an offer from the Licensor to |
|
| 187 |
+ exercise the Licensed Rights in the Adapted Material |
|
| 188 |
+ under the conditions of the Adapter's License You apply. |
|
| 189 |
+ |
|
| 190 |
+ c. No downstream restrictions. You may not offer or impose |
|
| 191 |
+ any additional or different terms or conditions on, or |
|
| 192 |
+ apply any Effective Technological Measures to, the |
|
| 193 |
+ Licensed Material if doing so restricts exercise of the |
|
| 194 |
+ Licensed Rights by any recipient of the Licensed |
|
| 195 |
+ Material. |
|
| 196 |
+ |
|
| 197 |
+ 6. No endorsement. Nothing in this Public License constitutes or |
|
| 198 |
+ may be construed as permission to assert or imply that You |
|
| 199 |
+ are, or that Your use of the Licensed Material is, connected |
|
| 200 |
+ with, or sponsored, endorsed, or granted official status by, |
|
| 201 |
+ the Licensor or others designated to receive attribution as |
|
| 202 |
+ provided in Section 3(a)(1)(A)(i). |
|
| 203 |
+ |
|
| 204 |
+ b. Other rights. |
|
| 205 |
+ |
|
| 206 |
+ 1. Moral rights, such as the right of integrity, are not |
|
| 207 |
+ licensed under this Public License, nor are publicity, |
|
| 208 |
+ privacy, and/or other similar personality rights; however, to |
|
| 209 |
+ the extent possible, the Licensor waives and/or agrees not to |
|
| 210 |
+ assert any such rights held by the Licensor to the limited |
|
| 211 |
+ extent necessary to allow You to exercise the Licensed |
|
| 212 |
+ Rights, but not otherwise. |
|
| 213 |
+ |
|
| 214 |
+ 2. Patent and trademark rights are not licensed under this |
|
| 215 |
+ Public License. |
|
| 216 |
+ |
|
| 217 |
+ 3. To the extent possible, the Licensor waives any right to |
|
| 218 |
+ collect royalties from You for the exercise of the Licensed |
|
| 219 |
+ Rights, whether directly or through a collecting society |
|
| 220 |
+ under any voluntary or waivable statutory or compulsory |
|
| 221 |
+ licensing scheme. In all other cases the Licensor expressly |
|
| 222 |
+ reserves any right to collect such royalties. |
|
| 223 |
+ |
|
| 224 |
+ |
|
| 225 |
+Section 3 -- License Conditions. |
|
| 226 |
+ |
|
| 227 |
+Your exercise of the Licensed Rights is expressly made subject to the |
|
| 228 |
+following conditions. |
|
| 229 |
+ |
|
| 230 |
+ a. Attribution. |
|
| 231 |
+ |
|
| 232 |
+ 1. If You Share the Licensed Material (including in modified |
|
| 233 |
+ form), You must: |
|
| 234 |
+ |
|
| 235 |
+ a. retain the following if it is supplied by the Licensor |
|
| 236 |
+ with the Licensed Material: |
|
| 237 |
+ |
|
| 238 |
+ i. identification of the creator(s) of the Licensed |
|
| 239 |
+ Material and any others designated to receive |
|
| 240 |
+ attribution, in any reasonable manner requested by |
|
| 241 |
+ the Licensor (including by pseudonym if |
|
| 242 |
+ designated); |
|
| 243 |
+ |
|
| 244 |
+ ii. a copyright notice; |
|
| 245 |
+ |
|
| 246 |
+ iii. a notice that refers to this Public License; |
|
| 247 |
+ |
|
| 248 |
+ iv. a notice that refers to the disclaimer of |
|
| 249 |
+ warranties; |
|
| 250 |
+ |
|
| 251 |
+ v. a URI or hyperlink to the Licensed Material to the |
|
| 252 |
+ extent reasonably practicable; |
|
| 253 |
+ |
|
| 254 |
+ b. indicate if You modified the Licensed Material and |
|
| 255 |
+ retain an indication of any previous modifications; and |
|
| 256 |
+ |
|
| 257 |
+ c. indicate the Licensed Material is licensed under this |
|
| 258 |
+ Public License, and include the text of, or the URI or |
|
| 259 |
+ hyperlink to, this Public License. |
|
| 260 |
+ |
|
| 261 |
+ 2. You may satisfy the conditions in Section 3(a)(1) in any |
|
| 262 |
+ reasonable manner based on the medium, means, and context in |
|
| 263 |
+ which You Share the Licensed Material. For example, it may be |
|
| 264 |
+ reasonable to satisfy the conditions by providing a URI or |
|
| 265 |
+ hyperlink to a resource that includes the required |
|
| 266 |
+ information. |
|
| 267 |
+ |
|
| 268 |
+ 3. If requested by the Licensor, You must remove any of the |
|
| 269 |
+ information required by Section 3(a)(1)(A) to the extent |
|
| 270 |
+ reasonably practicable. |
|
| 271 |
+ |
|
| 272 |
+ b. ShareAlike. |
|
| 273 |
+ |
|
| 274 |
+ In addition to the conditions in Section 3(a), if You Share |
|
| 275 |
+ Adapted Material You produce, the following conditions also apply. |
|
| 276 |
+ |
|
| 277 |
+ 1. The Adapter's License You apply must be a Creative Commons |
|
| 278 |
+ license with the same License Elements, this version or |
|
| 279 |
+ later, or a BY-SA Compatible License. |
|
| 280 |
+ |
|
| 281 |
+ 2. You must include the text of, or the URI or hyperlink to, the |
|
| 282 |
+ Adapter's License You apply. You may satisfy this condition |
|
| 283 |
+ in any reasonable manner based on the medium, means, and |
|
| 284 |
+ context in which You Share Adapted Material. |
|
| 285 |
+ |
|
| 286 |
+ 3. You may not offer or impose any additional or different terms |
|
| 287 |
+ or conditions on, or apply any Effective Technological |
|
| 288 |
+ Measures to, Adapted Material that restrict exercise of the |
|
| 289 |
+ rights granted under the Adapter's License You apply. |
|
| 290 |
+ |
|
| 291 |
+ |
|
| 292 |
+Section 4 -- Sui Generis Database Rights. |
|
| 293 |
+ |
|
| 294 |
+Where the Licensed Rights include Sui Generis Database Rights that |
|
| 295 |
+apply to Your use of the Licensed Material: |
|
| 296 |
+ |
|
| 297 |
+ a. for the avoidance of doubt, Section 2(a)(1) grants You the right |
|
| 298 |
+ to extract, reuse, reproduce, and Share all or a substantial |
|
| 299 |
+ portion of the contents of the database; |
|
| 300 |
+ |
|
| 301 |
+ b. if You include all or a substantial portion of the database |
|
| 302 |
+ contents in a database in which You have Sui Generis Database |
|
| 303 |
+ Rights, then the database in which You have Sui Generis Database |
|
| 304 |
+ Rights (but not its individual contents) is Adapted Material, |
|
| 305 |
+ |
|
| 306 |
+ including for purposes of Section 3(b); and |
|
| 307 |
+ c. You must comply with the conditions in Section 3(a) if You Share |
|
| 308 |
+ all or a substantial portion of the contents of the database. |
|
| 309 |
+ |
|
| 310 |
+For the avoidance of doubt, this Section 4 supplements and does not |
|
| 311 |
+replace Your obligations under this Public License where the Licensed |
|
| 312 |
+Rights include other Copyright and Similar Rights. |
|
| 313 |
+ |
|
| 314 |
+ |
|
| 315 |
+Section 5 -- Disclaimer of Warranties and Limitation of Liability. |
|
| 316 |
+ |
|
| 317 |
+ a. UNLESS OTHERWISE SEPARATELY UNDERTAKEN BY THE LICENSOR, TO THE |
|
| 318 |
+ EXTENT POSSIBLE, THE LICENSOR OFFERS THE LICENSED MATERIAL AS-IS |
|
| 319 |
+ AND AS-AVAILABLE, AND MAKES NO REPRESENTATIONS OR WARRANTIES OF |
|
| 320 |
+ ANY KIND CONCERNING THE LICENSED MATERIAL, WHETHER EXPRESS, |
|
| 321 |
+ IMPLIED, STATUTORY, OR OTHER. THIS INCLUDES, WITHOUT LIMITATION, |
|
| 322 |
+ WARRANTIES OF TITLE, MERCHANTABILITY, FITNESS FOR A PARTICULAR |
|
| 323 |
+ PURPOSE, NON-INFRINGEMENT, ABSENCE OF LATENT OR OTHER DEFECTS, |
|
| 324 |
+ ACCURACY, OR THE PRESENCE OR ABSENCE OF ERRORS, WHETHER OR NOT |
|
| 325 |
+ KNOWN OR DISCOVERABLE. WHERE DISCLAIMERS OF WARRANTIES ARE NOT |
|
| 326 |
+ ALLOWED IN FULL OR IN PART, THIS DISCLAIMER MAY NOT APPLY TO YOU. |
|
| 327 |
+ |
|
| 328 |
+ b. TO THE EXTENT POSSIBLE, IN NO EVENT WILL THE LICENSOR BE LIABLE |
|
| 329 |
+ TO YOU ON ANY LEGAL THEORY (INCLUDING, WITHOUT LIMITATION, |
|
| 330 |
+ NEGLIGENCE) OR OTHERWISE FOR ANY DIRECT, SPECIAL, INDIRECT, |
|
| 331 |
+ INCIDENTAL, CONSEQUENTIAL, PUNITIVE, EXEMPLARY, OR OTHER LOSSES, |
|
| 332 |
+ COSTS, EXPENSES, OR DAMAGES ARISING OUT OF THIS PUBLIC LICENSE OR |
|
| 333 |
+ USE OF THE LICENSED MATERIAL, EVEN IF THE LICENSOR HAS BEEN |
|
| 334 |
+ ADVISED OF THE POSSIBILITY OF SUCH LOSSES, COSTS, EXPENSES, OR |
|
| 335 |
+ DAMAGES. WHERE A LIMITATION OF LIABILITY IS NOT ALLOWED IN FULL OR |
|
| 336 |
+ IN PART, THIS LIMITATION MAY NOT APPLY TO YOU. |
|
| 337 |
+ |
|
| 338 |
+ c. The disclaimer of warranties and limitation of liability provided |
|
| 339 |
+ above shall be interpreted in a manner that, to the extent |
|
| 340 |
+ possible, most closely approximates an absolute disclaimer and |
|
| 341 |
+ waiver of all liability. |
|
| 342 |
+ |
|
| 343 |
+ |
|
| 344 |
+Section 6 -- Term and Termination. |
|
| 345 |
+ |
|
| 346 |
+ a. This Public License applies for the term of the Copyright and |
|
| 347 |
+ Similar Rights licensed here. However, if You fail to comply with |
|
| 348 |
+ this Public License, then Your rights under this Public License |
|
| 349 |
+ terminate automatically. |
|
| 350 |
+ |
|
| 351 |
+ b. Where Your right to use the Licensed Material has terminated under |
|
| 352 |
+ Section 6(a), it reinstates: |
|
| 353 |
+ |
|
| 354 |
+ 1. automatically as of the date the violation is cured, provided |
|
| 355 |
+ it is cured within 30 days of Your discovery of the |
|
| 356 |
+ violation; or |
|
| 357 |
+ |
|
| 358 |
+ 2. upon express reinstatement by the Licensor. |
|
| 359 |
+ |
|
| 360 |
+ For the avoidance of doubt, this Section 6(b) does not affect any |
|
| 361 |
+ right the Licensor may have to seek remedies for Your violations |
|
| 362 |
+ of this Public License. |
|
| 363 |
+ |
|
| 364 |
+ c. For the avoidance of doubt, the Licensor may also offer the |
|
| 365 |
+ Licensed Material under separate terms or conditions or stop |
|
| 366 |
+ distributing the Licensed Material at any time; however, doing so |
|
| 367 |
+ will not terminate this Public License. |
|
| 368 |
+ |
|
| 369 |
+ d. Sections 1, 5, 6, 7, and 8 survive termination of this Public |
|
| 370 |
+ License. |
|
| 371 |
+ |
|
| 372 |
+ |
|
| 373 |
+Section 7 -- Other Terms and Conditions. |
|
| 374 |
+ |
|
| 375 |
+ a. The Licensor shall not be bound by any additional or different |
|
| 376 |
+ terms or conditions communicated by You unless expressly agreed. |
|
| 377 |
+ |
|
| 378 |
+ b. Any arrangements, understandings, or agreements regarding the |
|
| 379 |
+ Licensed Material not stated herein are separate from and |
|
| 380 |
+ independent of the terms and conditions of this Public License. |
|
| 381 |
+ |
|
| 382 |
+ |
|
| 383 |
+Section 8 -- Interpretation. |
|
| 384 |
+ |
|
| 385 |
+ a. For the avoidance of doubt, this Public License does not, and |
|
| 386 |
+ shall not be interpreted to, reduce, limit, restrict, or impose |
|
| 387 |
+ conditions on any use of the Licensed Material that could lawfully |
|
| 388 |
+ be made without permission under this Public License. |
|
| 389 |
+ |
|
| 390 |
+ b. To the extent possible, if any provision of this Public License is |
|
| 391 |
+ deemed unenforceable, it shall be automatically reformed to the |
|
| 392 |
+ minimum extent necessary to make it enforceable. If the provision |
|
| 393 |
+ cannot be reformed, it shall be severed from this Public License |
|
| 394 |
+ without affecting the enforceability of the remaining terms and |
|
| 395 |
+ conditions. |
|
| 396 |
+ |
|
| 397 |
+ c. No term or condition of this Public License will be waived and no |
|
| 398 |
+ failure to comply consented to unless expressly agreed to by the |
|
| 399 |
+ Licensor. |
|
| 400 |
+ |
|
| 401 |
+ d. Nothing in this Public License constitutes or may be interpreted |
|
| 402 |
+ as a limitation upon, or waiver of, any privileges and immunities |
|
| 403 |
+ that apply to the Licensor or You, including from the legal |
|
| 404 |
+ processes of any jurisdiction or authority. |
|
| 405 |
+ |
|
| 406 |
+ |
|
| 407 |
+======================================================================= |
|
| 408 |
+ |
|
| 409 |
+Creative Commons is not a party to its public licenses. |
|
| 410 |
+Notwithstanding, Creative Commons may elect to apply one of its public |
|
| 411 |
+licenses to material it publishes and in those instances will be |
|
| 412 |
+considered the "Licensor." Except for the limited purpose of indicating |
|
| 413 |
+that material is shared under a Creative Commons public license or as |
|
| 414 |
+otherwise permitted by the Creative Commons policies published at |
|
| 415 |
+creativecommons.org/policies, Creative Commons does not authorize the |
|
| 416 |
+use of the trademark "Creative Commons" or any other trademark or logo |
|
| 417 |
+of Creative Commons without its prior written consent including, |
|
| 418 |
+without limitation, in connection with any unauthorized modifications |
|
| 419 |
+to any of its public licenses or any other arrangements, |
|
| 420 |
+understandings, or agreements concerning use of licensed material. For |
|
| 421 |
+the avoidance of doubt, this paragraph does not form part of the public |
|
| 422 |
+licenses. |
|
| 423 |
+ |
|
| 424 |
+Creative Commons may be contacted at creativecommons.org. |
| 0 | 425 |
new file mode 100644 |
| ... | ... |
@@ -0,0 +1,1290 @@ |
| 0 |
+// Code generated by protoc-gen-go. |
|
| 1 |
+// source: api.proto |
|
| 2 |
+// DO NOT EDIT! |
|
| 3 |
+ |
|
| 4 |
+/* |
|
| 5 |
+Package types is a generated protocol buffer package. |
|
| 6 |
+ |
|
| 7 |
+It is generated from these files: |
|
| 8 |
+ api.proto |
|
| 9 |
+ |
|
| 10 |
+It has these top-level messages: |
|
| 11 |
+ UpdateProcessRequest |
|
| 12 |
+ UpdateProcessResponse |
|
| 13 |
+ CreateContainerRequest |
|
| 14 |
+ CreateContainerResponse |
|
| 15 |
+ SignalRequest |
|
| 16 |
+ SignalResponse |
|
| 17 |
+ AddProcessRequest |
|
| 18 |
+ User |
|
| 19 |
+ AddProcessResponse |
|
| 20 |
+ CreateCheckpointRequest |
|
| 21 |
+ CreateCheckpointResponse |
|
| 22 |
+ DeleteCheckpointRequest |
|
| 23 |
+ DeleteCheckpointResponse |
|
| 24 |
+ ListCheckpointRequest |
|
| 25 |
+ Checkpoint |
|
| 26 |
+ ListCheckpointResponse |
|
| 27 |
+ StateRequest |
|
| 28 |
+ ContainerState |
|
| 29 |
+ Process |
|
| 30 |
+ Container |
|
| 31 |
+ Machine |
|
| 32 |
+ StateResponse |
|
| 33 |
+ UpdateContainerRequest |
|
| 34 |
+ UpdateResource |
|
| 35 |
+ UpdateContainerResponse |
|
| 36 |
+ EventsRequest |
|
| 37 |
+ Event |
|
| 38 |
+ NetworkStats |
|
| 39 |
+ CpuUsage |
|
| 40 |
+ ThrottlingData |
|
| 41 |
+ CpuStats |
|
| 42 |
+ PidsStats |
|
| 43 |
+ MemoryData |
|
| 44 |
+ MemoryStats |
|
| 45 |
+ BlkioStatsEntry |
|
| 46 |
+ BlkioStats |
|
| 47 |
+ HugetlbStats |
|
| 48 |
+ CgroupStats |
|
| 49 |
+ StatsResponse |
|
| 50 |
+ StatsRequest |
|
| 51 |
+*/ |
|
| 52 |
+package types |
|
| 53 |
+ |
|
| 54 |
+import proto "github.com/golang/protobuf/proto" |
|
| 55 |
+import fmt "fmt" |
|
| 56 |
+import math "math" |
|
| 57 |
+ |
|
| 58 |
+import ( |
|
| 59 |
+ context "golang.org/x/net/context" |
|
| 60 |
+ grpc "google.golang.org/grpc" |
|
| 61 |
+) |
|
| 62 |
+ |
|
| 63 |
+// Reference imports to suppress errors if they are not otherwise used. |
|
| 64 |
+var _ = proto.Marshal |
|
| 65 |
+var _ = fmt.Errorf |
|
| 66 |
+var _ = math.Inf |
|
| 67 |
+ |
|
| 68 |
+type UpdateProcessRequest struct {
|
|
| 69 |
+ Id string `protobuf:"bytes,1,opt,name=id" json:"id,omitempty"` |
|
| 70 |
+ Pid string `protobuf:"bytes,2,opt,name=pid" json:"pid,omitempty"` |
|
| 71 |
+ CloseStdin bool `protobuf:"varint,3,opt,name=closeStdin" json:"closeStdin,omitempty"` |
|
| 72 |
+ Width uint32 `protobuf:"varint,4,opt,name=width" json:"width,omitempty"` |
|
| 73 |
+ Height uint32 `protobuf:"varint,5,opt,name=height" json:"height,omitempty"` |
|
| 74 |
+} |
|
| 75 |
+ |
|
| 76 |
+func (m *UpdateProcessRequest) Reset() { *m = UpdateProcessRequest{} }
|
|
| 77 |
+func (m *UpdateProcessRequest) String() string { return proto.CompactTextString(m) }
|
|
| 78 |
+func (*UpdateProcessRequest) ProtoMessage() {}
|
|
| 79 |
+func (*UpdateProcessRequest) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{0} }
|
|
| 80 |
+ |
|
| 81 |
+type UpdateProcessResponse struct {
|
|
| 82 |
+} |
|
| 83 |
+ |
|
| 84 |
+func (m *UpdateProcessResponse) Reset() { *m = UpdateProcessResponse{} }
|
|
| 85 |
+func (m *UpdateProcessResponse) String() string { return proto.CompactTextString(m) }
|
|
| 86 |
+func (*UpdateProcessResponse) ProtoMessage() {}
|
|
| 87 |
+func (*UpdateProcessResponse) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{1} }
|
|
| 88 |
+ |
|
| 89 |
+type CreateContainerRequest struct {
|
|
| 90 |
+ Id string `protobuf:"bytes,1,opt,name=id" json:"id,omitempty"` |
|
| 91 |
+ BundlePath string `protobuf:"bytes,2,opt,name=bundlePath" json:"bundlePath,omitempty"` |
|
| 92 |
+ Checkpoint string `protobuf:"bytes,3,opt,name=checkpoint" json:"checkpoint,omitempty"` |
|
| 93 |
+ Stdin string `protobuf:"bytes,4,opt,name=stdin" json:"stdin,omitempty"` |
|
| 94 |
+ Stdout string `protobuf:"bytes,5,opt,name=stdout" json:"stdout,omitempty"` |
|
| 95 |
+ Stderr string `protobuf:"bytes,6,opt,name=stderr" json:"stderr,omitempty"` |
|
| 96 |
+ Labels []string `protobuf:"bytes,7,rep,name=labels" json:"labels,omitempty"` |
|
| 97 |
+} |
|
| 98 |
+ |
|
| 99 |
+func (m *CreateContainerRequest) Reset() { *m = CreateContainerRequest{} }
|
|
| 100 |
+func (m *CreateContainerRequest) String() string { return proto.CompactTextString(m) }
|
|
| 101 |
+func (*CreateContainerRequest) ProtoMessage() {}
|
|
| 102 |
+func (*CreateContainerRequest) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{2} }
|
|
| 103 |
+ |
|
| 104 |
+type CreateContainerResponse struct {
|
|
| 105 |
+ Container *Container `protobuf:"bytes,1,opt,name=container" json:"container,omitempty"` |
|
| 106 |
+} |
|
| 107 |
+ |
|
| 108 |
+func (m *CreateContainerResponse) Reset() { *m = CreateContainerResponse{} }
|
|
| 109 |
+func (m *CreateContainerResponse) String() string { return proto.CompactTextString(m) }
|
|
| 110 |
+func (*CreateContainerResponse) ProtoMessage() {}
|
|
| 111 |
+func (*CreateContainerResponse) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{3} }
|
|
| 112 |
+ |
|
| 113 |
+func (m *CreateContainerResponse) GetContainer() *Container {
|
|
| 114 |
+ if m != nil {
|
|
| 115 |
+ return m.Container |
|
| 116 |
+ } |
|
| 117 |
+ return nil |
|
| 118 |
+} |
|
| 119 |
+ |
|
| 120 |
+type SignalRequest struct {
|
|
| 121 |
+ Id string `protobuf:"bytes,1,opt,name=id" json:"id,omitempty"` |
|
| 122 |
+ Pid string `protobuf:"bytes,2,opt,name=pid" json:"pid,omitempty"` |
|
| 123 |
+ Signal uint32 `protobuf:"varint,3,opt,name=signal" json:"signal,omitempty"` |
|
| 124 |
+} |
|
| 125 |
+ |
|
| 126 |
+func (m *SignalRequest) Reset() { *m = SignalRequest{} }
|
|
| 127 |
+func (m *SignalRequest) String() string { return proto.CompactTextString(m) }
|
|
| 128 |
+func (*SignalRequest) ProtoMessage() {}
|
|
| 129 |
+func (*SignalRequest) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{4} }
|
|
| 130 |
+ |
|
| 131 |
+type SignalResponse struct {
|
|
| 132 |
+} |
|
| 133 |
+ |
|
| 134 |
+func (m *SignalResponse) Reset() { *m = SignalResponse{} }
|
|
| 135 |
+func (m *SignalResponse) String() string { return proto.CompactTextString(m) }
|
|
| 136 |
+func (*SignalResponse) ProtoMessage() {}
|
|
| 137 |
+func (*SignalResponse) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{5} }
|
|
| 138 |
+ |
|
| 139 |
+type AddProcessRequest struct {
|
|
| 140 |
+ Id string `protobuf:"bytes,1,opt,name=id" json:"id,omitempty"` |
|
| 141 |
+ Terminal bool `protobuf:"varint,2,opt,name=terminal" json:"terminal,omitempty"` |
|
| 142 |
+ User *User `protobuf:"bytes,3,opt,name=user" json:"user,omitempty"` |
|
| 143 |
+ Args []string `protobuf:"bytes,4,rep,name=args" json:"args,omitempty"` |
|
| 144 |
+ Env []string `protobuf:"bytes,5,rep,name=env" json:"env,omitempty"` |
|
| 145 |
+ Cwd string `protobuf:"bytes,6,opt,name=cwd" json:"cwd,omitempty"` |
|
| 146 |
+ Pid string `protobuf:"bytes,7,opt,name=pid" json:"pid,omitempty"` |
|
| 147 |
+ Stdin string `protobuf:"bytes,8,opt,name=stdin" json:"stdin,omitempty"` |
|
| 148 |
+ Stdout string `protobuf:"bytes,9,opt,name=stdout" json:"stdout,omitempty"` |
|
| 149 |
+ Stderr string `protobuf:"bytes,10,opt,name=stderr" json:"stderr,omitempty"` |
|
| 150 |
+ Capabilities []string `protobuf:"bytes,11,rep,name=capabilities" json:"capabilities,omitempty"` |
|
| 151 |
+ ApparmorProfile string `protobuf:"bytes,12,opt,name=apparmorProfile" json:"apparmorProfile,omitempty"` |
|
| 152 |
+ SelinuxLabel string `protobuf:"bytes,13,opt,name=selinuxLabel" json:"selinuxLabel,omitempty"` |
|
| 153 |
+ NoNewPrivileges bool `protobuf:"varint,14,opt,name=noNewPrivileges" json:"noNewPrivileges,omitempty"` |
|
| 154 |
+} |
|
| 155 |
+ |
|
| 156 |
+func (m *AddProcessRequest) Reset() { *m = AddProcessRequest{} }
|
|
| 157 |
+func (m *AddProcessRequest) String() string { return proto.CompactTextString(m) }
|
|
| 158 |
+func (*AddProcessRequest) ProtoMessage() {}
|
|
| 159 |
+func (*AddProcessRequest) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{6} }
|
|
| 160 |
+ |
|
| 161 |
+func (m *AddProcessRequest) GetUser() *User {
|
|
| 162 |
+ if m != nil {
|
|
| 163 |
+ return m.User |
|
| 164 |
+ } |
|
| 165 |
+ return nil |
|
| 166 |
+} |
|
| 167 |
+ |
|
| 168 |
+type User struct {
|
|
| 169 |
+ Uid uint32 `protobuf:"varint,1,opt,name=uid" json:"uid,omitempty"` |
|
| 170 |
+ Gid uint32 `protobuf:"varint,2,opt,name=gid" json:"gid,omitempty"` |
|
| 171 |
+ AdditionalGids []uint32 `protobuf:"varint,3,rep,name=additionalGids" json:"additionalGids,omitempty"` |
|
| 172 |
+} |
|
| 173 |
+ |
|
| 174 |
+func (m *User) Reset() { *m = User{} }
|
|
| 175 |
+func (m *User) String() string { return proto.CompactTextString(m) }
|
|
| 176 |
+func (*User) ProtoMessage() {}
|
|
| 177 |
+func (*User) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{7} }
|
|
| 178 |
+ |
|
| 179 |
+type AddProcessResponse struct {
|
|
| 180 |
+} |
|
| 181 |
+ |
|
| 182 |
+func (m *AddProcessResponse) Reset() { *m = AddProcessResponse{} }
|
|
| 183 |
+func (m *AddProcessResponse) String() string { return proto.CompactTextString(m) }
|
|
| 184 |
+func (*AddProcessResponse) ProtoMessage() {}
|
|
| 185 |
+func (*AddProcessResponse) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{8} }
|
|
| 186 |
+ |
|
| 187 |
+type CreateCheckpointRequest struct {
|
|
| 188 |
+ Id string `protobuf:"bytes,1,opt,name=id" json:"id,omitempty"` |
|
| 189 |
+ Checkpoint *Checkpoint `protobuf:"bytes,2,opt,name=checkpoint" json:"checkpoint,omitempty"` |
|
| 190 |
+} |
|
| 191 |
+ |
|
| 192 |
+func (m *CreateCheckpointRequest) Reset() { *m = CreateCheckpointRequest{} }
|
|
| 193 |
+func (m *CreateCheckpointRequest) String() string { return proto.CompactTextString(m) }
|
|
| 194 |
+func (*CreateCheckpointRequest) ProtoMessage() {}
|
|
| 195 |
+func (*CreateCheckpointRequest) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{9} }
|
|
| 196 |
+ |
|
| 197 |
+func (m *CreateCheckpointRequest) GetCheckpoint() *Checkpoint {
|
|
| 198 |
+ if m != nil {
|
|
| 199 |
+ return m.Checkpoint |
|
| 200 |
+ } |
|
| 201 |
+ return nil |
|
| 202 |
+} |
|
| 203 |
+ |
|
| 204 |
+type CreateCheckpointResponse struct {
|
|
| 205 |
+} |
|
| 206 |
+ |
|
| 207 |
+func (m *CreateCheckpointResponse) Reset() { *m = CreateCheckpointResponse{} }
|
|
| 208 |
+func (m *CreateCheckpointResponse) String() string { return proto.CompactTextString(m) }
|
|
| 209 |
+func (*CreateCheckpointResponse) ProtoMessage() {}
|
|
| 210 |
+func (*CreateCheckpointResponse) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{10} }
|
|
| 211 |
+ |
|
| 212 |
+type DeleteCheckpointRequest struct {
|
|
| 213 |
+ Id string `protobuf:"bytes,1,opt,name=id" json:"id,omitempty"` |
|
| 214 |
+ Name string `protobuf:"bytes,2,opt,name=name" json:"name,omitempty"` |
|
| 215 |
+} |
|
| 216 |
+ |
|
| 217 |
+func (m *DeleteCheckpointRequest) Reset() { *m = DeleteCheckpointRequest{} }
|
|
| 218 |
+func (m *DeleteCheckpointRequest) String() string { return proto.CompactTextString(m) }
|
|
| 219 |
+func (*DeleteCheckpointRequest) ProtoMessage() {}
|
|
| 220 |
+func (*DeleteCheckpointRequest) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{11} }
|
|
| 221 |
+ |
|
| 222 |
+type DeleteCheckpointResponse struct {
|
|
| 223 |
+} |
|
| 224 |
+ |
|
| 225 |
+func (m *DeleteCheckpointResponse) Reset() { *m = DeleteCheckpointResponse{} }
|
|
| 226 |
+func (m *DeleteCheckpointResponse) String() string { return proto.CompactTextString(m) }
|
|
| 227 |
+func (*DeleteCheckpointResponse) ProtoMessage() {}
|
|
| 228 |
+func (*DeleteCheckpointResponse) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{12} }
|
|
| 229 |
+ |
|
| 230 |
+type ListCheckpointRequest struct {
|
|
| 231 |
+ Id string `protobuf:"bytes,1,opt,name=id" json:"id,omitempty"` |
|
| 232 |
+} |
|
| 233 |
+ |
|
| 234 |
+func (m *ListCheckpointRequest) Reset() { *m = ListCheckpointRequest{} }
|
|
| 235 |
+func (m *ListCheckpointRequest) String() string { return proto.CompactTextString(m) }
|
|
| 236 |
+func (*ListCheckpointRequest) ProtoMessage() {}
|
|
| 237 |
+func (*ListCheckpointRequest) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{13} }
|
|
| 238 |
+ |
|
| 239 |
+type Checkpoint struct {
|
|
| 240 |
+ Name string `protobuf:"bytes,1,opt,name=name" json:"name,omitempty"` |
|
| 241 |
+ Exit bool `protobuf:"varint,2,opt,name=exit" json:"exit,omitempty"` |
|
| 242 |
+ Tcp bool `protobuf:"varint,3,opt,name=tcp" json:"tcp,omitempty"` |
|
| 243 |
+ UnixSockets bool `protobuf:"varint,4,opt,name=unixSockets" json:"unixSockets,omitempty"` |
|
| 244 |
+ Shell bool `protobuf:"varint,5,opt,name=shell" json:"shell,omitempty"` |
|
| 245 |
+} |
|
| 246 |
+ |
|
| 247 |
+func (m *Checkpoint) Reset() { *m = Checkpoint{} }
|
|
| 248 |
+func (m *Checkpoint) String() string { return proto.CompactTextString(m) }
|
|
| 249 |
+func (*Checkpoint) ProtoMessage() {}
|
|
| 250 |
+func (*Checkpoint) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{14} }
|
|
| 251 |
+ |
|
| 252 |
+type ListCheckpointResponse struct {
|
|
| 253 |
+ Checkpoints []*Checkpoint `protobuf:"bytes,1,rep,name=checkpoints" json:"checkpoints,omitempty"` |
|
| 254 |
+} |
|
| 255 |
+ |
|
| 256 |
+func (m *ListCheckpointResponse) Reset() { *m = ListCheckpointResponse{} }
|
|
| 257 |
+func (m *ListCheckpointResponse) String() string { return proto.CompactTextString(m) }
|
|
| 258 |
+func (*ListCheckpointResponse) ProtoMessage() {}
|
|
| 259 |
+func (*ListCheckpointResponse) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{15} }
|
|
| 260 |
+ |
|
| 261 |
+func (m *ListCheckpointResponse) GetCheckpoints() []*Checkpoint {
|
|
| 262 |
+ if m != nil {
|
|
| 263 |
+ return m.Checkpoints |
|
| 264 |
+ } |
|
| 265 |
+ return nil |
|
| 266 |
+} |
|
| 267 |
+ |
|
| 268 |
+type StateRequest struct {
|
|
| 269 |
+ Id string `protobuf:"bytes,1,opt,name=id" json:"id,omitempty"` |
|
| 270 |
+} |
|
| 271 |
+ |
|
| 272 |
+func (m *StateRequest) Reset() { *m = StateRequest{} }
|
|
| 273 |
+func (m *StateRequest) String() string { return proto.CompactTextString(m) }
|
|
| 274 |
+func (*StateRequest) ProtoMessage() {}
|
|
| 275 |
+func (*StateRequest) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{16} }
|
|
| 276 |
+ |
|
| 277 |
+type ContainerState struct {
|
|
| 278 |
+ Status string `protobuf:"bytes,1,opt,name=status" json:"status,omitempty"` |
|
| 279 |
+} |
|
| 280 |
+ |
|
| 281 |
+func (m *ContainerState) Reset() { *m = ContainerState{} }
|
|
| 282 |
+func (m *ContainerState) String() string { return proto.CompactTextString(m) }
|
|
| 283 |
+func (*ContainerState) ProtoMessage() {}
|
|
| 284 |
+func (*ContainerState) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{17} }
|
|
| 285 |
+ |
|
| 286 |
+type Process struct {
|
|
| 287 |
+ Pid string `protobuf:"bytes,1,opt,name=pid" json:"pid,omitempty"` |
|
| 288 |
+ Terminal bool `protobuf:"varint,2,opt,name=terminal" json:"terminal,omitempty"` |
|
| 289 |
+ User *User `protobuf:"bytes,3,opt,name=user" json:"user,omitempty"` |
|
| 290 |
+ Args []string `protobuf:"bytes,4,rep,name=args" json:"args,omitempty"` |
|
| 291 |
+ Env []string `protobuf:"bytes,5,rep,name=env" json:"env,omitempty"` |
|
| 292 |
+ Cwd string `protobuf:"bytes,6,opt,name=cwd" json:"cwd,omitempty"` |
|
| 293 |
+ SystemPid uint32 `protobuf:"varint,7,opt,name=systemPid" json:"systemPid,omitempty"` |
|
| 294 |
+ Stdin string `protobuf:"bytes,8,opt,name=stdin" json:"stdin,omitempty"` |
|
| 295 |
+ Stdout string `protobuf:"bytes,9,opt,name=stdout" json:"stdout,omitempty"` |
|
| 296 |
+ Stderr string `protobuf:"bytes,10,opt,name=stderr" json:"stderr,omitempty"` |
|
| 297 |
+ Capabilities []string `protobuf:"bytes,11,rep,name=capabilities" json:"capabilities,omitempty"` |
|
| 298 |
+ ApparmorProfile string `protobuf:"bytes,12,opt,name=apparmorProfile" json:"apparmorProfile,omitempty"` |
|
| 299 |
+ SelinuxLabel string `protobuf:"bytes,13,opt,name=selinuxLabel" json:"selinuxLabel,omitempty"` |
|
| 300 |
+ NoNewPrivileges bool `protobuf:"varint,14,opt,name=noNewPrivileges" json:"noNewPrivileges,omitempty"` |
|
| 301 |
+} |
|
| 302 |
+ |
|
| 303 |
+func (m *Process) Reset() { *m = Process{} }
|
|
| 304 |
+func (m *Process) String() string { return proto.CompactTextString(m) }
|
|
| 305 |
+func (*Process) ProtoMessage() {}
|
|
| 306 |
+func (*Process) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{18} }
|
|
| 307 |
+ |
|
| 308 |
+func (m *Process) GetUser() *User {
|
|
| 309 |
+ if m != nil {
|
|
| 310 |
+ return m.User |
|
| 311 |
+ } |
|
| 312 |
+ return nil |
|
| 313 |
+} |
|
| 314 |
+ |
|
| 315 |
+type Container struct {
|
|
| 316 |
+ Id string `protobuf:"bytes,1,opt,name=id" json:"id,omitempty"` |
|
| 317 |
+ BundlePath string `protobuf:"bytes,2,opt,name=bundlePath" json:"bundlePath,omitempty"` |
|
| 318 |
+ Processes []*Process `protobuf:"bytes,3,rep,name=processes" json:"processes,omitempty"` |
|
| 319 |
+ Status string `protobuf:"bytes,4,opt,name=status" json:"status,omitempty"` |
|
| 320 |
+ Labels []string `protobuf:"bytes,5,rep,name=labels" json:"labels,omitempty"` |
|
| 321 |
+ Pids []uint32 `protobuf:"varint,6,rep,name=pids" json:"pids,omitempty"` |
|
| 322 |
+ Runtime string `protobuf:"bytes,7,opt,name=runtime" json:"runtime,omitempty"` |
|
| 323 |
+} |
|
| 324 |
+ |
|
| 325 |
+func (m *Container) Reset() { *m = Container{} }
|
|
| 326 |
+func (m *Container) String() string { return proto.CompactTextString(m) }
|
|
| 327 |
+func (*Container) ProtoMessage() {}
|
|
| 328 |
+func (*Container) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{19} }
|
|
| 329 |
+ |
|
| 330 |
+func (m *Container) GetProcesses() []*Process {
|
|
| 331 |
+ if m != nil {
|
|
| 332 |
+ return m.Processes |
|
| 333 |
+ } |
|
| 334 |
+ return nil |
|
| 335 |
+} |
|
| 336 |
+ |
|
| 337 |
+// Machine is information about machine on which containerd is run |
|
| 338 |
+type Machine struct {
|
|
| 339 |
+ Cpus uint32 `protobuf:"varint,1,opt,name=cpus" json:"cpus,omitempty"` |
|
| 340 |
+ Memory uint64 `protobuf:"varint,2,opt,name=memory" json:"memory,omitempty"` |
|
| 341 |
+} |
|
| 342 |
+ |
|
| 343 |
+func (m *Machine) Reset() { *m = Machine{} }
|
|
| 344 |
+func (m *Machine) String() string { return proto.CompactTextString(m) }
|
|
| 345 |
+func (*Machine) ProtoMessage() {}
|
|
| 346 |
+func (*Machine) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{20} }
|
|
| 347 |
+ |
|
| 348 |
+// StateResponse is information about containerd daemon |
|
| 349 |
+type StateResponse struct {
|
|
| 350 |
+ Containers []*Container `protobuf:"bytes,1,rep,name=containers" json:"containers,omitempty"` |
|
| 351 |
+ Machine *Machine `protobuf:"bytes,2,opt,name=machine" json:"machine,omitempty"` |
|
| 352 |
+} |
|
| 353 |
+ |
|
| 354 |
+func (m *StateResponse) Reset() { *m = StateResponse{} }
|
|
| 355 |
+func (m *StateResponse) String() string { return proto.CompactTextString(m) }
|
|
| 356 |
+func (*StateResponse) ProtoMessage() {}
|
|
| 357 |
+func (*StateResponse) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{21} }
|
|
| 358 |
+ |
|
| 359 |
+func (m *StateResponse) GetContainers() []*Container {
|
|
| 360 |
+ if m != nil {
|
|
| 361 |
+ return m.Containers |
|
| 362 |
+ } |
|
| 363 |
+ return nil |
|
| 364 |
+} |
|
| 365 |
+ |
|
| 366 |
+func (m *StateResponse) GetMachine() *Machine {
|
|
| 367 |
+ if m != nil {
|
|
| 368 |
+ return m.Machine |
|
| 369 |
+ } |
|
| 370 |
+ return nil |
|
| 371 |
+} |
|
| 372 |
+ |
|
| 373 |
+type UpdateContainerRequest struct {
|
|
| 374 |
+ Id string `protobuf:"bytes,1,opt,name=id" json:"id,omitempty"` |
|
| 375 |
+ Pid string `protobuf:"bytes,2,opt,name=pid" json:"pid,omitempty"` |
|
| 376 |
+ Status string `protobuf:"bytes,3,opt,name=status" json:"status,omitempty"` |
|
| 377 |
+ Resources *UpdateResource `protobuf:"bytes,4,opt,name=resources" json:"resources,omitempty"` |
|
| 378 |
+} |
|
| 379 |
+ |
|
| 380 |
+func (m *UpdateContainerRequest) Reset() { *m = UpdateContainerRequest{} }
|
|
| 381 |
+func (m *UpdateContainerRequest) String() string { return proto.CompactTextString(m) }
|
|
| 382 |
+func (*UpdateContainerRequest) ProtoMessage() {}
|
|
| 383 |
+func (*UpdateContainerRequest) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{22} }
|
|
| 384 |
+ |
|
| 385 |
+func (m *UpdateContainerRequest) GetResources() *UpdateResource {
|
|
| 386 |
+ if m != nil {
|
|
| 387 |
+ return m.Resources |
|
| 388 |
+ } |
|
| 389 |
+ return nil |
|
| 390 |
+} |
|
| 391 |
+ |
|
| 392 |
+type UpdateResource struct {
|
|
| 393 |
+ BlkioWeight uint32 `protobuf:"varint,1,opt,name=blkioWeight" json:"blkioWeight,omitempty"` |
|
| 394 |
+ CpuShares uint32 `protobuf:"varint,2,opt,name=cpuShares" json:"cpuShares,omitempty"` |
|
| 395 |
+ CpuPeriod uint32 `protobuf:"varint,3,opt,name=cpuPeriod" json:"cpuPeriod,omitempty"` |
|
| 396 |
+ CpuQuota uint32 `protobuf:"varint,4,opt,name=cpuQuota" json:"cpuQuota,omitempty"` |
|
| 397 |
+ CpusetCpus string `protobuf:"bytes,5,opt,name=cpusetCpus" json:"cpusetCpus,omitempty"` |
|
| 398 |
+ CpusetMems string `protobuf:"bytes,6,opt,name=cpusetMems" json:"cpusetMems,omitempty"` |
|
| 399 |
+ MemoryLimit uint32 `protobuf:"varint,7,opt,name=memoryLimit" json:"memoryLimit,omitempty"` |
|
| 400 |
+ MemorySwap uint32 `protobuf:"varint,8,opt,name=memorySwap" json:"memorySwap,omitempty"` |
|
| 401 |
+ MemoryReservation uint32 `protobuf:"varint,9,opt,name=memoryReservation" json:"memoryReservation,omitempty"` |
|
| 402 |
+ KernelMemoryLimit uint32 `protobuf:"varint,10,opt,name=kernelMemoryLimit" json:"kernelMemoryLimit,omitempty"` |
|
| 403 |
+} |
|
| 404 |
+ |
|
| 405 |
+func (m *UpdateResource) Reset() { *m = UpdateResource{} }
|
|
| 406 |
+func (m *UpdateResource) String() string { return proto.CompactTextString(m) }
|
|
| 407 |
+func (*UpdateResource) ProtoMessage() {}
|
|
| 408 |
+func (*UpdateResource) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{23} }
|
|
| 409 |
+ |
|
| 410 |
+type UpdateContainerResponse struct {
|
|
| 411 |
+} |
|
| 412 |
+ |
|
| 413 |
+func (m *UpdateContainerResponse) Reset() { *m = UpdateContainerResponse{} }
|
|
| 414 |
+func (m *UpdateContainerResponse) String() string { return proto.CompactTextString(m) }
|
|
| 415 |
+func (*UpdateContainerResponse) ProtoMessage() {}
|
|
| 416 |
+func (*UpdateContainerResponse) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{24} }
|
|
| 417 |
+ |
|
| 418 |
+type EventsRequest struct {
|
|
| 419 |
+ Timestamp uint64 `protobuf:"varint,1,opt,name=timestamp" json:"timestamp,omitempty"` |
|
| 420 |
+} |
|
| 421 |
+ |
|
| 422 |
+func (m *EventsRequest) Reset() { *m = EventsRequest{} }
|
|
| 423 |
+func (m *EventsRequest) String() string { return proto.CompactTextString(m) }
|
|
| 424 |
+func (*EventsRequest) ProtoMessage() {}
|
|
| 425 |
+func (*EventsRequest) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{25} }
|
|
| 426 |
+ |
|
| 427 |
+type Event struct {
|
|
| 428 |
+ Type string `protobuf:"bytes,1,opt,name=type" json:"type,omitempty"` |
|
| 429 |
+ Id string `protobuf:"bytes,2,opt,name=id" json:"id,omitempty"` |
|
| 430 |
+ Status uint32 `protobuf:"varint,3,opt,name=status" json:"status,omitempty"` |
|
| 431 |
+ Pid string `protobuf:"bytes,4,opt,name=pid" json:"pid,omitempty"` |
|
| 432 |
+ Timestamp uint64 `protobuf:"varint,5,opt,name=timestamp" json:"timestamp,omitempty"` |
|
| 433 |
+} |
|
| 434 |
+ |
|
| 435 |
+func (m *Event) Reset() { *m = Event{} }
|
|
| 436 |
+func (m *Event) String() string { return proto.CompactTextString(m) }
|
|
| 437 |
+func (*Event) ProtoMessage() {}
|
|
| 438 |
+func (*Event) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{26} }
|
|
| 439 |
+ |
|
| 440 |
+type NetworkStats struct {
|
|
| 441 |
+ Name string `protobuf:"bytes,1,opt,name=name" json:"name,omitempty"` |
|
| 442 |
+ RxBytes uint64 `protobuf:"varint,2,opt,name=rx_bytes" json:"rx_bytes,omitempty"` |
|
| 443 |
+ Rx_Packets uint64 `protobuf:"varint,3,opt,name=rx_Packets" json:"rx_Packets,omitempty"` |
|
| 444 |
+ RxErrors uint64 `protobuf:"varint,4,opt,name=Rx_errors" json:"Rx_errors,omitempty"` |
|
| 445 |
+ RxDropped uint64 `protobuf:"varint,5,opt,name=Rx_dropped" json:"Rx_dropped,omitempty"` |
|
| 446 |
+ TxBytes uint64 `protobuf:"varint,6,opt,name=Tx_bytes" json:"Tx_bytes,omitempty"` |
|
| 447 |
+ TxPackets uint64 `protobuf:"varint,7,opt,name=Tx_packets" json:"Tx_packets,omitempty"` |
|
| 448 |
+ TxErrors uint64 `protobuf:"varint,8,opt,name=Tx_errors" json:"Tx_errors,omitempty"` |
|
| 449 |
+ TxDropped uint64 `protobuf:"varint,9,opt,name=Tx_dropped" json:"Tx_dropped,omitempty"` |
|
| 450 |
+} |
|
| 451 |
+ |
|
| 452 |
+func (m *NetworkStats) Reset() { *m = NetworkStats{} }
|
|
| 453 |
+func (m *NetworkStats) String() string { return proto.CompactTextString(m) }
|
|
| 454 |
+func (*NetworkStats) ProtoMessage() {}
|
|
| 455 |
+func (*NetworkStats) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{27} }
|
|
| 456 |
+ |
|
| 457 |
+type CpuUsage struct {
|
|
| 458 |
+ TotalUsage uint64 `protobuf:"varint,1,opt,name=total_usage" json:"total_usage,omitempty"` |
|
| 459 |
+ PercpuUsage []uint64 `protobuf:"varint,2,rep,name=percpu_usage" json:"percpu_usage,omitempty"` |
|
| 460 |
+ UsageInKernelmode uint64 `protobuf:"varint,3,opt,name=usage_in_kernelmode" json:"usage_in_kernelmode,omitempty"` |
|
| 461 |
+ UsageInUsermode uint64 `protobuf:"varint,4,opt,name=usage_in_usermode" json:"usage_in_usermode,omitempty"` |
|
| 462 |
+} |
|
| 463 |
+ |
|
| 464 |
+func (m *CpuUsage) Reset() { *m = CpuUsage{} }
|
|
| 465 |
+func (m *CpuUsage) String() string { return proto.CompactTextString(m) }
|
|
| 466 |
+func (*CpuUsage) ProtoMessage() {}
|
|
| 467 |
+func (*CpuUsage) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{28} }
|
|
| 468 |
+ |
|
| 469 |
+type ThrottlingData struct {
|
|
| 470 |
+ Periods uint64 `protobuf:"varint,1,opt,name=periods" json:"periods,omitempty"` |
|
| 471 |
+ ThrottledPeriods uint64 `protobuf:"varint,2,opt,name=throttled_periods" json:"throttled_periods,omitempty"` |
|
| 472 |
+ ThrottledTime uint64 `protobuf:"varint,3,opt,name=throttled_time" json:"throttled_time,omitempty"` |
|
| 473 |
+} |
|
| 474 |
+ |
|
| 475 |
+func (m *ThrottlingData) Reset() { *m = ThrottlingData{} }
|
|
| 476 |
+func (m *ThrottlingData) String() string { return proto.CompactTextString(m) }
|
|
| 477 |
+func (*ThrottlingData) ProtoMessage() {}
|
|
| 478 |
+func (*ThrottlingData) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{29} }
|
|
| 479 |
+ |
|
| 480 |
+type CpuStats struct {
|
|
| 481 |
+ CpuUsage *CpuUsage `protobuf:"bytes,1,opt,name=cpu_usage" json:"cpu_usage,omitempty"` |
|
| 482 |
+ ThrottlingData *ThrottlingData `protobuf:"bytes,2,opt,name=throttling_data" json:"throttling_data,omitempty"` |
|
| 483 |
+ SystemUsage uint64 `protobuf:"varint,3,opt,name=system_usage" json:"system_usage,omitempty"` |
|
| 484 |
+} |
|
| 485 |
+ |
|
| 486 |
+func (m *CpuStats) Reset() { *m = CpuStats{} }
|
|
| 487 |
+func (m *CpuStats) String() string { return proto.CompactTextString(m) }
|
|
| 488 |
+func (*CpuStats) ProtoMessage() {}
|
|
| 489 |
+func (*CpuStats) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{30} }
|
|
| 490 |
+ |
|
| 491 |
+func (m *CpuStats) GetCpuUsage() *CpuUsage {
|
|
| 492 |
+ if m != nil {
|
|
| 493 |
+ return m.CpuUsage |
|
| 494 |
+ } |
|
| 495 |
+ return nil |
|
| 496 |
+} |
|
| 497 |
+ |
|
| 498 |
+func (m *CpuStats) GetThrottlingData() *ThrottlingData {
|
|
| 499 |
+ if m != nil {
|
|
| 500 |
+ return m.ThrottlingData |
|
| 501 |
+ } |
|
| 502 |
+ return nil |
|
| 503 |
+} |
|
| 504 |
+ |
|
| 505 |
+type PidsStats struct {
|
|
| 506 |
+ Current uint64 `protobuf:"varint,1,opt,name=current" json:"current,omitempty"` |
|
| 507 |
+} |
|
| 508 |
+ |
|
| 509 |
+func (m *PidsStats) Reset() { *m = PidsStats{} }
|
|
| 510 |
+func (m *PidsStats) String() string { return proto.CompactTextString(m) }
|
|
| 511 |
+func (*PidsStats) ProtoMessage() {}
|
|
| 512 |
+func (*PidsStats) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{31} }
|
|
| 513 |
+ |
|
| 514 |
+type MemoryData struct {
|
|
| 515 |
+ Usage uint64 `protobuf:"varint,1,opt,name=usage" json:"usage,omitempty"` |
|
| 516 |
+ MaxUsage uint64 `protobuf:"varint,2,opt,name=max_usage" json:"max_usage,omitempty"` |
|
| 517 |
+ Failcnt uint64 `protobuf:"varint,3,opt,name=failcnt" json:"failcnt,omitempty"` |
|
| 518 |
+ Limit uint64 `protobuf:"varint,4,opt,name=limit" json:"limit,omitempty"` |
|
| 519 |
+} |
|
| 520 |
+ |
|
| 521 |
+func (m *MemoryData) Reset() { *m = MemoryData{} }
|
|
| 522 |
+func (m *MemoryData) String() string { return proto.CompactTextString(m) }
|
|
| 523 |
+func (*MemoryData) ProtoMessage() {}
|
|
| 524 |
+func (*MemoryData) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{32} }
|
|
| 525 |
+ |
|
| 526 |
+type MemoryStats struct {
|
|
| 527 |
+ Cache uint64 `protobuf:"varint,1,opt,name=cache" json:"cache,omitempty"` |
|
| 528 |
+ Usage *MemoryData `protobuf:"bytes,2,opt,name=usage" json:"usage,omitempty"` |
|
| 529 |
+ SwapUsage *MemoryData `protobuf:"bytes,3,opt,name=swap_usage" json:"swap_usage,omitempty"` |
|
| 530 |
+ KernelUsage *MemoryData `protobuf:"bytes,4,opt,name=kernel_usage" json:"kernel_usage,omitempty"` |
|
| 531 |
+ Stats map[string]uint64 `protobuf:"bytes,5,rep,name=stats" json:"stats,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"varint,2,opt,name=value"` |
|
| 532 |
+} |
|
| 533 |
+ |
|
| 534 |
+func (m *MemoryStats) Reset() { *m = MemoryStats{} }
|
|
| 535 |
+func (m *MemoryStats) String() string { return proto.CompactTextString(m) }
|
|
| 536 |
+func (*MemoryStats) ProtoMessage() {}
|
|
| 537 |
+func (*MemoryStats) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{33} }
|
|
| 538 |
+ |
|
| 539 |
+func (m *MemoryStats) GetUsage() *MemoryData {
|
|
| 540 |
+ if m != nil {
|
|
| 541 |
+ return m.Usage |
|
| 542 |
+ } |
|
| 543 |
+ return nil |
|
| 544 |
+} |
|
| 545 |
+ |
|
| 546 |
+func (m *MemoryStats) GetSwapUsage() *MemoryData {
|
|
| 547 |
+ if m != nil {
|
|
| 548 |
+ return m.SwapUsage |
|
| 549 |
+ } |
|
| 550 |
+ return nil |
|
| 551 |
+} |
|
| 552 |
+ |
|
| 553 |
+func (m *MemoryStats) GetKernelUsage() *MemoryData {
|
|
| 554 |
+ if m != nil {
|
|
| 555 |
+ return m.KernelUsage |
|
| 556 |
+ } |
|
| 557 |
+ return nil |
|
| 558 |
+} |
|
| 559 |
+ |
|
| 560 |
+func (m *MemoryStats) GetStats() map[string]uint64 {
|
|
| 561 |
+ if m != nil {
|
|
| 562 |
+ return m.Stats |
|
| 563 |
+ } |
|
| 564 |
+ return nil |
|
| 565 |
+} |
|
| 566 |
+ |
|
| 567 |
+type BlkioStatsEntry struct {
|
|
| 568 |
+ Major uint64 `protobuf:"varint,1,opt,name=major" json:"major,omitempty"` |
|
| 569 |
+ Minor uint64 `protobuf:"varint,2,opt,name=minor" json:"minor,omitempty"` |
|
| 570 |
+ Op string `protobuf:"bytes,3,opt,name=op" json:"op,omitempty"` |
|
| 571 |
+ Value uint64 `protobuf:"varint,4,opt,name=value" json:"value,omitempty"` |
|
| 572 |
+} |
|
| 573 |
+ |
|
| 574 |
+func (m *BlkioStatsEntry) Reset() { *m = BlkioStatsEntry{} }
|
|
| 575 |
+func (m *BlkioStatsEntry) String() string { return proto.CompactTextString(m) }
|
|
| 576 |
+func (*BlkioStatsEntry) ProtoMessage() {}
|
|
| 577 |
+func (*BlkioStatsEntry) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{34} }
|
|
| 578 |
+ |
|
| 579 |
+type BlkioStats struct {
|
|
| 580 |
+ IoServiceBytesRecursive []*BlkioStatsEntry `protobuf:"bytes,1,rep,name=io_service_bytes_recursive" json:"io_service_bytes_recursive,omitempty"` |
|
| 581 |
+ IoServicedRecursive []*BlkioStatsEntry `protobuf:"bytes,2,rep,name=io_serviced_recursive" json:"io_serviced_recursive,omitempty"` |
|
| 582 |
+ IoQueuedRecursive []*BlkioStatsEntry `protobuf:"bytes,3,rep,name=io_queued_recursive" json:"io_queued_recursive,omitempty"` |
|
| 583 |
+ IoServiceTimeRecursive []*BlkioStatsEntry `protobuf:"bytes,4,rep,name=io_service_time_recursive" json:"io_service_time_recursive,omitempty"` |
|
| 584 |
+ IoWaitTimeRecursive []*BlkioStatsEntry `protobuf:"bytes,5,rep,name=io_wait_time_recursive" json:"io_wait_time_recursive,omitempty"` |
|
| 585 |
+ IoMergedRecursive []*BlkioStatsEntry `protobuf:"bytes,6,rep,name=io_merged_recursive" json:"io_merged_recursive,omitempty"` |
|
| 586 |
+ IoTimeRecursive []*BlkioStatsEntry `protobuf:"bytes,7,rep,name=io_time_recursive" json:"io_time_recursive,omitempty"` |
|
| 587 |
+ SectorsRecursive []*BlkioStatsEntry `protobuf:"bytes,8,rep,name=sectors_recursive" json:"sectors_recursive,omitempty"` |
|
| 588 |
+} |
|
| 589 |
+ |
|
| 590 |
+func (m *BlkioStats) Reset() { *m = BlkioStats{} }
|
|
| 591 |
+func (m *BlkioStats) String() string { return proto.CompactTextString(m) }
|
|
| 592 |
+func (*BlkioStats) ProtoMessage() {}
|
|
| 593 |
+func (*BlkioStats) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{35} }
|
|
| 594 |
+ |
|
| 595 |
+func (m *BlkioStats) GetIoServiceBytesRecursive() []*BlkioStatsEntry {
|
|
| 596 |
+ if m != nil {
|
|
| 597 |
+ return m.IoServiceBytesRecursive |
|
| 598 |
+ } |
|
| 599 |
+ return nil |
|
| 600 |
+} |
|
| 601 |
+ |
|
| 602 |
+func (m *BlkioStats) GetIoServicedRecursive() []*BlkioStatsEntry {
|
|
| 603 |
+ if m != nil {
|
|
| 604 |
+ return m.IoServicedRecursive |
|
| 605 |
+ } |
|
| 606 |
+ return nil |
|
| 607 |
+} |
|
| 608 |
+ |
|
| 609 |
+func (m *BlkioStats) GetIoQueuedRecursive() []*BlkioStatsEntry {
|
|
| 610 |
+ if m != nil {
|
|
| 611 |
+ return m.IoQueuedRecursive |
|
| 612 |
+ } |
|
| 613 |
+ return nil |
|
| 614 |
+} |
|
| 615 |
+ |
|
| 616 |
+func (m *BlkioStats) GetIoServiceTimeRecursive() []*BlkioStatsEntry {
|
|
| 617 |
+ if m != nil {
|
|
| 618 |
+ return m.IoServiceTimeRecursive |
|
| 619 |
+ } |
|
| 620 |
+ return nil |
|
| 621 |
+} |
|
| 622 |
+ |
|
| 623 |
+func (m *BlkioStats) GetIoWaitTimeRecursive() []*BlkioStatsEntry {
|
|
| 624 |
+ if m != nil {
|
|
| 625 |
+ return m.IoWaitTimeRecursive |
|
| 626 |
+ } |
|
| 627 |
+ return nil |
|
| 628 |
+} |
|
| 629 |
+ |
|
| 630 |
+func (m *BlkioStats) GetIoMergedRecursive() []*BlkioStatsEntry {
|
|
| 631 |
+ if m != nil {
|
|
| 632 |
+ return m.IoMergedRecursive |
|
| 633 |
+ } |
|
| 634 |
+ return nil |
|
| 635 |
+} |
|
| 636 |
+ |
|
| 637 |
+func (m *BlkioStats) GetIoTimeRecursive() []*BlkioStatsEntry {
|
|
| 638 |
+ if m != nil {
|
|
| 639 |
+ return m.IoTimeRecursive |
|
| 640 |
+ } |
|
| 641 |
+ return nil |
|
| 642 |
+} |
|
| 643 |
+ |
|
| 644 |
+func (m *BlkioStats) GetSectorsRecursive() []*BlkioStatsEntry {
|
|
| 645 |
+ if m != nil {
|
|
| 646 |
+ return m.SectorsRecursive |
|
| 647 |
+ } |
|
| 648 |
+ return nil |
|
| 649 |
+} |
|
| 650 |
+ |
|
| 651 |
+type HugetlbStats struct {
|
|
| 652 |
+ Usage uint64 `protobuf:"varint,1,opt,name=usage" json:"usage,omitempty"` |
|
| 653 |
+ MaxUsage uint64 `protobuf:"varint,2,opt,name=max_usage" json:"max_usage,omitempty"` |
|
| 654 |
+ Failcnt uint64 `protobuf:"varint,3,opt,name=failcnt" json:"failcnt,omitempty"` |
|
| 655 |
+ Limit uint64 `protobuf:"varint,4,opt,name=limit" json:"limit,omitempty"` |
|
| 656 |
+} |
|
| 657 |
+ |
|
| 658 |
+func (m *HugetlbStats) Reset() { *m = HugetlbStats{} }
|
|
| 659 |
+func (m *HugetlbStats) String() string { return proto.CompactTextString(m) }
|
|
| 660 |
+func (*HugetlbStats) ProtoMessage() {}
|
|
| 661 |
+func (*HugetlbStats) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{36} }
|
|
| 662 |
+ |
|
| 663 |
+type CgroupStats struct {
|
|
| 664 |
+ CpuStats *CpuStats `protobuf:"bytes,1,opt,name=cpu_stats" json:"cpu_stats,omitempty"` |
|
| 665 |
+ MemoryStats *MemoryStats `protobuf:"bytes,2,opt,name=memory_stats" json:"memory_stats,omitempty"` |
|
| 666 |
+ BlkioStats *BlkioStats `protobuf:"bytes,3,opt,name=blkio_stats" json:"blkio_stats,omitempty"` |
|
| 667 |
+ HugetlbStats map[string]*HugetlbStats `protobuf:"bytes,4,rep,name=hugetlb_stats" json:"hugetlb_stats,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"` |
|
| 668 |
+ PidsStats *PidsStats `protobuf:"bytes,5,opt,name=pids_stats" json:"pids_stats,omitempty"` |
|
| 669 |
+} |
|
| 670 |
+ |
|
| 671 |
+func (m *CgroupStats) Reset() { *m = CgroupStats{} }
|
|
| 672 |
+func (m *CgroupStats) String() string { return proto.CompactTextString(m) }
|
|
| 673 |
+func (*CgroupStats) ProtoMessage() {}
|
|
| 674 |
+func (*CgroupStats) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{37} }
|
|
| 675 |
+ |
|
| 676 |
+func (m *CgroupStats) GetCpuStats() *CpuStats {
|
|
| 677 |
+ if m != nil {
|
|
| 678 |
+ return m.CpuStats |
|
| 679 |
+ } |
|
| 680 |
+ return nil |
|
| 681 |
+} |
|
| 682 |
+ |
|
| 683 |
+func (m *CgroupStats) GetMemoryStats() *MemoryStats {
|
|
| 684 |
+ if m != nil {
|
|
| 685 |
+ return m.MemoryStats |
|
| 686 |
+ } |
|
| 687 |
+ return nil |
|
| 688 |
+} |
|
| 689 |
+ |
|
| 690 |
+func (m *CgroupStats) GetBlkioStats() *BlkioStats {
|
|
| 691 |
+ if m != nil {
|
|
| 692 |
+ return m.BlkioStats |
|
| 693 |
+ } |
|
| 694 |
+ return nil |
|
| 695 |
+} |
|
| 696 |
+ |
|
| 697 |
+func (m *CgroupStats) GetHugetlbStats() map[string]*HugetlbStats {
|
|
| 698 |
+ if m != nil {
|
|
| 699 |
+ return m.HugetlbStats |
|
| 700 |
+ } |
|
| 701 |
+ return nil |
|
| 702 |
+} |
|
| 703 |
+ |
|
| 704 |
+func (m *CgroupStats) GetPidsStats() *PidsStats {
|
|
| 705 |
+ if m != nil {
|
|
| 706 |
+ return m.PidsStats |
|
| 707 |
+ } |
|
| 708 |
+ return nil |
|
| 709 |
+} |
|
| 710 |
+ |
|
| 711 |
+type StatsResponse struct {
|
|
| 712 |
+ NetworkStats []*NetworkStats `protobuf:"bytes,1,rep,name=network_stats" json:"network_stats,omitempty"` |
|
| 713 |
+ CgroupStats *CgroupStats `protobuf:"bytes,2,opt,name=cgroup_stats" json:"cgroup_stats,omitempty"` |
|
| 714 |
+ Timestamp uint64 `protobuf:"varint,3,opt,name=timestamp" json:"timestamp,omitempty"` |
|
| 715 |
+} |
|
| 716 |
+ |
|
| 717 |
+func (m *StatsResponse) Reset() { *m = StatsResponse{} }
|
|
| 718 |
+func (m *StatsResponse) String() string { return proto.CompactTextString(m) }
|
|
| 719 |
+func (*StatsResponse) ProtoMessage() {}
|
|
| 720 |
+func (*StatsResponse) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{38} }
|
|
| 721 |
+ |
|
| 722 |
+func (m *StatsResponse) GetNetworkStats() []*NetworkStats {
|
|
| 723 |
+ if m != nil {
|
|
| 724 |
+ return m.NetworkStats |
|
| 725 |
+ } |
|
| 726 |
+ return nil |
|
| 727 |
+} |
|
| 728 |
+ |
|
| 729 |
+func (m *StatsResponse) GetCgroupStats() *CgroupStats {
|
|
| 730 |
+ if m != nil {
|
|
| 731 |
+ return m.CgroupStats |
|
| 732 |
+ } |
|
| 733 |
+ return nil |
|
| 734 |
+} |
|
| 735 |
+ |
|
| 736 |
+type StatsRequest struct {
|
|
| 737 |
+ Id string `protobuf:"bytes,1,opt,name=id" json:"id,omitempty"` |
|
| 738 |
+} |
|
| 739 |
+ |
|
| 740 |
+func (m *StatsRequest) Reset() { *m = StatsRequest{} }
|
|
| 741 |
+func (m *StatsRequest) String() string { return proto.CompactTextString(m) }
|
|
| 742 |
+func (*StatsRequest) ProtoMessage() {}
|
|
| 743 |
+func (*StatsRequest) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{39} }
|
|
| 744 |
+ |
|
| 745 |
+func init() {
|
|
| 746 |
+ proto.RegisterType((*UpdateProcessRequest)(nil), "types.UpdateProcessRequest") |
|
| 747 |
+ proto.RegisterType((*UpdateProcessResponse)(nil), "types.UpdateProcessResponse") |
|
| 748 |
+ proto.RegisterType((*CreateContainerRequest)(nil), "types.CreateContainerRequest") |
|
| 749 |
+ proto.RegisterType((*CreateContainerResponse)(nil), "types.CreateContainerResponse") |
|
| 750 |
+ proto.RegisterType((*SignalRequest)(nil), "types.SignalRequest") |
|
| 751 |
+ proto.RegisterType((*SignalResponse)(nil), "types.SignalResponse") |
|
| 752 |
+ proto.RegisterType((*AddProcessRequest)(nil), "types.AddProcessRequest") |
|
| 753 |
+ proto.RegisterType((*User)(nil), "types.User") |
|
| 754 |
+ proto.RegisterType((*AddProcessResponse)(nil), "types.AddProcessResponse") |
|
| 755 |
+ proto.RegisterType((*CreateCheckpointRequest)(nil), "types.CreateCheckpointRequest") |
|
| 756 |
+ proto.RegisterType((*CreateCheckpointResponse)(nil), "types.CreateCheckpointResponse") |
|
| 757 |
+ proto.RegisterType((*DeleteCheckpointRequest)(nil), "types.DeleteCheckpointRequest") |
|
| 758 |
+ proto.RegisterType((*DeleteCheckpointResponse)(nil), "types.DeleteCheckpointResponse") |
|
| 759 |
+ proto.RegisterType((*ListCheckpointRequest)(nil), "types.ListCheckpointRequest") |
|
| 760 |
+ proto.RegisterType((*Checkpoint)(nil), "types.Checkpoint") |
|
| 761 |
+ proto.RegisterType((*ListCheckpointResponse)(nil), "types.ListCheckpointResponse") |
|
| 762 |
+ proto.RegisterType((*StateRequest)(nil), "types.StateRequest") |
|
| 763 |
+ proto.RegisterType((*ContainerState)(nil), "types.ContainerState") |
|
| 764 |
+ proto.RegisterType((*Process)(nil), "types.Process") |
|
| 765 |
+ proto.RegisterType((*Container)(nil), "types.Container") |
|
| 766 |
+ proto.RegisterType((*Machine)(nil), "types.Machine") |
|
| 767 |
+ proto.RegisterType((*StateResponse)(nil), "types.StateResponse") |
|
| 768 |
+ proto.RegisterType((*UpdateContainerRequest)(nil), "types.UpdateContainerRequest") |
|
| 769 |
+ proto.RegisterType((*UpdateResource)(nil), "types.UpdateResource") |
|
| 770 |
+ proto.RegisterType((*UpdateContainerResponse)(nil), "types.UpdateContainerResponse") |
|
| 771 |
+ proto.RegisterType((*EventsRequest)(nil), "types.EventsRequest") |
|
| 772 |
+ proto.RegisterType((*Event)(nil), "types.Event") |
|
| 773 |
+ proto.RegisterType((*NetworkStats)(nil), "types.NetworkStats") |
|
| 774 |
+ proto.RegisterType((*CpuUsage)(nil), "types.CpuUsage") |
|
| 775 |
+ proto.RegisterType((*ThrottlingData)(nil), "types.ThrottlingData") |
|
| 776 |
+ proto.RegisterType((*CpuStats)(nil), "types.CpuStats") |
|
| 777 |
+ proto.RegisterType((*PidsStats)(nil), "types.PidsStats") |
|
| 778 |
+ proto.RegisterType((*MemoryData)(nil), "types.MemoryData") |
|
| 779 |
+ proto.RegisterType((*MemoryStats)(nil), "types.MemoryStats") |
|
| 780 |
+ proto.RegisterType((*BlkioStatsEntry)(nil), "types.BlkioStatsEntry") |
|
| 781 |
+ proto.RegisterType((*BlkioStats)(nil), "types.BlkioStats") |
|
| 782 |
+ proto.RegisterType((*HugetlbStats)(nil), "types.HugetlbStats") |
|
| 783 |
+ proto.RegisterType((*CgroupStats)(nil), "types.CgroupStats") |
|
| 784 |
+ proto.RegisterType((*StatsResponse)(nil), "types.StatsResponse") |
|
| 785 |
+ proto.RegisterType((*StatsRequest)(nil), "types.StatsRequest") |
|
| 786 |
+} |
|
| 787 |
+ |
|
| 788 |
+// Reference imports to suppress errors if they are not otherwise used. |
|
| 789 |
+var _ context.Context |
|
| 790 |
+var _ grpc.ClientConn |
|
| 791 |
+ |
|
| 792 |
+// Client API for API service |
|
| 793 |
+ |
|
| 794 |
+type APIClient interface {
|
|
| 795 |
+ CreateContainer(ctx context.Context, in *CreateContainerRequest, opts ...grpc.CallOption) (*CreateContainerResponse, error) |
|
| 796 |
+ UpdateContainer(ctx context.Context, in *UpdateContainerRequest, opts ...grpc.CallOption) (*UpdateContainerResponse, error) |
|
| 797 |
+ Signal(ctx context.Context, in *SignalRequest, opts ...grpc.CallOption) (*SignalResponse, error) |
|
| 798 |
+ UpdateProcess(ctx context.Context, in *UpdateProcessRequest, opts ...grpc.CallOption) (*UpdateProcessResponse, error) |
|
| 799 |
+ AddProcess(ctx context.Context, in *AddProcessRequest, opts ...grpc.CallOption) (*AddProcessResponse, error) |
|
| 800 |
+ CreateCheckpoint(ctx context.Context, in *CreateCheckpointRequest, opts ...grpc.CallOption) (*CreateCheckpointResponse, error) |
|
| 801 |
+ DeleteCheckpoint(ctx context.Context, in *DeleteCheckpointRequest, opts ...grpc.CallOption) (*DeleteCheckpointResponse, error) |
|
| 802 |
+ ListCheckpoint(ctx context.Context, in *ListCheckpointRequest, opts ...grpc.CallOption) (*ListCheckpointResponse, error) |
|
| 803 |
+ State(ctx context.Context, in *StateRequest, opts ...grpc.CallOption) (*StateResponse, error) |
|
| 804 |
+ Events(ctx context.Context, in *EventsRequest, opts ...grpc.CallOption) (API_EventsClient, error) |
|
| 805 |
+ Stats(ctx context.Context, in *StatsRequest, opts ...grpc.CallOption) (*StatsResponse, error) |
|
| 806 |
+} |
|
| 807 |
+ |
|
| 808 |
+type aPIClient struct {
|
|
| 809 |
+ cc *grpc.ClientConn |
|
| 810 |
+} |
|
| 811 |
+ |
|
| 812 |
+func NewAPIClient(cc *grpc.ClientConn) APIClient {
|
|
| 813 |
+ return &aPIClient{cc}
|
|
| 814 |
+} |
|
| 815 |
+ |
|
| 816 |
+func (c *aPIClient) CreateContainer(ctx context.Context, in *CreateContainerRequest, opts ...grpc.CallOption) (*CreateContainerResponse, error) {
|
|
| 817 |
+ out := new(CreateContainerResponse) |
|
| 818 |
+ err := grpc.Invoke(ctx, "/types.API/CreateContainer", in, out, c.cc, opts...) |
|
| 819 |
+ if err != nil {
|
|
| 820 |
+ return nil, err |
|
| 821 |
+ } |
|
| 822 |
+ return out, nil |
|
| 823 |
+} |
|
| 824 |
+ |
|
| 825 |
+func (c *aPIClient) UpdateContainer(ctx context.Context, in *UpdateContainerRequest, opts ...grpc.CallOption) (*UpdateContainerResponse, error) {
|
|
| 826 |
+ out := new(UpdateContainerResponse) |
|
| 827 |
+ err := grpc.Invoke(ctx, "/types.API/UpdateContainer", in, out, c.cc, opts...) |
|
| 828 |
+ if err != nil {
|
|
| 829 |
+ return nil, err |
|
| 830 |
+ } |
|
| 831 |
+ return out, nil |
|
| 832 |
+} |
|
| 833 |
+ |
|
| 834 |
+func (c *aPIClient) Signal(ctx context.Context, in *SignalRequest, opts ...grpc.CallOption) (*SignalResponse, error) {
|
|
| 835 |
+ out := new(SignalResponse) |
|
| 836 |
+ err := grpc.Invoke(ctx, "/types.API/Signal", in, out, c.cc, opts...) |
|
| 837 |
+ if err != nil {
|
|
| 838 |
+ return nil, err |
|
| 839 |
+ } |
|
| 840 |
+ return out, nil |
|
| 841 |
+} |
|
| 842 |
+ |
|
| 843 |
+func (c *aPIClient) UpdateProcess(ctx context.Context, in *UpdateProcessRequest, opts ...grpc.CallOption) (*UpdateProcessResponse, error) {
|
|
| 844 |
+ out := new(UpdateProcessResponse) |
|
| 845 |
+ err := grpc.Invoke(ctx, "/types.API/UpdateProcess", in, out, c.cc, opts...) |
|
| 846 |
+ if err != nil {
|
|
| 847 |
+ return nil, err |
|
| 848 |
+ } |
|
| 849 |
+ return out, nil |
|
| 850 |
+} |
|
| 851 |
+ |
|
| 852 |
+func (c *aPIClient) AddProcess(ctx context.Context, in *AddProcessRequest, opts ...grpc.CallOption) (*AddProcessResponse, error) {
|
|
| 853 |
+ out := new(AddProcessResponse) |
|
| 854 |
+ err := grpc.Invoke(ctx, "/types.API/AddProcess", in, out, c.cc, opts...) |
|
| 855 |
+ if err != nil {
|
|
| 856 |
+ return nil, err |
|
| 857 |
+ } |
|
| 858 |
+ return out, nil |
|
| 859 |
+} |
|
| 860 |
+ |
|
| 861 |
+func (c *aPIClient) CreateCheckpoint(ctx context.Context, in *CreateCheckpointRequest, opts ...grpc.CallOption) (*CreateCheckpointResponse, error) {
|
|
| 862 |
+ out := new(CreateCheckpointResponse) |
|
| 863 |
+ err := grpc.Invoke(ctx, "/types.API/CreateCheckpoint", in, out, c.cc, opts...) |
|
| 864 |
+ if err != nil {
|
|
| 865 |
+ return nil, err |
|
| 866 |
+ } |
|
| 867 |
+ return out, nil |
|
| 868 |
+} |
|
| 869 |
+ |
|
| 870 |
+func (c *aPIClient) DeleteCheckpoint(ctx context.Context, in *DeleteCheckpointRequest, opts ...grpc.CallOption) (*DeleteCheckpointResponse, error) {
|
|
| 871 |
+ out := new(DeleteCheckpointResponse) |
|
| 872 |
+ err := grpc.Invoke(ctx, "/types.API/DeleteCheckpoint", in, out, c.cc, opts...) |
|
| 873 |
+ if err != nil {
|
|
| 874 |
+ return nil, err |
|
| 875 |
+ } |
|
| 876 |
+ return out, nil |
|
| 877 |
+} |
|
| 878 |
+ |
|
| 879 |
+func (c *aPIClient) ListCheckpoint(ctx context.Context, in *ListCheckpointRequest, opts ...grpc.CallOption) (*ListCheckpointResponse, error) {
|
|
| 880 |
+ out := new(ListCheckpointResponse) |
|
| 881 |
+ err := grpc.Invoke(ctx, "/types.API/ListCheckpoint", in, out, c.cc, opts...) |
|
| 882 |
+ if err != nil {
|
|
| 883 |
+ return nil, err |
|
| 884 |
+ } |
|
| 885 |
+ return out, nil |
|
| 886 |
+} |
|
| 887 |
+ |
|
| 888 |
+func (c *aPIClient) State(ctx context.Context, in *StateRequest, opts ...grpc.CallOption) (*StateResponse, error) {
|
|
| 889 |
+ out := new(StateResponse) |
|
| 890 |
+ err := grpc.Invoke(ctx, "/types.API/State", in, out, c.cc, opts...) |
|
| 891 |
+ if err != nil {
|
|
| 892 |
+ return nil, err |
|
| 893 |
+ } |
|
| 894 |
+ return out, nil |
|
| 895 |
+} |
|
| 896 |
+ |
|
| 897 |
+func (c *aPIClient) Events(ctx context.Context, in *EventsRequest, opts ...grpc.CallOption) (API_EventsClient, error) {
|
|
| 898 |
+ stream, err := grpc.NewClientStream(ctx, &_API_serviceDesc.Streams[0], c.cc, "/types.API/Events", opts...) |
|
| 899 |
+ if err != nil {
|
|
| 900 |
+ return nil, err |
|
| 901 |
+ } |
|
| 902 |
+ x := &aPIEventsClient{stream}
|
|
| 903 |
+ if err := x.ClientStream.SendMsg(in); err != nil {
|
|
| 904 |
+ return nil, err |
|
| 905 |
+ } |
|
| 906 |
+ if err := x.ClientStream.CloseSend(); err != nil {
|
|
| 907 |
+ return nil, err |
|
| 908 |
+ } |
|
| 909 |
+ return x, nil |
|
| 910 |
+} |
|
| 911 |
+ |
|
| 912 |
+type API_EventsClient interface {
|
|
| 913 |
+ Recv() (*Event, error) |
|
| 914 |
+ grpc.ClientStream |
|
| 915 |
+} |
|
| 916 |
+ |
|
| 917 |
+type aPIEventsClient struct {
|
|
| 918 |
+ grpc.ClientStream |
|
| 919 |
+} |
|
| 920 |
+ |
|
| 921 |
+func (x *aPIEventsClient) Recv() (*Event, error) {
|
|
| 922 |
+ m := new(Event) |
|
| 923 |
+ if err := x.ClientStream.RecvMsg(m); err != nil {
|
|
| 924 |
+ return nil, err |
|
| 925 |
+ } |
|
| 926 |
+ return m, nil |
|
| 927 |
+} |
|
| 928 |
+ |
|
| 929 |
+func (c *aPIClient) Stats(ctx context.Context, in *StatsRequest, opts ...grpc.CallOption) (*StatsResponse, error) {
|
|
| 930 |
+ out := new(StatsResponse) |
|
| 931 |
+ err := grpc.Invoke(ctx, "/types.API/Stats", in, out, c.cc, opts...) |
|
| 932 |
+ if err != nil {
|
|
| 933 |
+ return nil, err |
|
| 934 |
+ } |
|
| 935 |
+ return out, nil |
|
| 936 |
+} |
|
| 937 |
+ |
|
| 938 |
+// Server API for API service |
|
| 939 |
+ |
|
| 940 |
+type APIServer interface {
|
|
| 941 |
+ CreateContainer(context.Context, *CreateContainerRequest) (*CreateContainerResponse, error) |
|
| 942 |
+ UpdateContainer(context.Context, *UpdateContainerRequest) (*UpdateContainerResponse, error) |
|
| 943 |
+ Signal(context.Context, *SignalRequest) (*SignalResponse, error) |
|
| 944 |
+ UpdateProcess(context.Context, *UpdateProcessRequest) (*UpdateProcessResponse, error) |
|
| 945 |
+ AddProcess(context.Context, *AddProcessRequest) (*AddProcessResponse, error) |
|
| 946 |
+ CreateCheckpoint(context.Context, *CreateCheckpointRequest) (*CreateCheckpointResponse, error) |
|
| 947 |
+ DeleteCheckpoint(context.Context, *DeleteCheckpointRequest) (*DeleteCheckpointResponse, error) |
|
| 948 |
+ ListCheckpoint(context.Context, *ListCheckpointRequest) (*ListCheckpointResponse, error) |
|
| 949 |
+ State(context.Context, *StateRequest) (*StateResponse, error) |
|
| 950 |
+ Events(*EventsRequest, API_EventsServer) error |
|
| 951 |
+ Stats(context.Context, *StatsRequest) (*StatsResponse, error) |
|
| 952 |
+} |
|
| 953 |
+ |
|
| 954 |
+func RegisterAPIServer(s *grpc.Server, srv APIServer) {
|
|
| 955 |
+ s.RegisterService(&_API_serviceDesc, srv) |
|
| 956 |
+} |
|
| 957 |
+ |
|
| 958 |
+func _API_CreateContainer_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error) (interface{}, error) {
|
|
| 959 |
+ in := new(CreateContainerRequest) |
|
| 960 |
+ if err := dec(in); err != nil {
|
|
| 961 |
+ return nil, err |
|
| 962 |
+ } |
|
| 963 |
+ out, err := srv.(APIServer).CreateContainer(ctx, in) |
|
| 964 |
+ if err != nil {
|
|
| 965 |
+ return nil, err |
|
| 966 |
+ } |
|
| 967 |
+ return out, nil |
|
| 968 |
+} |
|
| 969 |
+ |
|
| 970 |
+func _API_UpdateContainer_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error) (interface{}, error) {
|
|
| 971 |
+ in := new(UpdateContainerRequest) |
|
| 972 |
+ if err := dec(in); err != nil {
|
|
| 973 |
+ return nil, err |
|
| 974 |
+ } |
|
| 975 |
+ out, err := srv.(APIServer).UpdateContainer(ctx, in) |
|
| 976 |
+ if err != nil {
|
|
| 977 |
+ return nil, err |
|
| 978 |
+ } |
|
| 979 |
+ return out, nil |
|
| 980 |
+} |
|
| 981 |
+ |
|
| 982 |
+func _API_Signal_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error) (interface{}, error) {
|
|
| 983 |
+ in := new(SignalRequest) |
|
| 984 |
+ if err := dec(in); err != nil {
|
|
| 985 |
+ return nil, err |
|
| 986 |
+ } |
|
| 987 |
+ out, err := srv.(APIServer).Signal(ctx, in) |
|
| 988 |
+ if err != nil {
|
|
| 989 |
+ return nil, err |
|
| 990 |
+ } |
|
| 991 |
+ return out, nil |
|
| 992 |
+} |
|
| 993 |
+ |
|
| 994 |
+func _API_UpdateProcess_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error) (interface{}, error) {
|
|
| 995 |
+ in := new(UpdateProcessRequest) |
|
| 996 |
+ if err := dec(in); err != nil {
|
|
| 997 |
+ return nil, err |
|
| 998 |
+ } |
|
| 999 |
+ out, err := srv.(APIServer).UpdateProcess(ctx, in) |
|
| 1000 |
+ if err != nil {
|
|
| 1001 |
+ return nil, err |
|
| 1002 |
+ } |
|
| 1003 |
+ return out, nil |
|
| 1004 |
+} |
|
| 1005 |
+ |
|
| 1006 |
+func _API_AddProcess_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error) (interface{}, error) {
|
|
| 1007 |
+ in := new(AddProcessRequest) |
|
| 1008 |
+ if err := dec(in); err != nil {
|
|
| 1009 |
+ return nil, err |
|
| 1010 |
+ } |
|
| 1011 |
+ out, err := srv.(APIServer).AddProcess(ctx, in) |
|
| 1012 |
+ if err != nil {
|
|
| 1013 |
+ return nil, err |
|
| 1014 |
+ } |
|
| 1015 |
+ return out, nil |
|
| 1016 |
+} |
|
| 1017 |
+ |
|
| 1018 |
+func _API_CreateCheckpoint_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error) (interface{}, error) {
|
|
| 1019 |
+ in := new(CreateCheckpointRequest) |
|
| 1020 |
+ if err := dec(in); err != nil {
|
|
| 1021 |
+ return nil, err |
|
| 1022 |
+ } |
|
| 1023 |
+ out, err := srv.(APIServer).CreateCheckpoint(ctx, in) |
|
| 1024 |
+ if err != nil {
|
|
| 1025 |
+ return nil, err |
|
| 1026 |
+ } |
|
| 1027 |
+ return out, nil |
|
| 1028 |
+} |
|
| 1029 |
+ |
|
| 1030 |
+func _API_DeleteCheckpoint_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error) (interface{}, error) {
|
|
| 1031 |
+ in := new(DeleteCheckpointRequest) |
|
| 1032 |
+ if err := dec(in); err != nil {
|
|
| 1033 |
+ return nil, err |
|
| 1034 |
+ } |
|
| 1035 |
+ out, err := srv.(APIServer).DeleteCheckpoint(ctx, in) |
|
| 1036 |
+ if err != nil {
|
|
| 1037 |
+ return nil, err |
|
| 1038 |
+ } |
|
| 1039 |
+ return out, nil |
|
| 1040 |
+} |
|
| 1041 |
+ |
|
| 1042 |
+func _API_ListCheckpoint_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error) (interface{}, error) {
|
|
| 1043 |
+ in := new(ListCheckpointRequest) |
|
| 1044 |
+ if err := dec(in); err != nil {
|
|
| 1045 |
+ return nil, err |
|
| 1046 |
+ } |
|
| 1047 |
+ out, err := srv.(APIServer).ListCheckpoint(ctx, in) |
|
| 1048 |
+ if err != nil {
|
|
| 1049 |
+ return nil, err |
|
| 1050 |
+ } |
|
| 1051 |
+ return out, nil |
|
| 1052 |
+} |
|
| 1053 |
+ |
|
| 1054 |
+func _API_State_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error) (interface{}, error) {
|
|
| 1055 |
+ in := new(StateRequest) |
|
| 1056 |
+ if err := dec(in); err != nil {
|
|
| 1057 |
+ return nil, err |
|
| 1058 |
+ } |
|
| 1059 |
+ out, err := srv.(APIServer).State(ctx, in) |
|
| 1060 |
+ if err != nil {
|
|
| 1061 |
+ return nil, err |
|
| 1062 |
+ } |
|
| 1063 |
+ return out, nil |
|
| 1064 |
+} |
|
| 1065 |
+ |
|
| 1066 |
+func _API_Events_Handler(srv interface{}, stream grpc.ServerStream) error {
|
|
| 1067 |
+ m := new(EventsRequest) |
|
| 1068 |
+ if err := stream.RecvMsg(m); err != nil {
|
|
| 1069 |
+ return err |
|
| 1070 |
+ } |
|
| 1071 |
+ return srv.(APIServer).Events(m, &aPIEventsServer{stream})
|
|
| 1072 |
+} |
|
| 1073 |
+ |
|
| 1074 |
+type API_EventsServer interface {
|
|
| 1075 |
+ Send(*Event) error |
|
| 1076 |
+ grpc.ServerStream |
|
| 1077 |
+} |
|
| 1078 |
+ |
|
| 1079 |
+type aPIEventsServer struct {
|
|
| 1080 |
+ grpc.ServerStream |
|
| 1081 |
+} |
|
| 1082 |
+ |
|
| 1083 |
+func (x *aPIEventsServer) Send(m *Event) error {
|
|
| 1084 |
+ return x.ServerStream.SendMsg(m) |
|
| 1085 |
+} |
|
| 1086 |
+ |
|
| 1087 |
+func _API_Stats_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error) (interface{}, error) {
|
|
| 1088 |
+ in := new(StatsRequest) |
|
| 1089 |
+ if err := dec(in); err != nil {
|
|
| 1090 |
+ return nil, err |
|
| 1091 |
+ } |
|
| 1092 |
+ out, err := srv.(APIServer).Stats(ctx, in) |
|
| 1093 |
+ if err != nil {
|
|
| 1094 |
+ return nil, err |
|
| 1095 |
+ } |
|
| 1096 |
+ return out, nil |
|
| 1097 |
+} |
|
| 1098 |
+ |
|
| 1099 |
+var _API_serviceDesc = grpc.ServiceDesc{
|
|
| 1100 |
+ ServiceName: "types.API", |
|
| 1101 |
+ HandlerType: (*APIServer)(nil), |
|
| 1102 |
+ Methods: []grpc.MethodDesc{
|
|
| 1103 |
+ {
|
|
| 1104 |
+ MethodName: "CreateContainer", |
|
| 1105 |
+ Handler: _API_CreateContainer_Handler, |
|
| 1106 |
+ }, |
|
| 1107 |
+ {
|
|
| 1108 |
+ MethodName: "UpdateContainer", |
|
| 1109 |
+ Handler: _API_UpdateContainer_Handler, |
|
| 1110 |
+ }, |
|
| 1111 |
+ {
|
|
| 1112 |
+ MethodName: "Signal", |
|
| 1113 |
+ Handler: _API_Signal_Handler, |
|
| 1114 |
+ }, |
|
| 1115 |
+ {
|
|
| 1116 |
+ MethodName: "UpdateProcess", |
|
| 1117 |
+ Handler: _API_UpdateProcess_Handler, |
|
| 1118 |
+ }, |
|
| 1119 |
+ {
|
|
| 1120 |
+ MethodName: "AddProcess", |
|
| 1121 |
+ Handler: _API_AddProcess_Handler, |
|
| 1122 |
+ }, |
|
| 1123 |
+ {
|
|
| 1124 |
+ MethodName: "CreateCheckpoint", |
|
| 1125 |
+ Handler: _API_CreateCheckpoint_Handler, |
|
| 1126 |
+ }, |
|
| 1127 |
+ {
|
|
| 1128 |
+ MethodName: "DeleteCheckpoint", |
|
| 1129 |
+ Handler: _API_DeleteCheckpoint_Handler, |
|
| 1130 |
+ }, |
|
| 1131 |
+ {
|
|
| 1132 |
+ MethodName: "ListCheckpoint", |
|
| 1133 |
+ Handler: _API_ListCheckpoint_Handler, |
|
| 1134 |
+ }, |
|
| 1135 |
+ {
|
|
| 1136 |
+ MethodName: "State", |
|
| 1137 |
+ Handler: _API_State_Handler, |
|
| 1138 |
+ }, |
|
| 1139 |
+ {
|
|
| 1140 |
+ MethodName: "Stats", |
|
| 1141 |
+ Handler: _API_Stats_Handler, |
|
| 1142 |
+ }, |
|
| 1143 |
+ }, |
|
| 1144 |
+ Streams: []grpc.StreamDesc{
|
|
| 1145 |
+ {
|
|
| 1146 |
+ StreamName: "Events", |
|
| 1147 |
+ Handler: _API_Events_Handler, |
|
| 1148 |
+ ServerStreams: true, |
|
| 1149 |
+ }, |
|
| 1150 |
+ }, |
|
| 1151 |
+} |
|
| 1152 |
+ |
|
| 1153 |
+var fileDescriptor0 = []byte{
|
|
| 1154 |
+ // 2142 bytes of a gzipped FileDescriptorProto |
|
| 1155 |
+ 0x1f, 0x8b, 0x08, 0x00, 0x00, 0x09, 0x6e, 0x88, 0x02, 0xff, 0xe4, 0x19, 0x4d, 0x6f, 0x23, 0x49, |
|
| 1156 |
+ 0x75, 0xfc, 0x11, 0xc7, 0x7e, 0xfe, 0x48, 0xdc, 0x93, 0x0f, 0x8f, 0x77, 0x67, 0x76, 0x68, 0xb1, |
|
| 1157 |
+ 0xec, 0x00, 0x4b, 0x18, 0x32, 0xbb, 0x62, 0x84, 0x04, 0xd2, 0x4e, 0x66, 0x80, 0x61, 0x27, 0x4b, |
|
| 1158 |
+ 0xa6, 0x93, 0x68, 0x2f, 0x48, 0x56, 0xc7, 0x5d, 0x6b, 0x37, 0x69, 0x77, 0xf7, 0x76, 0xb7, 0x13, |
|
| 1159 |
+ 0xe7, 0xc2, 0x11, 0x2e, 0x08, 0x71, 0xe2, 0x82, 0xc4, 0x85, 0x1b, 0x3f, 0x04, 0xfe, 0x09, 0xe2, |
|
| 1160 |
+ 0x27, 0x70, 0xe4, 0x55, 0xbd, 0xaa, 0xea, 0xea, 0xb6, 0x9d, 0x2c, 0x07, 0xc4, 0x61, 0x2f, 0x56, |
|
| 1161 |
+ 0xbd, 0x8f, 0x7a, 0xdf, 0xef, 0x55, 0x75, 0x19, 0x5a, 0x6e, 0xec, 0x1f, 0xc4, 0x49, 0x94, 0x45, |
|
| 1162 |
+ 0xd6, 0x46, 0x76, 0x13, 0xb3, 0xd4, 0xfe, 0x6d, 0x05, 0x76, 0xce, 0x63, 0xcf, 0xcd, 0xd8, 0x49, |
|
| 1163 |
+ 0x12, 0x8d, 0x59, 0x9a, 0x3a, 0xec, 0xcb, 0x39, 0x4b, 0x33, 0xab, 0x07, 0x55, 0xdf, 0x1b, 0x54, |
|
| 1164 |
+ 0x1e, 0x57, 0x9e, 0xb4, 0x1c, 0x5c, 0x59, 0xdb, 0x50, 0x8b, 0x11, 0x51, 0x15, 0x08, 0xbe, 0xb4, |
|
| 1165 |
+ 0x1e, 0x01, 0x8c, 0x83, 0x28, 0x65, 0xa7, 0x99, 0xe7, 0x87, 0x83, 0x1a, 0x12, 0x9a, 0x8e, 0x81, |
|
| 1166 |
+ 0xb1, 0x76, 0x60, 0xe3, 0xda, 0xf7, 0xb2, 0xe9, 0xa0, 0x8e, 0xa4, 0xae, 0x43, 0x80, 0xb5, 0x07, |
|
| 1167 |
+ 0x8d, 0x29, 0xf3, 0x27, 0xd3, 0x6c, 0xb0, 0x21, 0xd0, 0x12, 0xb2, 0xf7, 0x61, 0xb7, 0x64, 0x47, |
|
| 1168 |
+ 0x1a, 0x47, 0x61, 0xca, 0xec, 0xbf, 0x57, 0x60, 0xef, 0x28, 0x61, 0x48, 0x39, 0x8a, 0xc2, 0xcc, |
|
| 1169 |
+ 0xf5, 0x43, 0x96, 0xac, 0xb3, 0x11, 0x2d, 0xba, 0x98, 0x87, 0x5e, 0xc0, 0x4e, 0x5c, 0x54, 0x4b, |
|
| 1170 |
+ 0xa6, 0x1a, 0x18, 0x61, 0xf1, 0x94, 0x8d, 0x2f, 0xe3, 0xc8, 0x0f, 0x33, 0x61, 0x31, 0xd2, 0x73, |
|
| 1171 |
+ 0x0c, 0xb7, 0x38, 0x15, 0xce, 0xd4, 0x05, 0x89, 0x00, 0x6e, 0x31, 0x2e, 0xa2, 0x39, 0x59, 0xdc, |
|
| 1172 |
+ 0x72, 0x24, 0x24, 0xf1, 0x2c, 0x49, 0x06, 0x0d, 0x8d, 0x47, 0x88, 0xe3, 0x03, 0xf7, 0x82, 0x05, |
|
| 1173 |
+ 0xe9, 0x60, 0xf3, 0x71, 0x8d, 0xe3, 0x09, 0xb2, 0x5f, 0xc3, 0xfe, 0x92, 0x1f, 0xe4, 0xa3, 0x75, |
|
| 1174 |
+ 0x00, 0xad, 0xb1, 0x42, 0x0a, 0x7f, 0xda, 0x87, 0xdb, 0x07, 0x22, 0x41, 0x07, 0x39, 0x73, 0xce, |
|
| 1175 |
+ 0x82, 0xa2, 0xba, 0xa7, 0xfe, 0x24, 0x74, 0x83, 0xaf, 0x9e, 0x2d, 0x6e, 0xad, 0xd8, 0x22, 0xfc, |
|
| 1176 |
+ 0xc6, 0xb8, 0x13, 0x64, 0x6f, 0x43, 0x4f, 0x89, 0x92, 0x01, 0xff, 0x7d, 0x0d, 0xfa, 0x9f, 0x78, |
|
| 1177 |
+ 0xde, 0x1d, 0xf5, 0x30, 0x84, 0x66, 0xc6, 0x92, 0x99, 0xcf, 0x25, 0x56, 0x45, 0xee, 0x35, 0x6c, |
|
| 1178 |
+ 0xbd, 0x07, 0xf5, 0x79, 0x8a, 0x9e, 0xd4, 0x84, 0x27, 0x6d, 0xe9, 0xc9, 0x39, 0xa2, 0x1c, 0x41, |
|
| 1179 |
+ 0xb0, 0x2c, 0xa8, 0xbb, 0xc9, 0x24, 0xc5, 0x38, 0xf3, 0x00, 0x89, 0x35, 0x37, 0x99, 0x85, 0x57, |
|
| 1180 |
+ 0x18, 0x63, 0x8e, 0xe2, 0x4b, 0x8e, 0x19, 0x5f, 0x7b, 0x32, 0xba, 0x7c, 0xa9, 0xdc, 0xda, 0xcc, |
|
| 1181 |
+ 0xdd, 0xd2, 0x29, 0x6b, 0xae, 0x4e, 0x59, 0x6b, 0x4d, 0xca, 0xa0, 0x90, 0x32, 0x1b, 0x3a, 0x63, |
|
| 1182 |
+ 0x37, 0x76, 0x2f, 0xfc, 0xc0, 0xcf, 0x7c, 0x96, 0x0e, 0xda, 0xc2, 0x88, 0x02, 0xce, 0x7a, 0x02, |
|
| 1183 |
+ 0x5b, 0x6e, 0x1c, 0xbb, 0xc9, 0x2c, 0x4a, 0x30, 0x34, 0x5f, 0xf8, 0x01, 0x1b, 0x74, 0x84, 0x90, |
|
| 1184 |
+ 0x32, 0x9a, 0x4b, 0x4b, 0x59, 0xe0, 0x87, 0xf3, 0xc5, 0x1b, 0x9e, 0xf9, 0x41, 0x57, 0xb0, 0x15, |
|
| 1185 |
+ 0x70, 0x5c, 0x5a, 0x18, 0x7d, 0xc6, 0xae, 0x4f, 0x12, 0xff, 0x0a, 0xf7, 0x4c, 0x50, 0x69, 0x4f, |
|
| 1186 |
+ 0x44, 0xb1, 0x8c, 0xb6, 0x1d, 0xa8, 0xf3, 0xc8, 0x71, 0xdf, 0xe7, 0x32, 0x03, 0x5d, 0x87, 0x2f, |
|
| 1187 |
+ 0x39, 0x66, 0x22, 0x93, 0x8c, 0x18, 0x5c, 0x5a, 0xdf, 0x82, 0x9e, 0xeb, 0x79, 0x68, 0x6f, 0x84, |
|
| 1188 |
+ 0x69, 0xf8, 0x99, 0xef, 0xa5, 0x98, 0x82, 0x1a, 0x12, 0x4b, 0x58, 0x7b, 0x07, 0x2c, 0x33, 0xc3, |
|
| 1189 |
+ 0x32, 0xf1, 0xbf, 0xd2, 0x05, 0xaa, 0x5b, 0x62, 0x5d, 0xf6, 0x7f, 0x50, 0xe8, 0xa4, 0xaa, 0xc8, |
|
| 1190 |
+ 0x73, 0x5f, 0x55, 0x6c, 0xbe, 0xdb, 0x60, 0xb2, 0x87, 0x30, 0x58, 0x96, 0x2e, 0x35, 0xff, 0x18, |
|
| 1191 |
+ 0xf6, 0x5f, 0xb2, 0x80, 0x7d, 0x15, 0xcd, 0x58, 0x3a, 0xa1, 0x3b, 0x63, 0xb2, 0xb4, 0xc5, 0x9a, |
|
| 1192 |
+ 0x8b, 0x5e, 0xde, 0x2e, 0x45, 0x7f, 0x00, 0xbb, 0x6f, 0xfc, 0x34, 0xbb, 0x53, 0xb0, 0xfd, 0x1b, |
|
| 1193 |
+ 0x80, 0x9c, 0x49, 0xab, 0xa9, 0xe4, 0x6a, 0x38, 0x8e, 0x2d, 0xfc, 0x4c, 0x96, 0xbb, 0x58, 0xf3, |
|
| 1194 |
+ 0x1c, 0x64, 0xe3, 0x58, 0x4e, 0x3f, 0xbe, 0xb4, 0x1e, 0x43, 0x7b, 0x1e, 0xfa, 0x8b, 0xd3, 0x68, |
|
| 1195 |
+ 0x7c, 0xc9, 0xb2, 0x54, 0x8c, 0x92, 0xa6, 0x63, 0xa2, 0x44, 0xcd, 0x4e, 0x59, 0x10, 0x88, 0x79, |
|
| 1196 |
+ 0xd2, 0x74, 0x08, 0xb0, 0x8f, 0x61, 0xaf, 0x6c, 0xa8, 0x9c, 0x0e, 0xcf, 0xa0, 0x9d, 0xc7, 0x31, |
|
| 1197 |
+ 0x45, 0x93, 0x6a, 0xab, 0xa3, 0x6d, 0x72, 0xd9, 0x8f, 0xa0, 0x73, 0x9a, 0x61, 0xb4, 0xd7, 0xb9, |
|
| 1198 |
+ 0xfb, 0x04, 0x7a, 0x7a, 0xb4, 0x08, 0x46, 0x6a, 0x0e, 0x37, 0x9b, 0xa7, 0x92, 0x4b, 0x42, 0xf6, |
|
| 1199 |
+ 0x1f, 0x6b, 0xb0, 0x29, 0x4b, 0x45, 0x35, 0x60, 0x25, 0x6f, 0xc0, 0xff, 0xcb, 0x1c, 0x78, 0x17, |
|
| 1200 |
+ 0x5a, 0xe9, 0x4d, 0x9a, 0xb1, 0xd9, 0x89, 0x9c, 0x06, 0x5d, 0x27, 0x47, 0x7c, 0x0d, 0x66, 0xc2, |
|
| 1201 |
+ 0x3f, 0x2a, 0xd0, 0xd2, 0xd9, 0xfb, 0xaf, 0x8f, 0xc1, 0x0f, 0xa1, 0x15, 0x53, 0x3e, 0x19, 0x0d, |
|
| 1202 |
+ 0x88, 0xf6, 0x61, 0x4f, 0xe6, 0x46, 0x8d, 0x84, 0x9c, 0xc1, 0x28, 0x8b, 0xba, 0x59, 0x16, 0xc6, |
|
| 1203 |
+ 0x31, 0xb7, 0x61, 0x1e, 0x73, 0x3c, 0xa7, 0x31, 0x9f, 0x3c, 0x0d, 0x31, 0x79, 0xc4, 0xda, 0x1a, |
|
| 1204 |
+ 0xc0, 0x66, 0x32, 0x0f, 0x33, 0x1f, 0x1b, 0x8a, 0x66, 0xb7, 0x02, 0xed, 0x8f, 0x61, 0xf3, 0xd8, |
|
| 1205 |
+ 0x1d, 0x4f, 0xd1, 0x0f, 0xbe, 0x71, 0x1c, 0xcb, 0xea, 0xc3, 0x8d, 0x7c, 0xcd, 0x95, 0xcc, 0x18, |
|
| 1206 |
+ 0x86, 0xf1, 0x46, 0xb8, 0x51, 0x77, 0x24, 0x64, 0x5f, 0xe2, 0x01, 0x48, 0xd5, 0x2d, 0x7b, 0xe4, |
|
| 1207 |
+ 0x29, 0x0e, 0x24, 0x15, 0x10, 0xd5, 0x22, 0xcb, 0x47, 0xa8, 0xc1, 0x83, 0xd1, 0xde, 0x9c, 0x91, |
|
| 1208 |
+ 0x66, 0x39, 0xbf, 0x54, 0x0c, 0xa4, 0x3d, 0x8e, 0x22, 0xdb, 0xbf, 0xc3, 0x1b, 0x08, 0xdd, 0x4d, |
|
| 1209 |
+ 0xee, 0xbc, 0x81, 0xac, 0x3e, 0x77, 0x29, 0x7c, 0xb5, 0x42, 0xf8, 0x9e, 0x41, 0x2b, 0x61, 0x69, |
|
| 1210 |
+ 0x34, 0x4f, 0x30, 0xcc, 0x22, 0xb2, 0xed, 0xc3, 0x5d, 0xd5, 0x20, 0x42, 0x97, 0x23, 0xa9, 0x4e, |
|
| 1211 |
+ 0xce, 0x67, 0xff, 0xab, 0x0a, 0xbd, 0x22, 0x95, 0x8f, 0x9b, 0x8b, 0xe0, 0xd2, 0x8f, 0x3e, 0xa7, |
|
| 1212 |
+ 0x4b, 0x15, 0x05, 0xcf, 0x44, 0xf1, 0x66, 0xc1, 0x58, 0x9e, 0x4e, 0x5d, 0x94, 0x23, 0x0f, 0x8b, |
|
| 1213 |
+ 0x1c, 0x21, 0xa9, 0x27, 0x2c, 0xf1, 0x23, 0x4f, 0x5e, 0x0d, 0x72, 0x04, 0xef, 0x6e, 0x04, 0xde, |
|
| 1214 |
+ 0xce, 0xa3, 0xcc, 0x95, 0xd7, 0x38, 0x0d, 0x8b, 0xdb, 0x14, 0xe6, 0x88, 0x65, 0x47, 0x3c, 0x6b, |
|
| 1215 |
+ 0x1b, 0xf2, 0x36, 0xa5, 0x31, 0x39, 0xfd, 0x98, 0xcd, 0x52, 0xd9, 0xbd, 0x06, 0x86, 0x5b, 0x4e, |
|
| 1216 |
+ 0xd9, 0x7c, 0xe3, 0xcf, 0x70, 0xaa, 0x52, 0x1b, 0x9b, 0x28, 0x2e, 0x81, 0xc0, 0xd3, 0x6b, 0x37, |
|
| 1217 |
+ 0x16, 0xdd, 0xdc, 0x75, 0x0c, 0x0c, 0x16, 0x72, 0x9f, 0x20, 0x8c, 0x06, 0x4b, 0xae, 0x5c, 0x7e, |
|
| 1218 |
+ 0xc2, 0x89, 0xee, 0xee, 0x3a, 0xcb, 0x04, 0xce, 0x7d, 0xc9, 0x92, 0x90, 0x05, 0xc7, 0x86, 0x56, |
|
| 1219 |
+ 0x20, 0xee, 0x25, 0x82, 0xfd, 0x00, 0xf6, 0x97, 0x72, 0x2e, 0x8f, 0x94, 0xef, 0x41, 0xf7, 0xd5, |
|
| 1220 |
+ 0x15, 0xc3, 0x21, 0xab, 0xaa, 0x00, 0x63, 0xc8, 0x8b, 0x19, 0x33, 0x3b, 0x8b, 0x45, 0x06, 0xea, |
|
| 1221 |
+ 0x4e, 0x8e, 0xb0, 0x53, 0xd8, 0x10, 0xec, 0xbc, 0xc0, 0x79, 0x82, 0xd5, 0x99, 0xc2, 0xd7, 0xb2, |
|
| 1222 |
+ 0x80, 0xaa, 0xba, 0x80, 0x8a, 0xe5, 0xd2, 0xd5, 0xe5, 0x22, 0x0b, 0xab, 0x9e, 0x17, 0x56, 0x41, |
|
| 1223 |
+ 0xe9, 0x46, 0x59, 0xe9, 0x1f, 0xaa, 0xd0, 0xf9, 0x8c, 0x65, 0xd7, 0x51, 0x72, 0xc9, 0x1b, 0x25, |
|
| 1224 |
+ 0x5d, 0x79, 0xa0, 0x3d, 0x80, 0x66, 0xb2, 0x18, 0x5d, 0xdc, 0x64, 0xb2, 0x30, 0xea, 0xd8, 0x97, |
|
| 1225 |
+ 0x8b, 0x17, 0x1c, 0xb4, 0x1e, 0x02, 0x20, 0xe9, 0xc4, 0xa5, 0x43, 0xac, 0x46, 0xe2, 0x93, 0x85, |
|
| 1226 |
+ 0x44, 0x58, 0xef, 0x40, 0xcb, 0x59, 0x8c, 0x70, 0x4c, 0x46, 0x09, 0x55, 0x6f, 0xdd, 0x41, 0x51, |
|
| 1227 |
+ 0xaf, 0x04, 0xcc, 0xf7, 0x22, 0xd1, 0x4b, 0xa2, 0x38, 0x66, 0x9e, 0x32, 0x2d, 0x59, 0xbc, 0x24, |
|
| 1228 |
+ 0x04, 0xd7, 0x7a, 0xa6, 0xb4, 0x36, 0x48, 0x6b, 0x96, 0x6b, 0x45, 0x52, 0x2c, 0xb5, 0x6e, 0x4a, |
|
| 1229 |
+ 0xa7, 0x4c, 0xad, 0x67, 0x5a, 0x6b, 0x93, 0xb4, 0x66, 0x86, 0xd6, 0xb3, 0x5c, 0x6b, 0x4b, 0xed, |
|
| 1230 |
+ 0x95, 0x5a, 0xed, 0xbf, 0x55, 0xa0, 0x89, 0x65, 0x79, 0x9e, 0xba, 0x13, 0x86, 0x07, 0x53, 0x3b, |
|
| 1231 |
+ 0xc3, 0x12, 0x0e, 0x46, 0x73, 0x0e, 0xca, 0x94, 0x81, 0x40, 0x11, 0xc3, 0x37, 0xa0, 0x13, 0xb3, |
|
| 1232 |
+ 0x04, 0x8b, 0x55, 0x72, 0x54, 0x71, 0xa0, 0xd4, 0x9d, 0x36, 0xe1, 0x88, 0xe5, 0x00, 0xee, 0x0b, |
|
| 1233 |
+ 0xda, 0xc8, 0x0f, 0x47, 0x54, 0x3e, 0xb3, 0xc8, 0x63, 0x32, 0x54, 0x7d, 0x41, 0x7a, 0x1d, 0x7e, |
|
| 1234 |
+ 0xaa, 0x09, 0xd6, 0x77, 0xa0, 0xaf, 0xf9, 0xf9, 0xe1, 0x27, 0xb8, 0x29, 0x74, 0x5b, 0x92, 0xfb, |
|
| 1235 |
+ 0x5c, 0xa2, 0xf1, 0x2e, 0xd2, 0x3b, 0x9b, 0xe2, 0x67, 0x5a, 0x86, 0xa7, 0xc3, 0xe4, 0xa5, 0x8b, |
|
| 1236 |
+ 0xcd, 0x86, 0x13, 0x34, 0x16, 0x2d, 0x99, 0x4a, 0x6b, 0x15, 0x68, 0x7d, 0x17, 0xfa, 0x19, 0xf1, |
|
| 1237 |
+ 0x32, 0x6f, 0xa4, 0x78, 0x28, 0x9b, 0xdb, 0x9a, 0x70, 0x22, 0x99, 0xdf, 0x87, 0x5e, 0xce, 0x2c, |
|
| 1238 |
+ 0xe6, 0x31, 0xd9, 0xdb, 0xd5, 0xd8, 0x33, 0x3e, 0x95, 0xff, 0x4c, 0xc1, 0xa2, 0xca, 0xf9, 0x50, |
|
| 1239 |
+ 0x4c, 0x08, 0x23, 0x54, 0xed, 0xc3, 0x2d, 0x35, 0x59, 0x65, 0x30, 0xc4, 0x54, 0xa0, 0xb0, 0xfc, |
|
| 1240 |
+ 0x04, 0xb6, 0x32, 0x6d, 0xfa, 0x08, 0x1b, 0xc8, 0x95, 0xe3, 0x55, 0x4d, 0xb7, 0xa2, 0x63, 0x4e, |
|
| 1241 |
+ 0x2f, 0x2b, 0x3a, 0x8a, 0x91, 0xa7, 0x93, 0x5c, 0x2a, 0x24, 0xfb, 0xda, 0x84, 0x13, 0x2a, 0xec, |
|
| 1242 |
+ 0xf7, 0xa1, 0x85, 0xc7, 0x7c, 0x4a, 0xd6, 0x61, 0x60, 0xc6, 0xf3, 0x24, 0xc1, 0xfe, 0x52, 0x81, |
|
| 1243 |
+ 0x91, 0xa0, 0x1d, 0x01, 0x50, 0x43, 0x0b, 0xb9, 0x78, 0x29, 0x30, 0x93, 0x4d, 0x00, 0xaf, 0xa8, |
|
| 1244 |
+ 0x99, 0xbb, 0xd0, 0x49, 0x16, 0x15, 0x85, 0x08, 0x72, 0x05, 0x45, 0x7f, 0xe1, 0xfa, 0xc1, 0x58, |
|
| 1245 |
+ 0x7e, 0x2b, 0xa2, 0x68, 0x09, 0x72, 0x61, 0x81, 0x18, 0x1f, 0x94, 0x3f, 0x02, 0xec, 0xbf, 0x56, |
|
| 1246 |
+ 0xa1, 0x4d, 0x1a, 0xc9, 0x34, 0xe4, 0x1a, 0xe3, 0x11, 0xa2, 0x55, 0x0a, 0xc0, 0xfa, 0x40, 0x19, |
|
| 1247 |
+ 0x52, 0xbc, 0x35, 0xe7, 0xa6, 0x2a, 0xdb, 0xf0, 0x48, 0x4b, 0x71, 0xca, 0x19, 0x71, 0x58, 0xc9, |
|
| 1248 |
+ 0xdd, 0xe2, 0x4c, 0x64, 0xf0, 0x47, 0xd0, 0xa1, 0x4a, 0x94, 0x7b, 0xea, 0xeb, 0xf6, 0xb4, 0x89, |
|
| 1249 |
+ 0x8d, 0x76, 0x3d, 0xe3, 0xd7, 0x25, 0xb4, 0x57, 0x9c, 0xe3, 0xed, 0xc3, 0x87, 0x05, 0x76, 0xe1, |
|
| 1250 |
+ 0xc9, 0x81, 0xf8, 0x7d, 0x15, 0x66, 0x38, 0x50, 0x89, 0x77, 0xf8, 0x1c, 0x20, 0x47, 0xf2, 0xe9, |
|
| 1251 |
+ 0x74, 0xc9, 0x6e, 0xd4, 0xb5, 0x10, 0x97, 0xdc, 0xf7, 0x2b, 0x37, 0x98, 0xab, 0xa0, 0x12, 0xf0, |
|
| 1252 |
+ 0xa3, 0xea, 0xf3, 0x8a, 0x3d, 0x86, 0xad, 0x17, 0xfc, 0x74, 0x32, 0xb6, 0x23, 0xf3, 0xcc, 0xfd, |
|
| 1253 |
+ 0x75, 0x94, 0xa8, 0x40, 0x09, 0x40, 0x60, 0xfd, 0x10, 0xb1, 0x52, 0x84, 0x00, 0xf8, 0xc0, 0x8c, |
|
| 1254 |
+ 0x62, 0x79, 0x96, 0xe2, 0x2a, 0x57, 0x54, 0x37, 0x14, 0xd9, 0xff, 0xac, 0x03, 0xe4, 0x5a, 0xac, |
|
| 1255 |
+ 0x53, 0x18, 0xfa, 0xd1, 0x88, 0x1f, 0x05, 0xfe, 0x98, 0xd1, 0xe8, 0x19, 0x25, 0x0c, 0x0b, 0x25, |
|
| 1256 |
+ 0xf5, 0xaf, 0x98, 0xbc, 0x2d, 0xec, 0x49, 0xbf, 0x4b, 0xc6, 0x39, 0xfb, 0x08, 0xd1, 0x46, 0x31, |
|
| 1257 |
+ 0xa3, 0x1c, 0xb5, 0xcd, 0xfa, 0x05, 0xec, 0xe6, 0x42, 0x3d, 0x43, 0x5e, 0xf5, 0x56, 0x79, 0xf7, |
|
| 1258 |
+ 0xb5, 0x3c, 0x2f, 0x97, 0xf5, 0x53, 0x40, 0xf4, 0x08, 0x4f, 0x93, 0x79, 0x41, 0x52, 0xed, 0x56, |
|
| 1259 |
+ 0x49, 0x7d, 0x3f, 0x7a, 0x2b, 0x76, 0xe4, 0x72, 0xde, 0xc2, 0x03, 0xc3, 0x51, 0xde, 0xe0, 0x86, |
|
| 1260 |
+ 0xb4, 0xfa, 0xad, 0xd2, 0xf6, 0xb4, 0x5d, 0x7c, 0x04, 0xe4, 0x22, 0x3f, 0x05, 0xa4, 0x8c, 0xae, |
|
| 1261 |
+ 0x5d, 0x3f, 0x2b, 0xcb, 0xdb, 0xb8, 0xcb, 0xcf, 0xcf, 0x71, 0x53, 0x51, 0x18, 0xf9, 0x39, 0x63, |
|
| 1262 |
+ 0xc9, 0xa4, 0xe0, 0x67, 0xe3, 0x2e, 0x3f, 0x8f, 0xc5, 0x8e, 0x5c, 0xce, 0x0b, 0x40, 0x64, 0xd9, |
|
| 1263 |
+ 0x9e, 0xcd, 0x5b, 0xa5, 0x6c, 0xf9, 0x51, 0xd1, 0x96, 0x23, 0xe8, 0xa7, 0x6c, 0x9c, 0xe1, 0xd9, |
|
| 1264 |
+ 0x61, 0xc8, 0x68, 0xde, 0x2a, 0x63, 0x5b, 0x6e, 0xd0, 0x42, 0xec, 0x2f, 0xa1, 0xf3, 0xf3, 0xf9, |
|
| 1265 |
+ 0x84, 0x65, 0xc1, 0x85, 0xee, 0xf9, 0xff, 0xf5, 0x98, 0xf9, 0x37, 0x8e, 0x99, 0xa3, 0x49, 0x12, |
|
| 1266 |
+ 0xcd, 0xe3, 0xc2, 0x7c, 0xa6, 0x1e, 0x5e, 0x9a, 0xcf, 0x82, 0x47, 0xcc, 0x67, 0xe2, 0xfe, 0x18, |
|
| 1267 |
+ 0x3a, 0x74, 0x35, 0x92, 0x1b, 0x68, 0x0a, 0x59, 0xcb, 0x4d, 0xaf, 0xae, 0x62, 0xb4, 0xed, 0x50, |
|
| 1268 |
+ 0x5e, 0x33, 0xe5, 0xae, 0xe2, 0x34, 0xca, 0xc3, 0x84, 0xdf, 0x19, 0x79, 0xd7, 0xbd, 0x86, 0xee, |
|
| 1269 |
+ 0x94, 0x62, 0x23, 0x77, 0x51, 0x01, 0x7e, 0x53, 0x19, 0x97, 0xfb, 0x70, 0x60, 0xc6, 0x90, 0x42, |
|
| 1270 |
+ 0xdd, 0x99, 0x9a, 0x61, 0xfd, 0x3e, 0x00, 0xff, 0x90, 0x18, 0xa9, 0x41, 0x65, 0xbe, 0x90, 0xe9, |
|
| 1271 |
+ 0xb3, 0x00, 0xbf, 0x5a, 0xd4, 0x72, 0x78, 0x06, 0xfd, 0x25, 0x99, 0x2b, 0xc6, 0xd4, 0xb7, 0xcd, |
|
| 1272 |
+ 0x31, 0xd5, 0x3e, 0xbc, 0x2f, 0x45, 0x9a, 0x5b, 0xcd, 0xd9, 0xf5, 0x97, 0x0a, 0x7d, 0x77, 0xe8, |
|
| 1273 |
+ 0x37, 0x13, 0xeb, 0x39, 0x74, 0x43, 0xba, 0x66, 0xe9, 0x04, 0xd4, 0x0c, 0x41, 0xe6, 0x15, 0xcc, |
|
| 1274 |
+ 0xe9, 0x84, 0xe6, 0x85, 0x0c, 0x13, 0x31, 0x16, 0x11, 0x58, 0x99, 0x08, 0x23, 0x38, 0xf8, 0x5d, |
|
| 1275 |
+ 0x6f, 0x64, 0xbb, 0x70, 0xed, 0xab, 0x95, 0xaf, 0x7d, 0xf2, 0xab, 0x7f, 0xdd, 0xab, 0xdd, 0xe1, |
|
| 1276 |
+ 0x9f, 0x1a, 0x50, 0xfb, 0xe4, 0xe4, 0xb5, 0xe5, 0xc0, 0x56, 0xe9, 0x2d, 0xd2, 0x52, 0x73, 0x7f, |
|
| 1277 |
+ 0xf5, 0x5b, 0xeb, 0xf0, 0xd1, 0x3a, 0xb2, 0xbc, 0x14, 0xdf, 0xe3, 0x32, 0x4b, 0x37, 0x66, 0x2d, |
|
| 1278 |
+ 0x73, 0xf5, 0xd7, 0x93, 0x96, 0xb9, 0xee, 0xa2, 0x7d, 0xcf, 0xfa, 0x21, 0x34, 0xe8, 0x75, 0xd2, |
|
| 1279 |
+ 0xda, 0x91, 0xbc, 0x85, 0x77, 0xcf, 0xe1, 0x6e, 0x09, 0xab, 0x37, 0xbe, 0x81, 0x6e, 0xe1, 0x39, |
|
| 1280 |
+ 0xd9, 0x7a, 0xa7, 0xa0, 0xab, 0xf8, 0xb8, 0x39, 0x7c, 0x77, 0x35, 0x51, 0x4b, 0x3b, 0x02, 0xc8, |
|
| 1281 |
+ 0xdf, 0xcb, 0xac, 0x81, 0xe4, 0x5e, 0x7a, 0x24, 0x1d, 0x3e, 0x58, 0x41, 0xd1, 0x42, 0xce, 0x61, |
|
| 1282 |
+ 0xbb, 0xfc, 0x00, 0x66, 0x95, 0xa2, 0x5a, 0x7e, 0xa4, 0x1a, 0xbe, 0xb7, 0x96, 0x6e, 0x8a, 0x2d, |
|
| 1283 |
+ 0x3f, 0x7e, 0x69, 0xb1, 0x6b, 0x1e, 0xd5, 0xb4, 0xd8, 0xb5, 0xaf, 0x66, 0xf7, 0xac, 0x5f, 0x42, |
|
| 1284 |
+ 0xaf, 0xf8, 0x1c, 0x65, 0xa9, 0x20, 0xad, 0x7c, 0x4e, 0x1b, 0x3e, 0x5c, 0x43, 0xd5, 0x02, 0x3f, |
|
| 1285 |
+ 0x82, 0x0d, 0x7a, 0x67, 0x52, 0xbd, 0x61, 0x3e, 0x4f, 0x0d, 0x77, 0x8a, 0x48, 0xbd, 0xeb, 0x29, |
|
| 1286 |
+ 0x34, 0xe8, 0x5b, 0x4b, 0x17, 0x40, 0xe1, 0xd3, 0x6b, 0xd8, 0x31, 0xb1, 0xf6, 0xbd, 0xa7, 0x15, |
|
| 1287 |
+ 0xa5, 0x27, 0x2d, 0xe8, 0x49, 0x57, 0xe9, 0x31, 0x92, 0x73, 0xd1, 0x10, 0xff, 0x8a, 0x3c, 0xfb, |
|
| 1288 |
+ 0x4f, 0x00, 0x00, 0x00, 0xff, 0xff, 0x2a, 0x4e, 0xb6, 0x6b, 0x22, 0x19, 0x00, 0x00, |
|
| 1289 |
+} |
| 0 | 1290 |
new file mode 100644 |
| ... | ... |
@@ -0,0 +1,284 @@ |
| 0 |
+syntax = "proto3"; |
|
| 1 |
+ |
|
| 2 |
+package types; |
|
| 3 |
+ |
|
| 4 |
+service API {
|
|
| 5 |
+ rpc CreateContainer(CreateContainerRequest) returns (CreateContainerResponse) {}
|
|
| 6 |
+ rpc UpdateContainer(UpdateContainerRequest) returns (UpdateContainerResponse) {}
|
|
| 7 |
+ rpc Signal(SignalRequest) returns (SignalResponse) {}
|
|
| 8 |
+ rpc UpdateProcess(UpdateProcessRequest) returns (UpdateProcessResponse) {}
|
|
| 9 |
+ rpc AddProcess(AddProcessRequest) returns (AddProcessResponse) {}
|
|
| 10 |
+ rpc CreateCheckpoint(CreateCheckpointRequest) returns (CreateCheckpointResponse) {}
|
|
| 11 |
+ rpc DeleteCheckpoint(DeleteCheckpointRequest) returns (DeleteCheckpointResponse) {}
|
|
| 12 |
+ rpc ListCheckpoint(ListCheckpointRequest) returns (ListCheckpointResponse) {}
|
|
| 13 |
+ rpc State(StateRequest) returns (StateResponse) {}
|
|
| 14 |
+ rpc Events(EventsRequest) returns (stream Event) {}
|
|
| 15 |
+ rpc Stats(StatsRequest) returns (StatsResponse) {}
|
|
| 16 |
+} |
|
| 17 |
+ |
|
| 18 |
+message UpdateProcessRequest {
|
|
| 19 |
+ string id = 1; |
|
| 20 |
+ string pid = 2; |
|
| 21 |
+ bool closeStdin = 3; // Close stdin of the container |
|
| 22 |
+ uint32 width = 4; |
|
| 23 |
+ uint32 height = 5; |
|
| 24 |
+} |
|
| 25 |
+ |
|
| 26 |
+message UpdateProcessResponse {
|
|
| 27 |
+} |
|
| 28 |
+ |
|
| 29 |
+message CreateContainerRequest {
|
|
| 30 |
+ string id = 1; // ID of container |
|
| 31 |
+ string bundlePath = 2; // path to OCI bundle |
|
| 32 |
+ string checkpoint = 3; // checkpoint name if you want to create immediate checkpoint (optional) |
|
| 33 |
+ string stdin = 4; // path to the file where stdin will be read (optional) |
|
| 34 |
+ string stdout = 5; // path to file where stdout will be written (optional) |
|
| 35 |
+ string stderr = 6; // path to file where stderr will be written (optional) |
|
| 36 |
+ repeated string labels = 7; |
|
| 37 |
+} |
|
| 38 |
+ |
|
| 39 |
+message CreateContainerResponse {
|
|
| 40 |
+ Container container = 1; |
|
| 41 |
+} |
|
| 42 |
+ |
|
| 43 |
+message SignalRequest {
|
|
| 44 |
+ string id = 1; // ID of container |
|
| 45 |
+ string pid = 2; // PID of process inside container |
|
| 46 |
+ uint32 signal = 3; // Signal which will be sent, you can find value in "man 7 signal" |
|
| 47 |
+} |
|
| 48 |
+ |
|
| 49 |
+message SignalResponse {
|
|
| 50 |
+} |
|
| 51 |
+ |
|
| 52 |
+message AddProcessRequest {
|
|
| 53 |
+ string id = 1; // ID of container |
|
| 54 |
+ bool terminal = 2; // Use tty for container stdio |
|
| 55 |
+ User user = 3; // User under which process will be run |
|
| 56 |
+ repeated string args = 4; // Arguments for process, first is binary path itself |
|
| 57 |
+ repeated string env = 5; // List of environment variables for process |
|
| 58 |
+ string cwd = 6; // Workind directory of process |
|
| 59 |
+ string pid = 7; // Process ID |
|
| 60 |
+ string stdin = 8; // path to the file where stdin will be read (optional) |
|
| 61 |
+ string stdout = 9; // path to file where stdout will be written (optional) |
|
| 62 |
+ string stderr = 10; // path to file where stderr will be written (optional) |
|
| 63 |
+ repeated string capabilities = 11; |
|
| 64 |
+ string apparmorProfile = 12; |
|
| 65 |
+ string selinuxLabel = 13; |
|
| 66 |
+ bool noNewPrivileges = 14; |
|
| 67 |
+} |
|
| 68 |
+ |
|
| 69 |
+message User {
|
|
| 70 |
+ uint32 uid = 1; // UID of user |
|
| 71 |
+ uint32 gid = 2; // GID of user |
|
| 72 |
+ repeated uint32 additionalGids = 3; // Additional groups to which user will be added |
|
| 73 |
+} |
|
| 74 |
+ |
|
| 75 |
+message AddProcessResponse {
|
|
| 76 |
+} |
|
| 77 |
+ |
|
| 78 |
+message CreateCheckpointRequest {
|
|
| 79 |
+ string id = 1; // ID of container |
|
| 80 |
+ Checkpoint checkpoint = 2; // Checkpoint configuration |
|
| 81 |
+} |
|
| 82 |
+ |
|
| 83 |
+message CreateCheckpointResponse {
|
|
| 84 |
+} |
|
| 85 |
+ |
|
| 86 |
+message DeleteCheckpointRequest {
|
|
| 87 |
+ string id = 1; // ID of container |
|
| 88 |
+ string name = 2; // Name of checkpoint |
|
| 89 |
+} |
|
| 90 |
+ |
|
| 91 |
+message DeleteCheckpointResponse {
|
|
| 92 |
+} |
|
| 93 |
+ |
|
| 94 |
+message ListCheckpointRequest {
|
|
| 95 |
+ string id = 1; // ID of container |
|
| 96 |
+} |
|
| 97 |
+ |
|
| 98 |
+message Checkpoint {
|
|
| 99 |
+ string name = 1; // Name of checkpoint |
|
| 100 |
+ bool exit = 2; // checkpoint configuration: should container exit on checkpoint or not |
|
| 101 |
+ bool tcp = 3; // allow open tcp connections |
|
| 102 |
+ bool unixSockets = 4; // allow external unix sockets |
|
| 103 |
+ bool shell = 5; // allow shell-jobs |
|
| 104 |
+} |
|
| 105 |
+ |
|
| 106 |
+message ListCheckpointResponse {
|
|
| 107 |
+ repeated Checkpoint checkpoints = 1; // List of checkpoints |
|
| 108 |
+} |
|
| 109 |
+ |
|
| 110 |
+message StateRequest {
|
|
| 111 |
+ string id = 1; // container id for a single container |
|
| 112 |
+} |
|
| 113 |
+ |
|
| 114 |
+message ContainerState {
|
|
| 115 |
+ string status = 1; |
|
| 116 |
+} |
|
| 117 |
+ |
|
| 118 |
+message Process {
|
|
| 119 |
+ string pid = 1; |
|
| 120 |
+ bool terminal = 2; // Use tty for container stdio |
|
| 121 |
+ User user = 3; // User under which process will be run |
|
| 122 |
+ repeated string args = 4; // Arguments for process, first is binary path itself |
|
| 123 |
+ repeated string env = 5; // List of environment variables for process |
|
| 124 |
+ string cwd = 6; // Workind directory of process |
|
| 125 |
+ uint32 systemPid = 7; |
|
| 126 |
+ string stdin = 8; // path to the file where stdin will be read (optional) |
|
| 127 |
+ string stdout = 9; // path to file where stdout will be written (optional) |
|
| 128 |
+ string stderr = 10; // path to file where stderr will be written (optional) |
|
| 129 |
+repeated string capabilities = 11; |
|
| 130 |
+ string apparmorProfile = 12; |
|
| 131 |
+ string selinuxLabel = 13; |
|
| 132 |
+ bool noNewPrivileges = 14; |
|
| 133 |
+} |
|
| 134 |
+ |
|
| 135 |
+message Container {
|
|
| 136 |
+ string id = 1; // ID of container |
|
| 137 |
+ string bundlePath = 2; // Path to OCI bundle |
|
| 138 |
+ repeated Process processes = 3; // List of processes which run in container |
|
| 139 |
+ string status = 4; // Container status ("running", "paused", etc.)
|
|
| 140 |
+ repeated string labels = 5; |
|
| 141 |
+ repeated uint32 pids = 6; |
|
| 142 |
+ string runtime = 7; // runtime used to execute the container |
|
| 143 |
+} |
|
| 144 |
+ |
|
| 145 |
+// Machine is information about machine on which containerd is run |
|
| 146 |
+message Machine {
|
|
| 147 |
+ uint32 cpus = 1; // number of cpus |
|
| 148 |
+ uint64 memory = 2; // amount of memory |
|
| 149 |
+} |
|
| 150 |
+ |
|
| 151 |
+// StateResponse is information about containerd daemon |
|
| 152 |
+message StateResponse {
|
|
| 153 |
+ repeated Container containers = 1; |
|
| 154 |
+ Machine machine = 2; |
|
| 155 |
+} |
|
| 156 |
+ |
|
| 157 |
+message UpdateContainerRequest {
|
|
| 158 |
+ string id = 1; // ID of container |
|
| 159 |
+ string pid = 2; |
|
| 160 |
+ string status = 3; // Status to whcih containerd will try to change |
|
| 161 |
+ UpdateResource resources =4; |
|
| 162 |
+} |
|
| 163 |
+ |
|
| 164 |
+message UpdateResource {
|
|
| 165 |
+ uint32 blkioWeight =1; |
|
| 166 |
+ uint32 cpuShares = 2; |
|
| 167 |
+ uint32 cpuPeriod = 3; |
|
| 168 |
+ uint32 cpuQuota = 4; |
|
| 169 |
+ string cpusetCpus = 5; |
|
| 170 |
+ string cpusetMems = 6; |
|
| 171 |
+ uint32 memoryLimit = 7; |
|
| 172 |
+ uint32 memorySwap = 8; |
|
| 173 |
+ uint32 memoryReservation = 9; |
|
| 174 |
+ uint32 kernelMemoryLimit = 10; |
|
| 175 |
+} |
|
| 176 |
+ |
|
| 177 |
+message UpdateContainerResponse {
|
|
| 178 |
+} |
|
| 179 |
+ |
|
| 180 |
+message EventsRequest {
|
|
| 181 |
+ uint64 timestamp = 1; |
|
| 182 |
+} |
|
| 183 |
+ |
|
| 184 |
+message Event {
|
|
| 185 |
+ string type = 1; |
|
| 186 |
+ string id = 2; |
|
| 187 |
+ uint32 status = 3; |
|
| 188 |
+ string pid = 4; |
|
| 189 |
+ uint64 timestamp = 5; |
|
| 190 |
+} |
|
| 191 |
+ |
|
| 192 |
+message NetworkStats {
|
|
| 193 |
+ string name = 1; // name of network interface |
|
| 194 |
+ uint64 rx_bytes = 2; |
|
| 195 |
+ uint64 rx_Packets = 3; |
|
| 196 |
+ uint64 Rx_errors = 4; |
|
| 197 |
+ uint64 Rx_dropped = 5; |
|
| 198 |
+ uint64 Tx_bytes = 6; |
|
| 199 |
+ uint64 Tx_packets = 7; |
|
| 200 |
+ uint64 Tx_errors = 8; |
|
| 201 |
+ uint64 Tx_dropped = 9; |
|
| 202 |
+} |
|
| 203 |
+ |
|
| 204 |
+message CpuUsage {
|
|
| 205 |
+ uint64 total_usage = 1; |
|
| 206 |
+ repeated uint64 percpu_usage = 2; |
|
| 207 |
+ uint64 usage_in_kernelmode = 3; |
|
| 208 |
+ uint64 usage_in_usermode = 4; |
|
| 209 |
+} |
|
| 210 |
+ |
|
| 211 |
+message ThrottlingData {
|
|
| 212 |
+ uint64 periods = 1; |
|
| 213 |
+ uint64 throttled_periods = 2; |
|
| 214 |
+ uint64 throttled_time = 3; |
|
| 215 |
+} |
|
| 216 |
+ |
|
| 217 |
+message CpuStats {
|
|
| 218 |
+ CpuUsage cpu_usage = 1; |
|
| 219 |
+ ThrottlingData throttling_data = 2; |
|
| 220 |
+ uint64 system_usage = 3; |
|
| 221 |
+} |
|
| 222 |
+ |
|
| 223 |
+message PidsStats {
|
|
| 224 |
+ uint64 current = 1; |
|
| 225 |
+} |
|
| 226 |
+ |
|
| 227 |
+message MemoryData {
|
|
| 228 |
+ uint64 usage = 1; |
|
| 229 |
+ uint64 max_usage = 2; |
|
| 230 |
+ uint64 failcnt = 3; |
|
| 231 |
+ uint64 limit = 4; |
|
| 232 |
+} |
|
| 233 |
+ |
|
| 234 |
+message MemoryStats {
|
|
| 235 |
+ uint64 cache = 1; |
|
| 236 |
+ MemoryData usage = 2; |
|
| 237 |
+ MemoryData swap_usage = 3; |
|
| 238 |
+ MemoryData kernel_usage = 4; |
|
| 239 |
+ map<string, uint64> stats = 5; |
|
| 240 |
+} |
|
| 241 |
+ |
|
| 242 |
+message BlkioStatsEntry {
|
|
| 243 |
+ uint64 major = 1; |
|
| 244 |
+ uint64 minor = 2; |
|
| 245 |
+ string op = 3; |
|
| 246 |
+ uint64 value = 4; |
|
| 247 |
+} |
|
| 248 |
+ |
|
| 249 |
+message BlkioStats {
|
|
| 250 |
+ repeated BlkioStatsEntry io_service_bytes_recursive = 1; // number of bytes tranferred to and from the block device |
|
| 251 |
+ repeated BlkioStatsEntry io_serviced_recursive = 2; |
|
| 252 |
+ repeated BlkioStatsEntry io_queued_recursive = 3; |
|
| 253 |
+ repeated BlkioStatsEntry io_service_time_recursive = 4; |
|
| 254 |
+ repeated BlkioStatsEntry io_wait_time_recursive = 5; |
|
| 255 |
+ repeated BlkioStatsEntry io_merged_recursive = 6; |
|
| 256 |
+ repeated BlkioStatsEntry io_time_recursive = 7; |
|
| 257 |
+ repeated BlkioStatsEntry sectors_recursive = 8; |
|
| 258 |
+} |
|
| 259 |
+ |
|
| 260 |
+message HugetlbStats {
|
|
| 261 |
+ uint64 usage = 1; |
|
| 262 |
+ uint64 max_usage = 2; |
|
| 263 |
+ uint64 failcnt = 3; |
|
| 264 |
+ uint64 limit = 4; |
|
| 265 |
+} |
|
| 266 |
+ |
|
| 267 |
+message CgroupStats {
|
|
| 268 |
+ CpuStats cpu_stats = 1; |
|
| 269 |
+ MemoryStats memory_stats = 2; |
|
| 270 |
+ BlkioStats blkio_stats = 3; |
|
| 271 |
+ map<string, HugetlbStats> hugetlb_stats = 4; // the map is in the format "size of hugepage: stats of the hugepage" |
|
| 272 |
+ PidsStats pids_stats = 5; |
|
| 273 |
+} |
|
| 274 |
+ |
|
| 275 |
+message StatsResponse {
|
|
| 276 |
+ repeated NetworkStats network_stats = 1; |
|
| 277 |
+ CgroupStats cgroup_stats = 2; |
|
| 278 |
+ uint64 timestamp = 3; |
|
| 279 |
+}; |
|
| 280 |
+ |
|
| 281 |
+message StatsRequest {
|
|
| 282 |
+ string id = 1; |
|
| 283 |
+} |
| ... | ... |
@@ -130,6 +130,8 @@ func (m *Manager) Apply(pid int) (err error) {
|
| 130 | 130 |
return cgroups.EnterPid(m.Paths, pid) |
| 131 | 131 |
} |
| 132 | 132 |
|
| 133 |
+ m.mu.Lock() |
|
| 134 |
+ defer m.mu.Unlock() |
|
| 133 | 135 |
paths := make(map[string]string) |
| 134 | 136 |
for _, sys := range subsystems {
|
| 135 | 137 |
if err := sys.Apply(d); err != nil {
|
| ... | ... |
@@ -86,14 +86,14 @@ func (s *MemoryGroup) Set(path string, cgroup *configs.Cgroup) error {
|
| 86 | 86 |
return err |
| 87 | 87 |
} |
| 88 | 88 |
} |
| 89 |
- if cgroup.Resources.MemorySwappiness >= 0 && cgroup.Resources.MemorySwappiness <= 100 {
|
|
| 90 |
- if err := writeFile(path, "memory.swappiness", strconv.FormatInt(cgroup.Resources.MemorySwappiness, 10)); err != nil {
|
|
| 89 |
+ if cgroup.Resources.MemorySwappiness == nil || int64(*cgroup.Resources.MemorySwappiness) == -1 {
|
|
| 90 |
+ return nil |
|
| 91 |
+ } else if int64(*cgroup.Resources.MemorySwappiness) >= 0 && int64(*cgroup.Resources.MemorySwappiness) <= 100 {
|
|
| 92 |
+ if err := writeFile(path, "memory.swappiness", strconv.FormatInt(*cgroup.Resources.MemorySwappiness, 10)); err != nil {
|
|
| 91 | 93 |
return err |
| 92 | 94 |
} |
| 93 |
- } else if cgroup.Resources.MemorySwappiness == -1 {
|
|
| 94 |
- return nil |
|
| 95 | 95 |
} else {
|
| 96 |
- return fmt.Errorf("invalid value:%d. valid memory swappiness range is 0-100", cgroup.Resources.MemorySwappiness)
|
|
| 96 |
+ return fmt.Errorf("invalid value:%d. valid memory swappiness range is 0-100", int64(*cgroup.Resources.MemorySwappiness))
|
|
| 97 | 97 |
} |
| 98 | 98 |
|
| 99 | 99 |
return nil |
| ... | ... |
@@ -149,7 +149,7 @@ func memoryAssigned(cgroup *configs.Cgroup) bool {
|
| 149 | 149 |
cgroup.Resources.MemorySwap > 0 || |
| 150 | 150 |
cgroup.Resources.KernelMemory > 0 || |
| 151 | 151 |
cgroup.Resources.OomKillDisable || |
| 152 |
- cgroup.Resources.MemorySwappiness != -1 |
|
| 152 |
+ (cgroup.Resources.MemorySwappiness != nil && *cgroup.Resources.MemorySwappiness != -1) |
|
| 153 | 153 |
} |
| 154 | 154 |
|
| 155 | 155 |
func getMemoryData(path, name string) (cgroups.MemoryData, error) {
|
| ... | ... |
@@ -46,7 +46,7 @@ type MemoryStats struct {
|
| 46 | 46 |
Usage MemoryData `json:"usage,omitempty"` |
| 47 | 47 |
// usage of memory + swap |
| 48 | 48 |
SwapUsage MemoryData `json:"swap_usage,omitempty"` |
| 49 |
- // usafe of kernel memory |
|
| 49 |
+ // usage of kernel memory |
|
| 50 | 50 |
KernelUsage MemoryData `json:"kernel_usage,omitempty"` |
| 51 | 51 |
Stats map[string]uint64 `json:"stats,omitempty"` |
| 52 | 52 |
} |
| ... | ... |
@@ -80,7 +80,7 @@ type HugetlbStats struct {
|
| 80 | 80 |
Usage uint64 `json:"usage,omitempty"` |
| 81 | 81 |
// maximum usage ever recorded. |
| 82 | 82 |
MaxUsage uint64 `json:"max_usage,omitempty"` |
| 83 |
- // number of times htgetlb usage allocation failure. |
|
| 83 |
+ // number of times hugetlb usage allocation failure. |
|
| 84 | 84 |
Failcnt uint64 `json:"failcnt"` |
| 85 | 85 |
} |
| 86 | 86 |
|
| ... | ... |
@@ -111,7 +111,7 @@ type Resources struct {
|
| 111 | 111 |
OomKillDisable bool `json:"oom_kill_disable"` |
| 112 | 112 |
|
| 113 | 113 |
// Tuning swappiness behaviour per cgroup |
| 114 |
- MemorySwappiness int64 `json:"memory_swappiness"` |
|
| 114 |
+ MemorySwappiness *int64 `json:"memory_swappiness"` |
|
| 115 | 115 |
|
| 116 | 116 |
// Set priority of network traffic for container |
| 117 | 117 |
NetPrioIfpriomap []*IfPrioMap `json:"net_prio_ifpriomap"` |
| ... | ... |
@@ -128,11 +128,11 @@ type Config struct {
|
| 128 | 128 |
|
| 129 | 129 |
// AppArmorProfile specifies the profile to apply to the process running in the container and is |
| 130 | 130 |
// change at the time the process is execed |
| 131 |
- AppArmorProfile string `json:"apparmor_profile"` |
|
| 131 |
+ AppArmorProfile string `json:"apparmor_profile,omitempty"` |
|
| 132 | 132 |
|
| 133 | 133 |
// ProcessLabel specifies the label to apply to the process running in the container. It is |
| 134 | 134 |
// commonly used by selinux |
| 135 |
- ProcessLabel string `json:"process_label"` |
|
| 135 |
+ ProcessLabel string `json:"process_label,omitempty"` |
|
| 136 | 136 |
|
| 137 | 137 |
// Rlimits specifies the resource limits, such as max open files, to set in the container |
| 138 | 138 |
// If Rlimits are not set, the container will inherit rlimits from the parent process |
| ... | ... |
@@ -172,7 +172,7 @@ type Config struct {
|
| 172 | 172 |
Seccomp *Seccomp `json:"seccomp"` |
| 173 | 173 |
|
| 174 | 174 |
// NoNewPrivileges controls whether processes in the container can gain additional privileges. |
| 175 |
- NoNewPrivileges bool `json:"no_new_privileges"` |
|
| 175 |
+ NoNewPrivileges bool `json:"no_new_privileges,omitempty"` |
|
| 176 | 176 |
|
| 177 | 177 |
// Hooks are a collection of actions to perform at various container lifecycle events. |
| 178 | 178 |
// Hooks are not able to be marshaled to json but they are also not needed to. |
| ... | ... |
@@ -180,6 +180,9 @@ type Config struct {
|
| 180 | 180 |
|
| 181 | 181 |
// Version is the version of opencontainer specification that is supported. |
| 182 | 182 |
Version string `json:"version"` |
| 183 |
+ |
|
| 184 |
+ // Labels are user defined metadata that is stored in the config and populated on the state |
|
| 185 |
+ Labels []string `json:"labels"` |
|
| 183 | 186 |
} |
| 184 | 187 |
|
| 185 | 188 |
type Hooks struct {
|
| ... | ... |
@@ -2,7 +2,11 @@ |
| 2 | 2 |
|
| 3 | 3 |
package configs |
| 4 | 4 |
|
| 5 |
-import "fmt" |
|
| 5 |
+import ( |
|
| 6 |
+ "fmt" |
|
| 7 |
+ "os" |
|
| 8 |
+ "sync" |
|
| 9 |
+) |
|
| 6 | 10 |
|
| 7 | 11 |
const ( |
| 8 | 12 |
NEWNET NamespaceType = "NEWNET" |
| ... | ... |
@@ -13,6 +17,51 @@ const ( |
| 13 | 13 |
NEWUSER NamespaceType = "NEWUSER" |
| 14 | 14 |
) |
| 15 | 15 |
|
| 16 |
+var ( |
|
| 17 |
+ nsLock sync.Mutex |
|
| 18 |
+ supportedNamespaces = make(map[NamespaceType]bool) |
|
| 19 |
+) |
|
| 20 |
+ |
|
| 21 |
+// nsToFile converts the namespace type to its filename |
|
| 22 |
+func nsToFile(ns NamespaceType) string {
|
|
| 23 |
+ switch ns {
|
|
| 24 |
+ case NEWNET: |
|
| 25 |
+ return "net" |
|
| 26 |
+ case NEWNS: |
|
| 27 |
+ return "mnt" |
|
| 28 |
+ case NEWPID: |
|
| 29 |
+ return "pid" |
|
| 30 |
+ case NEWIPC: |
|
| 31 |
+ return "ipc" |
|
| 32 |
+ case NEWUSER: |
|
| 33 |
+ return "user" |
|
| 34 |
+ case NEWUTS: |
|
| 35 |
+ return "uts" |
|
| 36 |
+ } |
|
| 37 |
+ return "" |
|
| 38 |
+} |
|
| 39 |
+ |
|
| 40 |
+// IsNamespaceSupported returns whether a namespace is available or |
|
| 41 |
+// not |
|
| 42 |
+func IsNamespaceSupported(ns NamespaceType) bool {
|
|
| 43 |
+ nsLock.Lock() |
|
| 44 |
+ defer nsLock.Unlock() |
|
| 45 |
+ supported, ok := supportedNamespaces[ns] |
|
| 46 |
+ if ok {
|
|
| 47 |
+ return supported |
|
| 48 |
+ } |
|
| 49 |
+ nsFile := nsToFile(ns) |
|
| 50 |
+ // if the namespace type is unknown, just return false |
|
| 51 |
+ if nsFile == "" {
|
|
| 52 |
+ return false |
|
| 53 |
+ } |
|
| 54 |
+ _, err := os.Stat(fmt.Sprintf("/proc/self/ns/%s", nsFile))
|
|
| 55 |
+ // a namespace is supported if it exists and we have permissions to read it |
|
| 56 |
+ supported = err == nil |
|
| 57 |
+ supportedNamespaces[ns] = supported |
|
| 58 |
+ return supported |
|
| 59 |
+} |
|
| 60 |
+ |
|
| 16 | 61 |
func NamespaceTypes() []NamespaceType {
|
| 17 | 62 |
return []NamespaceType{
|
| 18 | 63 |
NEWNET, |
| ... | ... |
@@ -35,26 +84,7 @@ func (n *Namespace) GetPath(pid int) string {
|
| 35 | 35 |
if n.Path != "" {
|
| 36 | 36 |
return n.Path |
| 37 | 37 |
} |
| 38 |
- return fmt.Sprintf("/proc/%d/ns/%s", pid, n.file())
|
|
| 39 |
-} |
|
| 40 |
- |
|
| 41 |
-func (n *Namespace) file() string {
|
|
| 42 |
- file := "" |
|
| 43 |
- switch n.Type {
|
|
| 44 |
- case NEWNET: |
|
| 45 |
- file = "net" |
|
| 46 |
- case NEWNS: |
|
| 47 |
- file = "mnt" |
|
| 48 |
- case NEWPID: |
|
| 49 |
- file = "pid" |
|
| 50 |
- case NEWIPC: |
|
| 51 |
- file = "ipc" |
|
| 52 |
- case NEWUSER: |
|
| 53 |
- file = "user" |
|
| 54 |
- case NEWUTS: |
|
| 55 |
- file = "uts" |
|
| 56 |
- } |
|
| 57 |
- return file |
|
| 38 |
+ return fmt.Sprintf("/proc/%d/ns/%s", pid, nsToFile(n.Type))
|
|
| 58 | 39 |
} |
| 59 | 40 |
|
| 60 | 41 |
func (n *Namespaces) Remove(t NamespaceType) bool {
|
| ... | ... |
@@ -87,3 +117,11 @@ func (n *Namespaces) index(t NamespaceType) int {
|
| 87 | 87 |
func (n *Namespaces) Contains(t NamespaceType) bool {
|
| 88 | 88 |
return n.index(t) != -1 |
| 89 | 89 |
} |
| 90 |
+ |
|
| 91 |
+func (n *Namespaces) PathOf(t NamespaceType) string {
|
|
| 92 |
+ i := n.index(t) |
|
| 93 |
+ if i == -1 {
|
|
| 94 |
+ return "" |
|
| 95 |
+ } |
|
| 96 |
+ return (*n)[i].Path |
|
| 97 |
+} |
| ... | ... |
@@ -4,6 +4,7 @@ import ( |
| 4 | 4 |
"fmt" |
| 5 | 5 |
"os" |
| 6 | 6 |
"path/filepath" |
| 7 |
+ "strings" |
|
| 7 | 8 |
|
| 8 | 9 |
"github.com/opencontainers/runc/libcontainer/configs" |
| 9 | 10 |
) |
| ... | ... |
@@ -35,6 +36,9 @@ func (v *ConfigValidator) Validate(config *configs.Config) error {
|
| 35 | 35 |
if err := v.usernamespace(config); err != nil {
|
| 36 | 36 |
return err |
| 37 | 37 |
} |
| 38 |
+ if err := v.sysctl(config); err != nil {
|
|
| 39 |
+ return err |
|
| 40 |
+ } |
|
| 38 | 41 |
return nil |
| 39 | 42 |
} |
| 40 | 43 |
|
| ... | ... |
@@ -91,3 +95,44 @@ func (v *ConfigValidator) usernamespace(config *configs.Config) error {
|
| 91 | 91 |
} |
| 92 | 92 |
return nil |
| 93 | 93 |
} |
| 94 |
+ |
|
| 95 |
+// sysctl validates that the specified sysctl keys are valid or not. |
|
| 96 |
+// /proc/sys isn't completely namespaced and depending on which namespaces |
|
| 97 |
+// are specified, a subset of sysctls are permitted. |
|
| 98 |
+func (v *ConfigValidator) sysctl(config *configs.Config) error {
|
|
| 99 |
+ validSysctlPrefixes := []string{}
|
|
| 100 |
+ validSysctlMap := make(map[string]bool) |
|
| 101 |
+ if config.Namespaces.Contains(configs.NEWNET) {
|
|
| 102 |
+ validSysctlPrefixes = append(validSysctlPrefixes, "net.") |
|
| 103 |
+ } |
|
| 104 |
+ if config.Namespaces.Contains(configs.NEWIPC) {
|
|
| 105 |
+ validSysctlPrefixes = append(validSysctlPrefixes, "fs.mqueue.") |
|
| 106 |
+ validSysctlMap = map[string]bool{
|
|
| 107 |
+ "kernel.msgmax": true, |
|
| 108 |
+ "kernel.msgmnb": true, |
|
| 109 |
+ "kernel.msgmni": true, |
|
| 110 |
+ "kernel.sem": true, |
|
| 111 |
+ "kernel.shmall": true, |
|
| 112 |
+ "kernel.shmmax": true, |
|
| 113 |
+ "kernel.shmmni": true, |
|
| 114 |
+ "kernel.shm_rmid_forced": true, |
|
| 115 |
+ } |
|
| 116 |
+ } |
|
| 117 |
+ for s := range config.Sysctl {
|
|
| 118 |
+ if validSysctlMap[s] {
|
|
| 119 |
+ continue |
|
| 120 |
+ } |
|
| 121 |
+ valid := false |
|
| 122 |
+ for _, vp := range validSysctlPrefixes {
|
|
| 123 |
+ if strings.HasPrefix(s, vp) {
|
|
| 124 |
+ valid = true |
|
| 125 |
+ break |
|
| 126 |
+ } |
|
| 127 |
+ } |
|
| 128 |
+ if !valid {
|
|
| 129 |
+ return fmt.Errorf("sysctl %q is not permitted in the config", s)
|
|
| 130 |
+ } |
|
| 131 |
+ } |
|
| 132 |
+ |
|
| 133 |
+ return nil |
|
| 134 |
+} |
| ... | ... |
@@ -27,9 +27,6 @@ const ( |
| 27 | 27 |
// The container exists, but all its processes are paused. |
| 28 | 28 |
Paused |
| 29 | 29 |
|
| 30 |
- // The container exists, but its state is saved on disk |
|
| 31 |
- Checkpointed |
|
| 32 |
- |
|
| 33 | 30 |
// The container does not exist. |
| 34 | 31 |
Destroyed |
| 35 | 32 |
) |
| ... | ... |
@@ -44,8 +41,6 @@ func (s Status) String() string {
|
| 44 | 44 |
return "pausing" |
| 45 | 45 |
case Paused: |
| 46 | 46 |
return "paused" |
| 47 |
- case Checkpointed: |
|
| 48 |
- return "checkpointed" |
|
| 49 | 47 |
case Destroyed: |
| 50 | 48 |
return "destroyed" |
| 51 | 49 |
default: |
| ... | ... |
@@ -23,6 +23,7 @@ import ( |
| 23 | 23 |
"github.com/opencontainers/runc/libcontainer/configs" |
| 24 | 24 |
"github.com/opencontainers/runc/libcontainer/criurpc" |
| 25 | 25 |
"github.com/opencontainers/runc/libcontainer/utils" |
| 26 |
+ "github.com/syndtr/gocapability/capability" |
|
| 26 | 27 |
"github.com/vishvananda/netlink/nl" |
| 27 | 28 |
) |
| 28 | 29 |
|
| ... | ... |
@@ -268,37 +269,40 @@ func (c *linuxContainer) commandTemplate(p *Process, childPipe *os.File) (*exec. |
| 268 | 268 |
} |
| 269 | 269 |
|
| 270 | 270 |
func (c *linuxContainer) newInitProcess(p *Process, cmd *exec.Cmd, parentPipe, childPipe *os.File) (*initProcess, error) {
|
| 271 |
- t := "_LIBCONTAINER_INITTYPE=" + string(initStandard) |
|
| 272 |
- cloneFlags := c.config.Namespaces.CloneFlags() |
|
| 273 |
- if cloneFlags&syscall.CLONE_NEWUSER != 0 {
|
|
| 274 |
- if err := c.addUidGidMappings(cmd.SysProcAttr); err != nil {
|
|
| 275 |
- // user mappings are not supported |
|
| 276 |
- return nil, err |
|
| 277 |
- } |
|
| 278 |
- enableSetgroups(cmd.SysProcAttr) |
|
| 279 |
- // Default to root user when user namespaces are enabled. |
|
| 280 |
- if cmd.SysProcAttr.Credential == nil {
|
|
| 281 |
- cmd.SysProcAttr.Credential = &syscall.Credential{}
|
|
| 271 |
+ cmd.Env = append(cmd.Env, "_LIBCONTAINER_INITTYPE="+string(initStandard)) |
|
| 272 |
+ nsMaps := make(map[configs.NamespaceType]string) |
|
| 273 |
+ for _, ns := range c.config.Namespaces {
|
|
| 274 |
+ if ns.Path != "" {
|
|
| 275 |
+ nsMaps[ns.Type] = ns.Path |
|
| 282 | 276 |
} |
| 283 | 277 |
} |
| 284 |
- cmd.Env = append(cmd.Env, t) |
|
| 285 |
- cmd.SysProcAttr.Cloneflags = cloneFlags |
|
| 278 |
+ _, sharePidns := nsMaps[configs.NEWPID] |
|
| 279 |
+ data, err := c.bootstrapData(c.config.Namespaces.CloneFlags(), nsMaps, "") |
|
| 280 |
+ if err != nil {
|
|
| 281 |
+ return nil, err |
|
| 282 |
+ } |
|
| 286 | 283 |
return &initProcess{
|
| 287 |
- cmd: cmd, |
|
| 288 |
- childPipe: childPipe, |
|
| 289 |
- parentPipe: parentPipe, |
|
| 290 |
- manager: c.cgroupManager, |
|
| 291 |
- config: c.newInitConfig(p), |
|
| 292 |
- container: c, |
|
| 293 |
- process: p, |
|
| 284 |
+ cmd: cmd, |
|
| 285 |
+ childPipe: childPipe, |
|
| 286 |
+ parentPipe: parentPipe, |
|
| 287 |
+ manager: c.cgroupManager, |
|
| 288 |
+ config: c.newInitConfig(p), |
|
| 289 |
+ container: c, |
|
| 290 |
+ process: p, |
|
| 291 |
+ bootstrapData: data, |
|
| 292 |
+ sharePidns: sharePidns, |
|
| 294 | 293 |
}, nil |
| 295 | 294 |
} |
| 296 | 295 |
|
| 297 | 296 |
func (c *linuxContainer) newSetnsProcess(p *Process, cmd *exec.Cmd, parentPipe, childPipe *os.File) (*setnsProcess, error) {
|
| 298 | 297 |
cmd.Env = append(cmd.Env, "_LIBCONTAINER_INITTYPE="+string(initSetns)) |
| 298 |
+ state, err := c.currentState() |
|
| 299 |
+ if err != nil {
|
|
| 300 |
+ return nil, newSystemError(err) |
|
| 301 |
+ } |
|
| 299 | 302 |
// for setns process, we dont have to set cloneflags as the process namespaces |
| 300 | 303 |
// will only be set via setns syscall |
| 301 |
- data, err := c.bootstrapData(0, c.initProcess.pid(), p.consolePath) |
|
| 304 |
+ data, err := c.bootstrapData(0, state.NamespacePaths, p.consolePath) |
|
| 302 | 305 |
if err != nil {
|
| 303 | 306 |
return nil, err |
| 304 | 307 |
} |
| ... | ... |
@@ -315,7 +319,7 @@ func (c *linuxContainer) newSetnsProcess(p *Process, cmd *exec.Cmd, parentPipe, |
| 315 | 315 |
} |
| 316 | 316 |
|
| 317 | 317 |
func (c *linuxContainer) newInitConfig(process *Process) *initConfig {
|
| 318 |
- return &initConfig{
|
|
| 318 |
+ cfg := &initConfig{
|
|
| 319 | 319 |
Config: c.config, |
| 320 | 320 |
Args: process.Args, |
| 321 | 321 |
Env: process.Env, |
| ... | ... |
@@ -324,7 +328,21 @@ func (c *linuxContainer) newInitConfig(process *Process) *initConfig {
|
| 324 | 324 |
Console: process.consolePath, |
| 325 | 325 |
Capabilities: process.Capabilities, |
| 326 | 326 |
PassedFilesCount: len(process.ExtraFiles), |
| 327 |
+ ContainerId: c.ID(), |
|
| 328 |
+ NoNewPrivileges: c.config.NoNewPrivileges, |
|
| 329 |
+ AppArmorProfile: c.config.AppArmorProfile, |
|
| 330 |
+ ProcessLabel: c.config.ProcessLabel, |
|
| 331 |
+ } |
|
| 332 |
+ if process.NoNewPrivileges != nil {
|
|
| 333 |
+ cfg.NoNewPrivileges = *process.NoNewPrivileges |
|
| 334 |
+ } |
|
| 335 |
+ if process.AppArmorProfile != "" {
|
|
| 336 |
+ cfg.AppArmorProfile = process.AppArmorProfile |
|
| 337 |
+ } |
|
| 338 |
+ if process.Label != "" {
|
|
| 339 |
+ cfg.ProcessLabel = process.Label |
|
| 327 | 340 |
} |
| 341 |
+ return cfg |
|
| 328 | 342 |
} |
| 329 | 343 |
|
| 330 | 344 |
func newPipe() (parent *os.File, child *os.File, err error) {
|
| ... | ... |
@@ -1059,6 +1077,9 @@ func (c *linuxContainer) currentState() (*State, error) {
|
| 1059 | 1059 |
state.NamespacePaths[ns.Type] = ns.GetPath(pid) |
| 1060 | 1060 |
} |
| 1061 | 1061 |
for _, nsType := range configs.NamespaceTypes() {
|
| 1062 |
+ if !configs.IsNamespaceSupported(nsType) {
|
|
| 1063 |
+ continue |
|
| 1064 |
+ } |
|
| 1062 | 1065 |
if _, ok := state.NamespacePaths[nsType]; !ok {
|
| 1063 | 1066 |
ns := configs.Namespace{Type: nsType}
|
| 1064 | 1067 |
state.NamespacePaths[ns.Type] = ns.GetPath(pid) |
| ... | ... |
@@ -1068,18 +1089,69 @@ func (c *linuxContainer) currentState() (*State, error) {
|
| 1068 | 1068 |
return state, nil |
| 1069 | 1069 |
} |
| 1070 | 1070 |
|
| 1071 |
-// bootstrapData encodes the necessary data in netlink binary format as a io.Reader. |
|
| 1072 |
-// Consumer can write the data to a bootstrap program such as one that uses |
|
| 1073 |
-// nsenter package to bootstrap the container's init process correctly, i.e. with |
|
| 1074 |
-// correct namespaces, uid/gid mapping etc. |
|
| 1075 |
-func (c *linuxContainer) bootstrapData(cloneFlags uintptr, pid int, consolePath string) (io.Reader, error) {
|
|
| 1071 |
+// orderNamespacePaths sorts namespace paths into a list of paths that we |
|
| 1072 |
+// can setns in order. |
|
| 1073 |
+func (c *linuxContainer) orderNamespacePaths(namespaces map[configs.NamespaceType]string) ([]string, error) {
|
|
| 1074 |
+ paths := []string{}
|
|
| 1075 |
+ nsTypes := []configs.NamespaceType{
|
|
| 1076 |
+ configs.NEWIPC, |
|
| 1077 |
+ configs.NEWUTS, |
|
| 1078 |
+ configs.NEWNET, |
|
| 1079 |
+ configs.NEWPID, |
|
| 1080 |
+ configs.NEWNS, |
|
| 1081 |
+ } |
|
| 1082 |
+ // join userns if the init process explicitly requires NEWUSER |
|
| 1083 |
+ if c.config.Namespaces.Contains(configs.NEWUSER) {
|
|
| 1084 |
+ nsTypes = append(nsTypes, configs.NEWUSER) |
|
| 1085 |
+ } |
|
| 1086 |
+ for _, nsType := range nsTypes {
|
|
| 1087 |
+ if p, ok := namespaces[nsType]; ok && p != "" {
|
|
| 1088 |
+ // check if the requested namespace is supported |
|
| 1089 |
+ if !configs.IsNamespaceSupported(nsType) {
|
|
| 1090 |
+ return nil, newSystemError(fmt.Errorf("namespace %s is not supported", nsType))
|
|
| 1091 |
+ } |
|
| 1092 |
+ // only set to join this namespace if it exists |
|
| 1093 |
+ if _, err := os.Lstat(p); err != nil {
|
|
| 1094 |
+ return nil, newSystemError(err) |
|
| 1095 |
+ } |
|
| 1096 |
+ // do not allow namespace path with comma as we use it to separate |
|
| 1097 |
+ // the namespace paths |
|
| 1098 |
+ if strings.ContainsRune(p, ',') {
|
|
| 1099 |
+ return nil, newSystemError(fmt.Errorf("invalid path %s", p))
|
|
| 1100 |
+ } |
|
| 1101 |
+ paths = append(paths, p) |
|
| 1102 |
+ } |
|
| 1103 |
+ } |
|
| 1104 |
+ return paths, nil |
|
| 1105 |
+} |
|
| 1106 |
+ |
|
| 1107 |
+func encodeIDMapping(idMap []configs.IDMap) ([]byte, error) {
|
|
| 1108 |
+ data := bytes.NewBuffer(nil) |
|
| 1109 |
+ for _, im := range idMap {
|
|
| 1110 |
+ line := fmt.Sprintf("%d %d %d\n", im.ContainerID, im.HostID, im.Size)
|
|
| 1111 |
+ if _, err := data.WriteString(line); err != nil {
|
|
| 1112 |
+ return nil, err |
|
| 1113 |
+ } |
|
| 1114 |
+ } |
|
| 1115 |
+ return data.Bytes(), nil |
|
| 1116 |
+} |
|
| 1117 |
+ |
|
| 1118 |
+// bootstrapData encodes the necessary data in netlink binary format |
|
| 1119 |
+// as a io.Reader. |
|
| 1120 |
+// Consumer can write the data to a bootstrap program |
|
| 1121 |
+// such as one that uses nsenter package to bootstrap the container's |
|
| 1122 |
+// init process correctly, i.e. with correct namespaces, uid/gid |
|
| 1123 |
+// mapping etc. |
|
| 1124 |
+func (c *linuxContainer) bootstrapData(cloneFlags uintptr, nsMaps map[configs.NamespaceType]string, consolePath string) (io.Reader, error) {
|
|
| 1076 | 1125 |
// create the netlink message |
| 1077 | 1126 |
r := nl.NewNetlinkRequest(int(InitMsg), 0) |
| 1078 |
- // write pid |
|
| 1127 |
+ |
|
| 1128 |
+ // write cloneFlags |
|
| 1079 | 1129 |
r.AddData(&Int32msg{
|
| 1080 |
- Type: PidAttr, |
|
| 1081 |
- Value: uint32(pid), |
|
| 1130 |
+ Type: CloneFlagsAttr, |
|
| 1131 |
+ Value: uint32(cloneFlags), |
|
| 1082 | 1132 |
}) |
| 1133 |
+ |
|
| 1083 | 1134 |
// write console path |
| 1084 | 1135 |
if consolePath != "" {
|
| 1085 | 1136 |
r.AddData(&Bytemsg{
|
| ... | ... |
@@ -1087,5 +1159,57 @@ func (c *linuxContainer) bootstrapData(cloneFlags uintptr, pid int, consolePath |
| 1087 | 1087 |
Value: []byte(consolePath), |
| 1088 | 1088 |
}) |
| 1089 | 1089 |
} |
| 1090 |
+ |
|
| 1091 |
+ // write custom namespace paths |
|
| 1092 |
+ if len(nsMaps) > 0 {
|
|
| 1093 |
+ nsPaths, err := c.orderNamespacePaths(nsMaps) |
|
| 1094 |
+ if err != nil {
|
|
| 1095 |
+ return nil, err |
|
| 1096 |
+ } |
|
| 1097 |
+ r.AddData(&Bytemsg{
|
|
| 1098 |
+ Type: NsPathsAttr, |
|
| 1099 |
+ Value: []byte(strings.Join(nsPaths, ",")), |
|
| 1100 |
+ }) |
|
| 1101 |
+ } |
|
| 1102 |
+ |
|
| 1103 |
+ // write namespace paths only when we are not joining an existing user ns |
|
| 1104 |
+ _, joinExistingUser := nsMaps[configs.NEWUSER] |
|
| 1105 |
+ if !joinExistingUser {
|
|
| 1106 |
+ // write uid mappings |
|
| 1107 |
+ if len(c.config.UidMappings) > 0 {
|
|
| 1108 |
+ b, err := encodeIDMapping(c.config.UidMappings) |
|
| 1109 |
+ if err != nil {
|
|
| 1110 |
+ return nil, err |
|
| 1111 |
+ } |
|
| 1112 |
+ r.AddData(&Bytemsg{
|
|
| 1113 |
+ Type: UidmapAttr, |
|
| 1114 |
+ Value: b, |
|
| 1115 |
+ }) |
|
| 1116 |
+ } |
|
| 1117 |
+ |
|
| 1118 |
+ // write gid mappings |
|
| 1119 |
+ if len(c.config.GidMappings) > 0 {
|
|
| 1120 |
+ b, err := encodeIDMapping(c.config.UidMappings) |
|
| 1121 |
+ if err != nil {
|
|
| 1122 |
+ return nil, err |
|
| 1123 |
+ } |
|
| 1124 |
+ r.AddData(&Bytemsg{
|
|
| 1125 |
+ Type: GidmapAttr, |
|
| 1126 |
+ Value: b, |
|
| 1127 |
+ }) |
|
| 1128 |
+ // check if we have CAP_SETGID to setgroup properly |
|
| 1129 |
+ pid, err := capability.NewPid(os.Getpid()) |
|
| 1130 |
+ if err != nil {
|
|
| 1131 |
+ return nil, err |
|
| 1132 |
+ } |
|
| 1133 |
+ if !pid.Get(capability.EFFECTIVE, capability.CAP_SETGID) {
|
|
| 1134 |
+ r.AddData(&Boolmsg{
|
|
| 1135 |
+ Type: SetgroupAttr, |
|
| 1136 |
+ Value: true, |
|
| 1137 |
+ }) |
|
| 1138 |
+ } |
|
| 1139 |
+ } |
|
| 1140 |
+ } |
|
| 1141 |
+ |
|
| 1090 | 1142 |
return bytes.NewReader(r.Serialize()), nil |
| 1091 | 1143 |
} |
| 1092 | 1144 |
deleted file mode 100644 |
| ... | ... |
@@ -1,13 +0,0 @@ |
| 1 |
-// +build !go1.4 |
|
| 2 |
- |
|
| 3 |
-package libcontainer |
|
| 4 |
- |
|
| 5 |
-import ( |
|
| 6 |
- "fmt" |
|
| 7 |
- "syscall" |
|
| 8 |
-) |
|
| 9 |
- |
|
| 10 |
-// not available before go 1.4 |
|
| 11 |
-func (c *linuxContainer) addUidGidMappings(sys *syscall.SysProcAttr) error {
|
|
| 12 |
- return fmt.Errorf("User namespace is not supported in golang < 1.4")
|
|
| 13 |
-} |
| 14 | 1 |
deleted file mode 100644 |
| ... | ... |
@@ -1,26 +0,0 @@ |
| 1 |
-// +build go1.4 |
|
| 2 |
- |
|
| 3 |
-package libcontainer |
|
| 4 |
- |
|
| 5 |
-import "syscall" |
|
| 6 |
- |
|
| 7 |
-// Converts IDMap to SysProcIDMap array and adds it to SysProcAttr. |
|
| 8 |
-func (c *linuxContainer) addUidGidMappings(sys *syscall.SysProcAttr) error {
|
|
| 9 |
- if c.config.UidMappings != nil {
|
|
| 10 |
- sys.UidMappings = make([]syscall.SysProcIDMap, len(c.config.UidMappings)) |
|
| 11 |
- for i, um := range c.config.UidMappings {
|
|
| 12 |
- sys.UidMappings[i].ContainerID = um.ContainerID |
|
| 13 |
- sys.UidMappings[i].HostID = um.HostID |
|
| 14 |
- sys.UidMappings[i].Size = um.Size |
|
| 15 |
- } |
|
| 16 |
- } |
|
| 17 |
- if c.config.GidMappings != nil {
|
|
| 18 |
- sys.GidMappings = make([]syscall.SysProcIDMap, len(c.config.GidMappings)) |
|
| 19 |
- for i, gm := range c.config.GidMappings {
|
|
| 20 |
- sys.GidMappings[i].ContainerID = gm.ContainerID |
|
| 21 |
- sys.GidMappings[i].HostID = gm.HostID |
|
| 22 |
- sys.GidMappings[i].Size = gm.Size |
|
| 23 |
- } |
|
| 24 |
- } |
|
| 25 |
- return nil |
|
| 26 |
-} |
| ... | ... |
@@ -227,32 +227,40 @@ func (l *LinuxFactory) StartInitialization() (err error) {
|
| 227 | 227 |
pipe = os.NewFile(uintptr(pipefd), "pipe") |
| 228 | 228 |
it = initType(os.Getenv("_LIBCONTAINER_INITTYPE"))
|
| 229 | 229 |
) |
| 230 |
+ defer pipe.Close() |
|
| 230 | 231 |
// clear the current process's environment to clean any libcontainer |
| 231 | 232 |
// specific env vars. |
| 232 | 233 |
os.Clearenv() |
| 233 |
- var i initer |
|
| 234 |
- defer func() {
|
|
| 235 |
- // We have an error during the initialization of the container's init, |
|
| 236 |
- // send it back to the parent process in the form of an initError. |
|
| 237 |
- // If container's init successed, syscall.Exec will not return, hence |
|
| 238 |
- // this defer function will never be called. |
|
| 234 |
+ i, err := newContainerInit(it, pipe) |
|
| 235 |
+ if err != nil {
|
|
| 236 |
+ l.sendError(nil, pipe, err) |
|
| 237 |
+ return err |
|
| 238 |
+ } |
|
| 239 |
+ if err := i.Init(); err != nil {
|
|
| 240 |
+ if !isExecError(err) {
|
|
| 241 |
+ l.sendError(i, pipe, err) |
|
| 242 |
+ } |
|
| 243 |
+ return err |
|
| 244 |
+ } |
|
| 245 |
+ return nil |
|
| 246 |
+} |
|
| 247 |
+ |
|
| 248 |
+func (l *LinuxFactory) sendError(i initer, pipe *os.File, err error) {
|
|
| 249 |
+ // We have an error during the initialization of the container's init, |
|
| 250 |
+ // send it back to the parent process in the form of an initError. |
|
| 251 |
+ // If container's init successed, syscall.Exec will not return, hence |
|
| 252 |
+ // this defer function will never be called. |
|
| 253 |
+ if i != nil {
|
|
| 239 | 254 |
if _, ok := i.(*linuxStandardInit); ok {
|
| 240 | 255 |
// Synchronisation only necessary for standard init. |
| 241 | 256 |
if err := utils.WriteJSON(pipe, syncT{procError}); err != nil {
|
| 242 | 257 |
panic(err) |
| 243 | 258 |
} |
| 244 | 259 |
} |
| 245 |
- if err := utils.WriteJSON(pipe, newSystemError(err)); err != nil {
|
|
| 246 |
- panic(err) |
|
| 247 |
- } |
|
| 248 |
- // ensure that this pipe is always closed |
|
| 249 |
- pipe.Close() |
|
| 250 |
- }() |
|
| 251 |
- i, err = newContainerInit(it, pipe) |
|
| 252 |
- if err != nil {
|
|
| 253 |
- return err |
|
| 254 | 260 |
} |
| 255 |
- return i.Init() |
|
| 261 |
+ if err := utils.WriteJSON(pipe, newSystemError(err)); err != nil {
|
|
| 262 |
+ panic(err) |
|
| 263 |
+ } |
|
| 256 | 264 |
} |
| 257 | 265 |
|
| 258 | 266 |
func (l *LinuxFactory) loadState(root string) (*State, error) {
|
| ... | ... |
@@ -280,3 +288,8 @@ func (l *LinuxFactory) validateID(id string) error {
|
| 280 | 280 |
} |
| 281 | 281 |
return nil |
| 282 | 282 |
} |
| 283 |
+ |
|
| 284 |
+func isExecError(err error) bool {
|
|
| 285 |
+ _, ok := err.(*exec.Error) |
|
| 286 |
+ return ok |
|
| 287 |
+} |
| ... | ... |
@@ -48,11 +48,15 @@ type initConfig struct {
|
| 48 | 48 |
Env []string `json:"env"` |
| 49 | 49 |
Cwd string `json:"cwd"` |
| 50 | 50 |
Capabilities []string `json:"capabilities"` |
| 51 |
+ ProcessLabel string `json:"process_label"` |
|
| 52 |
+ AppArmorProfile string `json:"apparmor_profile"` |
|
| 53 |
+ NoNewPrivileges bool `json:"no_new_privileges"` |
|
| 51 | 54 |
User string `json:"user"` |
| 52 | 55 |
Config *configs.Config `json:"config"` |
| 53 | 56 |
Console string `json:"console"` |
| 54 | 57 |
Networks []*network `json:"network"` |
| 55 | 58 |
PassedFilesCount int `json:"passed_files_count"` |
| 59 |
+ ContainerId string `json:"containerid"` |
|
| 56 | 60 |
} |
| 57 | 61 |
|
| 58 | 62 |
type initer interface {
|
| ... | ... |
@@ -163,20 +167,22 @@ func syncParentReady(pipe io.ReadWriter) error {
|
| 163 | 163 |
return nil |
| 164 | 164 |
} |
| 165 | 165 |
|
| 166 |
-// joinExistingNamespaces gets all the namespace paths specified for the container and |
|
| 167 |
-// does a setns on the namespace fd so that the current process joins the namespace. |
|
| 168 |
-func joinExistingNamespaces(namespaces []configs.Namespace) error {
|
|
| 169 |
- for _, ns := range namespaces {
|
|
| 170 |
- if ns.Path != "" {
|
|
| 171 |
- f, err := os.OpenFile(ns.Path, os.O_RDONLY, 0) |
|
| 172 |
- if err != nil {
|
|
| 173 |
- return err |
|
| 174 |
- } |
|
| 175 |
- err = system.Setns(f.Fd(), uintptr(ns.Syscall())) |
|
| 176 |
- f.Close() |
|
| 177 |
- if err != nil {
|
|
| 178 |
- return err |
|
| 179 |
- } |
|
| 166 |
+// syncParentHooks sends to the given pipe a JSON payload which indicates that |
|
| 167 |
+// the parent should execute pre-start hooks. It then waits for the parent to |
|
| 168 |
+// indicate that it is cleared to resume. |
|
| 169 |
+func syncParentHooks(pipe io.ReadWriter) error {
|
|
| 170 |
+ // Tell parent. |
|
| 171 |
+ if err := utils.WriteJSON(pipe, syncT{procHooks}); err != nil {
|
|
| 172 |
+ return err |
|
| 173 |
+ } |
|
| 174 |
+ // Wait for parent to give the all-clear. |
|
| 175 |
+ var procSync syncT |
|
| 176 |
+ if err := json.NewDecoder(pipe).Decode(&procSync); err != nil {
|
|
| 177 |
+ if err == io.EOF {
|
|
| 178 |
+ return fmt.Errorf("parent closed synchronisation channel")
|
|
| 179 |
+ } |
|
| 180 |
+ if procSync.Type != procResume {
|
|
| 181 |
+ return fmt.Errorf("invalid synchronisation flag from parent")
|
|
| 180 | 182 |
} |
| 181 | 183 |
} |
| 182 | 184 |
return nil |
| ... | ... |
@@ -319,9 +325,10 @@ func setupRlimits(config *configs.Config) error {
|
| 319 | 319 |
return nil |
| 320 | 320 |
} |
| 321 | 321 |
|
| 322 |
-func setOomScoreAdj(oomScoreAdj int) error {
|
|
| 323 |
- path := "/proc/self/oom_score_adj" |
|
| 324 |
- return ioutil.WriteFile(path, []byte(strconv.Itoa(oomScoreAdj)), 0700) |
|
| 322 |
+func setOomScoreAdj(oomScoreAdj int, pid int) error {
|
|
| 323 |
+ path := fmt.Sprintf("/proc/%d/oom_score_adj", pid)
|
|
| 324 |
+ |
|
| 325 |
+ return ioutil.WriteFile(path, []byte(strconv.Itoa(oomScoreAdj)), 0600) |
|
| 325 | 326 |
} |
| 326 | 327 |
|
| 327 | 328 |
// killCgroupProcesses freezes then iterates over all the processes inside the |
| ... | ... |
@@ -12,8 +12,12 @@ import ( |
| 12 | 12 |
// The number is randomly chosen to not conflict with known netlink types |
| 13 | 13 |
const ( |
| 14 | 14 |
InitMsg uint16 = 62000 |
| 15 |
- PidAttr uint16 = 27281 |
|
| 15 |
+ CloneFlagsAttr uint16 = 27281 |
|
| 16 | 16 |
ConsolePathAttr uint16 = 27282 |
| 17 |
+ NsPathsAttr uint16 = 27283 |
|
| 18 |
+ UidmapAttr uint16 = 27284 |
|
| 19 |
+ GidmapAttr uint16 = 27285 |
|
| 20 |
+ SetgroupAttr uint16 = 27286 |
|
| 17 | 21 |
// When syscall.NLA_HDRLEN is in gccgo, take this out. |
| 18 | 22 |
syscall_NLA_HDRLEN = (syscall.SizeofNlAttr + syscall.NLA_ALIGNTO - 1) & ^(syscall.NLA_ALIGNTO - 1) |
| 19 | 23 |
) |
| ... | ... |
@@ -60,3 +64,25 @@ func (msg *Bytemsg) Serialize() []byte {
|
| 60 | 60 |
func (msg *Bytemsg) Len() int {
|
| 61 | 61 |
return syscall_NLA_HDRLEN + len(msg.Value) + 1 // null-terminated |
| 62 | 62 |
} |
| 63 |
+ |
|
| 64 |
+type Boolmsg struct {
|
|
| 65 |
+ Type uint16 |
|
| 66 |
+ Value bool |
|
| 67 |
+} |
|
| 68 |
+ |
|
| 69 |
+func (msg *Boolmsg) Serialize() []byte {
|
|
| 70 |
+ buf := make([]byte, msg.Len()) |
|
| 71 |
+ native := nl.NativeEndian() |
|
| 72 |
+ native.PutUint16(buf[0:2], uint16(msg.Len())) |
|
| 73 |
+ native.PutUint16(buf[2:4], msg.Type) |
|
| 74 |
+ if msg.Value {
|
|
| 75 |
+ buf[4] = 1 |
|
| 76 |
+ } else {
|
|
| 77 |
+ buf[4] = 0 |
|
| 78 |
+ } |
|
| 79 |
+ return buf |
|
| 80 |
+} |
|
| 81 |
+ |
|
| 82 |
+func (msg *Boolmsg) Len() int {
|
|
| 83 |
+ return syscall_NLA_HDRLEN + 1 |
|
| 84 |
+} |
| 63 | 85 |
deleted file mode 100644 |
| ... | ... |
@@ -1,25 +0,0 @@ |
| 1 |
-## nsenter |
|
| 2 |
- |
|
| 3 |
-The `nsenter` package registers a special init constructor that is called before |
|
| 4 |
-the Go runtime has a chance to boot. This provides us the ability to `setns` on |
|
| 5 |
-existing namespaces and avoid the issues that the Go runtime has with multiple |
|
| 6 |
-threads. This constructor will be called if this package is registered, |
|
| 7 |
-imported, in your go application. |
|
| 8 |
- |
|
| 9 |
-The `nsenter` package will `import "C"` and it uses [cgo](https://golang.org/cmd/cgo/) |
|
| 10 |
-package. In cgo, if the import of "C" is immediately preceded by a comment, that comment, |
|
| 11 |
-called the preamble, is used as a header when compiling the C parts of the package. |
|
| 12 |
-So every time we import package `nsenter`, the C code function `nsexec()` would be |
|
| 13 |
-called. And package `nsenter` is now only imported in Docker execdriver, so every time |
|
| 14 |
-before we call `execdriver.Exec()`, that C code would run. |
|
| 15 |
- |
|
| 16 |
-`nsexec()` will first check the environment variable `_LIBCONTAINER_INITPID` |
|
| 17 |
-which will give the process of the container that should be joined. Namespaces fd will |
|
| 18 |
-be found from `/proc/[pid]/ns` and set by `setns` syscall. |
|
| 19 |
- |
|
| 20 |
-And then get the pipe number from `_LIBCONTAINER_INITPIPE`, error message could |
|
| 21 |
-be transfered through it. If tty is added, `_LIBCONTAINER_CONSOLE_PATH` will |
|
| 22 |
-have value and start a console for output. |
|
| 23 |
- |
|
| 24 |
-Finally, `nsexec()` will clone a child process , exit the parent process and let |
|
| 25 |
-the Go runtime take over. |
| 13 | 1 |
deleted file mode 100644 |
| ... | ... |
@@ -1,25 +0,0 @@ |
| 1 |
-// +build linux,gccgo |
|
| 2 |
- |
|
| 3 |
-package nsenter |
|
| 4 |
- |
|
| 5 |
-/* |
|
| 6 |
-#cgo CFLAGS: -Wall |
|
| 7 |
-extern void nsexec(); |
|
| 8 |
-void __attribute__((constructor)) init(void) {
|
|
| 9 |
- nsexec(); |
|
| 10 |
-} |
|
| 11 |
-*/ |
|
| 12 |
-import "C" |
|
| 13 |
- |
|
| 14 |
-// AlwaysFalse is here to stay false |
|
| 15 |
-// (and be exported so the compiler doesn't optimize out its reference) |
|
| 16 |
-var AlwaysFalse bool |
|
| 17 |
- |
|
| 18 |
-func init() {
|
|
| 19 |
- if AlwaysFalse {
|
|
| 20 |
- // by referencing this C init() in a noop test, it will ensure the compiler |
|
| 21 |
- // links in the C function. |
|
| 22 |
- // https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65134 |
|
| 23 |
- C.init() |
|
| 24 |
- } |
|
| 25 |
-} |
| 6 | 1 |
deleted file mode 100644 |
| ... | ... |
@@ -1,261 +0,0 @@ |
| 1 |
-#define _GNU_SOURCE |
|
| 2 |
-#include <stdlib.h> |
|
| 3 |
-#include <unistd.h> |
|
| 4 |
-#include <stdio.h> |
|
| 5 |
-#include <errno.h> |
|
| 6 |
-#include <string.h> |
|
| 7 |
- |
|
| 8 |
-#include <linux/limits.h> |
|
| 9 |
-#include <sys/types.h> |
|
| 10 |
-#include <sys/wait.h> |
|
| 11 |
-#include <sys/types.h> |
|
| 12 |
-#include <sys/stat.h> |
|
| 13 |
-#include <sys/ioctl.h> |
|
| 14 |
-#include <fcntl.h> |
|
| 15 |
-#include <signal.h> |
|
| 16 |
-#include <setjmp.h> |
|
| 17 |
-#include <sched.h> |
|
| 18 |
-#include <signal.h> |
|
| 19 |
- |
|
| 20 |
-#include <bits/sockaddr.h> |
|
| 21 |
-#include <linux/netlink.h> |
|
| 22 |
-#include <linux/types.h> |
|
| 23 |
-#include <stdint.h> |
|
| 24 |
-#include <sys/socket.h> |
|
| 25 |
- |
|
| 26 |
-/* All arguments should be above stack, because it grows down */ |
|
| 27 |
-struct clone_arg {
|
|
| 28 |
- /* |
|
| 29 |
- * Reserve some space for clone() to locate arguments |
|
| 30 |
- * and retcode in this place |
|
| 31 |
- */ |
|
| 32 |
- char stack[4096] __attribute__ ((aligned(16))); |
|
| 33 |
- char stack_ptr[0]; |
|
| 34 |
- jmp_buf *env; |
|
| 35 |
-}; |
|
| 36 |
- |
|
| 37 |
-#define pr_perror(fmt, ...) fprintf(stderr, "nsenter: " fmt ": %m\n", ##__VA_ARGS__) |
|
| 38 |
- |
|
| 39 |
-static int child_func(void *_arg) |
|
| 40 |
-{
|
|
| 41 |
- struct clone_arg *arg = (struct clone_arg *)_arg; |
|
| 42 |
- longjmp(*arg->env, 1); |
|
| 43 |
-} |
|
| 44 |
- |
|
| 45 |
-// Use raw setns syscall for versions of glibc that don't include it (namely glibc-2.12) |
|
| 46 |
-#if __GLIBC__ == 2 && __GLIBC_MINOR__ < 14 |
|
| 47 |
-#define _GNU_SOURCE |
|
| 48 |
-#include "syscall.h" |
|
| 49 |
-#if defined(__NR_setns) && !defined(SYS_setns) |
|
| 50 |
-#define SYS_setns __NR_setns |
|
| 51 |
-#endif |
|
| 52 |
-#ifdef SYS_setns |
|
| 53 |
-int setns(int fd, int nstype) |
|
| 54 |
-{
|
|
| 55 |
- return syscall(SYS_setns, fd, nstype); |
|
| 56 |
-} |
|
| 57 |
-#endif |
|
| 58 |
-#endif |
|
| 59 |
- |
|
| 60 |
-static int clone_parent(jmp_buf * env) __attribute__ ((noinline)); |
|
| 61 |
-static int clone_parent(jmp_buf * env) |
|
| 62 |
-{
|
|
| 63 |
- struct clone_arg ca; |
|
| 64 |
- int child; |
|
| 65 |
- |
|
| 66 |
- ca.env = env; |
|
| 67 |
- child = clone(child_func, ca.stack_ptr, CLONE_PARENT | SIGCHLD, &ca); |
|
| 68 |
- |
|
| 69 |
- return child; |
|
| 70 |
-} |
|
| 71 |
- |
|
| 72 |
-static uint32_t readint32(char *buf) |
|
| 73 |
-{
|
|
| 74 |
- return *(uint32_t *) buf; |
|
| 75 |
-} |
|
| 76 |
- |
|
| 77 |
-// list of known message types we want to send to bootstrap program |
|
| 78 |
-// These are defined in libcontainer/message_linux.go |
|
| 79 |
-#define INIT_MSG 62000 |
|
| 80 |
-#define PID_ATTR 27281 |
|
| 81 |
-#define CONSOLE_PATH_ATTR 27282 |
|
| 82 |
- |
|
| 83 |
-void nsexec() |
|
| 84 |
-{
|
|
| 85 |
- char *namespaces[] = { "ipc", "uts", "net", "pid", "mnt", "user" };
|
|
| 86 |
- const int num = sizeof(namespaces) / sizeof(char *); |
|
| 87 |
- jmp_buf env; |
|
| 88 |
- char buf[PATH_MAX], *val; |
|
| 89 |
- int i, tfd, self_tfd, child, n, len, pipenum, consolefd = -1; |
|
| 90 |
- pid_t pid = 0; |
|
| 91 |
- |
|
| 92 |
- // if we dont have INITTYPE or this is the init process, skip the bootstrap process |
|
| 93 |
- val = getenv("_LIBCONTAINER_INITTYPE");
|
|
| 94 |
- if (val == NULL || strcmp(val, "standard") == 0) {
|
|
| 95 |
- return; |
|
| 96 |
- } |
|
| 97 |
- if (strcmp(val, "setns") != 0) {
|
|
| 98 |
- pr_perror("Invalid inittype %s", val);
|
|
| 99 |
- exit(1); |
|
| 100 |
- } |
|
| 101 |
- |
|
| 102 |
- val = getenv("_LIBCONTAINER_INITPIPE");
|
|
| 103 |
- if (val == NULL) {
|
|
| 104 |
- pr_perror("Child pipe not found");
|
|
| 105 |
- exit(1); |
|
| 106 |
- } |
|
| 107 |
- pipenum = atoi(val); |
|
| 108 |
- snprintf(buf, sizeof(buf), "%d", pipenum); |
|
| 109 |
- if (strcmp(val, buf)) {
|
|
| 110 |
- pr_perror("Unable to parse _LIBCONTAINER_INITPIPE");
|
|
| 111 |
- exit(1); |
|
| 112 |
- } |
|
| 113 |
- |
|
| 114 |
- char nlbuf[NLMSG_HDRLEN]; |
|
| 115 |
- struct nlmsghdr *nh; |
|
| 116 |
- if ((n = read(pipenum, nlbuf, NLMSG_HDRLEN)) != NLMSG_HDRLEN) {
|
|
| 117 |
- pr_perror("Failed to read netlink header, got %d", n);
|
|
| 118 |
- exit(1); |
|
| 119 |
- } |
|
| 120 |
- |
|
| 121 |
- nh = (struct nlmsghdr *)nlbuf; |
|
| 122 |
- if (nh->nlmsg_type == NLMSG_ERROR) {
|
|
| 123 |
- pr_perror("Invalid netlink header message");
|
|
| 124 |
- exit(1); |
|
| 125 |
- } |
|
| 126 |
- if (nh->nlmsg_type != INIT_MSG) {
|
|
| 127 |
- pr_perror("Unexpected netlink message type %d", nh->nlmsg_type);
|
|
| 128 |
- exit(1); |
|
| 129 |
- } |
|
| 130 |
- // read the netlink payload |
|
| 131 |
- len = NLMSG_PAYLOAD(nh, 0); |
|
| 132 |
- char data[len]; |
|
| 133 |
- if ((n = read(pipenum, data, len)) != len) {
|
|
| 134 |
- pr_perror("Failed to read netlink payload, got %d", n);
|
|
| 135 |
- exit(1); |
|
| 136 |
- } |
|
| 137 |
- |
|
| 138 |
- int start = 0; |
|
| 139 |
- struct nlattr *attr; |
|
| 140 |
- while (start < len) {
|
|
| 141 |
- int payload_len; |
|
| 142 |
- attr = (struct nlattr *)((void *)data + start); |
|
| 143 |
- start += NLA_HDRLEN; |
|
| 144 |
- payload_len = attr->nla_len - NLA_HDRLEN; |
|
| 145 |
- switch (attr->nla_type) {
|
|
| 146 |
- case PID_ATTR: |
|
| 147 |
- pid = (pid_t) readint32(data + start); |
|
| 148 |
- break; |
|
| 149 |
- case CONSOLE_PATH_ATTR: |
|
| 150 |
- consolefd = open((char *)data + start, O_RDWR); |
|
| 151 |
- if (consolefd < 0) {
|
|
| 152 |
- pr_perror("Failed to open console %s", (char *)data + start);
|
|
| 153 |
- exit(1); |
|
| 154 |
- } |
|
| 155 |
- break; |
|
| 156 |
- } |
|
| 157 |
- start += NLA_ALIGN(payload_len); |
|
| 158 |
- } |
|
| 159 |
- |
|
| 160 |
- // required pid to be passed |
|
| 161 |
- if (pid == 0) {
|
|
| 162 |
- pr_perror("missing pid");
|
|
| 163 |
- exit(1); |
|
| 164 |
- } |
|
| 165 |
- |
|
| 166 |
- /* Check that the specified process exists */ |
|
| 167 |
- snprintf(buf, PATH_MAX - 1, "/proc/%d/ns", pid); |
|
| 168 |
- tfd = open(buf, O_DIRECTORY | O_RDONLY); |
|
| 169 |
- if (tfd == -1) {
|
|
| 170 |
- pr_perror("Failed to open \"%s\"", buf);
|
|
| 171 |
- exit(1); |
|
| 172 |
- } |
|
| 173 |
- |
|
| 174 |
- self_tfd = open("/proc/self/ns", O_DIRECTORY | O_RDONLY);
|
|
| 175 |
- if (self_tfd == -1) {
|
|
| 176 |
- pr_perror("Failed to open /proc/self/ns");
|
|
| 177 |
- exit(1); |
|
| 178 |
- } |
|
| 179 |
- |
|
| 180 |
- for (i = 0; i < num; i++) {
|
|
| 181 |
- struct stat st; |
|
| 182 |
- struct stat self_st; |
|
| 183 |
- int fd; |
|
| 184 |
- |
|
| 185 |
- /* Symlinks on all namespaces exist for dead processes, but they can't be opened */ |
|
| 186 |
- if (fstatat(tfd, namespaces[i], &st, 0) == -1) {
|
|
| 187 |
- // Ignore nonexistent namespaces. |
|
| 188 |
- if (errno == ENOENT) |
|
| 189 |
- continue; |
|
| 190 |
- } |
|
| 191 |
- |
|
| 192 |
- /* Skip namespaces we're already part of */ |
|
| 193 |
- if (fstatat(self_tfd, namespaces[i], &self_st, 0) != -1 && st.st_ino == self_st.st_ino) {
|
|
| 194 |
- continue; |
|
| 195 |
- } |
|
| 196 |
- |
|
| 197 |
- fd = openat(tfd, namespaces[i], O_RDONLY); |
|
| 198 |
- if (fd == -1) {
|
|
| 199 |
- pr_perror("Failed to open ns file %s for ns %s", buf, namespaces[i]);
|
|
| 200 |
- exit(1); |
|
| 201 |
- } |
|
| 202 |
- // Set the namespace. |
|
| 203 |
- if (setns(fd, 0) == -1) {
|
|
| 204 |
- pr_perror("Failed to setns for %s", namespaces[i]);
|
|
| 205 |
- exit(1); |
|
| 206 |
- } |
|
| 207 |
- close(fd); |
|
| 208 |
- } |
|
| 209 |
- |
|
| 210 |
- close(self_tfd); |
|
| 211 |
- close(tfd); |
|
| 212 |
- |
|
| 213 |
- if (setjmp(env) == 1) {
|
|
| 214 |
- // Child |
|
| 215 |
- |
|
| 216 |
- if (setsid() == -1) {
|
|
| 217 |
- pr_perror("setsid failed");
|
|
| 218 |
- exit(1); |
|
| 219 |
- } |
|
| 220 |
- if (consolefd != -1) {
|
|
| 221 |
- if (ioctl(consolefd, TIOCSCTTY, 0) == -1) {
|
|
| 222 |
- pr_perror("ioctl TIOCSCTTY failed");
|
|
| 223 |
- exit(1); |
|
| 224 |
- } |
|
| 225 |
- if (dup3(consolefd, STDIN_FILENO, 0) != STDIN_FILENO) {
|
|
| 226 |
- pr_perror("Failed to dup 0");
|
|
| 227 |
- exit(1); |
|
| 228 |
- } |
|
| 229 |
- if (dup3(consolefd, STDOUT_FILENO, 0) != STDOUT_FILENO) {
|
|
| 230 |
- pr_perror("Failed to dup 1");
|
|
| 231 |
- exit(1); |
|
| 232 |
- } |
|
| 233 |
- if (dup3(consolefd, STDERR_FILENO, 0) != STDERR_FILENO) {
|
|
| 234 |
- pr_perror("Failed to dup 2");
|
|
| 235 |
- exit(1); |
|
| 236 |
- } |
|
| 237 |
- } |
|
| 238 |
- // Finish executing, let the Go runtime take over. |
|
| 239 |
- return; |
|
| 240 |
- } |
|
| 241 |
- // Parent |
|
| 242 |
- |
|
| 243 |
- // We must fork to actually enter the PID namespace, use CLONE_PARENT |
|
| 244 |
- // so the child can have the right parent, and we don't need to forward |
|
| 245 |
- // the child's exit code or resend its death signal. |
|
| 246 |
- child = clone_parent(&env); |
|
| 247 |
- if (child < 0) {
|
|
| 248 |
- pr_perror("Unable to fork");
|
|
| 249 |
- exit(1); |
|
| 250 |
- } |
|
| 251 |
- |
|
| 252 |
- len = snprintf(buf, sizeof(buf), "{ \"pid\" : %d }\n", child);
|
|
| 253 |
- |
|
| 254 |
- if (write(pipenum, buf, len) != len) {
|
|
| 255 |
- pr_perror("Unable to send a child pid");
|
|
| 256 |
- kill(child, SIGKILL); |
|
| 257 |
- exit(1); |
|
| 258 |
- } |
|
| 259 |
- |
|
| 260 |
- exit(0); |
|
| 261 |
-} |
| ... | ... |
@@ -48,6 +48,16 @@ type Process struct {
|
| 48 | 48 |
// All capabilities not specified will be dropped from the processes capability mask |
| 49 | 49 |
Capabilities []string |
| 50 | 50 |
|
| 51 |
+ // AppArmorProfile specifies the profile to apply to the process and is |
|
| 52 |
+ // changed at the time the process is execed |
|
| 53 |
+ AppArmorProfile string |
|
| 54 |
+ |
|
| 55 |
+ // Label specifies the label to apply to the process. It is commonly used by selinux |
|
| 56 |
+ Label string |
|
| 57 |
+ |
|
| 58 |
+ // NoNewPrivileges controls whether processes can gain additional privileges. |
|
| 59 |
+ NoNewPrivileges *bool |
|
| 60 |
+ |
|
| 51 | 61 |
ops processOperations |
| 52 | 62 |
} |
| 53 | 63 |
|
| ... | ... |
@@ -88,6 +88,10 @@ func (p *setnsProcess) start() (err error) {
|
| 88 | 88 |
if err := utils.WriteJSON(p.parentPipe, p.config); err != nil {
|
| 89 | 89 |
return newSystemError(err) |
| 90 | 90 |
} |
| 91 |
+ // set oom_score_adj |
|
| 92 |
+ if err := setOomScoreAdj(p.config.Config.OomScoreAdj, p.pid()); err != nil {
|
|
| 93 |
+ return newSystemError(err) |
|
| 94 |
+ } |
|
| 91 | 95 |
|
| 92 | 96 |
if err := syscall.Shutdown(int(p.parentPipe.Fd()), syscall.SHUT_WR); err != nil {
|
| 93 | 97 |
return newSystemError(err) |
| ... | ... |
@@ -167,14 +171,16 @@ func (p *setnsProcess) setExternalDescriptors(newFds []string) {
|
| 167 | 167 |
} |
| 168 | 168 |
|
| 169 | 169 |
type initProcess struct {
|
| 170 |
- cmd *exec.Cmd |
|
| 171 |
- parentPipe *os.File |
|
| 172 |
- childPipe *os.File |
|
| 173 |
- config *initConfig |
|
| 174 |
- manager cgroups.Manager |
|
| 175 |
- container *linuxContainer |
|
| 176 |
- fds []string |
|
| 177 |
- process *Process |
|
| 170 |
+ cmd *exec.Cmd |
|
| 171 |
+ parentPipe *os.File |
|
| 172 |
+ childPipe *os.File |
|
| 173 |
+ config *initConfig |
|
| 174 |
+ manager cgroups.Manager |
|
| 175 |
+ container *linuxContainer |
|
| 176 |
+ fds []string |
|
| 177 |
+ process *Process |
|
| 178 |
+ bootstrapData io.Reader |
|
| 179 |
+ sharePidns bool |
|
| 178 | 180 |
} |
| 179 | 181 |
|
| 180 | 182 |
func (p *initProcess) pid() int {
|
| ... | ... |
@@ -185,15 +191,49 @@ func (p *initProcess) externalDescriptors() []string {
|
| 185 | 185 |
return p.fds |
| 186 | 186 |
} |
| 187 | 187 |
|
| 188 |
-func (p *initProcess) start() (err error) {
|
|
| 188 |
+// execSetns runs the process that executes C code to perform the setns calls |
|
| 189 |
+// because setns support requires the C process to fork off a child and perform the setns |
|
| 190 |
+// before the go runtime boots, we wait on the process to die and receive the child's pid |
|
| 191 |
+// over the provided pipe. |
|
| 192 |
+// This is called by initProcess.start function |
|
| 193 |
+func (p *initProcess) execSetns() error {
|
|
| 194 |
+ status, err := p.cmd.Process.Wait() |
|
| 195 |
+ if err != nil {
|
|
| 196 |
+ p.cmd.Wait() |
|
| 197 |
+ return err |
|
| 198 |
+ } |
|
| 199 |
+ if !status.Success() {
|
|
| 200 |
+ p.cmd.Wait() |
|
| 201 |
+ return &exec.ExitError{ProcessState: status}
|
|
| 202 |
+ } |
|
| 203 |
+ var pid *pid |
|
| 204 |
+ if err := json.NewDecoder(p.parentPipe).Decode(&pid); err != nil {
|
|
| 205 |
+ p.cmd.Wait() |
|
| 206 |
+ return err |
|
| 207 |
+ } |
|
| 208 |
+ process, err := os.FindProcess(pid.Pid) |
|
| 209 |
+ if err != nil {
|
|
| 210 |
+ return err |
|
| 211 |
+ } |
|
| 212 |
+ p.cmd.Process = process |
|
| 213 |
+ return nil |
|
| 214 |
+} |
|
| 215 |
+ |
|
| 216 |
+func (p *initProcess) start() error {
|
|
| 189 | 217 |
defer p.parentPipe.Close() |
| 190 |
- err = p.cmd.Start() |
|
| 218 |
+ err := p.cmd.Start() |
|
| 191 | 219 |
p.process.ops = p |
| 192 | 220 |
p.childPipe.Close() |
| 193 | 221 |
if err != nil {
|
| 194 | 222 |
p.process.ops = nil |
| 195 | 223 |
return newSystemError(err) |
| 196 | 224 |
} |
| 225 |
+ if _, err := io.Copy(p.parentPipe, p.bootstrapData); err != nil {
|
|
| 226 |
+ return err |
|
| 227 |
+ } |
|
| 228 |
+ if err := p.execSetns(); err != nil {
|
|
| 229 |
+ return newSystemError(err) |
|
| 230 |
+ } |
|
| 197 | 231 |
// Save the standard descriptor names before the container process |
| 198 | 232 |
// can potentially move them (e.g., via dup2()). If we don't do this now, |
| 199 | 233 |
// we won't know at checkpoint time which file descriptor to look up. |
| ... | ... |
@@ -213,19 +253,6 @@ func (p *initProcess) start() (err error) {
|
| 213 | 213 |
p.manager.Destroy() |
| 214 | 214 |
} |
| 215 | 215 |
}() |
| 216 |
- if p.config.Config.Hooks != nil {
|
|
| 217 |
- s := configs.HookState{
|
|
| 218 |
- Version: p.container.config.Version, |
|
| 219 |
- ID: p.container.id, |
|
| 220 |
- Pid: p.pid(), |
|
| 221 |
- Root: p.config.Config.Rootfs, |
|
| 222 |
- } |
|
| 223 |
- for _, hook := range p.config.Config.Hooks.Prestart {
|
|
| 224 |
- if err := hook.Run(s); err != nil {
|
|
| 225 |
- return newSystemError(err) |
|
| 226 |
- } |
|
| 227 |
- } |
|
| 228 |
- } |
|
| 229 | 216 |
if err := p.createNetworkInterfaces(); err != nil {
|
| 230 | 217 |
return newSystemError(err) |
| 231 | 218 |
} |
| ... | ... |
@@ -233,14 +260,16 @@ func (p *initProcess) start() (err error) {
|
| 233 | 233 |
return newSystemError(err) |
| 234 | 234 |
} |
| 235 | 235 |
var ( |
| 236 |
- procSync syncT |
|
| 237 |
- sentRun bool |
|
| 238 |
- ierr *genericError |
|
| 236 |
+ procSync syncT |
|
| 237 |
+ sentRun bool |
|
| 238 |
+ sentResume bool |
|
| 239 |
+ ierr *genericError |
|
| 239 | 240 |
) |
| 240 | 241 |
|
| 242 |
+ dec := json.NewDecoder(p.parentPipe) |
|
| 241 | 243 |
loop: |
| 242 | 244 |
for {
|
| 243 |
- if err := json.NewDecoder(p.parentPipe).Decode(&procSync); err != nil {
|
|
| 245 |
+ if err := dec.Decode(&procSync); err != nil {
|
|
| 244 | 246 |
if err == io.EOF {
|
| 245 | 247 |
break loop |
| 246 | 248 |
} |
| ... | ... |
@@ -251,15 +280,54 @@ loop: |
| 251 | 251 |
if err := p.manager.Set(p.config.Config); err != nil {
|
| 252 | 252 |
return newSystemError(err) |
| 253 | 253 |
} |
| 254 |
+ // set oom_score_adj |
|
| 255 |
+ if err := setOomScoreAdj(p.config.Config.OomScoreAdj, p.pid()); err != nil {
|
|
| 256 |
+ return newSystemError(err) |
|
| 257 |
+ } |
|
| 258 |
+ // call prestart hooks |
|
| 259 |
+ if !p.config.Config.Namespaces.Contains(configs.NEWNS) {
|
|
| 260 |
+ if p.config.Config.Hooks != nil {
|
|
| 261 |
+ s := configs.HookState{
|
|
| 262 |
+ Version: p.container.config.Version, |
|
| 263 |
+ ID: p.container.id, |
|
| 264 |
+ Pid: p.pid(), |
|
| 265 |
+ Root: p.config.Config.Rootfs, |
|
| 266 |
+ } |
|
| 267 |
+ for _, hook := range p.config.Config.Hooks.Prestart {
|
|
| 268 |
+ if err := hook.Run(s); err != nil {
|
|
| 269 |
+ return newSystemError(err) |
|
| 270 |
+ } |
|
| 271 |
+ } |
|
| 272 |
+ } |
|
| 273 |
+ } |
|
| 254 | 274 |
// Sync with child. |
| 255 | 275 |
if err := utils.WriteJSON(p.parentPipe, syncT{procRun}); err != nil {
|
| 256 | 276 |
return newSystemError(err) |
| 257 | 277 |
} |
| 258 | 278 |
sentRun = true |
| 279 |
+ case procHooks: |
|
| 280 |
+ if p.config.Config.Hooks != nil {
|
|
| 281 |
+ s := configs.HookState{
|
|
| 282 |
+ Version: p.container.config.Version, |
|
| 283 |
+ ID: p.container.id, |
|
| 284 |
+ Pid: p.pid(), |
|
| 285 |
+ Root: p.config.Config.Rootfs, |
|
| 286 |
+ } |
|
| 287 |
+ for _, hook := range p.config.Config.Hooks.Prestart {
|
|
| 288 |
+ if err := hook.Run(s); err != nil {
|
|
| 289 |
+ return newSystemError(err) |
|
| 290 |
+ } |
|
| 291 |
+ } |
|
| 292 |
+ } |
|
| 293 |
+ // Sync with child. |
|
| 294 |
+ if err := utils.WriteJSON(p.parentPipe, syncT{procResume}); err != nil {
|
|
| 295 |
+ return newSystemError(err) |
|
| 296 |
+ } |
|
| 297 |
+ sentResume = true |
|
| 259 | 298 |
case procError: |
| 260 | 299 |
// wait for the child process to fully complete and receive an error message |
| 261 | 300 |
// if one was encoutered |
| 262 |
- if err := json.NewDecoder(p.parentPipe).Decode(&ierr); err != nil && err != io.EOF {
|
|
| 301 |
+ if err := dec.Decode(&ierr); err != nil && err != io.EOF {
|
|
| 263 | 302 |
return newSystemError(err) |
| 264 | 303 |
} |
| 265 | 304 |
if ierr != nil {
|
| ... | ... |
@@ -274,6 +342,9 @@ loop: |
| 274 | 274 |
if !sentRun {
|
| 275 | 275 |
return newSystemError(fmt.Errorf("could not synchronise with container process"))
|
| 276 | 276 |
} |
| 277 |
+ if p.config.Config.Namespaces.Contains(configs.NEWNS) && !sentResume {
|
|
| 278 |
+ return newSystemError(fmt.Errorf("could not synchronise after executing prestart hooks with container process"))
|
|
| 279 |
+ } |
|
| 277 | 280 |
if err := syscall.Shutdown(int(p.parentPipe.Fd()), syscall.SHUT_WR); err != nil {
|
| 278 | 281 |
return newSystemError(err) |
| 279 | 282 |
} |
| ... | ... |
@@ -291,7 +362,7 @@ func (p *initProcess) wait() (*os.ProcessState, error) {
|
| 291 | 291 |
return p.cmd.ProcessState, err |
| 292 | 292 |
} |
| 293 | 293 |
// we should kill all processes in cgroup when init is died if we use host PID namespace |
| 294 |
- if p.cmd.SysProcAttr.Cloneflags&syscall.CLONE_NEWPID == 0 {
|
|
| 294 |
+ if p.sharePidns {
|
|
| 295 | 295 |
killCgroupProcesses(p.manager) |
| 296 | 296 |
} |
| 297 | 297 |
return p.cmd.ProcessState, nil |
| ... | ... |
@@ -4,6 +4,7 @@ package libcontainer |
| 4 | 4 |
|
| 5 | 5 |
import ( |
| 6 | 6 |
"fmt" |
| 7 |
+ "io" |
|
| 7 | 8 |
"io/ioutil" |
| 8 | 9 |
"os" |
| 9 | 10 |
"os/exec" |
| ... | ... |
@@ -26,7 +27,7 @@ const defaultMountFlags = syscall.MS_NOEXEC | syscall.MS_NOSUID | syscall.MS_NOD |
| 26 | 26 |
|
| 27 | 27 |
// setupRootfs sets up the devices, mount points, and filesystems for use inside a |
| 28 | 28 |
// new mount namespace. |
| 29 |
-func setupRootfs(config *configs.Config, console *linuxConsole) (err error) {
|
|
| 29 |
+func setupRootfs(config *configs.Config, console *linuxConsole, pipe io.ReadWriter) (err error) {
|
|
| 30 | 30 |
if err := prepareRoot(config); err != nil {
|
| 31 | 31 |
return newSystemError(err) |
| 32 | 32 |
} |
| ... | ... |
@@ -59,6 +60,13 @@ func setupRootfs(config *configs.Config, console *linuxConsole) (err error) {
|
| 59 | 59 |
return newSystemError(err) |
| 60 | 60 |
} |
| 61 | 61 |
} |
| 62 |
+ // Signal the parent to run the pre-start hooks. |
|
| 63 |
+ // The hooks are run after the mounts are setup, but before we switch to the new |
|
| 64 |
+ // root, so that the old root is still available in the hooks for any mount |
|
| 65 |
+ // manipulations. |
|
| 66 |
+ if err := syncParentHooks(pipe); err != nil {
|
|
| 67 |
+ return err |
|
| 68 |
+ } |
|
| 62 | 69 |
if err := syscall.Chdir(config.Rootfs); err != nil {
|
| 63 | 70 |
return newSystemError(err) |
| 64 | 71 |
} |
| ... | ... |
@@ -75,6 +83,18 @@ func setupRootfs(config *configs.Config, console *linuxConsole) (err error) {
|
| 75 | 75 |
return newSystemError(err) |
| 76 | 76 |
} |
| 77 | 77 |
} |
| 78 |
+ // remount dev as ro if specifed |
|
| 79 |
+ for _, m := range config.Mounts {
|
|
| 80 |
+ if m.Destination == "/dev" {
|
|
| 81 |
+ if m.Flags&syscall.MS_RDONLY != 0 {
|
|
| 82 |
+ if err := remountReadonly(m.Destination); err != nil {
|
|
| 83 |
+ return newSystemError(err) |
|
| 84 |
+ } |
|
| 85 |
+ } |
|
| 86 |
+ break |
|
| 87 |
+ } |
|
| 88 |
+ } |
|
| 89 |
+ // set rootfs ( / ) as readonly |
|
| 78 | 90 |
if config.Readonlyfs {
|
| 79 | 91 |
if err := setReadonly(); err != nil {
|
| 80 | 92 |
return newSystemError(err) |
| ... | ... |
@@ -138,16 +158,6 @@ func mountToRootfs(m *configs.Mount, rootfs, mountLabel string) error {
|
| 138 | 138 |
} |
| 139 | 139 |
} |
| 140 | 140 |
return nil |
| 141 |
- case "devpts": |
|
| 142 |
- if err := os.MkdirAll(dest, 0755); err != nil {
|
|
| 143 |
- return err |
|
| 144 |
- } |
|
| 145 |
- return mountPropagate(m, rootfs, mountLabel) |
|
| 146 |
- case "securityfs": |
|
| 147 |
- if err := os.MkdirAll(dest, 0755); err != nil {
|
|
| 148 |
- return err |
|
| 149 |
- } |
|
| 150 |
- return mountPropagate(m, rootfs, mountLabel) |
|
| 151 | 141 |
case "bind": |
| 152 | 142 |
stat, err := os.Stat(m.Source) |
| 153 | 143 |
if err != nil {
|
| ... | ... |
@@ -253,7 +263,10 @@ func mountToRootfs(m *configs.Mount, rootfs, mountLabel string) error {
|
| 253 | 253 |
} |
| 254 | 254 |
} |
| 255 | 255 |
default: |
| 256 |
- return fmt.Errorf("unknown mount device %q to %q", m.Device, m.Destination)
|
|
| 256 |
+ if err := os.MkdirAll(dest, 0755); err != nil {
|
|
| 257 |
+ return err |
|
| 258 |
+ } |
|
| 259 |
+ return mountPropagate(m, rootfs, mountLabel) |
|
| 257 | 260 |
} |
| 258 | 261 |
return nil |
| 259 | 262 |
} |
| ... | ... |
@@ -552,7 +565,7 @@ func setupPtmx(config *configs.Config, console *linuxConsole) error {
|
| 552 | 552 |
return nil |
| 553 | 553 |
} |
| 554 | 554 |
|
| 555 |
-func pivotRoot(rootfs, pivotBaseDir string) error {
|
|
| 555 |
+func pivotRoot(rootfs, pivotBaseDir string) (err error) {
|
|
| 556 | 556 |
if pivotBaseDir == "" {
|
| 557 | 557 |
pivotBaseDir = "/" |
| 558 | 558 |
} |
| ... | ... |
@@ -564,6 +577,12 @@ func pivotRoot(rootfs, pivotBaseDir string) error {
|
| 564 | 564 |
if err != nil {
|
| 565 | 565 |
return fmt.Errorf("can't create pivot_root dir %s, error %v", pivotDir, err)
|
| 566 | 566 |
} |
| 567 |
+ defer func() {
|
|
| 568 |
+ errVal := os.Remove(pivotDir) |
|
| 569 |
+ if err == nil {
|
|
| 570 |
+ err = errVal |
|
| 571 |
+ } |
|
| 572 |
+ }() |
|
| 567 | 573 |
if err := syscall.PivotRoot(rootfs, pivotDir); err != nil {
|
| 568 | 574 |
return fmt.Errorf("pivot_root %s", err)
|
| 569 | 575 |
} |
| ... | ... |
@@ -582,7 +601,7 @@ func pivotRoot(rootfs, pivotBaseDir string) error {
|
| 582 | 582 |
if err := syscall.Unmount(pivotDir, syscall.MNT_DETACH); err != nil {
|
| 583 | 583 |
return fmt.Errorf("unmount pivot_root dir %s", err)
|
| 584 | 584 |
} |
| 585 |
- return os.Remove(pivotDir) |
|
| 585 |
+ return nil |
|
| 586 | 586 |
} |
| 587 | 587 |
|
| 588 | 588 |
func msMoveRoot(rootfs string) error {
|
| ... | ... |
@@ -671,14 +690,18 @@ func remount(m *configs.Mount, rootfs string) error {
|
| 671 | 671 |
// of propagation flags. |
| 672 | 672 |
func mountPropagate(m *configs.Mount, rootfs string, mountLabel string) error {
|
| 673 | 673 |
var ( |
| 674 |
- dest = m.Destination |
|
| 675 |
- data = label.FormatMountLabel(m.Data, mountLabel) |
|
| 674 |
+ dest = m.Destination |
|
| 675 |
+ data = label.FormatMountLabel(m.Data, mountLabel) |
|
| 676 |
+ flags = m.Flags |
|
| 676 | 677 |
) |
| 678 |
+ if dest == "/dev" {
|
|
| 679 |
+ flags &= ^syscall.MS_RDONLY |
|
| 680 |
+ } |
|
| 677 | 681 |
if !strings.HasPrefix(dest, rootfs) {
|
| 678 | 682 |
dest = filepath.Join(rootfs, dest) |
| 679 | 683 |
} |
| 680 | 684 |
|
| 681 |
- if err := syscall.Mount(m.Source, dest, m.Device, uintptr(m.Flags), data); err != nil {
|
|
| 685 |
+ if err := syscall.Mount(m.Source, dest, m.Device, uintptr(flags), data); err != nil {
|
|
| 682 | 686 |
return err |
| 683 | 687 |
} |
| 684 | 688 |
|
| ... | ... |
@@ -158,12 +158,14 @@ func Setfilecon(path string, scon string) error {
|
| 158 | 158 |
// Getfilecon returns the SELinux label for this path or returns an error. |
| 159 | 159 |
func Getfilecon(path string) (string, error) {
|
| 160 | 160 |
con, err := system.Lgetxattr(path, xattrNameSelinux) |
| 161 |
- |
|
| 161 |
+ if err != nil {
|
|
| 162 |
+ return "", err |
|
| 163 |
+ } |
|
| 162 | 164 |
// Trim the NUL byte at the end of the byte buffer, if present. |
| 163 |
- if con[len(con)-1] == '\x00' {
|
|
| 165 |
+ if len(con) > 0 && con[len(con)-1] == '\x00' {
|
|
| 164 | 166 |
con = con[:len(con)-1] |
| 165 | 167 |
} |
| 166 |
- return string(con), err |
|
| 168 |
+ return string(con), nil |
|
| 167 | 169 |
} |
| 168 | 170 |
|
| 169 | 171 |
func Setfscreatecon(scon string) error {
|
| ... | ... |
@@ -3,6 +3,7 @@ |
| 3 | 3 |
package libcontainer |
| 4 | 4 |
|
| 5 | 5 |
import ( |
| 6 |
+ "fmt" |
|
| 6 | 7 |
"os" |
| 7 | 8 |
|
| 8 | 9 |
"github.com/opencontainers/runc/libcontainer/apparmor" |
| ... | ... |
@@ -18,18 +19,19 @@ type linuxSetnsInit struct {
|
| 18 | 18 |
config *initConfig |
| 19 | 19 |
} |
| 20 | 20 |
|
| 21 |
+func (l *linuxSetnsInit) getSessionRingName() string {
|
|
| 22 |
+ return fmt.Sprintf("_ses.%s", l.config.ContainerId)
|
|
| 23 |
+} |
|
| 24 |
+ |
|
| 21 | 25 |
func (l *linuxSetnsInit) Init() error {
|
| 22 | 26 |
// do not inherit the parent's session keyring |
| 23 |
- if _, err := keyctl.JoinSessionKeyring("_ses"); err != nil {
|
|
| 27 |
+ if _, err := keyctl.JoinSessionKeyring(l.getSessionRingName()); err != nil {
|
|
| 24 | 28 |
return err |
| 25 | 29 |
} |
| 26 | 30 |
if err := setupRlimits(l.config.Config); err != nil {
|
| 27 | 31 |
return err |
| 28 | 32 |
} |
| 29 |
- if err := setOomScoreAdj(l.config.Config.OomScoreAdj); err != nil {
|
|
| 30 |
- return err |
|
| 31 |
- } |
|
| 32 |
- if l.config.Config.NoNewPrivileges {
|
|
| 33 |
+ if l.config.NoNewPrivileges {
|
|
| 33 | 34 |
if err := system.Prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); err != nil {
|
| 34 | 35 |
return err |
| 35 | 36 |
} |
| ... | ... |
@@ -42,11 +44,11 @@ func (l *linuxSetnsInit) Init() error {
|
| 42 | 42 |
if err := finalizeNamespace(l.config); err != nil {
|
| 43 | 43 |
return err |
| 44 | 44 |
} |
| 45 |
- if err := apparmor.ApplyProfile(l.config.Config.AppArmorProfile); err != nil {
|
|
| 45 |
+ if err := apparmor.ApplyProfile(l.config.AppArmorProfile); err != nil {
|
|
| 46 | 46 |
return err |
| 47 | 47 |
} |
| 48 |
- if l.config.Config.ProcessLabel != "" {
|
|
| 49 |
- if err := label.SetProcessLabel(l.config.Config.ProcessLabel); err != nil {
|
|
| 48 |
+ if l.config.ProcessLabel != "" {
|
|
| 49 |
+ if err := label.SetProcessLabel(l.config.ProcessLabel); err != nil {
|
|
| 50 | 50 |
return err |
| 51 | 51 |
} |
| 52 | 52 |
} |
| ... | ... |
@@ -3,6 +3,7 @@ |
| 3 | 3 |
package libcontainer |
| 4 | 4 |
|
| 5 | 5 |
import ( |
| 6 |
+ "fmt" |
|
| 6 | 7 |
"io" |
| 7 | 8 |
"os" |
| 8 | 9 |
"syscall" |
| ... | ... |
@@ -21,27 +22,39 @@ type linuxStandardInit struct {
|
| 21 | 21 |
config *initConfig |
| 22 | 22 |
} |
| 23 | 23 |
|
| 24 |
+func (l *linuxStandardInit) getSessionRingParams() (string, uint32, uint32) {
|
|
| 25 |
+ var newperms uint32 |
|
| 26 |
+ |
|
| 27 |
+ if l.config.Config.Namespaces.Contains(configs.NEWUSER) {
|
|
| 28 |
+ // with user ns we need 'other' search permissions |
|
| 29 |
+ newperms = 0x8 |
|
| 30 |
+ } else {
|
|
| 31 |
+ // without user ns we need 'UID' search permissions |
|
| 32 |
+ newperms = 0x80000 |
|
| 33 |
+ } |
|
| 34 |
+ |
|
| 35 |
+ // create a unique per session container name that we can |
|
| 36 |
+ // join in setns; however, other containers can also join it |
|
| 37 |
+ return fmt.Sprintf("_ses.%s", l.config.ContainerId), 0xffffffff, newperms
|
|
| 38 |
+} |
|
| 39 |
+ |
|
| 24 | 40 |
// PR_SET_NO_NEW_PRIVS isn't exposed in Golang so we define it ourselves copying the value |
| 25 | 41 |
// the kernel |
| 26 | 42 |
const PR_SET_NO_NEW_PRIVS = 0x26 |
| 27 | 43 |
|
| 28 | 44 |
func (l *linuxStandardInit) Init() error {
|
| 45 |
+ ringname, keepperms, newperms := l.getSessionRingParams() |
|
| 46 |
+ |
|
| 29 | 47 |
// do not inherit the parent's session keyring |
| 30 |
- sessKeyId, err := keyctl.JoinSessionKeyring("")
|
|
| 48 |
+ sessKeyId, err := keyctl.JoinSessionKeyring(ringname) |
|
| 31 | 49 |
if err != nil {
|
| 32 | 50 |
return err |
| 33 | 51 |
} |
| 34 | 52 |
// make session keyring searcheable |
| 35 |
- // without user ns we need 'UID' search permissions |
|
| 36 |
- // with user ns we need 'other' search permissions |
|
| 37 |
- if err := keyctl.ModKeyringPerm(sessKeyId, 0xffffffff, 0x080008); err != nil {
|
|
| 53 |
+ if err := keyctl.ModKeyringPerm(sessKeyId, keepperms, newperms); err != nil {
|
|
| 38 | 54 |
return err |
| 39 | 55 |
} |
| 40 | 56 |
|
| 41 |
- // join any namespaces via a path to the namespace fd if provided |
|
| 42 |
- if err := joinExistingNamespaces(l.config.Config.Namespaces); err != nil {
|
|
| 43 |
- return err |
|
| 44 |
- } |
|
| 45 | 57 |
var console *linuxConsole |
| 46 | 58 |
if l.config.Console != "" {
|
| 47 | 59 |
console = newConsoleFromPath(l.config.Console) |
| ... | ... |
@@ -49,9 +62,6 @@ func (l *linuxStandardInit) Init() error {
|
| 49 | 49 |
return err |
| 50 | 50 |
} |
| 51 | 51 |
} |
| 52 |
- if _, err := syscall.Setsid(); err != nil {
|
|
| 53 |
- return err |
|
| 54 |
- } |
|
| 55 | 52 |
if console != nil {
|
| 56 | 53 |
if err := system.Setctty(); err != nil {
|
| 57 | 54 |
return err |
| ... | ... |
@@ -66,13 +76,11 @@ func (l *linuxStandardInit) Init() error {
|
| 66 | 66 |
if err := setupRlimits(l.config.Config); err != nil {
|
| 67 | 67 |
return err |
| 68 | 68 |
} |
| 69 |
- if err := setOomScoreAdj(l.config.Config.OomScoreAdj); err != nil {
|
|
| 70 |
- return err |
|
| 71 |
- } |
|
| 69 |
+ |
|
| 72 | 70 |
label.Init() |
| 73 | 71 |
// InitializeMountNamespace() can be executed only for a new mount namespace |
| 74 | 72 |
if l.config.Config.Namespaces.Contains(configs.NEWNS) {
|
| 75 |
- if err := setupRootfs(l.config.Config, console); err != nil {
|
|
| 73 |
+ if err := setupRootfs(l.config.Config, console, l.pipe); err != nil {
|
|
| 76 | 74 |
return err |
| 77 | 75 |
} |
| 78 | 76 |
} |
| ... | ... |
@@ -81,10 +89,10 @@ func (l *linuxStandardInit) Init() error {
|
| 81 | 81 |
return err |
| 82 | 82 |
} |
| 83 | 83 |
} |
| 84 |
- if err := apparmor.ApplyProfile(l.config.Config.AppArmorProfile); err != nil {
|
|
| 84 |
+ if err := apparmor.ApplyProfile(l.config.AppArmorProfile); err != nil {
|
|
| 85 | 85 |
return err |
| 86 | 86 |
} |
| 87 |
- if err := label.SetProcessLabel(l.config.Config.ProcessLabel); err != nil {
|
|
| 87 |
+ if err := label.SetProcessLabel(l.config.ProcessLabel); err != nil {
|
|
| 88 | 88 |
return err |
| 89 | 89 |
} |
| 90 | 90 |
|
| ... | ... |
@@ -107,7 +115,7 @@ func (l *linuxStandardInit) Init() error {
|
| 107 | 107 |
if err != nil {
|
| 108 | 108 |
return err |
| 109 | 109 |
} |
| 110 |
- if l.config.Config.NoNewPrivileges {
|
|
| 110 |
+ if l.config.NoNewPrivileges {
|
|
| 111 | 111 |
if err := system.Prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); err != nil {
|
| 112 | 112 |
return err |
| 113 | 113 |
} |
| 0 | 9 |
new file mode 100644 |
| ... | ... |
@@ -0,0 +1,191 @@ |
| 0 |
+ |
|
| 1 |
+ Apache License |
|
| 2 |
+ Version 2.0, January 2004 |
|
| 3 |
+ http://www.apache.org/licenses/ |
|
| 4 |
+ |
|
| 5 |
+ TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION |
|
| 6 |
+ |
|
| 7 |
+ 1. Definitions. |
|
| 8 |
+ |
|
| 9 |
+ "License" shall mean the terms and conditions for use, reproduction, |
|
| 10 |
+ and distribution as defined by Sections 1 through 9 of this document. |
|
| 11 |
+ |
|
| 12 |
+ "Licensor" shall mean the copyright owner or entity authorized by |
|
| 13 |
+ the copyright owner that is granting the License. |
|
| 14 |
+ |
|
| 15 |
+ "Legal Entity" shall mean the union of the acting entity and all |
|
| 16 |
+ other entities that control, are controlled by, or are under common |
|
| 17 |
+ control with that entity. For the purposes of this definition, |
|
| 18 |
+ "control" means (i) the power, direct or indirect, to cause the |
|
| 19 |
+ direction or management of such entity, whether by contract or |
|
| 20 |
+ otherwise, or (ii) ownership of fifty percent (50%) or more of the |
|
| 21 |
+ outstanding shares, or (iii) beneficial ownership of such entity. |
|
| 22 |
+ |
|
| 23 |
+ "You" (or "Your") shall mean an individual or Legal Entity |
|
| 24 |
+ exercising permissions granted by this License. |
|
| 25 |
+ |
|
| 26 |
+ "Source" form shall mean the preferred form for making modifications, |
|
| 27 |
+ including but not limited to software source code, documentation |
|
| 28 |
+ source, and configuration files. |
|
| 29 |
+ |
|
| 30 |
+ "Object" form shall mean any form resulting from mechanical |
|
| 31 |
+ transformation or translation of a Source form, including but |
|
| 32 |
+ not limited to compiled object code, generated documentation, |
|
| 33 |
+ and conversions to other media types. |
|
| 34 |
+ |
|
| 35 |
+ "Work" shall mean the work of authorship, whether in Source or |
|
| 36 |
+ Object form, made available under the License, as indicated by a |
|
| 37 |
+ copyright notice that is included in or attached to the work |
|
| 38 |
+ (an example is provided in the Appendix below). |
|
| 39 |
+ |
|
| 40 |
+ "Derivative Works" shall mean any work, whether in Source or Object |
|
| 41 |
+ form, that is based on (or derived from) the Work and for which the |
|
| 42 |
+ editorial revisions, annotations, elaborations, or other modifications |
|
| 43 |
+ represent, as a whole, an original work of authorship. For the purposes |
|
| 44 |
+ of this License, Derivative Works shall not include works that remain |
|
| 45 |
+ separable from, or merely link (or bind by name) to the interfaces of, |
|
| 46 |
+ the Work and Derivative Works thereof. |
|
| 47 |
+ |
|
| 48 |
+ "Contribution" shall mean any work of authorship, including |
|
| 49 |
+ the original version of the Work and any modifications or additions |
|
| 50 |
+ to that Work or Derivative Works thereof, that is intentionally |
|
| 51 |
+ submitted to Licensor for inclusion in the Work by the copyright owner |
|
| 52 |
+ or by an individual or Legal Entity authorized to submit on behalf of |
|
| 53 |
+ the copyright owner. For the purposes of this definition, "submitted" |
|
| 54 |
+ means any form of electronic, verbal, or written communication sent |
|
| 55 |
+ to the Licensor or its representatives, including but not limited to |
|
| 56 |
+ communication on electronic mailing lists, source code control systems, |
|
| 57 |
+ and issue tracking systems that are managed by, or on behalf of, the |
|
| 58 |
+ Licensor for the purpose of discussing and improving the Work, but |
|
| 59 |
+ excluding communication that is conspicuously marked or otherwise |
|
| 60 |
+ designated in writing by the copyright owner as "Not a Contribution." |
|
| 61 |
+ |
|
| 62 |
+ "Contributor" shall mean Licensor and any individual or Legal Entity |
|
| 63 |
+ on behalf of whom a Contribution has been received by Licensor and |
|
| 64 |
+ subsequently incorporated within the Work. |
|
| 65 |
+ |
|
| 66 |
+ 2. Grant of Copyright License. Subject to the terms and conditions of |
|
| 67 |
+ this License, each Contributor hereby grants to You a perpetual, |
|
| 68 |
+ worldwide, non-exclusive, no-charge, royalty-free, irrevocable |
|
| 69 |
+ copyright license to reproduce, prepare Derivative Works of, |
|
| 70 |
+ publicly display, publicly perform, sublicense, and distribute the |
|
| 71 |
+ Work and such Derivative Works in Source or Object form. |
|
| 72 |
+ |
|
| 73 |
+ 3. Grant of Patent License. Subject to the terms and conditions of |
|
| 74 |
+ this License, each Contributor hereby grants to You a perpetual, |
|
| 75 |
+ worldwide, non-exclusive, no-charge, royalty-free, irrevocable |
|
| 76 |
+ (except as stated in this section) patent license to make, have made, |
|
| 77 |
+ use, offer to sell, sell, import, and otherwise transfer the Work, |
|
| 78 |
+ where such license applies only to those patent claims licensable |
|
| 79 |
+ by such Contributor that are necessarily infringed by their |
|
| 80 |
+ Contribution(s) alone or by combination of their Contribution(s) |
|
| 81 |
+ with the Work to which such Contribution(s) was submitted. If You |
|
| 82 |
+ institute patent litigation against any entity (including a |
|
| 83 |
+ cross-claim or counterclaim in a lawsuit) alleging that the Work |
|
| 84 |
+ or a Contribution incorporated within the Work constitutes direct |
|
| 85 |
+ or contributory patent infringement, then any patent licenses |
|
| 86 |
+ granted to You under this License for that Work shall terminate |
|
| 87 |
+ as of the date such litigation is filed. |
|
| 88 |
+ |
|
| 89 |
+ 4. Redistribution. You may reproduce and distribute copies of the |
|
| 90 |
+ Work or Derivative Works thereof in any medium, with or without |
|
| 91 |
+ modifications, and in Source or Object form, provided that You |
|
| 92 |
+ meet the following conditions: |
|
| 93 |
+ |
|
| 94 |
+ (a) You must give any other recipients of the Work or |
|
| 95 |
+ Derivative Works a copy of this License; and |
|
| 96 |
+ |
|
| 97 |
+ (b) You must cause any modified files to carry prominent notices |
|
| 98 |
+ stating that You changed the files; and |
|
| 99 |
+ |
|
| 100 |
+ (c) You must retain, in the Source form of any Derivative Works |
|
| 101 |
+ that You distribute, all copyright, patent, trademark, and |
|
| 102 |
+ attribution notices from the Source form of the Work, |
|
| 103 |
+ excluding those notices that do not pertain to any part of |
|
| 104 |
+ the Derivative Works; and |
|
| 105 |
+ |
|
| 106 |
+ (d) If the Work includes a "NOTICE" text file as part of its |
|
| 107 |
+ distribution, then any Derivative Works that You distribute must |
|
| 108 |
+ include a readable copy of the attribution notices contained |
|
| 109 |
+ within such NOTICE file, excluding those notices that do not |
|
| 110 |
+ pertain to any part of the Derivative Works, in at least one |
|
| 111 |
+ of the following places: within a NOTICE text file distributed |
|
| 112 |
+ as part of the Derivative Works; within the Source form or |
|
| 113 |
+ documentation, if provided along with the Derivative Works; or, |
|
| 114 |
+ within a display generated by the Derivative Works, if and |
|
| 115 |
+ wherever such third-party notices normally appear. The contents |
|
| 116 |
+ of the NOTICE file are for informational purposes only and |
|
| 117 |
+ do not modify the License. You may add Your own attribution |
|
| 118 |
+ notices within Derivative Works that You distribute, alongside |
|
| 119 |
+ or as an addendum to the NOTICE text from the Work, provided |
|
| 120 |
+ that such additional attribution notices cannot be construed |
|
| 121 |
+ as modifying the License. |
|
| 122 |
+ |
|
| 123 |
+ You may add Your own copyright statement to Your modifications and |
|
| 124 |
+ may provide additional or different license terms and conditions |
|
| 125 |
+ for use, reproduction, or distribution of Your modifications, or |
|
| 126 |
+ for any such Derivative Works as a whole, provided Your use, |
|
| 127 |
+ reproduction, and distribution of the Work otherwise complies with |
|
| 128 |
+ the conditions stated in this License. |
|
| 129 |
+ |
|
| 130 |
+ 5. Submission of Contributions. Unless You explicitly state otherwise, |
|
| 131 |
+ any Contribution intentionally submitted for inclusion in the Work |
|
| 132 |
+ by You to the Licensor shall be under the terms and conditions of |
|
| 133 |
+ this License, without any additional terms or conditions. |
|
| 134 |
+ Notwithstanding the above, nothing herein shall supersede or modify |
|
| 135 |
+ the terms of any separate license agreement you may have executed |
|
| 136 |
+ with Licensor regarding such Contributions. |
|
| 137 |
+ |
|
| 138 |
+ 6. Trademarks. This License does not grant permission to use the trade |
|
| 139 |
+ names, trademarks, service marks, or product names of the Licensor, |
|
| 140 |
+ except as required for reasonable and customary use in describing the |
|
| 141 |
+ origin of the Work and reproducing the content of the NOTICE file. |
|
| 142 |
+ |
|
| 143 |
+ 7. Disclaimer of Warranty. Unless required by applicable law or |
|
| 144 |
+ agreed to in writing, Licensor provides the Work (and each |
|
| 145 |
+ Contributor provides its Contributions) on an "AS IS" BASIS, |
|
| 146 |
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or |
|
| 147 |
+ implied, including, without limitation, any warranties or conditions |
|
| 148 |
+ of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A |
|
| 149 |
+ PARTICULAR PURPOSE. You are solely responsible for determining the |
|
| 150 |
+ appropriateness of using or redistributing the Work and assume any |
|
| 151 |
+ risks associated with Your exercise of permissions under this License. |
|
| 152 |
+ |
|
| 153 |
+ 8. Limitation of Liability. In no event and under no legal theory, |
|
| 154 |
+ whether in tort (including negligence), contract, or otherwise, |
|
| 155 |
+ unless required by applicable law (such as deliberate and grossly |
|
| 156 |
+ negligent acts) or agreed to in writing, shall any Contributor be |
|
| 157 |
+ liable to You for damages, including any direct, indirect, special, |
|
| 158 |
+ incidental, or consequential damages of any character arising as a |
|
| 159 |
+ result of this License or out of the use or inability to use the |
|
| 160 |
+ Work (including but not limited to damages for loss of goodwill, |
|
| 161 |
+ work stoppage, computer failure or malfunction, or any and all |
|
| 162 |
+ other commercial damages or losses), even if such Contributor |
|
| 163 |
+ has been advised of the possibility of such damages. |
|
| 164 |
+ |
|
| 165 |
+ 9. Accepting Warranty or Additional Liability. While redistributing |
|
| 166 |
+ the Work or Derivative Works thereof, You may choose to offer, |
|
| 167 |
+ and charge a fee for, acceptance of support, warranty, indemnity, |
|
| 168 |
+ or other liability obligations and/or rights consistent with this |
|
| 169 |
+ License. However, in accepting such obligations, You may act only |
|
| 170 |
+ on Your own behalf and on Your sole responsibility, not on behalf |
|
| 171 |
+ of any other Contributor, and only if You agree to indemnify, |
|
| 172 |
+ defend, and hold each Contributor harmless for any liability |
|
| 173 |
+ incurred by, or claims asserted against, such Contributor by reason |
|
| 174 |
+ of your accepting any such warranty or additional liability. |
|
| 175 |
+ |
|
| 176 |
+ END OF TERMS AND CONDITIONS |
|
| 177 |
+ |
|
| 178 |
+ Copyright 2015 The Linux Foundation. |
|
| 179 |
+ |
|
| 180 |
+ Licensed under the Apache License, Version 2.0 (the "License"); |
|
| 181 |
+ you may not use this file except in compliance with the License. |
|
| 182 |
+ You may obtain a copy of the License at |
|
| 183 |
+ |
|
| 184 |
+ http://www.apache.org/licenses/LICENSE-2.0 |
|
| 185 |
+ |
|
| 186 |
+ Unless required by applicable law or agreed to in writing, software |
|
| 187 |
+ distributed under the License is distributed on an "AS IS" BASIS, |
|
| 188 |
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
|
| 189 |
+ See the License for the specific language governing permissions and |
|
| 190 |
+ limitations under the License. |
| 0 | 191 |
new file mode 100644 |
| ... | ... |
@@ -0,0 +1,412 @@ |
| 0 |
+package specs |
|
| 1 |
+ |
|
| 2 |
+import "os" |
|
| 3 |
+ |
|
| 4 |
+// Spec is the base configuration for the container. It specifies platform |
|
| 5 |
+// independent configuration. This information must be included when the |
|
| 6 |
+// bundle is packaged for distribution. |
|
| 7 |
+type Spec struct {
|
|
| 8 |
+ // Version is the version of the specification that is supported. |
|
| 9 |
+ Version string `json:"ociVersion"` |
|
| 10 |
+ // Platform is the host information for OS and Arch. |
|
| 11 |
+ Platform Platform `json:"platform"` |
|
| 12 |
+ // Process is the container's main process. |
|
| 13 |
+ Process Process `json:"process"` |
|
| 14 |
+ // Root is the root information for the container's filesystem. |
|
| 15 |
+ Root Root `json:"root"` |
|
| 16 |
+ // Hostname is the container's host name. |
|
| 17 |
+ Hostname string `json:"hostname,omitempty"` |
|
| 18 |
+ // Mounts profile configuration for adding mounts to the container's filesystem. |
|
| 19 |
+ Mounts []Mount `json:"mounts"` |
|
| 20 |
+ // Hooks are the commands run at various lifecycle events of the container. |
|
| 21 |
+ Hooks Hooks `json:"hooks"` |
|
| 22 |
+ // Annotations is an unstructured key value map that may be set by external tools to store and retrieve arbitrary metadata. |
|
| 23 |
+ Annotations map[string]string `json:"annotations,omitempty"` |
|
| 24 |
+ |
|
| 25 |
+ // Linux is platform specific configuration for Linux based containers. |
|
| 26 |
+ Linux Linux `json:"linux" platform:"linux"` |
|
| 27 |
+} |
|
| 28 |
+ |
|
| 29 |
+// Process contains information to start a specific application inside the container. |
|
| 30 |
+type Process struct {
|
|
| 31 |
+ // Terminal creates an interactive terminal for the container. |
|
| 32 |
+ Terminal bool `json:"terminal"` |
|
| 33 |
+ // User specifies user information for the process. |
|
| 34 |
+ User User `json:"user"` |
|
| 35 |
+ // Args specifies the binary and arguments for the application to execute. |
|
| 36 |
+ Args []string `json:"args"` |
|
| 37 |
+ // Env populates the process environment for the process. |
|
| 38 |
+ Env []string `json:"env,omitempty"` |
|
| 39 |
+ // Cwd is the current working directory for the process and must be |
|
| 40 |
+ // relative to the container's root. |
|
| 41 |
+ Cwd string `json:"cwd"` |
|
| 42 |
+ // Capabilities are Linux capabilities that are kept for the container. |
|
| 43 |
+ Capabilities []string `json:"capabilities,omitempty" platform:"linux"` |
|
| 44 |
+ // Rlimits specifies rlimit options to apply to the process. |
|
| 45 |
+ Rlimits []Rlimit `json:"rlimits,omitempty"` |
|
| 46 |
+ // NoNewPrivileges controls whether additional privileges could be gained by processes in the container. |
|
| 47 |
+ NoNewPrivileges bool `json:"noNewPrivileges,omitempty"` |
|
| 48 |
+ |
|
| 49 |
+ // ApparmorProfile specified the apparmor profile for the container. (this field is platform dependent) |
|
| 50 |
+ ApparmorProfile string `json:"apparmorProfile,omitempty" platform:"linux"` |
|
| 51 |
+ // SelinuxProcessLabel specifies the selinux context that the container process is run as. (this field is platform dependent) |
|
| 52 |
+ SelinuxLabel string `json:"selinuxLabel,omitempty" platform:"linux"` |
|
| 53 |
+} |
|
| 54 |
+ |
|
| 55 |
+// User specifies Linux specific user and group information for the container's |
|
| 56 |
+// main process. |
|
| 57 |
+type User struct {
|
|
| 58 |
+ // UID is the user id. (this field is platform dependent) |
|
| 59 |
+ UID uint32 `json:"uid,omitempty" platform:"linux"` |
|
| 60 |
+ // GID is the group id. (this field is platform dependent) |
|
| 61 |
+ GID uint32 `json:"gid,omitempty" platform:"linux"` |
|
| 62 |
+ // AdditionalGids are additional group ids set for the container's process. (this field is platform dependent) |
|
| 63 |
+ AdditionalGids []uint32 `json:"additionalGids,omitempty" platform:"linux"` |
|
| 64 |
+} |
|
| 65 |
+ |
|
| 66 |
+// Root contains information about the container's root filesystem on the host. |
|
| 67 |
+type Root struct {
|
|
| 68 |
+ // Path is the absolute path to the container's root filesystem. |
|
| 69 |
+ Path string `json:"path"` |
|
| 70 |
+ // Readonly makes the root filesystem for the container readonly before the process is executed. |
|
| 71 |
+ Readonly bool `json:"readonly"` |
|
| 72 |
+} |
|
| 73 |
+ |
|
| 74 |
+// Platform specifies OS and arch information for the host system that the container |
|
| 75 |
+// is created for. |
|
| 76 |
+type Platform struct {
|
|
| 77 |
+ // OS is the operating system. |
|
| 78 |
+ OS string `json:"os"` |
|
| 79 |
+ // Arch is the architecture |
|
| 80 |
+ Arch string `json:"arch"` |
|
| 81 |
+} |
|
| 82 |
+ |
|
| 83 |
+// Mount specifies a mount for a container. |
|
| 84 |
+type Mount struct {
|
|
| 85 |
+ // Destination is the path where the mount will be placed relative to the container's root. The path and child directories MUST exist, a runtime MUST NOT create directories automatically to a mount point. |
|
| 86 |
+ Destination string `json:"destination"` |
|
| 87 |
+ // Type specifies the mount kind. |
|
| 88 |
+ Type string `json:"type"` |
|
| 89 |
+ // Source specifies the source path of the mount. In the case of bind mounts on |
|
| 90 |
+ // Linux based systems this would be the file on the host. |
|
| 91 |
+ Source string `json:"source"` |
|
| 92 |
+ // Options are fstab style mount options. |
|
| 93 |
+ Options []string `json:"options,omitempty"` |
|
| 94 |
+} |
|
| 95 |
+ |
|
| 96 |
+// Hook specifies a command that is run at a particular event in the lifecycle of a container |
|
| 97 |
+type Hook struct {
|
|
| 98 |
+ Path string `json:"path"` |
|
| 99 |
+ Args []string `json:"args,omitempty"` |
|
| 100 |
+ Env []string `json:"env,omitempty"` |
|
| 101 |
+} |
|
| 102 |
+ |
|
| 103 |
+// Hooks for container setup and teardown |
|
| 104 |
+type Hooks struct {
|
|
| 105 |
+ // Prestart is a list of hooks to be run before the container process is executed. |
|
| 106 |
+ // On Linux, they are run after the container namespaces are created. |
|
| 107 |
+ Prestart []Hook `json:"prestart,omitempty"` |
|
| 108 |
+ // Poststart is a list of hooks to be run after the container process is started. |
|
| 109 |
+ Poststart []Hook `json:"poststart,omitempty"` |
|
| 110 |
+ // Poststop is a list of hooks to be run after the container process exits. |
|
| 111 |
+ Poststop []Hook `json:"poststop,omitempty"` |
|
| 112 |
+} |
|
| 113 |
+ |
|
| 114 |
+// Linux contains platform specific configuration for Linux based containers. |
|
| 115 |
+type Linux struct {
|
|
| 116 |
+ // UIDMapping specifies user mappings for supporting user namespaces on Linux. |
|
| 117 |
+ UIDMappings []IDMapping `json:"uidMappings,omitempty"` |
|
| 118 |
+ // GIDMapping specifies group mappings for supporting user namespaces on Linux. |
|
| 119 |
+ GIDMappings []IDMapping `json:"gidMappings,omitempty"` |
|
| 120 |
+ // Sysctl are a set of key value pairs that are set for the container on start |
|
| 121 |
+ Sysctl map[string]string `json:"sysctl,omitempty"` |
|
| 122 |
+ // Resources contain cgroup information for handling resource constraints |
|
| 123 |
+ // for the container |
|
| 124 |
+ Resources *Resources `json:"resources,omitempty"` |
|
| 125 |
+ // CgroupsPath specifies the path to cgroups that are created and/or joined by the container. |
|
| 126 |
+ // The path is expected to be relative to the cgroups mountpoint. |
|
| 127 |
+ // If resources are specified, the cgroups at CgroupsPath will be updated based on resources. |
|
| 128 |
+ CgroupsPath *string `json:"cgroupsPath,omitempty"` |
|
| 129 |
+ // Namespaces contains the namespaces that are created and/or joined by the container |
|
| 130 |
+ Namespaces []Namespace `json:"namespaces"` |
|
| 131 |
+ // Devices are a list of device nodes that are created for the container |
|
| 132 |
+ Devices []Device `json:"devices"` |
|
| 133 |
+ // Seccomp specifies the seccomp security settings for the container. |
|
| 134 |
+ Seccomp *Seccomp `json:"seccomp,omitempty"` |
|
| 135 |
+ // RootfsPropagation is the rootfs mount propagation mode for the container. |
|
| 136 |
+ RootfsPropagation string `json:"rootfsPropagation,omitempty"` |
|
| 137 |
+} |
|
| 138 |
+ |
|
| 139 |
+// Namespace is the configuration for a Linux namespace |
|
| 140 |
+type Namespace struct {
|
|
| 141 |
+ // Type is the type of Linux namespace |
|
| 142 |
+ Type NamespaceType `json:"type"` |
|
| 143 |
+ // Path is a path to an existing namespace persisted on disk that can be joined |
|
| 144 |
+ // and is of the same type |
|
| 145 |
+ Path string `json:"path,omitempty"` |
|
| 146 |
+} |
|
| 147 |
+ |
|
| 148 |
+// NamespaceType is one of the Linux namespaces |
|
| 149 |
+type NamespaceType string |
|
| 150 |
+ |
|
| 151 |
+const ( |
|
| 152 |
+ // PIDNamespace for isolating process IDs |
|
| 153 |
+ PIDNamespace NamespaceType = "pid" |
|
| 154 |
+ // NetworkNamespace for isolating network devices, stacks, ports, etc |
|
| 155 |
+ NetworkNamespace = "network" |
|
| 156 |
+ // MountNamespace for isolating mount points |
|
| 157 |
+ MountNamespace = "mount" |
|
| 158 |
+ // IPCNamespace for isolating System V IPC, POSIX message queues |
|
| 159 |
+ IPCNamespace = "ipc" |
|
| 160 |
+ // UTSNamespace for isolating hostname and NIS domain name |
|
| 161 |
+ UTSNamespace = "uts" |
|
| 162 |
+ // UserNamespace for isolating user and group IDs |
|
| 163 |
+ UserNamespace = "user" |
|
| 164 |
+) |
|
| 165 |
+ |
|
| 166 |
+// IDMapping specifies UID/GID mappings |
|
| 167 |
+type IDMapping struct {
|
|
| 168 |
+ // HostID is the UID/GID of the host user or group |
|
| 169 |
+ HostID uint32 `json:"hostID"` |
|
| 170 |
+ // ContainerID is the UID/GID of the container's user or group |
|
| 171 |
+ ContainerID uint32 `json:"containerID"` |
|
| 172 |
+ // Size is the length of the range of IDs mapped between the two namespaces |
|
| 173 |
+ Size uint32 `json:"size"` |
|
| 174 |
+} |
|
| 175 |
+ |
|
| 176 |
+// Rlimit type and restrictions |
|
| 177 |
+type Rlimit struct {
|
|
| 178 |
+ // Type of the rlimit to set |
|
| 179 |
+ Type string `json:"type"` |
|
| 180 |
+ // Hard is the hard limit for the specified type |
|
| 181 |
+ Hard uint64 `json:"hard"` |
|
| 182 |
+ // Soft is the soft limit for the specified type |
|
| 183 |
+ Soft uint64 `json:"soft"` |
|
| 184 |
+} |
|
| 185 |
+ |
|
| 186 |
+// HugepageLimit structure corresponds to limiting kernel hugepages |
|
| 187 |
+type HugepageLimit struct {
|
|
| 188 |
+ // Pagesize is the hugepage size |
|
| 189 |
+ Pagesize *string `json:"pageSize,omitempty"` |
|
| 190 |
+ // Limit is the limit of "hugepagesize" hugetlb usage |
|
| 191 |
+ Limit *uint64 `json:"limit,omitempty"` |
|
| 192 |
+} |
|
| 193 |
+ |
|
| 194 |
+// InterfacePriority for network interfaces |
|
| 195 |
+type InterfacePriority struct {
|
|
| 196 |
+ // Name is the name of the network interface |
|
| 197 |
+ Name string `json:"name"` |
|
| 198 |
+ // Priority for the interface |
|
| 199 |
+ Priority uint32 `json:"priority"` |
|
| 200 |
+} |
|
| 201 |
+ |
|
| 202 |
+// blockIODevice holds major:minor format supported in blkio cgroup |
|
| 203 |
+type blockIODevice struct {
|
|
| 204 |
+ // Major is the device's major number. |
|
| 205 |
+ Major int64 `json:"major"` |
|
| 206 |
+ // Minor is the device's minor number. |
|
| 207 |
+ Minor int64 `json:"minor"` |
|
| 208 |
+} |
|
| 209 |
+ |
|
| 210 |
+// WeightDevice struct holds a `major:minor weight` pair for blkioWeightDevice |
|
| 211 |
+type WeightDevice struct {
|
|
| 212 |
+ blockIODevice |
|
| 213 |
+ // Weight is the bandwidth rate for the device, range is from 10 to 1000 |
|
| 214 |
+ Weight *uint16 `json:"weight,omitempty"` |
|
| 215 |
+ // LeafWeight is the bandwidth rate for the device while competing with the cgroup's child cgroups, range is from 10 to 1000, CFQ scheduler only |
|
| 216 |
+ LeafWeight *uint16 `json:"leafWeight,omitempty"` |
|
| 217 |
+} |
|
| 218 |
+ |
|
| 219 |
+// ThrottleDevice struct holds a `major:minor rate_per_second` pair |
|
| 220 |
+type ThrottleDevice struct {
|
|
| 221 |
+ blockIODevice |
|
| 222 |
+ // Rate is the IO rate limit per cgroup per device |
|
| 223 |
+ Rate *uint64 `json:"rate,omitempty"` |
|
| 224 |
+} |
|
| 225 |
+ |
|
| 226 |
+// BlockIO for Linux cgroup 'blkio' resource management |
|
| 227 |
+type BlockIO struct {
|
|
| 228 |
+ // Specifies per cgroup weight, range is from 10 to 1000 |
|
| 229 |
+ Weight *uint16 `json:"blkioWeight,omitempty"` |
|
| 230 |
+ // Specifies tasks' weight in the given cgroup while competing with the cgroup's child cgroups, range is from 10 to 1000, CFQ scheduler only |
|
| 231 |
+ LeafWeight *uint16 `json:"blkioLeafWeight,omitempty"` |
|
| 232 |
+ // Weight per cgroup per device, can override BlkioWeight |
|
| 233 |
+ WeightDevice []WeightDevice `json:"blkioWeightDevice,omitempty"` |
|
| 234 |
+ // IO read rate limit per cgroup per device, bytes per second |
|
| 235 |
+ ThrottleReadBpsDevice []ThrottleDevice `json:"blkioThrottleReadBpsDevice,omitempty"` |
|
| 236 |
+ // IO write rate limit per cgroup per device, bytes per second |
|
| 237 |
+ ThrottleWriteBpsDevice []ThrottleDevice `json:"blkioThrottleWriteBpsDevice,omitempty"` |
|
| 238 |
+ // IO read rate limit per cgroup per device, IO per second |
|
| 239 |
+ ThrottleReadIOPSDevice []ThrottleDevice `json:"blkioThrottleReadIOPSDevice,omitempty"` |
|
| 240 |
+ // IO write rate limit per cgroup per device, IO per second |
|
| 241 |
+ ThrottleWriteIOPSDevice []ThrottleDevice `json:"blkioThrottleWriteIOPSDevice,omitempty"` |
|
| 242 |
+} |
|
| 243 |
+ |
|
| 244 |
+// Memory for Linux cgroup 'memory' resource management |
|
| 245 |
+type Memory struct {
|
|
| 246 |
+ // Memory limit (in bytes). |
|
| 247 |
+ Limit *uint64 `json:"limit,omitempty"` |
|
| 248 |
+ // Memory reservation or soft_limit (in bytes). |
|
| 249 |
+ Reservation *uint64 `json:"reservation,omitempty"` |
|
| 250 |
+ // Total memory limit (memory + swap). |
|
| 251 |
+ Swap *uint64 `json:"swap,omitempty"` |
|
| 252 |
+ // Kernel memory limit (in bytes). |
|
| 253 |
+ Kernel *uint64 `json:"kernel,omitempty"` |
|
| 254 |
+ // Kernel memory limit for tcp (in bytes) |
|
| 255 |
+ KernelTCP *uint64 `json:"kernelTCP"` |
|
| 256 |
+ // How aggressive the kernel will swap memory pages. Range from 0 to 100. |
|
| 257 |
+ Swappiness *uint64 `json:"swappiness,omitempty"` |
|
| 258 |
+} |
|
| 259 |
+ |
|
| 260 |
+// CPU for Linux cgroup 'cpu' resource management |
|
| 261 |
+type CPU struct {
|
|
| 262 |
+ // CPU shares (relative weight (ratio) vs. other cgroups with cpu shares). |
|
| 263 |
+ Shares *uint64 `json:"shares,omitempty"` |
|
| 264 |
+ // CPU hardcap limit (in usecs). Allowed cpu time in a given period. |
|
| 265 |
+ Quota *uint64 `json:"quota,omitempty"` |
|
| 266 |
+ // CPU period to be used for hardcapping (in usecs). |
|
| 267 |
+ Period *uint64 `json:"period,omitempty"` |
|
| 268 |
+ // How much time realtime scheduling may use (in usecs). |
|
| 269 |
+ RealtimeRuntime *uint64 `json:"realtimeRuntime,omitempty"` |
|
| 270 |
+ // CPU period to be used for realtime scheduling (in usecs). |
|
| 271 |
+ RealtimePeriod *uint64 `json:"realtimePeriod,omitempty"` |
|
| 272 |
+ // CPUs to use within the cpuset. Default is to use any CPU available. |
|
| 273 |
+ Cpus *string `json:"cpus,omitempty"` |
|
| 274 |
+ // List of memory nodes in the cpuset. Default is to use any available memory node. |
|
| 275 |
+ Mems *string `json:"mems,omitempty"` |
|
| 276 |
+} |
|
| 277 |
+ |
|
| 278 |
+// Pids for Linux cgroup 'pids' resource management (Linux 4.3) |
|
| 279 |
+type Pids struct {
|
|
| 280 |
+ // Maximum number of PIDs. Default is "no limit". |
|
| 281 |
+ Limit *int64 `json:"limit,omitempty"` |
|
| 282 |
+} |
|
| 283 |
+ |
|
| 284 |
+// Network identification and priority configuration |
|
| 285 |
+type Network struct {
|
|
| 286 |
+ // Set class identifier for container's network packets |
|
| 287 |
+ ClassID *uint32 `json:"classID"` |
|
| 288 |
+ // Set priority of network traffic for container |
|
| 289 |
+ Priorities []InterfacePriority `json:"priorities,omitempty"` |
|
| 290 |
+} |
|
| 291 |
+ |
|
| 292 |
+// Resources has container runtime resource constraints |
|
| 293 |
+type Resources struct {
|
|
| 294 |
+ // Devices are a list of device rules for the whitelist controller |
|
| 295 |
+ Devices []DeviceCgroup `json:"devices"` |
|
| 296 |
+ // DisableOOMKiller disables the OOM killer for out of memory conditions |
|
| 297 |
+ DisableOOMKiller *bool `json:"disableOOMKiller,omitempty"` |
|
| 298 |
+ // Specify an oom_score_adj for the container. |
|
| 299 |
+ OOMScoreAdj *int `json:"oomScoreAdj,omitempty"` |
|
| 300 |
+ // Memory restriction configuration |
|
| 301 |
+ Memory *Memory `json:"memory,omitempty"` |
|
| 302 |
+ // CPU resource restriction configuration |
|
| 303 |
+ CPU *CPU `json:"cpu,omitempty"` |
|
| 304 |
+ // Task resource restriction configuration. |
|
| 305 |
+ Pids *Pids `json:"pids,omitempty"` |
|
| 306 |
+ // BlockIO restriction configuration |
|
| 307 |
+ BlockIO *BlockIO `json:"blockIO,omitempty"` |
|
| 308 |
+ // Hugetlb limit (in bytes) |
|
| 309 |
+ HugepageLimits []HugepageLimit `json:"hugepageLimits,omitempty"` |
|
| 310 |
+ // Network restriction configuration |
|
| 311 |
+ Network *Network `json:"network,omitempty"` |
|
| 312 |
+} |
|
| 313 |
+ |
|
| 314 |
+// Device represents the mknod information for a Linux special device file |
|
| 315 |
+type Device struct {
|
|
| 316 |
+ // Path to the device. |
|
| 317 |
+ Path string `json:"path"` |
|
| 318 |
+ // Device type, block, char, etc. |
|
| 319 |
+ Type string `json:"type"` |
|
| 320 |
+ // Major is the device's major number. |
|
| 321 |
+ Major int64 `json:"major"` |
|
| 322 |
+ // Minor is the device's minor number. |
|
| 323 |
+ Minor int64 `json:"minor"` |
|
| 324 |
+ // FileMode permission bits for the device. |
|
| 325 |
+ FileMode *os.FileMode `json:"fileMode,omitempty"` |
|
| 326 |
+ // UID of the device. |
|
| 327 |
+ UID *uint32 `json:"uid,omitempty"` |
|
| 328 |
+ // Gid of the device. |
|
| 329 |
+ GID *uint32 `json:"gid,omitempty"` |
|
| 330 |
+} |
|
| 331 |
+ |
|
| 332 |
+// DeviceCgroup represents a device rule for the whitelist controller |
|
| 333 |
+type DeviceCgroup struct {
|
|
| 334 |
+ // Allow or deny |
|
| 335 |
+ Allow bool `json:"allow"` |
|
| 336 |
+ // Device type, block, char, etc. |
|
| 337 |
+ Type *string `json:"type,omitempty"` |
|
| 338 |
+ // Major is the device's major number. |
|
| 339 |
+ Major *int64 `json:"major,omitempty"` |
|
| 340 |
+ // Minor is the device's minor number. |
|
| 341 |
+ Minor *int64 `json:"minor,omitempty"` |
|
| 342 |
+ // Cgroup access permissions format, rwm. |
|
| 343 |
+ Access *string `json:"access,omitempty"` |
|
| 344 |
+} |
|
| 345 |
+ |
|
| 346 |
+// Seccomp represents syscall restrictions |
|
| 347 |
+type Seccomp struct {
|
|
| 348 |
+ DefaultAction Action `json:"defaultAction"` |
|
| 349 |
+ Architectures []Arch `json:"architectures"` |
|
| 350 |
+ Syscalls []Syscall `json:"syscalls,omitempty"` |
|
| 351 |
+} |
|
| 352 |
+ |
|
| 353 |
+// Arch used for additional architectures |
|
| 354 |
+type Arch string |
|
| 355 |
+ |
|
| 356 |
+// Additional architectures permitted to be used for system calls |
|
| 357 |
+// By default only the native architecture of the kernel is permitted |
|
| 358 |
+const ( |
|
| 359 |
+ ArchX86 Arch = "SCMP_ARCH_X86" |
|
| 360 |
+ ArchX86_64 Arch = "SCMP_ARCH_X86_64" |
|
| 361 |
+ ArchX32 Arch = "SCMP_ARCH_X32" |
|
| 362 |
+ ArchARM Arch = "SCMP_ARCH_ARM" |
|
| 363 |
+ ArchAARCH64 Arch = "SCMP_ARCH_AARCH64" |
|
| 364 |
+ ArchMIPS Arch = "SCMP_ARCH_MIPS" |
|
| 365 |
+ ArchMIPS64 Arch = "SCMP_ARCH_MIPS64" |
|
| 366 |
+ ArchMIPS64N32 Arch = "SCMP_ARCH_MIPS64N32" |
|
| 367 |
+ ArchMIPSEL Arch = "SCMP_ARCH_MIPSEL" |
|
| 368 |
+ ArchMIPSEL64 Arch = "SCMP_ARCH_MIPSEL64" |
|
| 369 |
+ ArchMIPSEL64N32 Arch = "SCMP_ARCH_MIPSEL64N32" |
|
| 370 |
+) |
|
| 371 |
+ |
|
| 372 |
+// Action taken upon Seccomp rule match |
|
| 373 |
+type Action string |
|
| 374 |
+ |
|
| 375 |
+// Define actions for Seccomp rules |
|
| 376 |
+const ( |
|
| 377 |
+ ActKill Action = "SCMP_ACT_KILL" |
|
| 378 |
+ ActTrap Action = "SCMP_ACT_TRAP" |
|
| 379 |
+ ActErrno Action = "SCMP_ACT_ERRNO" |
|
| 380 |
+ ActTrace Action = "SCMP_ACT_TRACE" |
|
| 381 |
+ ActAllow Action = "SCMP_ACT_ALLOW" |
|
| 382 |
+) |
|
| 383 |
+ |
|
| 384 |
+// Operator used to match syscall arguments in Seccomp |
|
| 385 |
+type Operator string |
|
| 386 |
+ |
|
| 387 |
+// Define operators for syscall arguments in Seccomp |
|
| 388 |
+const ( |
|
| 389 |
+ OpNotEqual Operator = "SCMP_CMP_NE" |
|
| 390 |
+ OpLessThan Operator = "SCMP_CMP_LT" |
|
| 391 |
+ OpLessEqual Operator = "SCMP_CMP_LE" |
|
| 392 |
+ OpEqualTo Operator = "SCMP_CMP_EQ" |
|
| 393 |
+ OpGreaterEqual Operator = "SCMP_CMP_GE" |
|
| 394 |
+ OpGreaterThan Operator = "SCMP_CMP_GT" |
|
| 395 |
+ OpMaskedEqual Operator = "SCMP_CMP_MASKED_EQ" |
|
| 396 |
+) |
|
| 397 |
+ |
|
| 398 |
+// Arg used for matching specific syscall arguments in Seccomp |
|
| 399 |
+type Arg struct {
|
|
| 400 |
+ Index uint `json:"index"` |
|
| 401 |
+ Value uint64 `json:"value"` |
|
| 402 |
+ ValueTwo uint64 `json:"valueTwo"` |
|
| 403 |
+ Op Operator `json:"op"` |
|
| 404 |
+} |
|
| 405 |
+ |
|
| 406 |
+// Syscall is used to match a syscall in Seccomp |
|
| 407 |
+type Syscall struct {
|
|
| 408 |
+ Name string `json:"name"` |
|
| 409 |
+ Action Action `json:"action"` |
|
| 410 |
+ Args []Arg `json:"args,omitempty"` |
|
| 411 |
+} |
| 0 | 412 |
new file mode 100644 |
| ... | ... |
@@ -0,0 +1,13 @@ |
| 0 |
+package specs |
|
| 1 |
+ |
|
| 2 |
+// State holds information about the runtime state of the container. |
|
| 3 |
+type State struct {
|
|
| 4 |
+ // Version is the version of the specification that is supported. |
|
| 5 |
+ Version string `json:"version"` |
|
| 6 |
+ // ID is the container ID |
|
| 7 |
+ ID string `json:"id"` |
|
| 8 |
+ // Pid is the process id for the container's main process. |
|
| 9 |
+ Pid int `json:"pid"` |
|
| 10 |
+ // BundlePath is the path to the container's bundle directory. |
|
| 11 |
+ BundlePath string `json:"bundlePath"` |
|
| 12 |
+} |
| 0 | 13 |
new file mode 100644 |
| ... | ... |
@@ -0,0 +1,18 @@ |
| 0 |
+package specs |
|
| 1 |
+ |
|
| 2 |
+import "fmt" |
|
| 3 |
+ |
|
| 4 |
+const ( |
|
| 5 |
+ // VersionMajor is for an API incompatible changes |
|
| 6 |
+ VersionMajor = 0 |
|
| 7 |
+ // VersionMinor is for functionality in a backwards-compatible manner |
|
| 8 |
+ VersionMinor = 4 |
|
| 9 |
+ // VersionPatch is for backwards-compatible bug fixes |
|
| 10 |
+ VersionPatch = 0 |
|
| 11 |
+ |
|
| 12 |
+ // VersionDev indicates development branch. Releases will be empty string. |
|
| 13 |
+ VersionDev = "" |
|
| 14 |
+) |
|
| 15 |
+ |
|
| 16 |
+// Version is the specification version that the package types support. |
|
| 17 |
+var Version = fmt.Sprintf("%d.%d.%d%s", VersionMajor, VersionMinor, VersionPatch, VersionDev)
|