Browse code

Vendor containerd, specs, runc

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>

Tonis Tiigi authored on 2016/03/19 03:43:13
Showing 37 changed files
... ...
@@ -59,7 +59,8 @@ clone git github.com/miekg/pkcs11 df8ae6ca730422dba20c768ff38ef7d79077a59f
59 59
 clone git github.com/docker/go v1.5.1-1-1-gbaf439e
60 60
 clone git github.com/agl/ed25519 d2b94fd789ea21d12fac1a4443dd3a3f79cda72c
61 61
 
62
-clone git github.com/opencontainers/runc 2c3115481ee1782ad687a9e0b4834f89533c2acf # libcontainer
62
+clone git github.com/opencontainers/runc 7b6c4c418d5090f4f11eee949fdf49afd15838c9 # libcontainer
63
+clone git github.com/opencontainers/specs 3ce138b1934bf227a418e241ead496c383eaba1c # specs
63 64
 clone git github.com/seccomp/libseccomp-golang 1b506fc7c24eec5a3693cdcbed40d9c226cfc6a1
64 65
 # libcontainer deps (see src/github.com/opencontainers/runc/Godeps/Godeps.json)
65 66
 clone git github.com/coreos/go-systemd v4
... ...
@@ -87,4 +88,6 @@ clone git golang.org/x/oauth2 2baa8a1b9338cf13d9eeb27696d761155fa480be https://g
87 87
 clone git google.golang.org/api dc6d2353af16e2a2b0ff6986af051d473a4ed468 https://code.googlesource.com/google-api-go-client
88 88
 clone git google.golang.org/cloud dae7e3d993bc3812a2185af60552bb6b847e52a0 https://code.googlesource.com/gocloud
89 89
 
90
+# containerd
91
+clone git github.com/docker/containerd ab5eae56bf3a800e062c6d63fb94f766a732813f
90 92
 clean
91 93
new file mode 100644
... ...
@@ -0,0 +1,191 @@
0
+
1
+                                 Apache License
2
+                           Version 2.0, January 2004
3
+                        https://www.apache.org/licenses/
4
+
5
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
6
+
7
+   1. Definitions.
8
+
9
+      "License" shall mean the terms and conditions for use, reproduction,
10
+      and distribution as defined by Sections 1 through 9 of this document.
11
+
12
+      "Licensor" shall mean the copyright owner or entity authorized by
13
+      the copyright owner that is granting the License.
14
+
15
+      "Legal Entity" shall mean the union of the acting entity and all
16
+      other entities that control, are controlled by, or are under common
17
+      control with that entity. For the purposes of this definition,
18
+      "control" means (i) the power, direct or indirect, to cause the
19
+      direction or management of such entity, whether by contract or
20
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
21
+      outstanding shares, or (iii) beneficial ownership of such entity.
22
+
23
+      "You" (or "Your") shall mean an individual or Legal Entity
24
+      exercising permissions granted by this License.
25
+
26
+      "Source" form shall mean the preferred form for making modifications,
27
+      including but not limited to software source code, documentation
28
+      source, and configuration files.
29
+
30
+      "Object" form shall mean any form resulting from mechanical
31
+      transformation or translation of a Source form, including but
32
+      not limited to compiled object code, generated documentation,
33
+      and conversions to other media types.
34
+
35
+      "Work" shall mean the work of authorship, whether in Source or
36
+      Object form, made available under the License, as indicated by a
37
+      copyright notice that is included in or attached to the work
38
+      (an example is provided in the Appendix below).
39
+
40
+      "Derivative Works" shall mean any work, whether in Source or Object
41
+      form, that is based on (or derived from) the Work and for which the
42
+      editorial revisions, annotations, elaborations, or other modifications
43
+      represent, as a whole, an original work of authorship. For the purposes
44
+      of this License, Derivative Works shall not include works that remain
45
+      separable from, or merely link (or bind by name) to the interfaces of,
46
+      the Work and Derivative Works thereof.
47
+
48
+      "Contribution" shall mean any work of authorship, including
49
+      the original version of the Work and any modifications or additions
50
+      to that Work or Derivative Works thereof, that is intentionally
51
+      submitted to Licensor for inclusion in the Work by the copyright owner
52
+      or by an individual or Legal Entity authorized to submit on behalf of
53
+      the copyright owner. For the purposes of this definition, "submitted"
54
+      means any form of electronic, verbal, or written communication sent
55
+      to the Licensor or its representatives, including but not limited to
56
+      communication on electronic mailing lists, source code control systems,
57
+      and issue tracking systems that are managed by, or on behalf of, the
58
+      Licensor for the purpose of discussing and improving the Work, but
59
+      excluding communication that is conspicuously marked or otherwise
60
+      designated in writing by the copyright owner as "Not a Contribution."
61
+
62
+      "Contributor" shall mean Licensor and any individual or Legal Entity
63
+      on behalf of whom a Contribution has been received by Licensor and
64
+      subsequently incorporated within the Work.
65
+
66
+   2. Grant of Copyright License. Subject to the terms and conditions of
67
+      this License, each Contributor hereby grants to You a perpetual,
68
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
69
+      copyright license to reproduce, prepare Derivative Works of,
70
+      publicly display, publicly perform, sublicense, and distribute the
71
+      Work and such Derivative Works in Source or Object form.
72
+
73
+   3. Grant of Patent License. Subject to the terms and conditions of
74
+      this License, each Contributor hereby grants to You a perpetual,
75
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
76
+      (except as stated in this section) patent license to make, have made,
77
+      use, offer to sell, sell, import, and otherwise transfer the Work,
78
+      where such license applies only to those patent claims licensable
79
+      by such Contributor that are necessarily infringed by their
80
+      Contribution(s) alone or by combination of their Contribution(s)
81
+      with the Work to which such Contribution(s) was submitted. If You
82
+      institute patent litigation against any entity (including a
83
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
84
+      or a Contribution incorporated within the Work constitutes direct
85
+      or contributory patent infringement, then any patent licenses
86
+      granted to You under this License for that Work shall terminate
87
+      as of the date such litigation is filed.
88
+
89
+   4. Redistribution. You may reproduce and distribute copies of the
90
+      Work or Derivative Works thereof in any medium, with or without
91
+      modifications, and in Source or Object form, provided that You
92
+      meet the following conditions:
93
+
94
+      (a) You must give any other recipients of the Work or
95
+          Derivative Works a copy of this License; and
96
+
97
+      (b) You must cause any modified files to carry prominent notices
98
+          stating that You changed the files; and
99
+
100
+      (c) You must retain, in the Source form of any Derivative Works
101
+          that You distribute, all copyright, patent, trademark, and
102
+          attribution notices from the Source form of the Work,
103
+          excluding those notices that do not pertain to any part of
104
+          the Derivative Works; and
105
+
106
+      (d) If the Work includes a "NOTICE" text file as part of its
107
+          distribution, then any Derivative Works that You distribute must
108
+          include a readable copy of the attribution notices contained
109
+          within such NOTICE file, excluding those notices that do not
110
+          pertain to any part of the Derivative Works, in at least one
111
+          of the following places: within a NOTICE text file distributed
112
+          as part of the Derivative Works; within the Source form or
113
+          documentation, if provided along with the Derivative Works; or,
114
+          within a display generated by the Derivative Works, if and
115
+          wherever such third-party notices normally appear. The contents
116
+          of the NOTICE file are for informational purposes only and
117
+          do not modify the License. You may add Your own attribution
118
+          notices within Derivative Works that You distribute, alongside
119
+          or as an addendum to the NOTICE text from the Work, provided
120
+          that such additional attribution notices cannot be construed
121
+          as modifying the License.
122
+
123
+      You may add Your own copyright statement to Your modifications and
124
+      may provide additional or different license terms and conditions
125
+      for use, reproduction, or distribution of Your modifications, or
126
+      for any such Derivative Works as a whole, provided Your use,
127
+      reproduction, and distribution of the Work otherwise complies with
128
+      the conditions stated in this License.
129
+
130
+   5. Submission of Contributions. Unless You explicitly state otherwise,
131
+      any Contribution intentionally submitted for inclusion in the Work
132
+      by You to the Licensor shall be under the terms and conditions of
133
+      this License, without any additional terms or conditions.
134
+      Notwithstanding the above, nothing herein shall supersede or modify
135
+      the terms of any separate license agreement you may have executed
136
+      with Licensor regarding such Contributions.
137
+
138
+   6. Trademarks. This License does not grant permission to use the trade
139
+      names, trademarks, service marks, or product names of the Licensor,
140
+      except as required for reasonable and customary use in describing the
141
+      origin of the Work and reproducing the content of the NOTICE file.
142
+
143
+   7. Disclaimer of Warranty. Unless required by applicable law or
144
+      agreed to in writing, Licensor provides the Work (and each
145
+      Contributor provides its Contributions) on an "AS IS" BASIS,
146
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
147
+      implied, including, without limitation, any warranties or conditions
148
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
149
+      PARTICULAR PURPOSE. You are solely responsible for determining the
150
+      appropriateness of using or redistributing the Work and assume any
151
+      risks associated with Your exercise of permissions under this License.
152
+
153
+   8. Limitation of Liability. In no event and under no legal theory,
154
+      whether in tort (including negligence), contract, or otherwise,
155
+      unless required by applicable law (such as deliberate and grossly
156
+      negligent acts) or agreed to in writing, shall any Contributor be
157
+      liable to You for damages, including any direct, indirect, special,
158
+      incidental, or consequential damages of any character arising as a
159
+      result of this License or out of the use or inability to use the
160
+      Work (including but not limited to damages for loss of goodwill,
161
+      work stoppage, computer failure or malfunction, or any and all
162
+      other commercial damages or losses), even if such Contributor
163
+      has been advised of the possibility of such damages.
164
+
165
+   9. Accepting Warranty or Additional Liability. While redistributing
166
+      the Work or Derivative Works thereof, You may choose to offer,
167
+      and charge a fee for, acceptance of support, warranty, indemnity,
168
+      or other liability obligations and/or rights consistent with this
169
+      License. However, in accepting such obligations, You may act only
170
+      on Your own behalf and on Your sole responsibility, not on behalf
171
+      of any other Contributor, and only if You agree to indemnify,
172
+      defend, and hold each Contributor harmless for any liability
173
+      incurred by, or claims asserted against, such Contributor by reason
174
+      of your accepting any such warranty or additional liability.
175
+
176
+   END OF TERMS AND CONDITIONS
177
+
178
+   Copyright 2013-2015 Docker, Inc.
179
+
180
+   Licensed under the Apache License, Version 2.0 (the "License");
181
+   you may not use this file except in compliance with the License.
182
+   You may obtain a copy of the License at
183
+
184
+       https://www.apache.org/licenses/LICENSE-2.0
185
+
186
+   Unless required by applicable law or agreed to in writing, software
187
+   distributed under the License is distributed on an "AS IS" BASIS,
188
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
189
+   See the License for the specific language governing permissions and
190
+   limitations under the License.
0 191
new file mode 100644
... ...
@@ -0,0 +1,425 @@
0
+Attribution-ShareAlike 4.0 International
1
+
2
+=======================================================================
3
+
4
+Creative Commons Corporation ("Creative Commons") is not a law firm and
5
+does not provide legal services or legal advice. Distribution of
6
+Creative Commons public licenses does not create a lawyer-client or
7
+other relationship. Creative Commons makes its licenses and related
8
+information available on an "as-is" basis. Creative Commons gives no
9
+warranties regarding its licenses, any material licensed under their
10
+terms and conditions, or any related information. Creative Commons
11
+disclaims all liability for damages resulting from their use to the
12
+fullest extent possible.
13
+
14
+Using Creative Commons Public Licenses
15
+
16
+Creative Commons public licenses provide a standard set of terms and
17
+conditions that creators and other rights holders may use to share
18
+original works of authorship and other material subject to copyright
19
+and certain other rights specified in the public license below. The
20
+following considerations are for informational purposes only, are not
21
+exhaustive, and do not form part of our licenses.
22
+
23
+     Considerations for licensors: Our public licenses are
24
+     intended for use by those authorized to give the public
25
+     permission to use material in ways otherwise restricted by
26
+     copyright and certain other rights. Our licenses are
27
+     irrevocable. Licensors should read and understand the terms
28
+     and conditions of the license they choose before applying it.
29
+     Licensors should also secure all rights necessary before
30
+     applying our licenses so that the public can reuse the
31
+     material as expected. Licensors should clearly mark any
32
+     material not subject to the license. This includes other CC-
33
+     licensed material, or material used under an exception or
34
+     limitation to copyright. More considerations for licensors:
35
+	wiki.creativecommons.org/Considerations_for_licensors
36
+
37
+     Considerations for the public: By using one of our public
38
+     licenses, a licensor grants the public permission to use the
39
+     licensed material under specified terms and conditions. If
40
+     the licensor's permission is not necessary for any reason--for
41
+     example, because of any applicable exception or limitation to
42
+     copyright--then that use is not regulated by the license. Our
43
+     licenses grant only permissions under copyright and certain
44
+     other rights that a licensor has authority to grant. Use of
45
+     the licensed material may still be restricted for other
46
+     reasons, including because others have copyright or other
47
+     rights in the material. A licensor may make special requests,
48
+     such as asking that all changes be marked or described.
49
+     Although not required by our licenses, you are encouraged to
50
+     respect those requests where reasonable. More_considerations
51
+     for the public:
52
+	wiki.creativecommons.org/Considerations_for_licensees
53
+
54
+=======================================================================
55
+
56
+Creative Commons Attribution-ShareAlike 4.0 International Public
57
+License
58
+
59
+By exercising the Licensed Rights (defined below), You accept and agree
60
+to be bound by the terms and conditions of this Creative Commons
61
+Attribution-ShareAlike 4.0 International Public License ("Public
62
+License"). To the extent this Public License may be interpreted as a
63
+contract, You are granted the Licensed Rights in consideration of Your
64
+acceptance of these terms and conditions, and the Licensor grants You
65
+such rights in consideration of benefits the Licensor receives from
66
+making the Licensed Material available under these terms and
67
+conditions.
68
+
69
+
70
+Section 1 -- Definitions.
71
+
72
+  a. Adapted Material means material subject to Copyright and Similar
73
+     Rights that is derived from or based upon the Licensed Material
74
+     and in which the Licensed Material is translated, altered,
75
+     arranged, transformed, or otherwise modified in a manner requiring
76
+     permission under the Copyright and Similar Rights held by the
77
+     Licensor. For purposes of this Public License, where the Licensed
78
+     Material is a musical work, performance, or sound recording,
79
+     Adapted Material is always produced where the Licensed Material is
80
+     synched in timed relation with a moving image.
81
+
82
+  b. Adapter's License means the license You apply to Your Copyright
83
+     and Similar Rights in Your contributions to Adapted Material in
84
+     accordance with the terms and conditions of this Public License.
85
+
86
+  c. BY-SA Compatible License means a license listed at
87
+     creativecommons.org/compatiblelicenses, approved by Creative
88
+     Commons as essentially the equivalent of this Public License.
89
+
90
+  d. Copyright and Similar Rights means copyright and/or similar rights
91
+     closely related to copyright including, without limitation,
92
+     performance, broadcast, sound recording, and Sui Generis Database
93
+     Rights, without regard to how the rights are labeled or
94
+     categorized. For purposes of this Public License, the rights
95
+     specified in Section 2(b)(1)-(2) are not Copyright and Similar
96
+     Rights.
97
+
98
+  e. Effective Technological Measures means those measures that, in the
99
+     absence of proper authority, may not be circumvented under laws
100
+     fulfilling obligations under Article 11 of the WIPO Copyright
101
+     Treaty adopted on December 20, 1996, and/or similar international
102
+     agreements.
103
+
104
+  f. Exceptions and Limitations means fair use, fair dealing, and/or
105
+     any other exception or limitation to Copyright and Similar Rights
106
+     that applies to Your use of the Licensed Material.
107
+
108
+  g. License Elements means the license attributes listed in the name
109
+     of a Creative Commons Public License. The License Elements of this
110
+     Public License are Attribution and ShareAlike.
111
+
112
+  h. Licensed Material means the artistic or literary work, database,
113
+     or other material to which the Licensor applied this Public
114
+     License.
115
+
116
+  i. Licensed Rights means the rights granted to You subject to the
117
+     terms and conditions of this Public License, which are limited to
118
+     all Copyright and Similar Rights that apply to Your use of the
119
+     Licensed Material and that the Licensor has authority to license.
120
+
121
+  j. Licensor means the individual(s) or entity(ies) granting rights
122
+     under this Public License.
123
+
124
+  k. Share means to provide material to the public by any means or
125
+     process that requires permission under the Licensed Rights, such
126
+     as reproduction, public display, public performance, distribution,
127
+     dissemination, communication, or importation, and to make material
128
+     available to the public including in ways that members of the
129
+     public may access the material from a place and at a time
130
+     individually chosen by them.
131
+
132
+  l. Sui Generis Database Rights means rights other than copyright
133
+     resulting from Directive 96/9/EC of the European Parliament and of
134
+     the Council of 11 March 1996 on the legal protection of databases,
135
+     as amended and/or succeeded, as well as other essentially
136
+     equivalent rights anywhere in the world.
137
+
138
+  m. You means the individual or entity exercising the Licensed Rights
139
+     under this Public License. Your has a corresponding meaning.
140
+
141
+
142
+Section 2 -- Scope.
143
+
144
+  a. License grant.
145
+
146
+       1. Subject to the terms and conditions of this Public License,
147
+          the Licensor hereby grants You a worldwide, royalty-free,
148
+          non-sublicensable, non-exclusive, irrevocable license to
149
+          exercise the Licensed Rights in the Licensed Material to:
150
+
151
+            a. reproduce and Share the Licensed Material, in whole or
152
+               in part; and
153
+
154
+            b. produce, reproduce, and Share Adapted Material.
155
+
156
+       2. Exceptions and Limitations. For the avoidance of doubt, where
157
+          Exceptions and Limitations apply to Your use, this Public
158
+          License does not apply, and You do not need to comply with
159
+          its terms and conditions.
160
+
161
+       3. Term. The term of this Public License is specified in Section
162
+          6(a).
163
+
164
+       4. Media and formats; technical modifications allowed. The
165
+          Licensor authorizes You to exercise the Licensed Rights in
166
+          all media and formats whether now known or hereafter created,
167
+          and to make technical modifications necessary to do so. The
168
+          Licensor waives and/or agrees not to assert any right or
169
+          authority to forbid You from making technical modifications
170
+          necessary to exercise the Licensed Rights, including
171
+          technical modifications necessary to circumvent Effective
172
+          Technological Measures. For purposes of this Public License,
173
+          simply making modifications authorized by this Section 2(a)
174
+          (4) never produces Adapted Material.
175
+
176
+       5. Downstream recipients.
177
+
178
+            a. Offer from the Licensor -- Licensed Material. Every
179
+               recipient of the Licensed Material automatically
180
+               receives an offer from the Licensor to exercise the
181
+               Licensed Rights under the terms and conditions of this
182
+               Public License.
183
+
184
+            b. Additional offer from the Licensor -- Adapted Material.
185
+               Every recipient of Adapted Material from You
186
+               automatically receives an offer from the Licensor to
187
+               exercise the Licensed Rights in the Adapted Material
188
+               under the conditions of the Adapter's License You apply.
189
+
190
+            c. No downstream restrictions. You may not offer or impose
191
+               any additional or different terms or conditions on, or
192
+               apply any Effective Technological Measures to, the
193
+               Licensed Material if doing so restricts exercise of the
194
+               Licensed Rights by any recipient of the Licensed
195
+               Material.
196
+
197
+       6. No endorsement. Nothing in this Public License constitutes or
198
+          may be construed as permission to assert or imply that You
199
+          are, or that Your use of the Licensed Material is, connected
200
+          with, or sponsored, endorsed, or granted official status by,
201
+          the Licensor or others designated to receive attribution as
202
+          provided in Section 3(a)(1)(A)(i).
203
+
204
+  b. Other rights.
205
+
206
+       1. Moral rights, such as the right of integrity, are not
207
+          licensed under this Public License, nor are publicity,
208
+          privacy, and/or other similar personality rights; however, to
209
+          the extent possible, the Licensor waives and/or agrees not to
210
+          assert any such rights held by the Licensor to the limited
211
+          extent necessary to allow You to exercise the Licensed
212
+          Rights, but not otherwise.
213
+
214
+       2. Patent and trademark rights are not licensed under this
215
+          Public License.
216
+
217
+       3. To the extent possible, the Licensor waives any right to
218
+          collect royalties from You for the exercise of the Licensed
219
+          Rights, whether directly or through a collecting society
220
+          under any voluntary or waivable statutory or compulsory
221
+          licensing scheme. In all other cases the Licensor expressly
222
+          reserves any right to collect such royalties.
223
+
224
+
225
+Section 3 -- License Conditions.
226
+
227
+Your exercise of the Licensed Rights is expressly made subject to the
228
+following conditions.
229
+
230
+  a. Attribution.
231
+
232
+       1. If You Share the Licensed Material (including in modified
233
+          form), You must:
234
+
235
+            a. retain the following if it is supplied by the Licensor
236
+               with the Licensed Material:
237
+
238
+                 i. identification of the creator(s) of the Licensed
239
+                    Material and any others designated to receive
240
+                    attribution, in any reasonable manner requested by
241
+                    the Licensor (including by pseudonym if
242
+                    designated);
243
+
244
+                ii. a copyright notice;
245
+
246
+               iii. a notice that refers to this Public License;
247
+
248
+                iv. a notice that refers to the disclaimer of
249
+                    warranties;
250
+
251
+                 v. a URI or hyperlink to the Licensed Material to the
252
+                    extent reasonably practicable;
253
+
254
+            b. indicate if You modified the Licensed Material and
255
+               retain an indication of any previous modifications; and
256
+
257
+            c. indicate the Licensed Material is licensed under this
258
+               Public License, and include the text of, or the URI or
259
+               hyperlink to, this Public License.
260
+
261
+       2. You may satisfy the conditions in Section 3(a)(1) in any
262
+          reasonable manner based on the medium, means, and context in
263
+          which You Share the Licensed Material. For example, it may be
264
+          reasonable to satisfy the conditions by providing a URI or
265
+          hyperlink to a resource that includes the required
266
+          information.
267
+
268
+       3. If requested by the Licensor, You must remove any of the
269
+          information required by Section 3(a)(1)(A) to the extent
270
+          reasonably practicable.
271
+
272
+  b. ShareAlike.
273
+
274
+     In addition to the conditions in Section 3(a), if You Share
275
+     Adapted Material You produce, the following conditions also apply.
276
+
277
+       1. The Adapter's License You apply must be a Creative Commons
278
+          license with the same License Elements, this version or
279
+          later, or a BY-SA Compatible License.
280
+
281
+       2. You must include the text of, or the URI or hyperlink to, the
282
+          Adapter's License You apply. You may satisfy this condition
283
+          in any reasonable manner based on the medium, means, and
284
+          context in which You Share Adapted Material.
285
+
286
+       3. You may not offer or impose any additional or different terms
287
+          or conditions on, or apply any Effective Technological
288
+          Measures to, Adapted Material that restrict exercise of the
289
+          rights granted under the Adapter's License You apply.
290
+
291
+
292
+Section 4 -- Sui Generis Database Rights.
293
+
294
+Where the Licensed Rights include Sui Generis Database Rights that
295
+apply to Your use of the Licensed Material:
296
+
297
+  a. for the avoidance of doubt, Section 2(a)(1) grants You the right
298
+     to extract, reuse, reproduce, and Share all or a substantial
299
+     portion of the contents of the database;
300
+
301
+  b. if You include all or a substantial portion of the database
302
+     contents in a database in which You have Sui Generis Database
303
+     Rights, then the database in which You have Sui Generis Database
304
+     Rights (but not its individual contents) is Adapted Material,
305
+
306
+     including for purposes of Section 3(b); and
307
+  c. You must comply with the conditions in Section 3(a) if You Share
308
+     all or a substantial portion of the contents of the database.
309
+
310
+For the avoidance of doubt, this Section 4 supplements and does not
311
+replace Your obligations under this Public License where the Licensed
312
+Rights include other Copyright and Similar Rights.
313
+
314
+
315
+Section 5 -- Disclaimer of Warranties and Limitation of Liability.
316
+
317
+  a. UNLESS OTHERWISE SEPARATELY UNDERTAKEN BY THE LICENSOR, TO THE
318
+     EXTENT POSSIBLE, THE LICENSOR OFFERS THE LICENSED MATERIAL AS-IS
319
+     AND AS-AVAILABLE, AND MAKES NO REPRESENTATIONS OR WARRANTIES OF
320
+     ANY KIND CONCERNING THE LICENSED MATERIAL, WHETHER EXPRESS,
321
+     IMPLIED, STATUTORY, OR OTHER. THIS INCLUDES, WITHOUT LIMITATION,
322
+     WARRANTIES OF TITLE, MERCHANTABILITY, FITNESS FOR A PARTICULAR
323
+     PURPOSE, NON-INFRINGEMENT, ABSENCE OF LATENT OR OTHER DEFECTS,
324
+     ACCURACY, OR THE PRESENCE OR ABSENCE OF ERRORS, WHETHER OR NOT
325
+     KNOWN OR DISCOVERABLE. WHERE DISCLAIMERS OF WARRANTIES ARE NOT
326
+     ALLOWED IN FULL OR IN PART, THIS DISCLAIMER MAY NOT APPLY TO YOU.
327
+
328
+  b. TO THE EXTENT POSSIBLE, IN NO EVENT WILL THE LICENSOR BE LIABLE
329
+     TO YOU ON ANY LEGAL THEORY (INCLUDING, WITHOUT LIMITATION,
330
+     NEGLIGENCE) OR OTHERWISE FOR ANY DIRECT, SPECIAL, INDIRECT,
331
+     INCIDENTAL, CONSEQUENTIAL, PUNITIVE, EXEMPLARY, OR OTHER LOSSES,
332
+     COSTS, EXPENSES, OR DAMAGES ARISING OUT OF THIS PUBLIC LICENSE OR
333
+     USE OF THE LICENSED MATERIAL, EVEN IF THE LICENSOR HAS BEEN
334
+     ADVISED OF THE POSSIBILITY OF SUCH LOSSES, COSTS, EXPENSES, OR
335
+     DAMAGES. WHERE A LIMITATION OF LIABILITY IS NOT ALLOWED IN FULL OR
336
+     IN PART, THIS LIMITATION MAY NOT APPLY TO YOU.
337
+
338
+  c. The disclaimer of warranties and limitation of liability provided
339
+     above shall be interpreted in a manner that, to the extent
340
+     possible, most closely approximates an absolute disclaimer and
341
+     waiver of all liability.
342
+
343
+
344
+Section 6 -- Term and Termination.
345
+
346
+  a. This Public License applies for the term of the Copyright and
347
+     Similar Rights licensed here. However, if You fail to comply with
348
+     this Public License, then Your rights under this Public License
349
+     terminate automatically.
350
+
351
+  b. Where Your right to use the Licensed Material has terminated under
352
+     Section 6(a), it reinstates:
353
+
354
+       1. automatically as of the date the violation is cured, provided
355
+          it is cured within 30 days of Your discovery of the
356
+          violation; or
357
+
358
+       2. upon express reinstatement by the Licensor.
359
+
360
+     For the avoidance of doubt, this Section 6(b) does not affect any
361
+     right the Licensor may have to seek remedies for Your violations
362
+     of this Public License.
363
+
364
+  c. For the avoidance of doubt, the Licensor may also offer the
365
+     Licensed Material under separate terms or conditions or stop
366
+     distributing the Licensed Material at any time; however, doing so
367
+     will not terminate this Public License.
368
+
369
+  d. Sections 1, 5, 6, 7, and 8 survive termination of this Public
370
+     License.
371
+
372
+
373
+Section 7 -- Other Terms and Conditions.
374
+
375
+  a. The Licensor shall not be bound by any additional or different
376
+     terms or conditions communicated by You unless expressly agreed.
377
+
378
+  b. Any arrangements, understandings, or agreements regarding the
379
+     Licensed Material not stated herein are separate from and
380
+     independent of the terms and conditions of this Public License.
381
+
382
+
383
+Section 8 -- Interpretation.
384
+
385
+  a. For the avoidance of doubt, this Public License does not, and
386
+     shall not be interpreted to, reduce, limit, restrict, or impose
387
+     conditions on any use of the Licensed Material that could lawfully
388
+     be made without permission under this Public License.
389
+
390
+  b. To the extent possible, if any provision of this Public License is
391
+     deemed unenforceable, it shall be automatically reformed to the
392
+     minimum extent necessary to make it enforceable. If the provision
393
+     cannot be reformed, it shall be severed from this Public License
394
+     without affecting the enforceability of the remaining terms and
395
+     conditions.
396
+
397
+  c. No term or condition of this Public License will be waived and no
398
+     failure to comply consented to unless expressly agreed to by the
399
+     Licensor.
400
+
401
+  d. Nothing in this Public License constitutes or may be interpreted
402
+     as a limitation upon, or waiver of, any privileges and immunities
403
+     that apply to the Licensor or You, including from the legal
404
+     processes of any jurisdiction or authority.
405
+
406
+
407
+=======================================================================
408
+
409
+Creative Commons is not a party to its public licenses.
410
+Notwithstanding, Creative Commons may elect to apply one of its public
411
+licenses to material it publishes and in those instances will be
412
+considered the "Licensor." Except for the limited purpose of indicating
413
+that material is shared under a Creative Commons public license or as
414
+otherwise permitted by the Creative Commons policies published at
415
+creativecommons.org/policies, Creative Commons does not authorize the
416
+use of the trademark "Creative Commons" or any other trademark or logo
417
+of Creative Commons without its prior written consent including,
418
+without limitation, in connection with any unauthorized modifications
419
+to any of its public licenses or any other arrangements,
420
+understandings, or agreements concerning use of licensed material. For
421
+the avoidance of doubt, this paragraph does not form part of the public
422
+licenses.
423
+
424
+Creative Commons may be contacted at creativecommons.org.
0 425
new file mode 100644
... ...
@@ -0,0 +1,1290 @@
0
+// Code generated by protoc-gen-go.
1
+// source: api.proto
2
+// DO NOT EDIT!
3
+
4
+/*
5
+Package types is a generated protocol buffer package.
6
+
7
+It is generated from these files:
8
+	api.proto
9
+
10
+It has these top-level messages:
11
+	UpdateProcessRequest
12
+	UpdateProcessResponse
13
+	CreateContainerRequest
14
+	CreateContainerResponse
15
+	SignalRequest
16
+	SignalResponse
17
+	AddProcessRequest
18
+	User
19
+	AddProcessResponse
20
+	CreateCheckpointRequest
21
+	CreateCheckpointResponse
22
+	DeleteCheckpointRequest
23
+	DeleteCheckpointResponse
24
+	ListCheckpointRequest
25
+	Checkpoint
26
+	ListCheckpointResponse
27
+	StateRequest
28
+	ContainerState
29
+	Process
30
+	Container
31
+	Machine
32
+	StateResponse
33
+	UpdateContainerRequest
34
+	UpdateResource
35
+	UpdateContainerResponse
36
+	EventsRequest
37
+	Event
38
+	NetworkStats
39
+	CpuUsage
40
+	ThrottlingData
41
+	CpuStats
42
+	PidsStats
43
+	MemoryData
44
+	MemoryStats
45
+	BlkioStatsEntry
46
+	BlkioStats
47
+	HugetlbStats
48
+	CgroupStats
49
+	StatsResponse
50
+	StatsRequest
51
+*/
52
+package types
53
+
54
+import proto "github.com/golang/protobuf/proto"
55
+import fmt "fmt"
56
+import math "math"
57
+
58
+import (
59
+	context "golang.org/x/net/context"
60
+	grpc "google.golang.org/grpc"
61
+)
62
+
63
+// Reference imports to suppress errors if they are not otherwise used.
64
+var _ = proto.Marshal
65
+var _ = fmt.Errorf
66
+var _ = math.Inf
67
+
68
+type UpdateProcessRequest struct {
69
+	Id         string `protobuf:"bytes,1,opt,name=id" json:"id,omitempty"`
70
+	Pid        string `protobuf:"bytes,2,opt,name=pid" json:"pid,omitempty"`
71
+	CloseStdin bool   `protobuf:"varint,3,opt,name=closeStdin" json:"closeStdin,omitempty"`
72
+	Width      uint32 `protobuf:"varint,4,opt,name=width" json:"width,omitempty"`
73
+	Height     uint32 `protobuf:"varint,5,opt,name=height" json:"height,omitempty"`
74
+}
75
+
76
+func (m *UpdateProcessRequest) Reset()                    { *m = UpdateProcessRequest{} }
77
+func (m *UpdateProcessRequest) String() string            { return proto.CompactTextString(m) }
78
+func (*UpdateProcessRequest) ProtoMessage()               {}
79
+func (*UpdateProcessRequest) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{0} }
80
+
81
+type UpdateProcessResponse struct {
82
+}
83
+
84
+func (m *UpdateProcessResponse) Reset()                    { *m = UpdateProcessResponse{} }
85
+func (m *UpdateProcessResponse) String() string            { return proto.CompactTextString(m) }
86
+func (*UpdateProcessResponse) ProtoMessage()               {}
87
+func (*UpdateProcessResponse) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{1} }
88
+
89
+type CreateContainerRequest struct {
90
+	Id         string   `protobuf:"bytes,1,opt,name=id" json:"id,omitempty"`
91
+	BundlePath string   `protobuf:"bytes,2,opt,name=bundlePath" json:"bundlePath,omitempty"`
92
+	Checkpoint string   `protobuf:"bytes,3,opt,name=checkpoint" json:"checkpoint,omitempty"`
93
+	Stdin      string   `protobuf:"bytes,4,opt,name=stdin" json:"stdin,omitempty"`
94
+	Stdout     string   `protobuf:"bytes,5,opt,name=stdout" json:"stdout,omitempty"`
95
+	Stderr     string   `protobuf:"bytes,6,opt,name=stderr" json:"stderr,omitempty"`
96
+	Labels     []string `protobuf:"bytes,7,rep,name=labels" json:"labels,omitempty"`
97
+}
98
+
99
+func (m *CreateContainerRequest) Reset()                    { *m = CreateContainerRequest{} }
100
+func (m *CreateContainerRequest) String() string            { return proto.CompactTextString(m) }
101
+func (*CreateContainerRequest) ProtoMessage()               {}
102
+func (*CreateContainerRequest) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{2} }
103
+
104
+type CreateContainerResponse struct {
105
+	Container *Container `protobuf:"bytes,1,opt,name=container" json:"container,omitempty"`
106
+}
107
+
108
+func (m *CreateContainerResponse) Reset()                    { *m = CreateContainerResponse{} }
109
+func (m *CreateContainerResponse) String() string            { return proto.CompactTextString(m) }
110
+func (*CreateContainerResponse) ProtoMessage()               {}
111
+func (*CreateContainerResponse) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{3} }
112
+
113
+func (m *CreateContainerResponse) GetContainer() *Container {
114
+	if m != nil {
115
+		return m.Container
116
+	}
117
+	return nil
118
+}
119
+
120
+type SignalRequest struct {
121
+	Id     string `protobuf:"bytes,1,opt,name=id" json:"id,omitempty"`
122
+	Pid    string `protobuf:"bytes,2,opt,name=pid" json:"pid,omitempty"`
123
+	Signal uint32 `protobuf:"varint,3,opt,name=signal" json:"signal,omitempty"`
124
+}
125
+
126
+func (m *SignalRequest) Reset()                    { *m = SignalRequest{} }
127
+func (m *SignalRequest) String() string            { return proto.CompactTextString(m) }
128
+func (*SignalRequest) ProtoMessage()               {}
129
+func (*SignalRequest) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{4} }
130
+
131
+type SignalResponse struct {
132
+}
133
+
134
+func (m *SignalResponse) Reset()                    { *m = SignalResponse{} }
135
+func (m *SignalResponse) String() string            { return proto.CompactTextString(m) }
136
+func (*SignalResponse) ProtoMessage()               {}
137
+func (*SignalResponse) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{5} }
138
+
139
+type AddProcessRequest struct {
140
+	Id              string   `protobuf:"bytes,1,opt,name=id" json:"id,omitempty"`
141
+	Terminal        bool     `protobuf:"varint,2,opt,name=terminal" json:"terminal,omitempty"`
142
+	User            *User    `protobuf:"bytes,3,opt,name=user" json:"user,omitempty"`
143
+	Args            []string `protobuf:"bytes,4,rep,name=args" json:"args,omitempty"`
144
+	Env             []string `protobuf:"bytes,5,rep,name=env" json:"env,omitempty"`
145
+	Cwd             string   `protobuf:"bytes,6,opt,name=cwd" json:"cwd,omitempty"`
146
+	Pid             string   `protobuf:"bytes,7,opt,name=pid" json:"pid,omitempty"`
147
+	Stdin           string   `protobuf:"bytes,8,opt,name=stdin" json:"stdin,omitempty"`
148
+	Stdout          string   `protobuf:"bytes,9,opt,name=stdout" json:"stdout,omitempty"`
149
+	Stderr          string   `protobuf:"bytes,10,opt,name=stderr" json:"stderr,omitempty"`
150
+	Capabilities    []string `protobuf:"bytes,11,rep,name=capabilities" json:"capabilities,omitempty"`
151
+	ApparmorProfile string   `protobuf:"bytes,12,opt,name=apparmorProfile" json:"apparmorProfile,omitempty"`
152
+	SelinuxLabel    string   `protobuf:"bytes,13,opt,name=selinuxLabel" json:"selinuxLabel,omitempty"`
153
+	NoNewPrivileges bool     `protobuf:"varint,14,opt,name=noNewPrivileges" json:"noNewPrivileges,omitempty"`
154
+}
155
+
156
+func (m *AddProcessRequest) Reset()                    { *m = AddProcessRequest{} }
157
+func (m *AddProcessRequest) String() string            { return proto.CompactTextString(m) }
158
+func (*AddProcessRequest) ProtoMessage()               {}
159
+func (*AddProcessRequest) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{6} }
160
+
161
+func (m *AddProcessRequest) GetUser() *User {
162
+	if m != nil {
163
+		return m.User
164
+	}
165
+	return nil
166
+}
167
+
168
+type User struct {
169
+	Uid            uint32   `protobuf:"varint,1,opt,name=uid" json:"uid,omitempty"`
170
+	Gid            uint32   `protobuf:"varint,2,opt,name=gid" json:"gid,omitempty"`
171
+	AdditionalGids []uint32 `protobuf:"varint,3,rep,name=additionalGids" json:"additionalGids,omitempty"`
172
+}
173
+
174
+func (m *User) Reset()                    { *m = User{} }
175
+func (m *User) String() string            { return proto.CompactTextString(m) }
176
+func (*User) ProtoMessage()               {}
177
+func (*User) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{7} }
178
+
179
+type AddProcessResponse struct {
180
+}
181
+
182
+func (m *AddProcessResponse) Reset()                    { *m = AddProcessResponse{} }
183
+func (m *AddProcessResponse) String() string            { return proto.CompactTextString(m) }
184
+func (*AddProcessResponse) ProtoMessage()               {}
185
+func (*AddProcessResponse) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{8} }
186
+
187
+type CreateCheckpointRequest struct {
188
+	Id         string      `protobuf:"bytes,1,opt,name=id" json:"id,omitempty"`
189
+	Checkpoint *Checkpoint `protobuf:"bytes,2,opt,name=checkpoint" json:"checkpoint,omitempty"`
190
+}
191
+
192
+func (m *CreateCheckpointRequest) Reset()                    { *m = CreateCheckpointRequest{} }
193
+func (m *CreateCheckpointRequest) String() string            { return proto.CompactTextString(m) }
194
+func (*CreateCheckpointRequest) ProtoMessage()               {}
195
+func (*CreateCheckpointRequest) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{9} }
196
+
197
+func (m *CreateCheckpointRequest) GetCheckpoint() *Checkpoint {
198
+	if m != nil {
199
+		return m.Checkpoint
200
+	}
201
+	return nil
202
+}
203
+
204
+type CreateCheckpointResponse struct {
205
+}
206
+
207
+func (m *CreateCheckpointResponse) Reset()                    { *m = CreateCheckpointResponse{} }
208
+func (m *CreateCheckpointResponse) String() string            { return proto.CompactTextString(m) }
209
+func (*CreateCheckpointResponse) ProtoMessage()               {}
210
+func (*CreateCheckpointResponse) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{10} }
211
+
212
+type DeleteCheckpointRequest struct {
213
+	Id   string `protobuf:"bytes,1,opt,name=id" json:"id,omitempty"`
214
+	Name string `protobuf:"bytes,2,opt,name=name" json:"name,omitempty"`
215
+}
216
+
217
+func (m *DeleteCheckpointRequest) Reset()                    { *m = DeleteCheckpointRequest{} }
218
+func (m *DeleteCheckpointRequest) String() string            { return proto.CompactTextString(m) }
219
+func (*DeleteCheckpointRequest) ProtoMessage()               {}
220
+func (*DeleteCheckpointRequest) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{11} }
221
+
222
+type DeleteCheckpointResponse struct {
223
+}
224
+
225
+func (m *DeleteCheckpointResponse) Reset()                    { *m = DeleteCheckpointResponse{} }
226
+func (m *DeleteCheckpointResponse) String() string            { return proto.CompactTextString(m) }
227
+func (*DeleteCheckpointResponse) ProtoMessage()               {}
228
+func (*DeleteCheckpointResponse) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{12} }
229
+
230
+type ListCheckpointRequest struct {
231
+	Id string `protobuf:"bytes,1,opt,name=id" json:"id,omitempty"`
232
+}
233
+
234
+func (m *ListCheckpointRequest) Reset()                    { *m = ListCheckpointRequest{} }
235
+func (m *ListCheckpointRequest) String() string            { return proto.CompactTextString(m) }
236
+func (*ListCheckpointRequest) ProtoMessage()               {}
237
+func (*ListCheckpointRequest) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{13} }
238
+
239
+type Checkpoint struct {
240
+	Name        string `protobuf:"bytes,1,opt,name=name" json:"name,omitempty"`
241
+	Exit        bool   `protobuf:"varint,2,opt,name=exit" json:"exit,omitempty"`
242
+	Tcp         bool   `protobuf:"varint,3,opt,name=tcp" json:"tcp,omitempty"`
243
+	UnixSockets bool   `protobuf:"varint,4,opt,name=unixSockets" json:"unixSockets,omitempty"`
244
+	Shell       bool   `protobuf:"varint,5,opt,name=shell" json:"shell,omitempty"`
245
+}
246
+
247
+func (m *Checkpoint) Reset()                    { *m = Checkpoint{} }
248
+func (m *Checkpoint) String() string            { return proto.CompactTextString(m) }
249
+func (*Checkpoint) ProtoMessage()               {}
250
+func (*Checkpoint) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{14} }
251
+
252
+type ListCheckpointResponse struct {
253
+	Checkpoints []*Checkpoint `protobuf:"bytes,1,rep,name=checkpoints" json:"checkpoints,omitempty"`
254
+}
255
+
256
+func (m *ListCheckpointResponse) Reset()                    { *m = ListCheckpointResponse{} }
257
+func (m *ListCheckpointResponse) String() string            { return proto.CompactTextString(m) }
258
+func (*ListCheckpointResponse) ProtoMessage()               {}
259
+func (*ListCheckpointResponse) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{15} }
260
+
261
+func (m *ListCheckpointResponse) GetCheckpoints() []*Checkpoint {
262
+	if m != nil {
263
+		return m.Checkpoints
264
+	}
265
+	return nil
266
+}
267
+
268
+type StateRequest struct {
269
+	Id string `protobuf:"bytes,1,opt,name=id" json:"id,omitempty"`
270
+}
271
+
272
+func (m *StateRequest) Reset()                    { *m = StateRequest{} }
273
+func (m *StateRequest) String() string            { return proto.CompactTextString(m) }
274
+func (*StateRequest) ProtoMessage()               {}
275
+func (*StateRequest) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{16} }
276
+
277
+type ContainerState struct {
278
+	Status string `protobuf:"bytes,1,opt,name=status" json:"status,omitempty"`
279
+}
280
+
281
+func (m *ContainerState) Reset()                    { *m = ContainerState{} }
282
+func (m *ContainerState) String() string            { return proto.CompactTextString(m) }
283
+func (*ContainerState) ProtoMessage()               {}
284
+func (*ContainerState) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{17} }
285
+
286
+type Process struct {
287
+	Pid             string   `protobuf:"bytes,1,opt,name=pid" json:"pid,omitempty"`
288
+	Terminal        bool     `protobuf:"varint,2,opt,name=terminal" json:"terminal,omitempty"`
289
+	User            *User    `protobuf:"bytes,3,opt,name=user" json:"user,omitempty"`
290
+	Args            []string `protobuf:"bytes,4,rep,name=args" json:"args,omitempty"`
291
+	Env             []string `protobuf:"bytes,5,rep,name=env" json:"env,omitempty"`
292
+	Cwd             string   `protobuf:"bytes,6,opt,name=cwd" json:"cwd,omitempty"`
293
+	SystemPid       uint32   `protobuf:"varint,7,opt,name=systemPid" json:"systemPid,omitempty"`
294
+	Stdin           string   `protobuf:"bytes,8,opt,name=stdin" json:"stdin,omitempty"`
295
+	Stdout          string   `protobuf:"bytes,9,opt,name=stdout" json:"stdout,omitempty"`
296
+	Stderr          string   `protobuf:"bytes,10,opt,name=stderr" json:"stderr,omitempty"`
297
+	Capabilities    []string `protobuf:"bytes,11,rep,name=capabilities" json:"capabilities,omitempty"`
298
+	ApparmorProfile string   `protobuf:"bytes,12,opt,name=apparmorProfile" json:"apparmorProfile,omitempty"`
299
+	SelinuxLabel    string   `protobuf:"bytes,13,opt,name=selinuxLabel" json:"selinuxLabel,omitempty"`
300
+	NoNewPrivileges bool     `protobuf:"varint,14,opt,name=noNewPrivileges" json:"noNewPrivileges,omitempty"`
301
+}
302
+
303
+func (m *Process) Reset()                    { *m = Process{} }
304
+func (m *Process) String() string            { return proto.CompactTextString(m) }
305
+func (*Process) ProtoMessage()               {}
306
+func (*Process) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{18} }
307
+
308
+func (m *Process) GetUser() *User {
309
+	if m != nil {
310
+		return m.User
311
+	}
312
+	return nil
313
+}
314
+
315
+type Container struct {
316
+	Id         string     `protobuf:"bytes,1,opt,name=id" json:"id,omitempty"`
317
+	BundlePath string     `protobuf:"bytes,2,opt,name=bundlePath" json:"bundlePath,omitempty"`
318
+	Processes  []*Process `protobuf:"bytes,3,rep,name=processes" json:"processes,omitempty"`
319
+	Status     string     `protobuf:"bytes,4,opt,name=status" json:"status,omitempty"`
320
+	Labels     []string   `protobuf:"bytes,5,rep,name=labels" json:"labels,omitempty"`
321
+	Pids       []uint32   `protobuf:"varint,6,rep,name=pids" json:"pids,omitempty"`
322
+	Runtime    string     `protobuf:"bytes,7,opt,name=runtime" json:"runtime,omitempty"`
323
+}
324
+
325
+func (m *Container) Reset()                    { *m = Container{} }
326
+func (m *Container) String() string            { return proto.CompactTextString(m) }
327
+func (*Container) ProtoMessage()               {}
328
+func (*Container) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{19} }
329
+
330
+func (m *Container) GetProcesses() []*Process {
331
+	if m != nil {
332
+		return m.Processes
333
+	}
334
+	return nil
335
+}
336
+
337
+// Machine is information about machine on which containerd is run
338
+type Machine struct {
339
+	Cpus   uint32 `protobuf:"varint,1,opt,name=cpus" json:"cpus,omitempty"`
340
+	Memory uint64 `protobuf:"varint,2,opt,name=memory" json:"memory,omitempty"`
341
+}
342
+
343
+func (m *Machine) Reset()                    { *m = Machine{} }
344
+func (m *Machine) String() string            { return proto.CompactTextString(m) }
345
+func (*Machine) ProtoMessage()               {}
346
+func (*Machine) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{20} }
347
+
348
+// StateResponse is information about containerd daemon
349
+type StateResponse struct {
350
+	Containers []*Container `protobuf:"bytes,1,rep,name=containers" json:"containers,omitempty"`
351
+	Machine    *Machine     `protobuf:"bytes,2,opt,name=machine" json:"machine,omitempty"`
352
+}
353
+
354
+func (m *StateResponse) Reset()                    { *m = StateResponse{} }
355
+func (m *StateResponse) String() string            { return proto.CompactTextString(m) }
356
+func (*StateResponse) ProtoMessage()               {}
357
+func (*StateResponse) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{21} }
358
+
359
+func (m *StateResponse) GetContainers() []*Container {
360
+	if m != nil {
361
+		return m.Containers
362
+	}
363
+	return nil
364
+}
365
+
366
+func (m *StateResponse) GetMachine() *Machine {
367
+	if m != nil {
368
+		return m.Machine
369
+	}
370
+	return nil
371
+}
372
+
373
+type UpdateContainerRequest struct {
374
+	Id        string          `protobuf:"bytes,1,opt,name=id" json:"id,omitempty"`
375
+	Pid       string          `protobuf:"bytes,2,opt,name=pid" json:"pid,omitempty"`
376
+	Status    string          `protobuf:"bytes,3,opt,name=status" json:"status,omitempty"`
377
+	Resources *UpdateResource `protobuf:"bytes,4,opt,name=resources" json:"resources,omitempty"`
378
+}
379
+
380
+func (m *UpdateContainerRequest) Reset()                    { *m = UpdateContainerRequest{} }
381
+func (m *UpdateContainerRequest) String() string            { return proto.CompactTextString(m) }
382
+func (*UpdateContainerRequest) ProtoMessage()               {}
383
+func (*UpdateContainerRequest) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{22} }
384
+
385
+func (m *UpdateContainerRequest) GetResources() *UpdateResource {
386
+	if m != nil {
387
+		return m.Resources
388
+	}
389
+	return nil
390
+}
391
+
392
+type UpdateResource struct {
393
+	BlkioWeight       uint32 `protobuf:"varint,1,opt,name=blkioWeight" json:"blkioWeight,omitempty"`
394
+	CpuShares         uint32 `protobuf:"varint,2,opt,name=cpuShares" json:"cpuShares,omitempty"`
395
+	CpuPeriod         uint32 `protobuf:"varint,3,opt,name=cpuPeriod" json:"cpuPeriod,omitempty"`
396
+	CpuQuota          uint32 `protobuf:"varint,4,opt,name=cpuQuota" json:"cpuQuota,omitempty"`
397
+	CpusetCpus        string `protobuf:"bytes,5,opt,name=cpusetCpus" json:"cpusetCpus,omitempty"`
398
+	CpusetMems        string `protobuf:"bytes,6,opt,name=cpusetMems" json:"cpusetMems,omitempty"`
399
+	MemoryLimit       uint32 `protobuf:"varint,7,opt,name=memoryLimit" json:"memoryLimit,omitempty"`
400
+	MemorySwap        uint32 `protobuf:"varint,8,opt,name=memorySwap" json:"memorySwap,omitempty"`
401
+	MemoryReservation uint32 `protobuf:"varint,9,opt,name=memoryReservation" json:"memoryReservation,omitempty"`
402
+	KernelMemoryLimit uint32 `protobuf:"varint,10,opt,name=kernelMemoryLimit" json:"kernelMemoryLimit,omitempty"`
403
+}
404
+
405
+func (m *UpdateResource) Reset()                    { *m = UpdateResource{} }
406
+func (m *UpdateResource) String() string            { return proto.CompactTextString(m) }
407
+func (*UpdateResource) ProtoMessage()               {}
408
+func (*UpdateResource) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{23} }
409
+
410
+type UpdateContainerResponse struct {
411
+}
412
+
413
+func (m *UpdateContainerResponse) Reset()                    { *m = UpdateContainerResponse{} }
414
+func (m *UpdateContainerResponse) String() string            { return proto.CompactTextString(m) }
415
+func (*UpdateContainerResponse) ProtoMessage()               {}
416
+func (*UpdateContainerResponse) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{24} }
417
+
418
+type EventsRequest struct {
419
+	Timestamp uint64 `protobuf:"varint,1,opt,name=timestamp" json:"timestamp,omitempty"`
420
+}
421
+
422
+func (m *EventsRequest) Reset()                    { *m = EventsRequest{} }
423
+func (m *EventsRequest) String() string            { return proto.CompactTextString(m) }
424
+func (*EventsRequest) ProtoMessage()               {}
425
+func (*EventsRequest) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{25} }
426
+
427
+type Event struct {
428
+	Type      string `protobuf:"bytes,1,opt,name=type" json:"type,omitempty"`
429
+	Id        string `protobuf:"bytes,2,opt,name=id" json:"id,omitempty"`
430
+	Status    uint32 `protobuf:"varint,3,opt,name=status" json:"status,omitempty"`
431
+	Pid       string `protobuf:"bytes,4,opt,name=pid" json:"pid,omitempty"`
432
+	Timestamp uint64 `protobuf:"varint,5,opt,name=timestamp" json:"timestamp,omitempty"`
433
+}
434
+
435
+func (m *Event) Reset()                    { *m = Event{} }
436
+func (m *Event) String() string            { return proto.CompactTextString(m) }
437
+func (*Event) ProtoMessage()               {}
438
+func (*Event) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{26} }
439
+
440
+type NetworkStats struct {
441
+	Name       string `protobuf:"bytes,1,opt,name=name" json:"name,omitempty"`
442
+	RxBytes    uint64 `protobuf:"varint,2,opt,name=rx_bytes" json:"rx_bytes,omitempty"`
443
+	Rx_Packets uint64 `protobuf:"varint,3,opt,name=rx_Packets" json:"rx_Packets,omitempty"`
444
+	RxErrors   uint64 `protobuf:"varint,4,opt,name=Rx_errors" json:"Rx_errors,omitempty"`
445
+	RxDropped  uint64 `protobuf:"varint,5,opt,name=Rx_dropped" json:"Rx_dropped,omitempty"`
446
+	TxBytes    uint64 `protobuf:"varint,6,opt,name=Tx_bytes" json:"Tx_bytes,omitempty"`
447
+	TxPackets  uint64 `protobuf:"varint,7,opt,name=Tx_packets" json:"Tx_packets,omitempty"`
448
+	TxErrors   uint64 `protobuf:"varint,8,opt,name=Tx_errors" json:"Tx_errors,omitempty"`
449
+	TxDropped  uint64 `protobuf:"varint,9,opt,name=Tx_dropped" json:"Tx_dropped,omitempty"`
450
+}
451
+
452
+func (m *NetworkStats) Reset()                    { *m = NetworkStats{} }
453
+func (m *NetworkStats) String() string            { return proto.CompactTextString(m) }
454
+func (*NetworkStats) ProtoMessage()               {}
455
+func (*NetworkStats) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{27} }
456
+
457
+type CpuUsage struct {
458
+	TotalUsage        uint64   `protobuf:"varint,1,opt,name=total_usage" json:"total_usage,omitempty"`
459
+	PercpuUsage       []uint64 `protobuf:"varint,2,rep,name=percpu_usage" json:"percpu_usage,omitempty"`
460
+	UsageInKernelmode uint64   `protobuf:"varint,3,opt,name=usage_in_kernelmode" json:"usage_in_kernelmode,omitempty"`
461
+	UsageInUsermode   uint64   `protobuf:"varint,4,opt,name=usage_in_usermode" json:"usage_in_usermode,omitempty"`
462
+}
463
+
464
+func (m *CpuUsage) Reset()                    { *m = CpuUsage{} }
465
+func (m *CpuUsage) String() string            { return proto.CompactTextString(m) }
466
+func (*CpuUsage) ProtoMessage()               {}
467
+func (*CpuUsage) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{28} }
468
+
469
+type ThrottlingData struct {
470
+	Periods          uint64 `protobuf:"varint,1,opt,name=periods" json:"periods,omitempty"`
471
+	ThrottledPeriods uint64 `protobuf:"varint,2,opt,name=throttled_periods" json:"throttled_periods,omitempty"`
472
+	ThrottledTime    uint64 `protobuf:"varint,3,opt,name=throttled_time" json:"throttled_time,omitempty"`
473
+}
474
+
475
+func (m *ThrottlingData) Reset()                    { *m = ThrottlingData{} }
476
+func (m *ThrottlingData) String() string            { return proto.CompactTextString(m) }
477
+func (*ThrottlingData) ProtoMessage()               {}
478
+func (*ThrottlingData) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{29} }
479
+
480
+type CpuStats struct {
481
+	CpuUsage       *CpuUsage       `protobuf:"bytes,1,opt,name=cpu_usage" json:"cpu_usage,omitempty"`
482
+	ThrottlingData *ThrottlingData `protobuf:"bytes,2,opt,name=throttling_data" json:"throttling_data,omitempty"`
483
+	SystemUsage    uint64          `protobuf:"varint,3,opt,name=system_usage" json:"system_usage,omitempty"`
484
+}
485
+
486
+func (m *CpuStats) Reset()                    { *m = CpuStats{} }
487
+func (m *CpuStats) String() string            { return proto.CompactTextString(m) }
488
+func (*CpuStats) ProtoMessage()               {}
489
+func (*CpuStats) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{30} }
490
+
491
+func (m *CpuStats) GetCpuUsage() *CpuUsage {
492
+	if m != nil {
493
+		return m.CpuUsage
494
+	}
495
+	return nil
496
+}
497
+
498
+func (m *CpuStats) GetThrottlingData() *ThrottlingData {
499
+	if m != nil {
500
+		return m.ThrottlingData
501
+	}
502
+	return nil
503
+}
504
+
505
+type PidsStats struct {
506
+	Current uint64 `protobuf:"varint,1,opt,name=current" json:"current,omitempty"`
507
+}
508
+
509
+func (m *PidsStats) Reset()                    { *m = PidsStats{} }
510
+func (m *PidsStats) String() string            { return proto.CompactTextString(m) }
511
+func (*PidsStats) ProtoMessage()               {}
512
+func (*PidsStats) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{31} }
513
+
514
+type MemoryData struct {
515
+	Usage    uint64 `protobuf:"varint,1,opt,name=usage" json:"usage,omitempty"`
516
+	MaxUsage uint64 `protobuf:"varint,2,opt,name=max_usage" json:"max_usage,omitempty"`
517
+	Failcnt  uint64 `protobuf:"varint,3,opt,name=failcnt" json:"failcnt,omitempty"`
518
+	Limit    uint64 `protobuf:"varint,4,opt,name=limit" json:"limit,omitempty"`
519
+}
520
+
521
+func (m *MemoryData) Reset()                    { *m = MemoryData{} }
522
+func (m *MemoryData) String() string            { return proto.CompactTextString(m) }
523
+func (*MemoryData) ProtoMessage()               {}
524
+func (*MemoryData) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{32} }
525
+
526
+type MemoryStats struct {
527
+	Cache       uint64            `protobuf:"varint,1,opt,name=cache" json:"cache,omitempty"`
528
+	Usage       *MemoryData       `protobuf:"bytes,2,opt,name=usage" json:"usage,omitempty"`
529
+	SwapUsage   *MemoryData       `protobuf:"bytes,3,opt,name=swap_usage" json:"swap_usage,omitempty"`
530
+	KernelUsage *MemoryData       `protobuf:"bytes,4,opt,name=kernel_usage" json:"kernel_usage,omitempty"`
531
+	Stats       map[string]uint64 `protobuf:"bytes,5,rep,name=stats" json:"stats,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"varint,2,opt,name=value"`
532
+}
533
+
534
+func (m *MemoryStats) Reset()                    { *m = MemoryStats{} }
535
+func (m *MemoryStats) String() string            { return proto.CompactTextString(m) }
536
+func (*MemoryStats) ProtoMessage()               {}
537
+func (*MemoryStats) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{33} }
538
+
539
+func (m *MemoryStats) GetUsage() *MemoryData {
540
+	if m != nil {
541
+		return m.Usage
542
+	}
543
+	return nil
544
+}
545
+
546
+func (m *MemoryStats) GetSwapUsage() *MemoryData {
547
+	if m != nil {
548
+		return m.SwapUsage
549
+	}
550
+	return nil
551
+}
552
+
553
+func (m *MemoryStats) GetKernelUsage() *MemoryData {
554
+	if m != nil {
555
+		return m.KernelUsage
556
+	}
557
+	return nil
558
+}
559
+
560
+func (m *MemoryStats) GetStats() map[string]uint64 {
561
+	if m != nil {
562
+		return m.Stats
563
+	}
564
+	return nil
565
+}
566
+
567
+type BlkioStatsEntry struct {
568
+	Major uint64 `protobuf:"varint,1,opt,name=major" json:"major,omitempty"`
569
+	Minor uint64 `protobuf:"varint,2,opt,name=minor" json:"minor,omitempty"`
570
+	Op    string `protobuf:"bytes,3,opt,name=op" json:"op,omitempty"`
571
+	Value uint64 `protobuf:"varint,4,opt,name=value" json:"value,omitempty"`
572
+}
573
+
574
+func (m *BlkioStatsEntry) Reset()                    { *m = BlkioStatsEntry{} }
575
+func (m *BlkioStatsEntry) String() string            { return proto.CompactTextString(m) }
576
+func (*BlkioStatsEntry) ProtoMessage()               {}
577
+func (*BlkioStatsEntry) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{34} }
578
+
579
+type BlkioStats struct {
580
+	IoServiceBytesRecursive []*BlkioStatsEntry `protobuf:"bytes,1,rep,name=io_service_bytes_recursive" json:"io_service_bytes_recursive,omitempty"`
581
+	IoServicedRecursive     []*BlkioStatsEntry `protobuf:"bytes,2,rep,name=io_serviced_recursive" json:"io_serviced_recursive,omitempty"`
582
+	IoQueuedRecursive       []*BlkioStatsEntry `protobuf:"bytes,3,rep,name=io_queued_recursive" json:"io_queued_recursive,omitempty"`
583
+	IoServiceTimeRecursive  []*BlkioStatsEntry `protobuf:"bytes,4,rep,name=io_service_time_recursive" json:"io_service_time_recursive,omitempty"`
584
+	IoWaitTimeRecursive     []*BlkioStatsEntry `protobuf:"bytes,5,rep,name=io_wait_time_recursive" json:"io_wait_time_recursive,omitempty"`
585
+	IoMergedRecursive       []*BlkioStatsEntry `protobuf:"bytes,6,rep,name=io_merged_recursive" json:"io_merged_recursive,omitempty"`
586
+	IoTimeRecursive         []*BlkioStatsEntry `protobuf:"bytes,7,rep,name=io_time_recursive" json:"io_time_recursive,omitempty"`
587
+	SectorsRecursive        []*BlkioStatsEntry `protobuf:"bytes,8,rep,name=sectors_recursive" json:"sectors_recursive,omitempty"`
588
+}
589
+
590
+func (m *BlkioStats) Reset()                    { *m = BlkioStats{} }
591
+func (m *BlkioStats) String() string            { return proto.CompactTextString(m) }
592
+func (*BlkioStats) ProtoMessage()               {}
593
+func (*BlkioStats) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{35} }
594
+
595
+func (m *BlkioStats) GetIoServiceBytesRecursive() []*BlkioStatsEntry {
596
+	if m != nil {
597
+		return m.IoServiceBytesRecursive
598
+	}
599
+	return nil
600
+}
601
+
602
+func (m *BlkioStats) GetIoServicedRecursive() []*BlkioStatsEntry {
603
+	if m != nil {
604
+		return m.IoServicedRecursive
605
+	}
606
+	return nil
607
+}
608
+
609
+func (m *BlkioStats) GetIoQueuedRecursive() []*BlkioStatsEntry {
610
+	if m != nil {
611
+		return m.IoQueuedRecursive
612
+	}
613
+	return nil
614
+}
615
+
616
+func (m *BlkioStats) GetIoServiceTimeRecursive() []*BlkioStatsEntry {
617
+	if m != nil {
618
+		return m.IoServiceTimeRecursive
619
+	}
620
+	return nil
621
+}
622
+
623
+func (m *BlkioStats) GetIoWaitTimeRecursive() []*BlkioStatsEntry {
624
+	if m != nil {
625
+		return m.IoWaitTimeRecursive
626
+	}
627
+	return nil
628
+}
629
+
630
+func (m *BlkioStats) GetIoMergedRecursive() []*BlkioStatsEntry {
631
+	if m != nil {
632
+		return m.IoMergedRecursive
633
+	}
634
+	return nil
635
+}
636
+
637
+func (m *BlkioStats) GetIoTimeRecursive() []*BlkioStatsEntry {
638
+	if m != nil {
639
+		return m.IoTimeRecursive
640
+	}
641
+	return nil
642
+}
643
+
644
+func (m *BlkioStats) GetSectorsRecursive() []*BlkioStatsEntry {
645
+	if m != nil {
646
+		return m.SectorsRecursive
647
+	}
648
+	return nil
649
+}
650
+
651
+type HugetlbStats struct {
652
+	Usage    uint64 `protobuf:"varint,1,opt,name=usage" json:"usage,omitempty"`
653
+	MaxUsage uint64 `protobuf:"varint,2,opt,name=max_usage" json:"max_usage,omitempty"`
654
+	Failcnt  uint64 `protobuf:"varint,3,opt,name=failcnt" json:"failcnt,omitempty"`
655
+	Limit    uint64 `protobuf:"varint,4,opt,name=limit" json:"limit,omitempty"`
656
+}
657
+
658
+func (m *HugetlbStats) Reset()                    { *m = HugetlbStats{} }
659
+func (m *HugetlbStats) String() string            { return proto.CompactTextString(m) }
660
+func (*HugetlbStats) ProtoMessage()               {}
661
+func (*HugetlbStats) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{36} }
662
+
663
+type CgroupStats struct {
664
+	CpuStats     *CpuStats                `protobuf:"bytes,1,opt,name=cpu_stats" json:"cpu_stats,omitempty"`
665
+	MemoryStats  *MemoryStats             `protobuf:"bytes,2,opt,name=memory_stats" json:"memory_stats,omitempty"`
666
+	BlkioStats   *BlkioStats              `protobuf:"bytes,3,opt,name=blkio_stats" json:"blkio_stats,omitempty"`
667
+	HugetlbStats map[string]*HugetlbStats `protobuf:"bytes,4,rep,name=hugetlb_stats" json:"hugetlb_stats,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
668
+	PidsStats    *PidsStats               `protobuf:"bytes,5,opt,name=pids_stats" json:"pids_stats,omitempty"`
669
+}
670
+
671
+func (m *CgroupStats) Reset()                    { *m = CgroupStats{} }
672
+func (m *CgroupStats) String() string            { return proto.CompactTextString(m) }
673
+func (*CgroupStats) ProtoMessage()               {}
674
+func (*CgroupStats) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{37} }
675
+
676
+func (m *CgroupStats) GetCpuStats() *CpuStats {
677
+	if m != nil {
678
+		return m.CpuStats
679
+	}
680
+	return nil
681
+}
682
+
683
+func (m *CgroupStats) GetMemoryStats() *MemoryStats {
684
+	if m != nil {
685
+		return m.MemoryStats
686
+	}
687
+	return nil
688
+}
689
+
690
+func (m *CgroupStats) GetBlkioStats() *BlkioStats {
691
+	if m != nil {
692
+		return m.BlkioStats
693
+	}
694
+	return nil
695
+}
696
+
697
+func (m *CgroupStats) GetHugetlbStats() map[string]*HugetlbStats {
698
+	if m != nil {
699
+		return m.HugetlbStats
700
+	}
701
+	return nil
702
+}
703
+
704
+func (m *CgroupStats) GetPidsStats() *PidsStats {
705
+	if m != nil {
706
+		return m.PidsStats
707
+	}
708
+	return nil
709
+}
710
+
711
+type StatsResponse struct {
712
+	NetworkStats []*NetworkStats `protobuf:"bytes,1,rep,name=network_stats" json:"network_stats,omitempty"`
713
+	CgroupStats  *CgroupStats    `protobuf:"bytes,2,opt,name=cgroup_stats" json:"cgroup_stats,omitempty"`
714
+	Timestamp    uint64          `protobuf:"varint,3,opt,name=timestamp" json:"timestamp,omitempty"`
715
+}
716
+
717
+func (m *StatsResponse) Reset()                    { *m = StatsResponse{} }
718
+func (m *StatsResponse) String() string            { return proto.CompactTextString(m) }
719
+func (*StatsResponse) ProtoMessage()               {}
720
+func (*StatsResponse) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{38} }
721
+
722
+func (m *StatsResponse) GetNetworkStats() []*NetworkStats {
723
+	if m != nil {
724
+		return m.NetworkStats
725
+	}
726
+	return nil
727
+}
728
+
729
+func (m *StatsResponse) GetCgroupStats() *CgroupStats {
730
+	if m != nil {
731
+		return m.CgroupStats
732
+	}
733
+	return nil
734
+}
735
+
736
+type StatsRequest struct {
737
+	Id string `protobuf:"bytes,1,opt,name=id" json:"id,omitempty"`
738
+}
739
+
740
+func (m *StatsRequest) Reset()                    { *m = StatsRequest{} }
741
+func (m *StatsRequest) String() string            { return proto.CompactTextString(m) }
742
+func (*StatsRequest) ProtoMessage()               {}
743
+func (*StatsRequest) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{39} }
744
+
745
+func init() {
746
+	proto.RegisterType((*UpdateProcessRequest)(nil), "types.UpdateProcessRequest")
747
+	proto.RegisterType((*UpdateProcessResponse)(nil), "types.UpdateProcessResponse")
748
+	proto.RegisterType((*CreateContainerRequest)(nil), "types.CreateContainerRequest")
749
+	proto.RegisterType((*CreateContainerResponse)(nil), "types.CreateContainerResponse")
750
+	proto.RegisterType((*SignalRequest)(nil), "types.SignalRequest")
751
+	proto.RegisterType((*SignalResponse)(nil), "types.SignalResponse")
752
+	proto.RegisterType((*AddProcessRequest)(nil), "types.AddProcessRequest")
753
+	proto.RegisterType((*User)(nil), "types.User")
754
+	proto.RegisterType((*AddProcessResponse)(nil), "types.AddProcessResponse")
755
+	proto.RegisterType((*CreateCheckpointRequest)(nil), "types.CreateCheckpointRequest")
756
+	proto.RegisterType((*CreateCheckpointResponse)(nil), "types.CreateCheckpointResponse")
757
+	proto.RegisterType((*DeleteCheckpointRequest)(nil), "types.DeleteCheckpointRequest")
758
+	proto.RegisterType((*DeleteCheckpointResponse)(nil), "types.DeleteCheckpointResponse")
759
+	proto.RegisterType((*ListCheckpointRequest)(nil), "types.ListCheckpointRequest")
760
+	proto.RegisterType((*Checkpoint)(nil), "types.Checkpoint")
761
+	proto.RegisterType((*ListCheckpointResponse)(nil), "types.ListCheckpointResponse")
762
+	proto.RegisterType((*StateRequest)(nil), "types.StateRequest")
763
+	proto.RegisterType((*ContainerState)(nil), "types.ContainerState")
764
+	proto.RegisterType((*Process)(nil), "types.Process")
765
+	proto.RegisterType((*Container)(nil), "types.Container")
766
+	proto.RegisterType((*Machine)(nil), "types.Machine")
767
+	proto.RegisterType((*StateResponse)(nil), "types.StateResponse")
768
+	proto.RegisterType((*UpdateContainerRequest)(nil), "types.UpdateContainerRequest")
769
+	proto.RegisterType((*UpdateResource)(nil), "types.UpdateResource")
770
+	proto.RegisterType((*UpdateContainerResponse)(nil), "types.UpdateContainerResponse")
771
+	proto.RegisterType((*EventsRequest)(nil), "types.EventsRequest")
772
+	proto.RegisterType((*Event)(nil), "types.Event")
773
+	proto.RegisterType((*NetworkStats)(nil), "types.NetworkStats")
774
+	proto.RegisterType((*CpuUsage)(nil), "types.CpuUsage")
775
+	proto.RegisterType((*ThrottlingData)(nil), "types.ThrottlingData")
776
+	proto.RegisterType((*CpuStats)(nil), "types.CpuStats")
777
+	proto.RegisterType((*PidsStats)(nil), "types.PidsStats")
778
+	proto.RegisterType((*MemoryData)(nil), "types.MemoryData")
779
+	proto.RegisterType((*MemoryStats)(nil), "types.MemoryStats")
780
+	proto.RegisterType((*BlkioStatsEntry)(nil), "types.BlkioStatsEntry")
781
+	proto.RegisterType((*BlkioStats)(nil), "types.BlkioStats")
782
+	proto.RegisterType((*HugetlbStats)(nil), "types.HugetlbStats")
783
+	proto.RegisterType((*CgroupStats)(nil), "types.CgroupStats")
784
+	proto.RegisterType((*StatsResponse)(nil), "types.StatsResponse")
785
+	proto.RegisterType((*StatsRequest)(nil), "types.StatsRequest")
786
+}
787
+
788
+// Reference imports to suppress errors if they are not otherwise used.
789
+var _ context.Context
790
+var _ grpc.ClientConn
791
+
792
+// Client API for API service
793
+
794
+type APIClient interface {
795
+	CreateContainer(ctx context.Context, in *CreateContainerRequest, opts ...grpc.CallOption) (*CreateContainerResponse, error)
796
+	UpdateContainer(ctx context.Context, in *UpdateContainerRequest, opts ...grpc.CallOption) (*UpdateContainerResponse, error)
797
+	Signal(ctx context.Context, in *SignalRequest, opts ...grpc.CallOption) (*SignalResponse, error)
798
+	UpdateProcess(ctx context.Context, in *UpdateProcessRequest, opts ...grpc.CallOption) (*UpdateProcessResponse, error)
799
+	AddProcess(ctx context.Context, in *AddProcessRequest, opts ...grpc.CallOption) (*AddProcessResponse, error)
800
+	CreateCheckpoint(ctx context.Context, in *CreateCheckpointRequest, opts ...grpc.CallOption) (*CreateCheckpointResponse, error)
801
+	DeleteCheckpoint(ctx context.Context, in *DeleteCheckpointRequest, opts ...grpc.CallOption) (*DeleteCheckpointResponse, error)
802
+	ListCheckpoint(ctx context.Context, in *ListCheckpointRequest, opts ...grpc.CallOption) (*ListCheckpointResponse, error)
803
+	State(ctx context.Context, in *StateRequest, opts ...grpc.CallOption) (*StateResponse, error)
804
+	Events(ctx context.Context, in *EventsRequest, opts ...grpc.CallOption) (API_EventsClient, error)
805
+	Stats(ctx context.Context, in *StatsRequest, opts ...grpc.CallOption) (*StatsResponse, error)
806
+}
807
+
808
+type aPIClient struct {
809
+	cc *grpc.ClientConn
810
+}
811
+
812
+func NewAPIClient(cc *grpc.ClientConn) APIClient {
813
+	return &aPIClient{cc}
814
+}
815
+
816
+func (c *aPIClient) CreateContainer(ctx context.Context, in *CreateContainerRequest, opts ...grpc.CallOption) (*CreateContainerResponse, error) {
817
+	out := new(CreateContainerResponse)
818
+	err := grpc.Invoke(ctx, "/types.API/CreateContainer", in, out, c.cc, opts...)
819
+	if err != nil {
820
+		return nil, err
821
+	}
822
+	return out, nil
823
+}
824
+
825
+func (c *aPIClient) UpdateContainer(ctx context.Context, in *UpdateContainerRequest, opts ...grpc.CallOption) (*UpdateContainerResponse, error) {
826
+	out := new(UpdateContainerResponse)
827
+	err := grpc.Invoke(ctx, "/types.API/UpdateContainer", in, out, c.cc, opts...)
828
+	if err != nil {
829
+		return nil, err
830
+	}
831
+	return out, nil
832
+}
833
+
834
+func (c *aPIClient) Signal(ctx context.Context, in *SignalRequest, opts ...grpc.CallOption) (*SignalResponse, error) {
835
+	out := new(SignalResponse)
836
+	err := grpc.Invoke(ctx, "/types.API/Signal", in, out, c.cc, opts...)
837
+	if err != nil {
838
+		return nil, err
839
+	}
840
+	return out, nil
841
+}
842
+
843
+func (c *aPIClient) UpdateProcess(ctx context.Context, in *UpdateProcessRequest, opts ...grpc.CallOption) (*UpdateProcessResponse, error) {
844
+	out := new(UpdateProcessResponse)
845
+	err := grpc.Invoke(ctx, "/types.API/UpdateProcess", in, out, c.cc, opts...)
846
+	if err != nil {
847
+		return nil, err
848
+	}
849
+	return out, nil
850
+}
851
+
852
+func (c *aPIClient) AddProcess(ctx context.Context, in *AddProcessRequest, opts ...grpc.CallOption) (*AddProcessResponse, error) {
853
+	out := new(AddProcessResponse)
854
+	err := grpc.Invoke(ctx, "/types.API/AddProcess", in, out, c.cc, opts...)
855
+	if err != nil {
856
+		return nil, err
857
+	}
858
+	return out, nil
859
+}
860
+
861
+func (c *aPIClient) CreateCheckpoint(ctx context.Context, in *CreateCheckpointRequest, opts ...grpc.CallOption) (*CreateCheckpointResponse, error) {
862
+	out := new(CreateCheckpointResponse)
863
+	err := grpc.Invoke(ctx, "/types.API/CreateCheckpoint", in, out, c.cc, opts...)
864
+	if err != nil {
865
+		return nil, err
866
+	}
867
+	return out, nil
868
+}
869
+
870
+func (c *aPIClient) DeleteCheckpoint(ctx context.Context, in *DeleteCheckpointRequest, opts ...grpc.CallOption) (*DeleteCheckpointResponse, error) {
871
+	out := new(DeleteCheckpointResponse)
872
+	err := grpc.Invoke(ctx, "/types.API/DeleteCheckpoint", in, out, c.cc, opts...)
873
+	if err != nil {
874
+		return nil, err
875
+	}
876
+	return out, nil
877
+}
878
+
879
+func (c *aPIClient) ListCheckpoint(ctx context.Context, in *ListCheckpointRequest, opts ...grpc.CallOption) (*ListCheckpointResponse, error) {
880
+	out := new(ListCheckpointResponse)
881
+	err := grpc.Invoke(ctx, "/types.API/ListCheckpoint", in, out, c.cc, opts...)
882
+	if err != nil {
883
+		return nil, err
884
+	}
885
+	return out, nil
886
+}
887
+
888
+func (c *aPIClient) State(ctx context.Context, in *StateRequest, opts ...grpc.CallOption) (*StateResponse, error) {
889
+	out := new(StateResponse)
890
+	err := grpc.Invoke(ctx, "/types.API/State", in, out, c.cc, opts...)
891
+	if err != nil {
892
+		return nil, err
893
+	}
894
+	return out, nil
895
+}
896
+
897
+func (c *aPIClient) Events(ctx context.Context, in *EventsRequest, opts ...grpc.CallOption) (API_EventsClient, error) {
898
+	stream, err := grpc.NewClientStream(ctx, &_API_serviceDesc.Streams[0], c.cc, "/types.API/Events", opts...)
899
+	if err != nil {
900
+		return nil, err
901
+	}
902
+	x := &aPIEventsClient{stream}
903
+	if err := x.ClientStream.SendMsg(in); err != nil {
904
+		return nil, err
905
+	}
906
+	if err := x.ClientStream.CloseSend(); err != nil {
907
+		return nil, err
908
+	}
909
+	return x, nil
910
+}
911
+
912
+type API_EventsClient interface {
913
+	Recv() (*Event, error)
914
+	grpc.ClientStream
915
+}
916
+
917
+type aPIEventsClient struct {
918
+	grpc.ClientStream
919
+}
920
+
921
+func (x *aPIEventsClient) Recv() (*Event, error) {
922
+	m := new(Event)
923
+	if err := x.ClientStream.RecvMsg(m); err != nil {
924
+		return nil, err
925
+	}
926
+	return m, nil
927
+}
928
+
929
+func (c *aPIClient) Stats(ctx context.Context, in *StatsRequest, opts ...grpc.CallOption) (*StatsResponse, error) {
930
+	out := new(StatsResponse)
931
+	err := grpc.Invoke(ctx, "/types.API/Stats", in, out, c.cc, opts...)
932
+	if err != nil {
933
+		return nil, err
934
+	}
935
+	return out, nil
936
+}
937
+
938
+// Server API for API service
939
+
940
+type APIServer interface {
941
+	CreateContainer(context.Context, *CreateContainerRequest) (*CreateContainerResponse, error)
942
+	UpdateContainer(context.Context, *UpdateContainerRequest) (*UpdateContainerResponse, error)
943
+	Signal(context.Context, *SignalRequest) (*SignalResponse, error)
944
+	UpdateProcess(context.Context, *UpdateProcessRequest) (*UpdateProcessResponse, error)
945
+	AddProcess(context.Context, *AddProcessRequest) (*AddProcessResponse, error)
946
+	CreateCheckpoint(context.Context, *CreateCheckpointRequest) (*CreateCheckpointResponse, error)
947
+	DeleteCheckpoint(context.Context, *DeleteCheckpointRequest) (*DeleteCheckpointResponse, error)
948
+	ListCheckpoint(context.Context, *ListCheckpointRequest) (*ListCheckpointResponse, error)
949
+	State(context.Context, *StateRequest) (*StateResponse, error)
950
+	Events(*EventsRequest, API_EventsServer) error
951
+	Stats(context.Context, *StatsRequest) (*StatsResponse, error)
952
+}
953
+
954
+func RegisterAPIServer(s *grpc.Server, srv APIServer) {
955
+	s.RegisterService(&_API_serviceDesc, srv)
956
+}
957
+
958
+func _API_CreateContainer_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error) (interface{}, error) {
959
+	in := new(CreateContainerRequest)
960
+	if err := dec(in); err != nil {
961
+		return nil, err
962
+	}
963
+	out, err := srv.(APIServer).CreateContainer(ctx, in)
964
+	if err != nil {
965
+		return nil, err
966
+	}
967
+	return out, nil
968
+}
969
+
970
+func _API_UpdateContainer_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error) (interface{}, error) {
971
+	in := new(UpdateContainerRequest)
972
+	if err := dec(in); err != nil {
973
+		return nil, err
974
+	}
975
+	out, err := srv.(APIServer).UpdateContainer(ctx, in)
976
+	if err != nil {
977
+		return nil, err
978
+	}
979
+	return out, nil
980
+}
981
+
982
+func _API_Signal_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error) (interface{}, error) {
983
+	in := new(SignalRequest)
984
+	if err := dec(in); err != nil {
985
+		return nil, err
986
+	}
987
+	out, err := srv.(APIServer).Signal(ctx, in)
988
+	if err != nil {
989
+		return nil, err
990
+	}
991
+	return out, nil
992
+}
993
+
994
+func _API_UpdateProcess_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error) (interface{}, error) {
995
+	in := new(UpdateProcessRequest)
996
+	if err := dec(in); err != nil {
997
+		return nil, err
998
+	}
999
+	out, err := srv.(APIServer).UpdateProcess(ctx, in)
1000
+	if err != nil {
1001
+		return nil, err
1002
+	}
1003
+	return out, nil
1004
+}
1005
+
1006
+func _API_AddProcess_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error) (interface{}, error) {
1007
+	in := new(AddProcessRequest)
1008
+	if err := dec(in); err != nil {
1009
+		return nil, err
1010
+	}
1011
+	out, err := srv.(APIServer).AddProcess(ctx, in)
1012
+	if err != nil {
1013
+		return nil, err
1014
+	}
1015
+	return out, nil
1016
+}
1017
+
1018
+func _API_CreateCheckpoint_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error) (interface{}, error) {
1019
+	in := new(CreateCheckpointRequest)
1020
+	if err := dec(in); err != nil {
1021
+		return nil, err
1022
+	}
1023
+	out, err := srv.(APIServer).CreateCheckpoint(ctx, in)
1024
+	if err != nil {
1025
+		return nil, err
1026
+	}
1027
+	return out, nil
1028
+}
1029
+
1030
+func _API_DeleteCheckpoint_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error) (interface{}, error) {
1031
+	in := new(DeleteCheckpointRequest)
1032
+	if err := dec(in); err != nil {
1033
+		return nil, err
1034
+	}
1035
+	out, err := srv.(APIServer).DeleteCheckpoint(ctx, in)
1036
+	if err != nil {
1037
+		return nil, err
1038
+	}
1039
+	return out, nil
1040
+}
1041
+
1042
+func _API_ListCheckpoint_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error) (interface{}, error) {
1043
+	in := new(ListCheckpointRequest)
1044
+	if err := dec(in); err != nil {
1045
+		return nil, err
1046
+	}
1047
+	out, err := srv.(APIServer).ListCheckpoint(ctx, in)
1048
+	if err != nil {
1049
+		return nil, err
1050
+	}
1051
+	return out, nil
1052
+}
1053
+
1054
+func _API_State_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error) (interface{}, error) {
1055
+	in := new(StateRequest)
1056
+	if err := dec(in); err != nil {
1057
+		return nil, err
1058
+	}
1059
+	out, err := srv.(APIServer).State(ctx, in)
1060
+	if err != nil {
1061
+		return nil, err
1062
+	}
1063
+	return out, nil
1064
+}
1065
+
1066
+func _API_Events_Handler(srv interface{}, stream grpc.ServerStream) error {
1067
+	m := new(EventsRequest)
1068
+	if err := stream.RecvMsg(m); err != nil {
1069
+		return err
1070
+	}
1071
+	return srv.(APIServer).Events(m, &aPIEventsServer{stream})
1072
+}
1073
+
1074
+type API_EventsServer interface {
1075
+	Send(*Event) error
1076
+	grpc.ServerStream
1077
+}
1078
+
1079
+type aPIEventsServer struct {
1080
+	grpc.ServerStream
1081
+}
1082
+
1083
+func (x *aPIEventsServer) Send(m *Event) error {
1084
+	return x.ServerStream.SendMsg(m)
1085
+}
1086
+
1087
+func _API_Stats_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error) (interface{}, error) {
1088
+	in := new(StatsRequest)
1089
+	if err := dec(in); err != nil {
1090
+		return nil, err
1091
+	}
1092
+	out, err := srv.(APIServer).Stats(ctx, in)
1093
+	if err != nil {
1094
+		return nil, err
1095
+	}
1096
+	return out, nil
1097
+}
1098
+
1099
+var _API_serviceDesc = grpc.ServiceDesc{
1100
+	ServiceName: "types.API",
1101
+	HandlerType: (*APIServer)(nil),
1102
+	Methods: []grpc.MethodDesc{
1103
+		{
1104
+			MethodName: "CreateContainer",
1105
+			Handler:    _API_CreateContainer_Handler,
1106
+		},
1107
+		{
1108
+			MethodName: "UpdateContainer",
1109
+			Handler:    _API_UpdateContainer_Handler,
1110
+		},
1111
+		{
1112
+			MethodName: "Signal",
1113
+			Handler:    _API_Signal_Handler,
1114
+		},
1115
+		{
1116
+			MethodName: "UpdateProcess",
1117
+			Handler:    _API_UpdateProcess_Handler,
1118
+		},
1119
+		{
1120
+			MethodName: "AddProcess",
1121
+			Handler:    _API_AddProcess_Handler,
1122
+		},
1123
+		{
1124
+			MethodName: "CreateCheckpoint",
1125
+			Handler:    _API_CreateCheckpoint_Handler,
1126
+		},
1127
+		{
1128
+			MethodName: "DeleteCheckpoint",
1129
+			Handler:    _API_DeleteCheckpoint_Handler,
1130
+		},
1131
+		{
1132
+			MethodName: "ListCheckpoint",
1133
+			Handler:    _API_ListCheckpoint_Handler,
1134
+		},
1135
+		{
1136
+			MethodName: "State",
1137
+			Handler:    _API_State_Handler,
1138
+		},
1139
+		{
1140
+			MethodName: "Stats",
1141
+			Handler:    _API_Stats_Handler,
1142
+		},
1143
+	},
1144
+	Streams: []grpc.StreamDesc{
1145
+		{
1146
+			StreamName:    "Events",
1147
+			Handler:       _API_Events_Handler,
1148
+			ServerStreams: true,
1149
+		},
1150
+	},
1151
+}
1152
+
1153
+var fileDescriptor0 = []byte{
1154
+	// 2142 bytes of a gzipped FileDescriptorProto
1155
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x09, 0x6e, 0x88, 0x02, 0xff, 0xe4, 0x19, 0x4d, 0x6f, 0x23, 0x49,
1156
+	0x75, 0xfc, 0x11, 0xc7, 0x7e, 0xfe, 0x48, 0xdc, 0x93, 0x0f, 0x8f, 0x77, 0x67, 0x76, 0x68, 0xb1,
1157
+	0xec, 0x00, 0x4b, 0x18, 0x32, 0xbb, 0x62, 0x84, 0x04, 0xd2, 0x4e, 0x66, 0x80, 0x61, 0x27, 0x4b,
1158
+	0xa6, 0x93, 0x68, 0x2f, 0x48, 0x56, 0xc7, 0x5d, 0x6b, 0x37, 0x69, 0x77, 0xf7, 0x76, 0xb7, 0x13,
1159
+	0xe7, 0xc2, 0x11, 0x2e, 0x08, 0x71, 0xe2, 0x82, 0xc4, 0x85, 0x1b, 0x3f, 0x04, 0xfe, 0x09, 0xe2,
1160
+	0x27, 0x70, 0xe4, 0x55, 0xbd, 0xaa, 0xea, 0xea, 0xb6, 0x9d, 0x2c, 0x07, 0xc4, 0x61, 0x2f, 0x56,
1161
+	0xbd, 0x8f, 0x7a, 0xdf, 0xef, 0x55, 0x75, 0x19, 0x5a, 0x6e, 0xec, 0x1f, 0xc4, 0x49, 0x94, 0x45,
1162
+	0xd6, 0x46, 0x76, 0x13, 0xb3, 0xd4, 0xfe, 0x6d, 0x05, 0x76, 0xce, 0x63, 0xcf, 0xcd, 0xd8, 0x49,
1163
+	0x12, 0x8d, 0x59, 0x9a, 0x3a, 0xec, 0xcb, 0x39, 0x4b, 0x33, 0xab, 0x07, 0x55, 0xdf, 0x1b, 0x54,
1164
+	0x1e, 0x57, 0x9e, 0xb4, 0x1c, 0x5c, 0x59, 0xdb, 0x50, 0x8b, 0x11, 0x51, 0x15, 0x08, 0xbe, 0xb4,
1165
+	0x1e, 0x01, 0x8c, 0x83, 0x28, 0x65, 0xa7, 0x99, 0xe7, 0x87, 0x83, 0x1a, 0x12, 0x9a, 0x8e, 0x81,
1166
+	0xb1, 0x76, 0x60, 0xe3, 0xda, 0xf7, 0xb2, 0xe9, 0xa0, 0x8e, 0xa4, 0xae, 0x43, 0x80, 0xb5, 0x07,
1167
+	0x8d, 0x29, 0xf3, 0x27, 0xd3, 0x6c, 0xb0, 0x21, 0xd0, 0x12, 0xb2, 0xf7, 0x61, 0xb7, 0x64, 0x47,
1168
+	0x1a, 0x47, 0x61, 0xca, 0xec, 0xbf, 0x57, 0x60, 0xef, 0x28, 0x61, 0x48, 0x39, 0x8a, 0xc2, 0xcc,
1169
+	0xf5, 0x43, 0x96, 0xac, 0xb3, 0x11, 0x2d, 0xba, 0x98, 0x87, 0x5e, 0xc0, 0x4e, 0x5c, 0x54, 0x4b,
1170
+	0xa6, 0x1a, 0x18, 0x61, 0xf1, 0x94, 0x8d, 0x2f, 0xe3, 0xc8, 0x0f, 0x33, 0x61, 0x31, 0xd2, 0x73,
1171
+	0x0c, 0xb7, 0x38, 0x15, 0xce, 0xd4, 0x05, 0x89, 0x00, 0x6e, 0x31, 0x2e, 0xa2, 0x39, 0x59, 0xdc,
1172
+	0x72, 0x24, 0x24, 0xf1, 0x2c, 0x49, 0x06, 0x0d, 0x8d, 0x47, 0x88, 0xe3, 0x03, 0xf7, 0x82, 0x05,
1173
+	0xe9, 0x60, 0xf3, 0x71, 0x8d, 0xe3, 0x09, 0xb2, 0x5f, 0xc3, 0xfe, 0x92, 0x1f, 0xe4, 0xa3, 0x75,
1174
+	0x00, 0xad, 0xb1, 0x42, 0x0a, 0x7f, 0xda, 0x87, 0xdb, 0x07, 0x22, 0x41, 0x07, 0x39, 0x73, 0xce,
1175
+	0x82, 0xa2, 0xba, 0xa7, 0xfe, 0x24, 0x74, 0x83, 0xaf, 0x9e, 0x2d, 0x6e, 0xad, 0xd8, 0x22, 0xfc,
1176
+	0xc6, 0xb8, 0x13, 0x64, 0x6f, 0x43, 0x4f, 0x89, 0x92, 0x01, 0xff, 0x7d, 0x0d, 0xfa, 0x9f, 0x78,
1177
+	0xde, 0x1d, 0xf5, 0x30, 0x84, 0x66, 0xc6, 0x92, 0x99, 0xcf, 0x25, 0x56, 0x45, 0xee, 0x35, 0x6c,
1178
+	0xbd, 0x07, 0xf5, 0x79, 0x8a, 0x9e, 0xd4, 0x84, 0x27, 0x6d, 0xe9, 0xc9, 0x39, 0xa2, 0x1c, 0x41,
1179
+	0xb0, 0x2c, 0xa8, 0xbb, 0xc9, 0x24, 0xc5, 0x38, 0xf3, 0x00, 0x89, 0x35, 0x37, 0x99, 0x85, 0x57,
1180
+	0x18, 0x63, 0x8e, 0xe2, 0x4b, 0x8e, 0x19, 0x5f, 0x7b, 0x32, 0xba, 0x7c, 0xa9, 0xdc, 0xda, 0xcc,
1181
+	0xdd, 0xd2, 0x29, 0x6b, 0xae, 0x4e, 0x59, 0x6b, 0x4d, 0xca, 0xa0, 0x90, 0x32, 0x1b, 0x3a, 0x63,
1182
+	0x37, 0x76, 0x2f, 0xfc, 0xc0, 0xcf, 0x7c, 0x96, 0x0e, 0xda, 0xc2, 0x88, 0x02, 0xce, 0x7a, 0x02,
1183
+	0x5b, 0x6e, 0x1c, 0xbb, 0xc9, 0x2c, 0x4a, 0x30, 0x34, 0x5f, 0xf8, 0x01, 0x1b, 0x74, 0x84, 0x90,
1184
+	0x32, 0x9a, 0x4b, 0x4b, 0x59, 0xe0, 0x87, 0xf3, 0xc5, 0x1b, 0x9e, 0xf9, 0x41, 0x57, 0xb0, 0x15,
1185
+	0x70, 0x5c, 0x5a, 0x18, 0x7d, 0xc6, 0xae, 0x4f, 0x12, 0xff, 0x0a, 0xf7, 0x4c, 0x50, 0x69, 0x4f,
1186
+	0x44, 0xb1, 0x8c, 0xb6, 0x1d, 0xa8, 0xf3, 0xc8, 0x71, 0xdf, 0xe7, 0x32, 0x03, 0x5d, 0x87, 0x2f,
1187
+	0x39, 0x66, 0x22, 0x93, 0x8c, 0x18, 0x5c, 0x5a, 0xdf, 0x82, 0x9e, 0xeb, 0x79, 0x68, 0x6f, 0x84,
1188
+	0x69, 0xf8, 0x99, 0xef, 0xa5, 0x98, 0x82, 0x1a, 0x12, 0x4b, 0x58, 0x7b, 0x07, 0x2c, 0x33, 0xc3,
1189
+	0x32, 0xf1, 0xbf, 0xd2, 0x05, 0xaa, 0x5b, 0x62, 0x5d, 0xf6, 0x7f, 0x50, 0xe8, 0xa4, 0xaa, 0xc8,
1190
+	0x73, 0x5f, 0x55, 0x6c, 0xbe, 0xdb, 0x60, 0xb2, 0x87, 0x30, 0x58, 0x96, 0x2e, 0x35, 0xff, 0x18,
1191
+	0xf6, 0x5f, 0xb2, 0x80, 0x7d, 0x15, 0xcd, 0x58, 0x3a, 0xa1, 0x3b, 0x63, 0xb2, 0xb4, 0xc5, 0x9a,
1192
+	0x8b, 0x5e, 0xde, 0x2e, 0x45, 0x7f, 0x00, 0xbb, 0x6f, 0xfc, 0x34, 0xbb, 0x53, 0xb0, 0xfd, 0x1b,
1193
+	0x80, 0x9c, 0x49, 0xab, 0xa9, 0xe4, 0x6a, 0x38, 0x8e, 0x2d, 0xfc, 0x4c, 0x96, 0xbb, 0x58, 0xf3,
1194
+	0x1c, 0x64, 0xe3, 0x58, 0x4e, 0x3f, 0xbe, 0xb4, 0x1e, 0x43, 0x7b, 0x1e, 0xfa, 0x8b, 0xd3, 0x68,
1195
+	0x7c, 0xc9, 0xb2, 0x54, 0x8c, 0x92, 0xa6, 0x63, 0xa2, 0x44, 0xcd, 0x4e, 0x59, 0x10, 0x88, 0x79,
1196
+	0xd2, 0x74, 0x08, 0xb0, 0x8f, 0x61, 0xaf, 0x6c, 0xa8, 0x9c, 0x0e, 0xcf, 0xa0, 0x9d, 0xc7, 0x31,
1197
+	0x45, 0x93, 0x6a, 0xab, 0xa3, 0x6d, 0x72, 0xd9, 0x8f, 0xa0, 0x73, 0x9a, 0x61, 0xb4, 0xd7, 0xb9,
1198
+	0xfb, 0x04, 0x7a, 0x7a, 0xb4, 0x08, 0x46, 0x6a, 0x0e, 0x37, 0x9b, 0xa7, 0x92, 0x4b, 0x42, 0xf6,
1199
+	0x1f, 0x6b, 0xb0, 0x29, 0x4b, 0x45, 0x35, 0x60, 0x25, 0x6f, 0xc0, 0xff, 0xcb, 0x1c, 0x78, 0x17,
1200
+	0x5a, 0xe9, 0x4d, 0x9a, 0xb1, 0xd9, 0x89, 0x9c, 0x06, 0x5d, 0x27, 0x47, 0x7c, 0x0d, 0x66, 0xc2,
1201
+	0x3f, 0x2a, 0xd0, 0xd2, 0xd9, 0xfb, 0xaf, 0x8f, 0xc1, 0x0f, 0xa1, 0x15, 0x53, 0x3e, 0x19, 0x0d,
1202
+	0x88, 0xf6, 0x61, 0x4f, 0xe6, 0x46, 0x8d, 0x84, 0x9c, 0xc1, 0x28, 0x8b, 0xba, 0x59, 0x16, 0xc6,
1203
+	0x31, 0xb7, 0x61, 0x1e, 0x73, 0x3c, 0xa7, 0x31, 0x9f, 0x3c, 0x0d, 0x31, 0x79, 0xc4, 0xda, 0x1a,
1204
+	0xc0, 0x66, 0x32, 0x0f, 0x33, 0x1f, 0x1b, 0x8a, 0x66, 0xb7, 0x02, 0xed, 0x8f, 0x61, 0xf3, 0xd8,
1205
+	0x1d, 0x4f, 0xd1, 0x0f, 0xbe, 0x71, 0x1c, 0xcb, 0xea, 0xc3, 0x8d, 0x7c, 0xcd, 0x95, 0xcc, 0x18,
1206
+	0x86, 0xf1, 0x46, 0xb8, 0x51, 0x77, 0x24, 0x64, 0x5f, 0xe2, 0x01, 0x48, 0xd5, 0x2d, 0x7b, 0xe4,
1207
+	0x29, 0x0e, 0x24, 0x15, 0x10, 0xd5, 0x22, 0xcb, 0x47, 0xa8, 0xc1, 0x83, 0xd1, 0xde, 0x9c, 0x91,
1208
+	0x66, 0x39, 0xbf, 0x54, 0x0c, 0xa4, 0x3d, 0x8e, 0x22, 0xdb, 0xbf, 0xc3, 0x1b, 0x08, 0xdd, 0x4d,
1209
+	0xee, 0xbc, 0x81, 0xac, 0x3e, 0x77, 0x29, 0x7c, 0xb5, 0x42, 0xf8, 0x9e, 0x41, 0x2b, 0x61, 0x69,
1210
+	0x34, 0x4f, 0x30, 0xcc, 0x22, 0xb2, 0xed, 0xc3, 0x5d, 0xd5, 0x20, 0x42, 0x97, 0x23, 0xa9, 0x4e,
1211
+	0xce, 0x67, 0xff, 0xab, 0x0a, 0xbd, 0x22, 0x95, 0x8f, 0x9b, 0x8b, 0xe0, 0xd2, 0x8f, 0x3e, 0xa7,
1212
+	0x4b, 0x15, 0x05, 0xcf, 0x44, 0xf1, 0x66, 0xc1, 0x58, 0x9e, 0x4e, 0x5d, 0x94, 0x23, 0x0f, 0x8b,
1213
+	0x1c, 0x21, 0xa9, 0x27, 0x2c, 0xf1, 0x23, 0x4f, 0x5e, 0x0d, 0x72, 0x04, 0xef, 0x6e, 0x04, 0xde,
1214
+	0xce, 0xa3, 0xcc, 0x95, 0xd7, 0x38, 0x0d, 0x8b, 0xdb, 0x14, 0xe6, 0x88, 0x65, 0x47, 0x3c, 0x6b,
1215
+	0x1b, 0xf2, 0x36, 0xa5, 0x31, 0x39, 0xfd, 0x98, 0xcd, 0x52, 0xd9, 0xbd, 0x06, 0x86, 0x5b, 0x4e,
1216
+	0xd9, 0x7c, 0xe3, 0xcf, 0x70, 0xaa, 0x52, 0x1b, 0x9b, 0x28, 0x2e, 0x81, 0xc0, 0xd3, 0x6b, 0x37,
1217
+	0x16, 0xdd, 0xdc, 0x75, 0x0c, 0x0c, 0x16, 0x72, 0x9f, 0x20, 0x8c, 0x06, 0x4b, 0xae, 0x5c, 0x7e,
1218
+	0xc2, 0x89, 0xee, 0xee, 0x3a, 0xcb, 0x04, 0xce, 0x7d, 0xc9, 0x92, 0x90, 0x05, 0xc7, 0x86, 0x56,
1219
+	0x20, 0xee, 0x25, 0x82, 0xfd, 0x00, 0xf6, 0x97, 0x72, 0x2e, 0x8f, 0x94, 0xef, 0x41, 0xf7, 0xd5,
1220
+	0x15, 0xc3, 0x21, 0xab, 0xaa, 0x00, 0x63, 0xc8, 0x8b, 0x19, 0x33, 0x3b, 0x8b, 0x45, 0x06, 0xea,
1221
+	0x4e, 0x8e, 0xb0, 0x53, 0xd8, 0x10, 0xec, 0xbc, 0xc0, 0x79, 0x82, 0xd5, 0x99, 0xc2, 0xd7, 0xb2,
1222
+	0x80, 0xaa, 0xba, 0x80, 0x8a, 0xe5, 0xd2, 0xd5, 0xe5, 0x22, 0x0b, 0xab, 0x9e, 0x17, 0x56, 0x41,
1223
+	0xe9, 0x46, 0x59, 0xe9, 0x1f, 0xaa, 0xd0, 0xf9, 0x8c, 0x65, 0xd7, 0x51, 0x72, 0xc9, 0x1b, 0x25,
1224
+	0x5d, 0x79, 0xa0, 0x3d, 0x80, 0x66, 0xb2, 0x18, 0x5d, 0xdc, 0x64, 0xb2, 0x30, 0xea, 0xd8, 0x97,
1225
+	0x8b, 0x17, 0x1c, 0xb4, 0x1e, 0x02, 0x20, 0xe9, 0xc4, 0xa5, 0x43, 0xac, 0x46, 0xe2, 0x93, 0x85,
1226
+	0x44, 0x58, 0xef, 0x40, 0xcb, 0x59, 0x8c, 0x70, 0x4c, 0x46, 0x09, 0x55, 0x6f, 0xdd, 0x41, 0x51,
1227
+	0xaf, 0x04, 0xcc, 0xf7, 0x22, 0xd1, 0x4b, 0xa2, 0x38, 0x66, 0x9e, 0x32, 0x2d, 0x59, 0xbc, 0x24,
1228
+	0x04, 0xd7, 0x7a, 0xa6, 0xb4, 0x36, 0x48, 0x6b, 0x96, 0x6b, 0x45, 0x52, 0x2c, 0xb5, 0x6e, 0x4a,
1229
+	0xa7, 0x4c, 0xad, 0x67, 0x5a, 0x6b, 0x93, 0xb4, 0x66, 0x86, 0xd6, 0xb3, 0x5c, 0x6b, 0x4b, 0xed,
1230
+	0x95, 0x5a, 0xed, 0xbf, 0x55, 0xa0, 0x89, 0x65, 0x79, 0x9e, 0xba, 0x13, 0x86, 0x07, 0x53, 0x3b,
1231
+	0xc3, 0x12, 0x0e, 0x46, 0x73, 0x0e, 0xca, 0x94, 0x81, 0x40, 0x11, 0xc3, 0x37, 0xa0, 0x13, 0xb3,
1232
+	0x04, 0x8b, 0x55, 0x72, 0x54, 0x71, 0xa0, 0xd4, 0x9d, 0x36, 0xe1, 0x88, 0xe5, 0x00, 0xee, 0x0b,
1233
+	0xda, 0xc8, 0x0f, 0x47, 0x54, 0x3e, 0xb3, 0xc8, 0x63, 0x32, 0x54, 0x7d, 0x41, 0x7a, 0x1d, 0x7e,
1234
+	0xaa, 0x09, 0xd6, 0x77, 0xa0, 0xaf, 0xf9, 0xf9, 0xe1, 0x27, 0xb8, 0x29, 0x74, 0x5b, 0x92, 0xfb,
1235
+	0x5c, 0xa2, 0xf1, 0x2e, 0xd2, 0x3b, 0x9b, 0xe2, 0x67, 0x5a, 0x86, 0xa7, 0xc3, 0xe4, 0xa5, 0x8b,
1236
+	0xcd, 0x86, 0x13, 0x34, 0x16, 0x2d, 0x99, 0x4a, 0x6b, 0x15, 0x68, 0x7d, 0x17, 0xfa, 0x19, 0xf1,
1237
+	0x32, 0x6f, 0xa4, 0x78, 0x28, 0x9b, 0xdb, 0x9a, 0x70, 0x22, 0x99, 0xdf, 0x87, 0x5e, 0xce, 0x2c,
1238
+	0xe6, 0x31, 0xd9, 0xdb, 0xd5, 0xd8, 0x33, 0x3e, 0x95, 0xff, 0x4c, 0xc1, 0xa2, 0xca, 0xf9, 0x50,
1239
+	0x4c, 0x08, 0x23, 0x54, 0xed, 0xc3, 0x2d, 0x35, 0x59, 0x65, 0x30, 0xc4, 0x54, 0xa0, 0xb0, 0xfc,
1240
+	0x04, 0xb6, 0x32, 0x6d, 0xfa, 0x08, 0x1b, 0xc8, 0x95, 0xe3, 0x55, 0x4d, 0xb7, 0xa2, 0x63, 0x4e,
1241
+	0x2f, 0x2b, 0x3a, 0x8a, 0x91, 0xa7, 0x93, 0x5c, 0x2a, 0x24, 0xfb, 0xda, 0x84, 0x13, 0x2a, 0xec,
1242
+	0xf7, 0xa1, 0x85, 0xc7, 0x7c, 0x4a, 0xd6, 0x61, 0x60, 0xc6, 0xf3, 0x24, 0xc1, 0xfe, 0x52, 0x81,
1243
+	0x91, 0xa0, 0x1d, 0x01, 0x50, 0x43, 0x0b, 0xb9, 0x78, 0x29, 0x30, 0x93, 0x4d, 0x00, 0xaf, 0xa8,
1244
+	0x99, 0xbb, 0xd0, 0x49, 0x16, 0x15, 0x85, 0x08, 0x72, 0x05, 0x45, 0x7f, 0xe1, 0xfa, 0xc1, 0x58,
1245
+	0x7e, 0x2b, 0xa2, 0x68, 0x09, 0x72, 0x61, 0x81, 0x18, 0x1f, 0x94, 0x3f, 0x02, 0xec, 0xbf, 0x56,
1246
+	0xa1, 0x4d, 0x1a, 0xc9, 0x34, 0xe4, 0x1a, 0xe3, 0x11, 0xa2, 0x55, 0x0a, 0xc0, 0xfa, 0x40, 0x19,
1247
+	0x52, 0xbc, 0x35, 0xe7, 0xa6, 0x2a, 0xdb, 0xf0, 0x48, 0x4b, 0x71, 0xca, 0x19, 0x71, 0x58, 0xc9,
1248
+	0xdd, 0xe2, 0x4c, 0x64, 0xf0, 0x47, 0xd0, 0xa1, 0x4a, 0x94, 0x7b, 0xea, 0xeb, 0xf6, 0xb4, 0x89,
1249
+	0x8d, 0x76, 0x3d, 0xe3, 0xd7, 0x25, 0xb4, 0x57, 0x9c, 0xe3, 0xed, 0xc3, 0x87, 0x05, 0x76, 0xe1,
1250
+	0xc9, 0x81, 0xf8, 0x7d, 0x15, 0x66, 0x38, 0x50, 0x89, 0x77, 0xf8, 0x1c, 0x20, 0x47, 0xf2, 0xe9,
1251
+	0x74, 0xc9, 0x6e, 0xd4, 0xb5, 0x10, 0x97, 0xdc, 0xf7, 0x2b, 0x37, 0x98, 0xab, 0xa0, 0x12, 0xf0,
1252
+	0xa3, 0xea, 0xf3, 0x8a, 0x3d, 0x86, 0xad, 0x17, 0xfc, 0x74, 0x32, 0xb6, 0x23, 0xf3, 0xcc, 0xfd,
1253
+	0x75, 0x94, 0xa8, 0x40, 0x09, 0x40, 0x60, 0xfd, 0x10, 0xb1, 0x52, 0x84, 0x00, 0xf8, 0xc0, 0x8c,
1254
+	0x62, 0x79, 0x96, 0xe2, 0x2a, 0x57, 0x54, 0x37, 0x14, 0xd9, 0xff, 0xac, 0x03, 0xe4, 0x5a, 0xac,
1255
+	0x53, 0x18, 0xfa, 0xd1, 0x88, 0x1f, 0x05, 0xfe, 0x98, 0xd1, 0xe8, 0x19, 0x25, 0x0c, 0x0b, 0x25,
1256
+	0xf5, 0xaf, 0x98, 0xbc, 0x2d, 0xec, 0x49, 0xbf, 0x4b, 0xc6, 0x39, 0xfb, 0x08, 0xd1, 0x46, 0x31,
1257
+	0xa3, 0x1c, 0xb5, 0xcd, 0xfa, 0x05, 0xec, 0xe6, 0x42, 0x3d, 0x43, 0x5e, 0xf5, 0x56, 0x79, 0xf7,
1258
+	0xb5, 0x3c, 0x2f, 0x97, 0xf5, 0x53, 0x40, 0xf4, 0x08, 0x4f, 0x93, 0x79, 0x41, 0x52, 0xed, 0x56,
1259
+	0x49, 0x7d, 0x3f, 0x7a, 0x2b, 0x76, 0xe4, 0x72, 0xde, 0xc2, 0x03, 0xc3, 0x51, 0xde, 0xe0, 0x86,
1260
+	0xb4, 0xfa, 0xad, 0xd2, 0xf6, 0xb4, 0x5d, 0x7c, 0x04, 0xe4, 0x22, 0x3f, 0x05, 0xa4, 0x8c, 0xae,
1261
+	0x5d, 0x3f, 0x2b, 0xcb, 0xdb, 0xb8, 0xcb, 0xcf, 0xcf, 0x71, 0x53, 0x51, 0x18, 0xf9, 0x39, 0x63,
1262
+	0xc9, 0xa4, 0xe0, 0x67, 0xe3, 0x2e, 0x3f, 0x8f, 0xc5, 0x8e, 0x5c, 0xce, 0x0b, 0x40, 0x64, 0xd9,
1263
+	0x9e, 0xcd, 0x5b, 0xa5, 0x6c, 0xf9, 0x51, 0xd1, 0x96, 0x23, 0xe8, 0xa7, 0x6c, 0x9c, 0xe1, 0xd9,
1264
+	0x61, 0xc8, 0x68, 0xde, 0x2a, 0x63, 0x5b, 0x6e, 0xd0, 0x42, 0xec, 0x2f, 0xa1, 0xf3, 0xf3, 0xf9,
1265
+	0x84, 0x65, 0xc1, 0x85, 0xee, 0xf9, 0xff, 0xf5, 0x98, 0xf9, 0x37, 0x8e, 0x99, 0xa3, 0x49, 0x12,
1266
+	0xcd, 0xe3, 0xc2, 0x7c, 0xa6, 0x1e, 0x5e, 0x9a, 0xcf, 0x82, 0x47, 0xcc, 0x67, 0xe2, 0xfe, 0x18,
1267
+	0x3a, 0x74, 0x35, 0x92, 0x1b, 0x68, 0x0a, 0x59, 0xcb, 0x4d, 0xaf, 0xae, 0x62, 0xb4, 0xed, 0x50,
1268
+	0x5e, 0x33, 0xe5, 0xae, 0xe2, 0x34, 0xca, 0xc3, 0x84, 0xdf, 0x19, 0x79, 0xd7, 0xbd, 0x86, 0xee,
1269
+	0x94, 0x62, 0x23, 0x77, 0x51, 0x01, 0x7e, 0x53, 0x19, 0x97, 0xfb, 0x70, 0x60, 0xc6, 0x90, 0x42,
1270
+	0xdd, 0x99, 0x9a, 0x61, 0xfd, 0x3e, 0x00, 0xff, 0x90, 0x18, 0xa9, 0x41, 0x65, 0xbe, 0x90, 0xe9,
1271
+	0xb3, 0x00, 0xbf, 0x5a, 0xd4, 0x72, 0x78, 0x06, 0xfd, 0x25, 0x99, 0x2b, 0xc6, 0xd4, 0xb7, 0xcd,
1272
+	0x31, 0xd5, 0x3e, 0xbc, 0x2f, 0x45, 0x9a, 0x5b, 0xcd, 0xd9, 0xf5, 0x97, 0x0a, 0x7d, 0x77, 0xe8,
1273
+	0x37, 0x13, 0xeb, 0x39, 0x74, 0x43, 0xba, 0x66, 0xe9, 0x04, 0xd4, 0x0c, 0x41, 0xe6, 0x15, 0xcc,
1274
+	0xe9, 0x84, 0xe6, 0x85, 0x0c, 0x13, 0x31, 0x16, 0x11, 0x58, 0x99, 0x08, 0x23, 0x38, 0xf8, 0x5d,
1275
+	0x6f, 0x64, 0xbb, 0x70, 0xed, 0xab, 0x95, 0xaf, 0x7d, 0xf2, 0xab, 0x7f, 0xdd, 0xab, 0xdd, 0xe1,
1276
+	0x9f, 0x1a, 0x50, 0xfb, 0xe4, 0xe4, 0xb5, 0xe5, 0xc0, 0x56, 0xe9, 0x2d, 0xd2, 0x52, 0x73, 0x7f,
1277
+	0xf5, 0x5b, 0xeb, 0xf0, 0xd1, 0x3a, 0xb2, 0xbc, 0x14, 0xdf, 0xe3, 0x32, 0x4b, 0x37, 0x66, 0x2d,
1278
+	0x73, 0xf5, 0xd7, 0x93, 0x96, 0xb9, 0xee, 0xa2, 0x7d, 0xcf, 0xfa, 0x21, 0x34, 0xe8, 0x75, 0xd2,
1279
+	0xda, 0x91, 0xbc, 0x85, 0x77, 0xcf, 0xe1, 0x6e, 0x09, 0xab, 0x37, 0xbe, 0x81, 0x6e, 0xe1, 0x39,
1280
+	0xd9, 0x7a, 0xa7, 0xa0, 0xab, 0xf8, 0xb8, 0x39, 0x7c, 0x77, 0x35, 0x51, 0x4b, 0x3b, 0x02, 0xc8,
1281
+	0xdf, 0xcb, 0xac, 0x81, 0xe4, 0x5e, 0x7a, 0x24, 0x1d, 0x3e, 0x58, 0x41, 0xd1, 0x42, 0xce, 0x61,
1282
+	0xbb, 0xfc, 0x00, 0x66, 0x95, 0xa2, 0x5a, 0x7e, 0xa4, 0x1a, 0xbe, 0xb7, 0x96, 0x6e, 0x8a, 0x2d,
1283
+	0x3f, 0x7e, 0x69, 0xb1, 0x6b, 0x1e, 0xd5, 0xb4, 0xd8, 0xb5, 0xaf, 0x66, 0xf7, 0xac, 0x5f, 0x42,
1284
+	0xaf, 0xf8, 0x1c, 0x65, 0xa9, 0x20, 0xad, 0x7c, 0x4e, 0x1b, 0x3e, 0x5c, 0x43, 0xd5, 0x02, 0x3f,
1285
+	0x82, 0x0d, 0x7a, 0x67, 0x52, 0xbd, 0x61, 0x3e, 0x4f, 0x0d, 0x77, 0x8a, 0x48, 0xbd, 0xeb, 0x29,
1286
+	0x34, 0xe8, 0x5b, 0x4b, 0x17, 0x40, 0xe1, 0xd3, 0x6b, 0xd8, 0x31, 0xb1, 0xf6, 0xbd, 0xa7, 0x15,
1287
+	0xa5, 0x27, 0x2d, 0xe8, 0x49, 0x57, 0xe9, 0x31, 0x92, 0x73, 0xd1, 0x10, 0xff, 0x8a, 0x3c, 0xfb,
1288
+	0x4f, 0x00, 0x00, 0x00, 0xff, 0xff, 0x2a, 0x4e, 0xb6, 0x6b, 0x22, 0x19, 0x00, 0x00,
1289
+}
0 1290
new file mode 100644
... ...
@@ -0,0 +1,284 @@
0
+syntax = "proto3";
1
+
2
+package types;
3
+
4
+service API {
5
+	rpc CreateContainer(CreateContainerRequest) returns (CreateContainerResponse) {}
6
+	rpc UpdateContainer(UpdateContainerRequest) returns (UpdateContainerResponse) {}
7
+	rpc Signal(SignalRequest) returns (SignalResponse) {}
8
+    rpc UpdateProcess(UpdateProcessRequest) returns (UpdateProcessResponse) {}
9
+	rpc AddProcess(AddProcessRequest) returns (AddProcessResponse) {}
10
+	rpc CreateCheckpoint(CreateCheckpointRequest) returns (CreateCheckpointResponse) {}
11
+	rpc DeleteCheckpoint(DeleteCheckpointRequest) returns (DeleteCheckpointResponse) {}
12
+	rpc ListCheckpoint(ListCheckpointRequest) returns (ListCheckpointResponse) {}
13
+	rpc State(StateRequest) returns (StateResponse) {}
14
+	rpc Events(EventsRequest) returns (stream Event) {}
15
+	rpc Stats(StatsRequest) returns (StatsResponse) {}
16
+}
17
+
18
+message UpdateProcessRequest {
19
+    string id = 1;
20
+    string pid = 2;
21
+    bool closeStdin = 3; // Close stdin of the container
22
+    uint32 width = 4;
23
+    uint32 height = 5;
24
+}
25
+
26
+message UpdateProcessResponse {
27
+}
28
+
29
+message CreateContainerRequest {
30
+	string id = 1; // ID of container
31
+	string bundlePath = 2; // path to OCI bundle
32
+	string checkpoint = 3; // checkpoint name if you want to create immediate checkpoint (optional)
33
+    string stdin = 4; // path to the file where stdin will be read (optional)
34
+	string stdout = 5; // path to file where stdout will be written (optional)
35
+	string stderr = 6; // path to file where stderr will be written (optional)
36
+    repeated string labels = 7;
37
+}
38
+
39
+message CreateContainerResponse {
40
+    Container container = 1;
41
+}
42
+
43
+message SignalRequest {
44
+	string id = 1; // ID of container
45
+	string pid = 2; // PID of process inside container
46
+	uint32 signal = 3; // Signal which will be sent, you can find value in "man 7 signal"
47
+}
48
+
49
+message SignalResponse {
50
+}
51
+
52
+message AddProcessRequest {
53
+	string id = 1; // ID of container
54
+	bool terminal = 2; // Use tty for container stdio
55
+	User user = 3; // User under which process will be run
56
+	repeated string args = 4; // Arguments for process, first is binary path itself
57
+	repeated string env = 5; // List of environment variables for process
58
+	string cwd = 6; // Workind directory of process
59
+    string pid = 7; // Process ID
60
+    string stdin = 8; // path to the file where stdin will be read (optional)
61
+	string stdout = 9; // path to file where stdout will be written (optional)
62
+	string stderr = 10; // path to file where stderr will be written (optional)
63
+    repeated string capabilities = 11;
64
+    string apparmorProfile = 12;
65
+    string selinuxLabel = 13;
66
+    bool noNewPrivileges = 14;
67
+}
68
+
69
+message User {
70
+	uint32 uid = 1; // UID of user
71
+	uint32 gid = 2; // GID of user
72
+	repeated uint32 additionalGids = 3; // Additional groups to which user will be added
73
+}
74
+
75
+message AddProcessResponse {
76
+}
77
+
78
+message CreateCheckpointRequest {
79
+	string id = 1; // ID of container
80
+	Checkpoint checkpoint = 2; // Checkpoint configuration
81
+}
82
+
83
+message CreateCheckpointResponse {
84
+}
85
+
86
+message DeleteCheckpointRequest {
87
+	string id = 1; // ID of container
88
+	string name = 2; // Name of checkpoint
89
+}
90
+
91
+message DeleteCheckpointResponse {
92
+}
93
+
94
+message ListCheckpointRequest {
95
+	string id = 1; // ID of container
96
+}
97
+
98
+message Checkpoint {
99
+	string name = 1; // Name of checkpoint
100
+	bool exit = 2; // checkpoint configuration: should container exit on checkpoint or not
101
+	bool tcp = 3; // allow open tcp connections
102
+	bool unixSockets = 4; // allow external unix sockets
103
+	bool shell = 5; // allow shell-jobs
104
+}
105
+
106
+message ListCheckpointResponse {
107
+	repeated Checkpoint checkpoints = 1; // List of checkpoints
108
+}
109
+
110
+message StateRequest {
111
+    string id = 1; // container id for a single container
112
+}
113
+
114
+message ContainerState {
115
+	string status = 1;
116
+}
117
+
118
+message Process {
119
+	string pid = 1;
120
+	bool terminal = 2; // Use tty for container stdio
121
+	User user = 3; // User under which process will be run
122
+	repeated string args = 4; // Arguments for process, first is binary path itself
123
+	repeated string env = 5; // List of environment variables for process
124
+	string cwd = 6; // Workind directory of process
125
+    uint32 systemPid = 7;
126
+    string stdin = 8; // path to the file where stdin will be read (optional)
127
+	string stdout = 9; // path to file where stdout will be written (optional)
128
+	string stderr = 10; // path to file where stderr will be written (optional)
129
+repeated string capabilities = 11;
130
+    string apparmorProfile = 12;
131
+    string selinuxLabel = 13;
132
+    bool noNewPrivileges = 14;
133
+}
134
+
135
+message Container {
136
+	string id = 1; // ID of container
137
+	string bundlePath = 2; // Path to OCI bundle
138
+	repeated Process processes = 3; // List of processes which run in container
139
+	string status = 4; // Container status ("running", "paused", etc.)
140
+    repeated string labels = 5;
141
+    repeated uint32 pids = 6;
142
+    string runtime = 7; // runtime used to execute the container
143
+}
144
+
145
+// Machine is information about machine on which containerd is run
146
+message Machine {
147
+	uint32 cpus = 1; // number of cpus
148
+	uint64 memory = 2; // amount of memory
149
+}
150
+
151
+// StateResponse is information about containerd daemon
152
+message StateResponse {
153
+	repeated Container containers = 1;
154
+	Machine machine = 2;
155
+}
156
+
157
+message UpdateContainerRequest {
158
+	string id = 1; // ID of container
159
+    string pid = 2;
160
+	string status = 3; // Status to whcih containerd will try to change
161
+    UpdateResource resources =4;
162
+}
163
+
164
+message UpdateResource {
165
+    uint32 blkioWeight =1;
166
+    uint32 cpuShares = 2;
167
+    uint32 cpuPeriod = 3;
168
+    uint32 cpuQuota = 4;
169
+    string cpusetCpus = 5;
170
+    string cpusetMems = 6;
171
+    uint32 memoryLimit = 7;
172
+    uint32 memorySwap = 8;
173
+    uint32 memoryReservation = 9;
174
+    uint32 kernelMemoryLimit = 10;
175
+}
176
+
177
+message UpdateContainerResponse {
178
+}
179
+
180
+message EventsRequest {
181
+    uint64 timestamp = 1;
182
+}
183
+
184
+message Event {
185
+	string type = 1;
186
+	string id = 2;
187
+	uint32 status = 3;
188
+	string pid = 4;
189
+    uint64 timestamp = 5;
190
+}
191
+
192
+message NetworkStats {
193
+	string name = 1; // name of network interface
194
+	uint64 rx_bytes  = 2;
195
+	uint64 rx_Packets = 3;
196
+	uint64 Rx_errors  = 4;
197
+	uint64 Rx_dropped = 5;
198
+	uint64 Tx_bytes   = 6;
199
+	uint64 Tx_packets = 7;
200
+	uint64 Tx_errors  = 8;
201
+	uint64 Tx_dropped = 9;
202
+}
203
+
204
+message CpuUsage {
205
+	uint64 total_usage = 1;
206
+	repeated uint64 percpu_usage = 2;
207
+	uint64 usage_in_kernelmode = 3;
208
+	uint64 usage_in_usermode = 4;
209
+}
210
+
211
+message ThrottlingData {
212
+	uint64 periods = 1;
213
+	uint64 throttled_periods = 2;
214
+	uint64 throttled_time = 3;
215
+}
216
+
217
+message CpuStats {
218
+	CpuUsage cpu_usage = 1;
219
+	ThrottlingData throttling_data = 2;
220
+	uint64 system_usage = 3;
221
+}
222
+
223
+message PidsStats {
224
+	uint64 current = 1;
225
+}
226
+
227
+message MemoryData {
228
+	uint64 usage = 1;
229
+	uint64 max_usage = 2;
230
+	uint64 failcnt = 3;
231
+	uint64 limit = 4;
232
+}
233
+
234
+message MemoryStats {
235
+	uint64 cache = 1;
236
+	MemoryData usage = 2;
237
+	MemoryData swap_usage = 3;
238
+	MemoryData kernel_usage = 4;
239
+	map<string, uint64> stats = 5;
240
+}
241
+
242
+message BlkioStatsEntry {
243
+	uint64 major = 1;
244
+	uint64 minor = 2;
245
+	string op = 3;
246
+	uint64 value = 4;
247
+}
248
+
249
+message BlkioStats {
250
+	repeated BlkioStatsEntry io_service_bytes_recursive = 1; // number of bytes tranferred to and from the block device
251
+	repeated BlkioStatsEntry io_serviced_recursive = 2;
252
+	repeated BlkioStatsEntry io_queued_recursive = 3;
253
+	repeated BlkioStatsEntry io_service_time_recursive = 4;
254
+	repeated BlkioStatsEntry io_wait_time_recursive = 5;
255
+	repeated BlkioStatsEntry io_merged_recursive = 6;
256
+	repeated BlkioStatsEntry io_time_recursive = 7;
257
+	repeated BlkioStatsEntry sectors_recursive = 8;
258
+}
259
+
260
+message HugetlbStats {
261
+	uint64 usage = 1;
262
+	uint64 max_usage = 2;
263
+	uint64 failcnt = 3;
264
+	uint64 limit = 4;
265
+}
266
+
267
+message CgroupStats {
268
+	CpuStats cpu_stats = 1;
269
+	MemoryStats memory_stats  = 2;
270
+	BlkioStats blkio_stats = 3;
271
+	map<string, HugetlbStats> hugetlb_stats = 4; // the map is in the format "size of hugepage: stats of the hugepage"
272
+	PidsStats pids_stats = 5;
273
+}
274
+
275
+message StatsResponse {
276
+	repeated NetworkStats network_stats = 1;
277
+	CgroupStats cgroup_stats = 2;
278
+	uint64 timestamp = 3;
279
+};
280
+
281
+message StatsRequest {
282
+	string id = 1;
283
+}
... ...
@@ -76,7 +76,7 @@ config := &configs.Config{
76 76
 		Name:   "test-container",
77 77
 		Parent: "system",
78 78
 		Resources: &configs.Resources{
79
-			MemorySwappiness: -1,
79
+			MemorySwappiness: nil,
80 80
 			AllowAllDevices:  false,
81 81
 			AllowedDevices:   configs.DefaultAllowedDevices,
82 82
 		},
... ...
@@ -130,6 +130,8 @@ func (m *Manager) Apply(pid int) (err error) {
130 130
 		return cgroups.EnterPid(m.Paths, pid)
131 131
 	}
132 132
 
133
+	m.mu.Lock()
134
+	defer m.mu.Unlock()
133 135
 	paths := make(map[string]string)
134 136
 	for _, sys := range subsystems {
135 137
 		if err := sys.Apply(d); err != nil {
... ...
@@ -86,14 +86,14 @@ func (s *MemoryGroup) Set(path string, cgroup *configs.Cgroup) error {
86 86
 			return err
87 87
 		}
88 88
 	}
89
-	if cgroup.Resources.MemorySwappiness >= 0 && cgroup.Resources.MemorySwappiness <= 100 {
90
-		if err := writeFile(path, "memory.swappiness", strconv.FormatInt(cgroup.Resources.MemorySwappiness, 10)); err != nil {
89
+	if cgroup.Resources.MemorySwappiness == nil || int64(*cgroup.Resources.MemorySwappiness) == -1 {
90
+		return nil
91
+	} else if int64(*cgroup.Resources.MemorySwappiness) >= 0 && int64(*cgroup.Resources.MemorySwappiness) <= 100 {
92
+		if err := writeFile(path, "memory.swappiness", strconv.FormatInt(*cgroup.Resources.MemorySwappiness, 10)); err != nil {
91 93
 			return err
92 94
 		}
93
-	} else if cgroup.Resources.MemorySwappiness == -1 {
94
-		return nil
95 95
 	} else {
96
-		return fmt.Errorf("invalid value:%d. valid memory swappiness range is 0-100", cgroup.Resources.MemorySwappiness)
96
+		return fmt.Errorf("invalid value:%d. valid memory swappiness range is 0-100", int64(*cgroup.Resources.MemorySwappiness))
97 97
 	}
98 98
 
99 99
 	return nil
... ...
@@ -149,7 +149,7 @@ func memoryAssigned(cgroup *configs.Cgroup) bool {
149 149
 		cgroup.Resources.MemorySwap > 0 ||
150 150
 		cgroup.Resources.KernelMemory > 0 ||
151 151
 		cgroup.Resources.OomKillDisable ||
152
-		cgroup.Resources.MemorySwappiness != -1
152
+		(cgroup.Resources.MemorySwappiness != nil && *cgroup.Resources.MemorySwappiness != -1)
153 153
 }
154 154
 
155 155
 func getMemoryData(path, name string) (cgroups.MemoryData, error) {
... ...
@@ -46,7 +46,7 @@ type MemoryStats struct {
46 46
 	Usage MemoryData `json:"usage,omitempty"`
47 47
 	// usage of memory + swap
48 48
 	SwapUsage MemoryData `json:"swap_usage,omitempty"`
49
-	// usafe of kernel memory
49
+	// usage of kernel memory
50 50
 	KernelUsage MemoryData        `json:"kernel_usage,omitempty"`
51 51
 	Stats       map[string]uint64 `json:"stats,omitempty"`
52 52
 }
... ...
@@ -80,7 +80,7 @@ type HugetlbStats struct {
80 80
 	Usage uint64 `json:"usage,omitempty"`
81 81
 	// maximum usage ever recorded.
82 82
 	MaxUsage uint64 `json:"max_usage,omitempty"`
83
-	// number of times htgetlb usage allocation failure.
83
+	// number of times hugetlb usage allocation failure.
84 84
 	Failcnt uint64 `json:"failcnt"`
85 85
 }
86 86
 
... ...
@@ -111,7 +111,7 @@ type Resources struct {
111 111
 	OomKillDisable bool `json:"oom_kill_disable"`
112 112
 
113 113
 	// Tuning swappiness behaviour per cgroup
114
-	MemorySwappiness int64 `json:"memory_swappiness"`
114
+	MemorySwappiness *int64 `json:"memory_swappiness"`
115 115
 
116 116
 	// Set priority of network traffic for container
117 117
 	NetPrioIfpriomap []*IfPrioMap `json:"net_prio_ifpriomap"`
... ...
@@ -128,11 +128,11 @@ type Config struct {
128 128
 
129 129
 	// AppArmorProfile specifies the profile to apply to the process running in the container and is
130 130
 	// change at the time the process is execed
131
-	AppArmorProfile string `json:"apparmor_profile"`
131
+	AppArmorProfile string `json:"apparmor_profile,omitempty"`
132 132
 
133 133
 	// ProcessLabel specifies the label to apply to the process running in the container.  It is
134 134
 	// commonly used by selinux
135
-	ProcessLabel string `json:"process_label"`
135
+	ProcessLabel string `json:"process_label,omitempty"`
136 136
 
137 137
 	// Rlimits specifies the resource limits, such as max open files, to set in the container
138 138
 	// If Rlimits are not set, the container will inherit rlimits from the parent process
... ...
@@ -172,7 +172,7 @@ type Config struct {
172 172
 	Seccomp *Seccomp `json:"seccomp"`
173 173
 
174 174
 	// NoNewPrivileges controls whether processes in the container can gain additional privileges.
175
-	NoNewPrivileges bool `json:"no_new_privileges"`
175
+	NoNewPrivileges bool `json:"no_new_privileges,omitempty"`
176 176
 
177 177
 	// Hooks are a collection of actions to perform at various container lifecycle events.
178 178
 	// Hooks are not able to be marshaled to json but they are also not needed to.
... ...
@@ -180,6 +180,9 @@ type Config struct {
180 180
 
181 181
 	// Version is the version of opencontainer specification that is supported.
182 182
 	Version string `json:"version"`
183
+
184
+	// Labels are user defined metadata that is stored in the config and populated on the state
185
+	Labels []string `json:"labels"`
183 186
 }
184 187
 
185 188
 type Hooks struct {
... ...
@@ -2,7 +2,11 @@
2 2
 
3 3
 package configs
4 4
 
5
-import "fmt"
5
+import (
6
+	"fmt"
7
+	"os"
8
+	"sync"
9
+)
6 10
 
7 11
 const (
8 12
 	NEWNET  NamespaceType = "NEWNET"
... ...
@@ -13,6 +17,51 @@ const (
13 13
 	NEWUSER NamespaceType = "NEWUSER"
14 14
 )
15 15
 
16
+var (
17
+	nsLock              sync.Mutex
18
+	supportedNamespaces = make(map[NamespaceType]bool)
19
+)
20
+
21
+// nsToFile converts the namespace type to its filename
22
+func nsToFile(ns NamespaceType) string {
23
+	switch ns {
24
+	case NEWNET:
25
+		return "net"
26
+	case NEWNS:
27
+		return "mnt"
28
+	case NEWPID:
29
+		return "pid"
30
+	case NEWIPC:
31
+		return "ipc"
32
+	case NEWUSER:
33
+		return "user"
34
+	case NEWUTS:
35
+		return "uts"
36
+	}
37
+	return ""
38
+}
39
+
40
+// IsNamespaceSupported returns whether a namespace is available or
41
+// not
42
+func IsNamespaceSupported(ns NamespaceType) bool {
43
+	nsLock.Lock()
44
+	defer nsLock.Unlock()
45
+	supported, ok := supportedNamespaces[ns]
46
+	if ok {
47
+		return supported
48
+	}
49
+	nsFile := nsToFile(ns)
50
+	// if the namespace type is unknown, just return false
51
+	if nsFile == "" {
52
+		return false
53
+	}
54
+	_, err := os.Stat(fmt.Sprintf("/proc/self/ns/%s", nsFile))
55
+	// a namespace is supported if it exists and we have permissions to read it
56
+	supported = err == nil
57
+	supportedNamespaces[ns] = supported
58
+	return supported
59
+}
60
+
16 61
 func NamespaceTypes() []NamespaceType {
17 62
 	return []NamespaceType{
18 63
 		NEWNET,
... ...
@@ -35,26 +84,7 @@ func (n *Namespace) GetPath(pid int) string {
35 35
 	if n.Path != "" {
36 36
 		return n.Path
37 37
 	}
38
-	return fmt.Sprintf("/proc/%d/ns/%s", pid, n.file())
39
-}
40
-
41
-func (n *Namespace) file() string {
42
-	file := ""
43
-	switch n.Type {
44
-	case NEWNET:
45
-		file = "net"
46
-	case NEWNS:
47
-		file = "mnt"
48
-	case NEWPID:
49
-		file = "pid"
50
-	case NEWIPC:
51
-		file = "ipc"
52
-	case NEWUSER:
53
-		file = "user"
54
-	case NEWUTS:
55
-		file = "uts"
56
-	}
57
-	return file
38
+	return fmt.Sprintf("/proc/%d/ns/%s", pid, nsToFile(n.Type))
58 39
 }
59 40
 
60 41
 func (n *Namespaces) Remove(t NamespaceType) bool {
... ...
@@ -87,3 +117,11 @@ func (n *Namespaces) index(t NamespaceType) int {
87 87
 func (n *Namespaces) Contains(t NamespaceType) bool {
88 88
 	return n.index(t) != -1
89 89
 }
90
+
91
+func (n *Namespaces) PathOf(t NamespaceType) string {
92
+	i := n.index(t)
93
+	if i == -1 {
94
+		return ""
95
+	}
96
+	return (*n)[i].Path
97
+}
... ...
@@ -4,6 +4,7 @@ import (
4 4
 	"fmt"
5 5
 	"os"
6 6
 	"path/filepath"
7
+	"strings"
7 8
 
8 9
 	"github.com/opencontainers/runc/libcontainer/configs"
9 10
 )
... ...
@@ -35,6 +36,9 @@ func (v *ConfigValidator) Validate(config *configs.Config) error {
35 35
 	if err := v.usernamespace(config); err != nil {
36 36
 		return err
37 37
 	}
38
+	if err := v.sysctl(config); err != nil {
39
+		return err
40
+	}
38 41
 	return nil
39 42
 }
40 43
 
... ...
@@ -91,3 +95,44 @@ func (v *ConfigValidator) usernamespace(config *configs.Config) error {
91 91
 	}
92 92
 	return nil
93 93
 }
94
+
95
+// sysctl validates that the specified sysctl keys are valid or not.
96
+// /proc/sys isn't completely namespaced and depending on which namespaces
97
+// are specified, a subset of sysctls are permitted.
98
+func (v *ConfigValidator) sysctl(config *configs.Config) error {
99
+	validSysctlPrefixes := []string{}
100
+	validSysctlMap := make(map[string]bool)
101
+	if config.Namespaces.Contains(configs.NEWNET) {
102
+		validSysctlPrefixes = append(validSysctlPrefixes, "net.")
103
+	}
104
+	if config.Namespaces.Contains(configs.NEWIPC) {
105
+		validSysctlPrefixes = append(validSysctlPrefixes, "fs.mqueue.")
106
+		validSysctlMap = map[string]bool{
107
+			"kernel.msgmax":          true,
108
+			"kernel.msgmnb":          true,
109
+			"kernel.msgmni":          true,
110
+			"kernel.sem":             true,
111
+			"kernel.shmall":          true,
112
+			"kernel.shmmax":          true,
113
+			"kernel.shmmni":          true,
114
+			"kernel.shm_rmid_forced": true,
115
+		}
116
+	}
117
+	for s := range config.Sysctl {
118
+		if validSysctlMap[s] {
119
+			continue
120
+		}
121
+		valid := false
122
+		for _, vp := range validSysctlPrefixes {
123
+			if strings.HasPrefix(s, vp) {
124
+				valid = true
125
+				break
126
+			}
127
+		}
128
+		if !valid {
129
+			return fmt.Errorf("sysctl %q is not permitted in the config", s)
130
+		}
131
+	}
132
+
133
+	return nil
134
+}
... ...
@@ -27,9 +27,6 @@ const (
27 27
 	// The container exists, but all its processes are paused.
28 28
 	Paused
29 29
 
30
-	// The container exists, but its state is saved on disk
31
-	Checkpointed
32
-
33 30
 	// The container does not exist.
34 31
 	Destroyed
35 32
 )
... ...
@@ -44,8 +41,6 @@ func (s Status) String() string {
44 44
 		return "pausing"
45 45
 	case Paused:
46 46
 		return "paused"
47
-	case Checkpointed:
48
-		return "checkpointed"
49 47
 	case Destroyed:
50 48
 		return "destroyed"
51 49
 	default:
... ...
@@ -23,6 +23,7 @@ import (
23 23
 	"github.com/opencontainers/runc/libcontainer/configs"
24 24
 	"github.com/opencontainers/runc/libcontainer/criurpc"
25 25
 	"github.com/opencontainers/runc/libcontainer/utils"
26
+	"github.com/syndtr/gocapability/capability"
26 27
 	"github.com/vishvananda/netlink/nl"
27 28
 )
28 29
 
... ...
@@ -268,37 +269,40 @@ func (c *linuxContainer) commandTemplate(p *Process, childPipe *os.File) (*exec.
268 268
 }
269 269
 
270 270
 func (c *linuxContainer) newInitProcess(p *Process, cmd *exec.Cmd, parentPipe, childPipe *os.File) (*initProcess, error) {
271
-	t := "_LIBCONTAINER_INITTYPE=" + string(initStandard)
272
-	cloneFlags := c.config.Namespaces.CloneFlags()
273
-	if cloneFlags&syscall.CLONE_NEWUSER != 0 {
274
-		if err := c.addUidGidMappings(cmd.SysProcAttr); err != nil {
275
-			// user mappings are not supported
276
-			return nil, err
277
-		}
278
-		enableSetgroups(cmd.SysProcAttr)
279
-		// Default to root user when user namespaces are enabled.
280
-		if cmd.SysProcAttr.Credential == nil {
281
-			cmd.SysProcAttr.Credential = &syscall.Credential{}
271
+	cmd.Env = append(cmd.Env, "_LIBCONTAINER_INITTYPE="+string(initStandard))
272
+	nsMaps := make(map[configs.NamespaceType]string)
273
+	for _, ns := range c.config.Namespaces {
274
+		if ns.Path != "" {
275
+			nsMaps[ns.Type] = ns.Path
282 276
 		}
283 277
 	}
284
-	cmd.Env = append(cmd.Env, t)
285
-	cmd.SysProcAttr.Cloneflags = cloneFlags
278
+	_, sharePidns := nsMaps[configs.NEWPID]
279
+	data, err := c.bootstrapData(c.config.Namespaces.CloneFlags(), nsMaps, "")
280
+	if err != nil {
281
+		return nil, err
282
+	}
286 283
 	return &initProcess{
287
-		cmd:        cmd,
288
-		childPipe:  childPipe,
289
-		parentPipe: parentPipe,
290
-		manager:    c.cgroupManager,
291
-		config:     c.newInitConfig(p),
292
-		container:  c,
293
-		process:    p,
284
+		cmd:           cmd,
285
+		childPipe:     childPipe,
286
+		parentPipe:    parentPipe,
287
+		manager:       c.cgroupManager,
288
+		config:        c.newInitConfig(p),
289
+		container:     c,
290
+		process:       p,
291
+		bootstrapData: data,
292
+		sharePidns:    sharePidns,
294 293
 	}, nil
295 294
 }
296 295
 
297 296
 func (c *linuxContainer) newSetnsProcess(p *Process, cmd *exec.Cmd, parentPipe, childPipe *os.File) (*setnsProcess, error) {
298 297
 	cmd.Env = append(cmd.Env, "_LIBCONTAINER_INITTYPE="+string(initSetns))
298
+	state, err := c.currentState()
299
+	if err != nil {
300
+		return nil, newSystemError(err)
301
+	}
299 302
 	// for setns process, we dont have to set cloneflags as the process namespaces
300 303
 	// will only be set via setns syscall
301
-	data, err := c.bootstrapData(0, c.initProcess.pid(), p.consolePath)
304
+	data, err := c.bootstrapData(0, state.NamespacePaths, p.consolePath)
302 305
 	if err != nil {
303 306
 		return nil, err
304 307
 	}
... ...
@@ -315,7 +319,7 @@ func (c *linuxContainer) newSetnsProcess(p *Process, cmd *exec.Cmd, parentPipe,
315 315
 }
316 316
 
317 317
 func (c *linuxContainer) newInitConfig(process *Process) *initConfig {
318
-	return &initConfig{
318
+	cfg := &initConfig{
319 319
 		Config:           c.config,
320 320
 		Args:             process.Args,
321 321
 		Env:              process.Env,
... ...
@@ -324,7 +328,21 @@ func (c *linuxContainer) newInitConfig(process *Process) *initConfig {
324 324
 		Console:          process.consolePath,
325 325
 		Capabilities:     process.Capabilities,
326 326
 		PassedFilesCount: len(process.ExtraFiles),
327
+		ContainerId:      c.ID(),
328
+		NoNewPrivileges:  c.config.NoNewPrivileges,
329
+		AppArmorProfile:  c.config.AppArmorProfile,
330
+		ProcessLabel:     c.config.ProcessLabel,
331
+	}
332
+	if process.NoNewPrivileges != nil {
333
+		cfg.NoNewPrivileges = *process.NoNewPrivileges
334
+	}
335
+	if process.AppArmorProfile != "" {
336
+		cfg.AppArmorProfile = process.AppArmorProfile
337
+	}
338
+	if process.Label != "" {
339
+		cfg.ProcessLabel = process.Label
327 340
 	}
341
+	return cfg
328 342
 }
329 343
 
330 344
 func newPipe() (parent *os.File, child *os.File, err error) {
... ...
@@ -1059,6 +1077,9 @@ func (c *linuxContainer) currentState() (*State, error) {
1059 1059
 			state.NamespacePaths[ns.Type] = ns.GetPath(pid)
1060 1060
 		}
1061 1061
 		for _, nsType := range configs.NamespaceTypes() {
1062
+			if !configs.IsNamespaceSupported(nsType) {
1063
+				continue
1064
+			}
1062 1065
 			if _, ok := state.NamespacePaths[nsType]; !ok {
1063 1066
 				ns := configs.Namespace{Type: nsType}
1064 1067
 				state.NamespacePaths[ns.Type] = ns.GetPath(pid)
... ...
@@ -1068,18 +1089,69 @@ func (c *linuxContainer) currentState() (*State, error) {
1068 1068
 	return state, nil
1069 1069
 }
1070 1070
 
1071
-// bootstrapData encodes the necessary data in netlink binary format as a io.Reader.
1072
-// Consumer can write the data to a bootstrap program such as one that uses
1073
-// nsenter package to bootstrap the container's init process correctly, i.e. with
1074
-// correct namespaces, uid/gid mapping etc.
1075
-func (c *linuxContainer) bootstrapData(cloneFlags uintptr, pid int, consolePath string) (io.Reader, error) {
1071
+// orderNamespacePaths sorts namespace paths into a list of paths that we
1072
+// can setns in order.
1073
+func (c *linuxContainer) orderNamespacePaths(namespaces map[configs.NamespaceType]string) ([]string, error) {
1074
+	paths := []string{}
1075
+	nsTypes := []configs.NamespaceType{
1076
+		configs.NEWIPC,
1077
+		configs.NEWUTS,
1078
+		configs.NEWNET,
1079
+		configs.NEWPID,
1080
+		configs.NEWNS,
1081
+	}
1082
+	// join userns if the init process explicitly requires NEWUSER
1083
+	if c.config.Namespaces.Contains(configs.NEWUSER) {
1084
+		nsTypes = append(nsTypes, configs.NEWUSER)
1085
+	}
1086
+	for _, nsType := range nsTypes {
1087
+		if p, ok := namespaces[nsType]; ok && p != "" {
1088
+			// check if the requested namespace is supported
1089
+			if !configs.IsNamespaceSupported(nsType) {
1090
+				return nil, newSystemError(fmt.Errorf("namespace %s is not supported", nsType))
1091
+			}
1092
+			// only set to join this namespace if it exists
1093
+			if _, err := os.Lstat(p); err != nil {
1094
+				return nil, newSystemError(err)
1095
+			}
1096
+			// do not allow namespace path with comma as we use it to separate
1097
+			// the namespace paths
1098
+			if strings.ContainsRune(p, ',') {
1099
+				return nil, newSystemError(fmt.Errorf("invalid path %s", p))
1100
+			}
1101
+			paths = append(paths, p)
1102
+		}
1103
+	}
1104
+	return paths, nil
1105
+}
1106
+
1107
+func encodeIDMapping(idMap []configs.IDMap) ([]byte, error) {
1108
+	data := bytes.NewBuffer(nil)
1109
+	for _, im := range idMap {
1110
+		line := fmt.Sprintf("%d %d %d\n", im.ContainerID, im.HostID, im.Size)
1111
+		if _, err := data.WriteString(line); err != nil {
1112
+			return nil, err
1113
+		}
1114
+	}
1115
+	return data.Bytes(), nil
1116
+}
1117
+
1118
+// bootstrapData encodes the necessary data in netlink binary format
1119
+// as a io.Reader.
1120
+// Consumer can write the data to a bootstrap program
1121
+// such as one that uses nsenter package to bootstrap the container's
1122
+// init process correctly, i.e. with correct namespaces, uid/gid
1123
+// mapping etc.
1124
+func (c *linuxContainer) bootstrapData(cloneFlags uintptr, nsMaps map[configs.NamespaceType]string, consolePath string) (io.Reader, error) {
1076 1125
 	// create the netlink message
1077 1126
 	r := nl.NewNetlinkRequest(int(InitMsg), 0)
1078
-	// write pid
1127
+
1128
+	// write cloneFlags
1079 1129
 	r.AddData(&Int32msg{
1080
-		Type:  PidAttr,
1081
-		Value: uint32(pid),
1130
+		Type:  CloneFlagsAttr,
1131
+		Value: uint32(cloneFlags),
1082 1132
 	})
1133
+
1083 1134
 	// write console path
1084 1135
 	if consolePath != "" {
1085 1136
 		r.AddData(&Bytemsg{
... ...
@@ -1087,5 +1159,57 @@ func (c *linuxContainer) bootstrapData(cloneFlags uintptr, pid int, consolePath
1087 1087
 			Value: []byte(consolePath),
1088 1088
 		})
1089 1089
 	}
1090
+
1091
+	// write custom namespace paths
1092
+	if len(nsMaps) > 0 {
1093
+		nsPaths, err := c.orderNamespacePaths(nsMaps)
1094
+		if err != nil {
1095
+			return nil, err
1096
+		}
1097
+		r.AddData(&Bytemsg{
1098
+			Type:  NsPathsAttr,
1099
+			Value: []byte(strings.Join(nsPaths, ",")),
1100
+		})
1101
+	}
1102
+
1103
+	// write namespace paths only when we are not joining an existing user ns
1104
+	_, joinExistingUser := nsMaps[configs.NEWUSER]
1105
+	if !joinExistingUser {
1106
+		// write uid mappings
1107
+		if len(c.config.UidMappings) > 0 {
1108
+			b, err := encodeIDMapping(c.config.UidMappings)
1109
+			if err != nil {
1110
+				return nil, err
1111
+			}
1112
+			r.AddData(&Bytemsg{
1113
+				Type:  UidmapAttr,
1114
+				Value: b,
1115
+			})
1116
+		}
1117
+
1118
+		// write gid mappings
1119
+		if len(c.config.GidMappings) > 0 {
1120
+			b, err := encodeIDMapping(c.config.UidMappings)
1121
+			if err != nil {
1122
+				return nil, err
1123
+			}
1124
+			r.AddData(&Bytemsg{
1125
+				Type:  GidmapAttr,
1126
+				Value: b,
1127
+			})
1128
+			// check if we have CAP_SETGID to setgroup properly
1129
+			pid, err := capability.NewPid(os.Getpid())
1130
+			if err != nil {
1131
+				return nil, err
1132
+			}
1133
+			if !pid.Get(capability.EFFECTIVE, capability.CAP_SETGID) {
1134
+				r.AddData(&Boolmsg{
1135
+					Type:  SetgroupAttr,
1136
+					Value: true,
1137
+				})
1138
+			}
1139
+		}
1140
+	}
1141
+
1090 1142
 	return bytes.NewReader(r.Serialize()), nil
1091 1143
 }
1092 1144
deleted file mode 100644
... ...
@@ -1,13 +0,0 @@
1
-// +build !go1.4
2
-
3
-package libcontainer
4
-
5
-import (
6
-	"fmt"
7
-	"syscall"
8
-)
9
-
10
-// not available before go 1.4
11
-func (c *linuxContainer) addUidGidMappings(sys *syscall.SysProcAttr) error {
12
-	return fmt.Errorf("User namespace is not supported in golang < 1.4")
13
-}
14 1
deleted file mode 100644
... ...
@@ -1,26 +0,0 @@
1
-// +build go1.4
2
-
3
-package libcontainer
4
-
5
-import "syscall"
6
-
7
-// Converts IDMap to SysProcIDMap array and adds it to SysProcAttr.
8
-func (c *linuxContainer) addUidGidMappings(sys *syscall.SysProcAttr) error {
9
-	if c.config.UidMappings != nil {
10
-		sys.UidMappings = make([]syscall.SysProcIDMap, len(c.config.UidMappings))
11
-		for i, um := range c.config.UidMappings {
12
-			sys.UidMappings[i].ContainerID = um.ContainerID
13
-			sys.UidMappings[i].HostID = um.HostID
14
-			sys.UidMappings[i].Size = um.Size
15
-		}
16
-	}
17
-	if c.config.GidMappings != nil {
18
-		sys.GidMappings = make([]syscall.SysProcIDMap, len(c.config.GidMappings))
19
-		for i, gm := range c.config.GidMappings {
20
-			sys.GidMappings[i].ContainerID = gm.ContainerID
21
-			sys.GidMappings[i].HostID = gm.HostID
22
-			sys.GidMappings[i].Size = gm.Size
23
-		}
24
-	}
25
-	return nil
26
-}
... ...
@@ -227,32 +227,40 @@ func (l *LinuxFactory) StartInitialization() (err error) {
227 227
 		pipe = os.NewFile(uintptr(pipefd), "pipe")
228 228
 		it   = initType(os.Getenv("_LIBCONTAINER_INITTYPE"))
229 229
 	)
230
+	defer pipe.Close()
230 231
 	// clear the current process's environment to clean any libcontainer
231 232
 	// specific env vars.
232 233
 	os.Clearenv()
233
-	var i initer
234
-	defer func() {
235
-		// We have an error during the initialization of the container's init,
236
-		// send it back to the parent process in the form of an initError.
237
-		// If container's init successed, syscall.Exec will not return, hence
238
-		// this defer function will never be called.
234
+	i, err := newContainerInit(it, pipe)
235
+	if err != nil {
236
+		l.sendError(nil, pipe, err)
237
+		return err
238
+	}
239
+	if err := i.Init(); err != nil {
240
+		if !isExecError(err) {
241
+			l.sendError(i, pipe, err)
242
+		}
243
+		return err
244
+	}
245
+	return nil
246
+}
247
+
248
+func (l *LinuxFactory) sendError(i initer, pipe *os.File, err error) {
249
+	// We have an error during the initialization of the container's init,
250
+	// send it back to the parent process in the form of an initError.
251
+	// If container's init successed, syscall.Exec will not return, hence
252
+	// this defer function will never be called.
253
+	if i != nil {
239 254
 		if _, ok := i.(*linuxStandardInit); ok {
240 255
 			//  Synchronisation only necessary for standard init.
241 256
 			if err := utils.WriteJSON(pipe, syncT{procError}); err != nil {
242 257
 				panic(err)
243 258
 			}
244 259
 		}
245
-		if err := utils.WriteJSON(pipe, newSystemError(err)); err != nil {
246
-			panic(err)
247
-		}
248
-		// ensure that this pipe is always closed
249
-		pipe.Close()
250
-	}()
251
-	i, err = newContainerInit(it, pipe)
252
-	if err != nil {
253
-		return err
254 260
 	}
255
-	return i.Init()
261
+	if err := utils.WriteJSON(pipe, newSystemError(err)); err != nil {
262
+		panic(err)
263
+	}
256 264
 }
257 265
 
258 266
 func (l *LinuxFactory) loadState(root string) (*State, error) {
... ...
@@ -280,3 +288,8 @@ func (l *LinuxFactory) validateID(id string) error {
280 280
 	}
281 281
 	return nil
282 282
 }
283
+
284
+func isExecError(err error) bool {
285
+	_, ok := err.(*exec.Error)
286
+	return ok
287
+}
... ...
@@ -15,6 +15,8 @@ const (
15 15
 	procReady syncType = iota
16 16
 	procError
17 17
 	procRun
18
+	procHooks
19
+	procResume
18 20
 )
19 21
 
20 22
 type syncT struct {
... ...
@@ -48,11 +48,15 @@ type initConfig struct {
48 48
 	Env              []string        `json:"env"`
49 49
 	Cwd              string          `json:"cwd"`
50 50
 	Capabilities     []string        `json:"capabilities"`
51
+	ProcessLabel     string          `json:"process_label"`
52
+	AppArmorProfile  string          `json:"apparmor_profile"`
53
+	NoNewPrivileges  bool            `json:"no_new_privileges"`
51 54
 	User             string          `json:"user"`
52 55
 	Config           *configs.Config `json:"config"`
53 56
 	Console          string          `json:"console"`
54 57
 	Networks         []*network      `json:"network"`
55 58
 	PassedFilesCount int             `json:"passed_files_count"`
59
+	ContainerId      string          `json:"containerid"`
56 60
 }
57 61
 
58 62
 type initer interface {
... ...
@@ -163,20 +167,22 @@ func syncParentReady(pipe io.ReadWriter) error {
163 163
 	return nil
164 164
 }
165 165
 
166
-// joinExistingNamespaces gets all the namespace paths specified for the container and
167
-// does a setns on the namespace fd so that the current process joins the namespace.
168
-func joinExistingNamespaces(namespaces []configs.Namespace) error {
169
-	for _, ns := range namespaces {
170
-		if ns.Path != "" {
171
-			f, err := os.OpenFile(ns.Path, os.O_RDONLY, 0)
172
-			if err != nil {
173
-				return err
174
-			}
175
-			err = system.Setns(f.Fd(), uintptr(ns.Syscall()))
176
-			f.Close()
177
-			if err != nil {
178
-				return err
179
-			}
166
+// syncParentHooks sends to the given pipe a JSON payload which indicates that
167
+// the parent should execute pre-start hooks. It then waits for the parent to
168
+// indicate that it is cleared to resume.
169
+func syncParentHooks(pipe io.ReadWriter) error {
170
+	// Tell parent.
171
+	if err := utils.WriteJSON(pipe, syncT{procHooks}); err != nil {
172
+		return err
173
+	}
174
+	// Wait for parent to give the all-clear.
175
+	var procSync syncT
176
+	if err := json.NewDecoder(pipe).Decode(&procSync); err != nil {
177
+		if err == io.EOF {
178
+			return fmt.Errorf("parent closed synchronisation channel")
179
+		}
180
+		if procSync.Type != procResume {
181
+			return fmt.Errorf("invalid synchronisation flag from parent")
180 182
 		}
181 183
 	}
182 184
 	return nil
... ...
@@ -319,9 +325,10 @@ func setupRlimits(config *configs.Config) error {
319 319
 	return nil
320 320
 }
321 321
 
322
-func setOomScoreAdj(oomScoreAdj int) error {
323
-	path := "/proc/self/oom_score_adj"
324
-	return ioutil.WriteFile(path, []byte(strconv.Itoa(oomScoreAdj)), 0700)
322
+func setOomScoreAdj(oomScoreAdj int, pid int) error {
323
+	path := fmt.Sprintf("/proc/%d/oom_score_adj", pid)
324
+
325
+	return ioutil.WriteFile(path, []byte(strconv.Itoa(oomScoreAdj)), 0600)
325 326
 }
326 327
 
327 328
 // killCgroupProcesses freezes then iterates over all the processes inside the
... ...
@@ -12,8 +12,12 @@ import (
12 12
 // The number is randomly chosen to not conflict with known netlink types
13 13
 const (
14 14
 	InitMsg         uint16 = 62000
15
-	PidAttr         uint16 = 27281
15
+	CloneFlagsAttr  uint16 = 27281
16 16
 	ConsolePathAttr uint16 = 27282
17
+	NsPathsAttr     uint16 = 27283
18
+	UidmapAttr      uint16 = 27284
19
+	GidmapAttr      uint16 = 27285
20
+	SetgroupAttr    uint16 = 27286
17 21
 	// When syscall.NLA_HDRLEN is in gccgo, take this out.
18 22
 	syscall_NLA_HDRLEN = (syscall.SizeofNlAttr + syscall.NLA_ALIGNTO - 1) & ^(syscall.NLA_ALIGNTO - 1)
19 23
 )
... ...
@@ -60,3 +64,25 @@ func (msg *Bytemsg) Serialize() []byte {
60 60
 func (msg *Bytemsg) Len() int {
61 61
 	return syscall_NLA_HDRLEN + len(msg.Value) + 1 // null-terminated
62 62
 }
63
+
64
+type Boolmsg struct {
65
+	Type  uint16
66
+	Value bool
67
+}
68
+
69
+func (msg *Boolmsg) Serialize() []byte {
70
+	buf := make([]byte, msg.Len())
71
+	native := nl.NativeEndian()
72
+	native.PutUint16(buf[0:2], uint16(msg.Len()))
73
+	native.PutUint16(buf[2:4], msg.Type)
74
+	if msg.Value {
75
+		buf[4] = 1
76
+	} else {
77
+		buf[4] = 0
78
+	}
79
+	return buf
80
+}
81
+
82
+func (msg *Boolmsg) Len() int {
83
+	return syscall_NLA_HDRLEN + 1
84
+}
63 85
deleted file mode 100644
... ...
@@ -1,25 +0,0 @@
1
-## nsenter
2
-
3
-The `nsenter` package registers a special init constructor that is called before 
4
-the Go runtime has a chance to boot.  This provides us the ability to `setns` on 
5
-existing namespaces and avoid the issues that the Go runtime has with multiple 
6
-threads.  This constructor will be called if this package is registered, 
7
-imported, in your go application.
8
-
9
-The `nsenter` package will `import "C"` and it uses [cgo](https://golang.org/cmd/cgo/)
10
-package. In cgo, if the import of "C" is immediately preceded by a comment, that comment, 
11
-called the preamble, is used as a header when compiling the C parts of the package.
12
-So every time we  import package `nsenter`, the C code function `nsexec()` would be 
13
-called. And package `nsenter` is now only imported in Docker execdriver, so every time 
14
-before we call `execdriver.Exec()`, that C code would run.
15
-
16
-`nsexec()` will first check the environment variable `_LIBCONTAINER_INITPID` 
17
-which will give the process of the container that should be joined. Namespaces fd will 
18
-be found from `/proc/[pid]/ns` and set by `setns` syscall.
19
-
20
-And then get the pipe number from `_LIBCONTAINER_INITPIPE`, error message could
21
-be transfered through it. If tty is added, `_LIBCONTAINER_CONSOLE_PATH` will 
22
-have value and start a console for output.
23
-
24
-Finally, `nsexec()` will clone a child process , exit the parent process and let 
25
-the Go runtime take over.
26 1
deleted file mode 100644
... ...
@@ -1,12 +0,0 @@
1
-// +build linux,!gccgo
2
-
3
-package nsenter
4
-
5
-/*
6
-#cgo CFLAGS: -Wall
7
-extern void nsexec();
8
-void __attribute__((constructor)) init(void) {
9
-	nsexec();
10
-}
11
-*/
12
-import "C"
13 1
deleted file mode 100644
... ...
@@ -1,25 +0,0 @@
1
-// +build linux,gccgo
2
-
3
-package nsenter
4
-
5
-/*
6
-#cgo CFLAGS: -Wall
7
-extern void nsexec();
8
-void __attribute__((constructor)) init(void) {
9
-	nsexec();
10
-}
11
-*/
12
-import "C"
13
-
14
-// AlwaysFalse is here to stay false
15
-// (and be exported so the compiler doesn't optimize out its reference)
16
-var AlwaysFalse bool
17
-
18
-func init() {
19
-	if AlwaysFalse {
20
-		// by referencing this C init() in a noop test, it will ensure the compiler
21
-		// links in the C function.
22
-		// https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65134
23
-		C.init()
24
-	}
25
-}
26 1
deleted file mode 100644
... ...
@@ -1,5 +0,0 @@
1
-// +build !linux !cgo
2
-
3
-package nsenter
4
-
5
-import "C"
6 1
deleted file mode 100644
... ...
@@ -1,261 +0,0 @@
1
-#define _GNU_SOURCE
2
-#include <stdlib.h>
3
-#include <unistd.h>
4
-#include <stdio.h>
5
-#include <errno.h>
6
-#include <string.h>
7
-
8
-#include <linux/limits.h>
9
-#include <sys/types.h>
10
-#include <sys/wait.h>
11
-#include <sys/types.h>
12
-#include <sys/stat.h>
13
-#include <sys/ioctl.h>
14
-#include <fcntl.h>
15
-#include <signal.h>
16
-#include <setjmp.h>
17
-#include <sched.h>
18
-#include <signal.h>
19
-
20
-#include <bits/sockaddr.h>
21
-#include <linux/netlink.h>
22
-#include <linux/types.h>
23
-#include <stdint.h>
24
-#include <sys/socket.h>
25
-
26
-/* All arguments should be above stack, because it grows down */
27
-struct clone_arg {
28
-	/*
29
-	 * Reserve some space for clone() to locate arguments
30
-	 * and retcode in this place
31
-	 */
32
-	char stack[4096] __attribute__ ((aligned(16)));
33
-	char stack_ptr[0];
34
-	jmp_buf *env;
35
-};
36
-
37
-#define pr_perror(fmt, ...) fprintf(stderr, "nsenter: " fmt ": %m\n", ##__VA_ARGS__)
38
-
39
-static int child_func(void *_arg)
40
-{
41
-	struct clone_arg *arg = (struct clone_arg *)_arg;
42
-	longjmp(*arg->env, 1);
43
-}
44
-
45
-// Use raw setns syscall for versions of glibc that don't include it (namely glibc-2.12)
46
-#if __GLIBC__ == 2 && __GLIBC_MINOR__ < 14
47
-#define _GNU_SOURCE
48
-#include "syscall.h"
49
-#if defined(__NR_setns) && !defined(SYS_setns)
50
-#define SYS_setns __NR_setns
51
-#endif
52
-#ifdef SYS_setns
53
-int setns(int fd, int nstype)
54
-{
55
-	return syscall(SYS_setns, fd, nstype);
56
-}
57
-#endif
58
-#endif
59
-
60
-static int clone_parent(jmp_buf * env) __attribute__ ((noinline));
61
-static int clone_parent(jmp_buf * env)
62
-{
63
-	struct clone_arg ca;
64
-	int child;
65
-
66
-	ca.env = env;
67
-	child = clone(child_func, ca.stack_ptr, CLONE_PARENT | SIGCHLD, &ca);
68
-
69
-	return child;
70
-}
71
-
72
-static uint32_t readint32(char *buf)
73
-{
74
-	return *(uint32_t *) buf;
75
-}
76
-
77
-// list of known message types we want to send to bootstrap program
78
-// These are defined in libcontainer/message_linux.go
79
-#define INIT_MSG 62000
80
-#define PID_ATTR 27281
81
-#define CONSOLE_PATH_ATTR 27282
82
-
83
-void nsexec()
84
-{
85
-	char *namespaces[] = { "ipc", "uts", "net", "pid", "mnt", "user" };
86
-	const int num = sizeof(namespaces) / sizeof(char *);
87
-	jmp_buf env;
88
-	char buf[PATH_MAX], *val;
89
-	int i, tfd, self_tfd, child, n, len, pipenum, consolefd = -1;
90
-	pid_t pid = 0;
91
-
92
-	// if we dont have INITTYPE or this is the init process, skip the bootstrap process
93
-	val = getenv("_LIBCONTAINER_INITTYPE");
94
-	if (val == NULL || strcmp(val, "standard") == 0) {
95
-		return;
96
-	}
97
-	if (strcmp(val, "setns") != 0) {
98
-		pr_perror("Invalid inittype %s", val);
99
-		exit(1);
100
-	}
101
-
102
-	val = getenv("_LIBCONTAINER_INITPIPE");
103
-	if (val == NULL) {
104
-		pr_perror("Child pipe not found");
105
-		exit(1);
106
-	}
107
-	pipenum = atoi(val);
108
-	snprintf(buf, sizeof(buf), "%d", pipenum);
109
-	if (strcmp(val, buf)) {
110
-		pr_perror("Unable to parse _LIBCONTAINER_INITPIPE");
111
-		exit(1);
112
-	}
113
-
114
-	char nlbuf[NLMSG_HDRLEN];
115
-	struct nlmsghdr *nh;
116
-	if ((n = read(pipenum, nlbuf, NLMSG_HDRLEN)) != NLMSG_HDRLEN) {
117
-		pr_perror("Failed to read netlink header, got %d", n);
118
-		exit(1);
119
-	}
120
-
121
-	nh = (struct nlmsghdr *)nlbuf;
122
-	if (nh->nlmsg_type == NLMSG_ERROR) {
123
-		pr_perror("Invalid netlink header message");
124
-		exit(1);
125
-	}
126
-	if (nh->nlmsg_type != INIT_MSG) {
127
-		pr_perror("Unexpected netlink message type %d", nh->nlmsg_type);
128
-		exit(1);
129
-	}
130
-	// read the netlink payload
131
-	len = NLMSG_PAYLOAD(nh, 0);
132
-	char data[len];
133
-	if ((n = read(pipenum, data, len)) != len) {
134
-		pr_perror("Failed to read netlink payload, got %d", n);
135
-		exit(1);
136
-	}
137
-
138
-	int start = 0;
139
-	struct nlattr *attr;
140
-	while (start < len) {
141
-		int payload_len;
142
-		attr = (struct nlattr *)((void *)data + start);
143
-		start += NLA_HDRLEN;
144
-		payload_len = attr->nla_len - NLA_HDRLEN;
145
-		switch (attr->nla_type) {
146
-		case PID_ATTR:
147
-			pid = (pid_t) readint32(data + start);
148
-			break;
149
-		case CONSOLE_PATH_ATTR:
150
-			consolefd = open((char *)data + start, O_RDWR);
151
-			if (consolefd < 0) {
152
-				pr_perror("Failed to open console %s", (char *)data + start);
153
-				exit(1);
154
-			}
155
-			break;
156
-		}
157
-		start += NLA_ALIGN(payload_len);
158
-	}
159
-
160
-	// required pid to be passed
161
-	if (pid == 0) {
162
-		pr_perror("missing pid");
163
-		exit(1);
164
-	}
165
-
166
-	/* Check that the specified process exists */
167
-	snprintf(buf, PATH_MAX - 1, "/proc/%d/ns", pid);
168
-	tfd = open(buf, O_DIRECTORY | O_RDONLY);
169
-	if (tfd == -1) {
170
-		pr_perror("Failed to open \"%s\"", buf);
171
-		exit(1);
172
-	}
173
-
174
-	self_tfd = open("/proc/self/ns", O_DIRECTORY | O_RDONLY);
175
-	if (self_tfd == -1) {
176
-		pr_perror("Failed to open /proc/self/ns");
177
-		exit(1);
178
-	}
179
-
180
-	for (i = 0; i < num; i++) {
181
-		struct stat st;
182
-		struct stat self_st;
183
-		int fd;
184
-
185
-		/* Symlinks on all namespaces exist for dead processes, but they can't be opened */
186
-		if (fstatat(tfd, namespaces[i], &st, 0) == -1) {
187
-			// Ignore nonexistent namespaces.
188
-			if (errno == ENOENT)
189
-				continue;
190
-		}
191
-
192
-		/* Skip namespaces we're already part of */
193
-		if (fstatat(self_tfd, namespaces[i], &self_st, 0) != -1 && st.st_ino == self_st.st_ino) {
194
-			continue;
195
-		}
196
-
197
-		fd = openat(tfd, namespaces[i], O_RDONLY);
198
-		if (fd == -1) {
199
-			pr_perror("Failed to open ns file %s for ns %s", buf, namespaces[i]);
200
-			exit(1);
201
-		}
202
-		// Set the namespace.
203
-		if (setns(fd, 0) == -1) {
204
-			pr_perror("Failed to setns for %s", namespaces[i]);
205
-			exit(1);
206
-		}
207
-		close(fd);
208
-	}
209
-
210
-	close(self_tfd);
211
-	close(tfd);
212
-
213
-	if (setjmp(env) == 1) {
214
-		// Child
215
-
216
-		if (setsid() == -1) {
217
-			pr_perror("setsid failed");
218
-			exit(1);
219
-		}
220
-		if (consolefd != -1) {
221
-			if (ioctl(consolefd, TIOCSCTTY, 0) == -1) {
222
-				pr_perror("ioctl TIOCSCTTY failed");
223
-				exit(1);
224
-			}
225
-			if (dup3(consolefd, STDIN_FILENO, 0) != STDIN_FILENO) {
226
-				pr_perror("Failed to dup 0");
227
-				exit(1);
228
-			}
229
-			if (dup3(consolefd, STDOUT_FILENO, 0) != STDOUT_FILENO) {
230
-				pr_perror("Failed to dup 1");
231
-				exit(1);
232
-			}
233
-			if (dup3(consolefd, STDERR_FILENO, 0) != STDERR_FILENO) {
234
-				pr_perror("Failed to dup 2");
235
-				exit(1);
236
-			}
237
-		}
238
-		// Finish executing, let the Go runtime take over.
239
-		return;
240
-	}
241
-	// Parent
242
-
243
-	// We must fork to actually enter the PID namespace, use CLONE_PARENT
244
-	// so the child can have the right parent, and we don't need to forward
245
-	// the child's exit code or resend its death signal.
246
-	child = clone_parent(&env);
247
-	if (child < 0) {
248
-		pr_perror("Unable to fork");
249
-		exit(1);
250
-	}
251
-
252
-	len = snprintf(buf, sizeof(buf), "{ \"pid\" : %d }\n", child);
253
-
254
-	if (write(pipenum, buf, len) != len) {
255
-		pr_perror("Unable to send a child pid");
256
-		kill(child, SIGKILL);
257
-		exit(1);
258
-	}
259
-
260
-	exit(0);
261
-}
... ...
@@ -48,6 +48,16 @@ type Process struct {
48 48
 	// All capabilities not specified will be dropped from the processes capability mask
49 49
 	Capabilities []string
50 50
 
51
+	// AppArmorProfile specifies the profile to apply to the process and is
52
+	// changed at the time the process is execed
53
+	AppArmorProfile string
54
+
55
+	// Label specifies the label to apply to the process.  It is commonly used by selinux
56
+	Label string
57
+
58
+	// NoNewPrivileges controls whether processes can gain additional privileges.
59
+	NoNewPrivileges *bool
60
+
51 61
 	ops processOperations
52 62
 }
53 63
 
... ...
@@ -88,6 +88,10 @@ func (p *setnsProcess) start() (err error) {
88 88
 	if err := utils.WriteJSON(p.parentPipe, p.config); err != nil {
89 89
 		return newSystemError(err)
90 90
 	}
91
+	// set oom_score_adj
92
+	if err := setOomScoreAdj(p.config.Config.OomScoreAdj, p.pid()); err != nil {
93
+		return newSystemError(err)
94
+	}
91 95
 
92 96
 	if err := syscall.Shutdown(int(p.parentPipe.Fd()), syscall.SHUT_WR); err != nil {
93 97
 		return newSystemError(err)
... ...
@@ -167,14 +171,16 @@ func (p *setnsProcess) setExternalDescriptors(newFds []string) {
167 167
 }
168 168
 
169 169
 type initProcess struct {
170
-	cmd        *exec.Cmd
171
-	parentPipe *os.File
172
-	childPipe  *os.File
173
-	config     *initConfig
174
-	manager    cgroups.Manager
175
-	container  *linuxContainer
176
-	fds        []string
177
-	process    *Process
170
+	cmd           *exec.Cmd
171
+	parentPipe    *os.File
172
+	childPipe     *os.File
173
+	config        *initConfig
174
+	manager       cgroups.Manager
175
+	container     *linuxContainer
176
+	fds           []string
177
+	process       *Process
178
+	bootstrapData io.Reader
179
+	sharePidns    bool
178 180
 }
179 181
 
180 182
 func (p *initProcess) pid() int {
... ...
@@ -185,15 +191,49 @@ func (p *initProcess) externalDescriptors() []string {
185 185
 	return p.fds
186 186
 }
187 187
 
188
-func (p *initProcess) start() (err error) {
188
+// execSetns runs the process that executes C code to perform the setns calls
189
+// because setns support requires the C process to fork off a child and perform the setns
190
+// before the go runtime boots, we wait on the process to die and receive the child's pid
191
+// over the provided pipe.
192
+// This is called by initProcess.start function
193
+func (p *initProcess) execSetns() error {
194
+	status, err := p.cmd.Process.Wait()
195
+	if err != nil {
196
+		p.cmd.Wait()
197
+		return err
198
+	}
199
+	if !status.Success() {
200
+		p.cmd.Wait()
201
+		return &exec.ExitError{ProcessState: status}
202
+	}
203
+	var pid *pid
204
+	if err := json.NewDecoder(p.parentPipe).Decode(&pid); err != nil {
205
+		p.cmd.Wait()
206
+		return err
207
+	}
208
+	process, err := os.FindProcess(pid.Pid)
209
+	if err != nil {
210
+		return err
211
+	}
212
+	p.cmd.Process = process
213
+	return nil
214
+}
215
+
216
+func (p *initProcess) start() error {
189 217
 	defer p.parentPipe.Close()
190
-	err = p.cmd.Start()
218
+	err := p.cmd.Start()
191 219
 	p.process.ops = p
192 220
 	p.childPipe.Close()
193 221
 	if err != nil {
194 222
 		p.process.ops = nil
195 223
 		return newSystemError(err)
196 224
 	}
225
+	if _, err := io.Copy(p.parentPipe, p.bootstrapData); err != nil {
226
+		return err
227
+	}
228
+	if err := p.execSetns(); err != nil {
229
+		return newSystemError(err)
230
+	}
197 231
 	// Save the standard descriptor names before the container process
198 232
 	// can potentially move them (e.g., via dup2()).  If we don't do this now,
199 233
 	// we won't know at checkpoint time which file descriptor to look up.
... ...
@@ -213,19 +253,6 @@ func (p *initProcess) start() (err error) {
213 213
 			p.manager.Destroy()
214 214
 		}
215 215
 	}()
216
-	if p.config.Config.Hooks != nil {
217
-		s := configs.HookState{
218
-			Version: p.container.config.Version,
219
-			ID:      p.container.id,
220
-			Pid:     p.pid(),
221
-			Root:    p.config.Config.Rootfs,
222
-		}
223
-		for _, hook := range p.config.Config.Hooks.Prestart {
224
-			if err := hook.Run(s); err != nil {
225
-				return newSystemError(err)
226
-			}
227
-		}
228
-	}
229 216
 	if err := p.createNetworkInterfaces(); err != nil {
230 217
 		return newSystemError(err)
231 218
 	}
... ...
@@ -233,14 +260,16 @@ func (p *initProcess) start() (err error) {
233 233
 		return newSystemError(err)
234 234
 	}
235 235
 	var (
236
-		procSync syncT
237
-		sentRun  bool
238
-		ierr     *genericError
236
+		procSync   syncT
237
+		sentRun    bool
238
+		sentResume bool
239
+		ierr       *genericError
239 240
 	)
240 241
 
242
+	dec := json.NewDecoder(p.parentPipe)
241 243
 loop:
242 244
 	for {
243
-		if err := json.NewDecoder(p.parentPipe).Decode(&procSync); err != nil {
245
+		if err := dec.Decode(&procSync); err != nil {
244 246
 			if err == io.EOF {
245 247
 				break loop
246 248
 			}
... ...
@@ -251,15 +280,54 @@ loop:
251 251
 			if err := p.manager.Set(p.config.Config); err != nil {
252 252
 				return newSystemError(err)
253 253
 			}
254
+			// set oom_score_adj
255
+			if err := setOomScoreAdj(p.config.Config.OomScoreAdj, p.pid()); err != nil {
256
+				return newSystemError(err)
257
+			}
258
+			// call prestart hooks
259
+			if !p.config.Config.Namespaces.Contains(configs.NEWNS) {
260
+				if p.config.Config.Hooks != nil {
261
+					s := configs.HookState{
262
+						Version: p.container.config.Version,
263
+						ID:      p.container.id,
264
+						Pid:     p.pid(),
265
+						Root:    p.config.Config.Rootfs,
266
+					}
267
+					for _, hook := range p.config.Config.Hooks.Prestart {
268
+						if err := hook.Run(s); err != nil {
269
+							return newSystemError(err)
270
+						}
271
+					}
272
+				}
273
+			}
254 274
 			// Sync with child.
255 275
 			if err := utils.WriteJSON(p.parentPipe, syncT{procRun}); err != nil {
256 276
 				return newSystemError(err)
257 277
 			}
258 278
 			sentRun = true
279
+		case procHooks:
280
+			if p.config.Config.Hooks != nil {
281
+				s := configs.HookState{
282
+					Version: p.container.config.Version,
283
+					ID:      p.container.id,
284
+					Pid:     p.pid(),
285
+					Root:    p.config.Config.Rootfs,
286
+				}
287
+				for _, hook := range p.config.Config.Hooks.Prestart {
288
+					if err := hook.Run(s); err != nil {
289
+						return newSystemError(err)
290
+					}
291
+				}
292
+			}
293
+			// Sync with child.
294
+			if err := utils.WriteJSON(p.parentPipe, syncT{procResume}); err != nil {
295
+				return newSystemError(err)
296
+			}
297
+			sentResume = true
259 298
 		case procError:
260 299
 			// wait for the child process to fully complete and receive an error message
261 300
 			// if one was encoutered
262
-			if err := json.NewDecoder(p.parentPipe).Decode(&ierr); err != nil && err != io.EOF {
301
+			if err := dec.Decode(&ierr); err != nil && err != io.EOF {
263 302
 				return newSystemError(err)
264 303
 			}
265 304
 			if ierr != nil {
... ...
@@ -274,6 +342,9 @@ loop:
274 274
 	if !sentRun {
275 275
 		return newSystemError(fmt.Errorf("could not synchronise with container process"))
276 276
 	}
277
+	if p.config.Config.Namespaces.Contains(configs.NEWNS) && !sentResume {
278
+		return newSystemError(fmt.Errorf("could not synchronise after executing prestart hooks with container process"))
279
+	}
277 280
 	if err := syscall.Shutdown(int(p.parentPipe.Fd()), syscall.SHUT_WR); err != nil {
278 281
 		return newSystemError(err)
279 282
 	}
... ...
@@ -291,7 +362,7 @@ func (p *initProcess) wait() (*os.ProcessState, error) {
291 291
 		return p.cmd.ProcessState, err
292 292
 	}
293 293
 	// we should kill all processes in cgroup when init is died if we use host PID namespace
294
-	if p.cmd.SysProcAttr.Cloneflags&syscall.CLONE_NEWPID == 0 {
294
+	if p.sharePidns {
295 295
 		killCgroupProcesses(p.manager)
296 296
 	}
297 297
 	return p.cmd.ProcessState, nil
... ...
@@ -4,6 +4,7 @@ package libcontainer
4 4
 
5 5
 import (
6 6
 	"fmt"
7
+	"io"
7 8
 	"io/ioutil"
8 9
 	"os"
9 10
 	"os/exec"
... ...
@@ -26,7 +27,7 @@ const defaultMountFlags = syscall.MS_NOEXEC | syscall.MS_NOSUID | syscall.MS_NOD
26 26
 
27 27
 // setupRootfs sets up the devices, mount points, and filesystems for use inside a
28 28
 // new mount namespace.
29
-func setupRootfs(config *configs.Config, console *linuxConsole) (err error) {
29
+func setupRootfs(config *configs.Config, console *linuxConsole, pipe io.ReadWriter) (err error) {
30 30
 	if err := prepareRoot(config); err != nil {
31 31
 		return newSystemError(err)
32 32
 	}
... ...
@@ -59,6 +60,13 @@ func setupRootfs(config *configs.Config, console *linuxConsole) (err error) {
59 59
 			return newSystemError(err)
60 60
 		}
61 61
 	}
62
+	// Signal the parent to run the pre-start hooks.
63
+	// The hooks are run after the mounts are setup, but before we switch to the new
64
+	// root, so that the old root is still available in the hooks for any mount
65
+	// manipulations.
66
+	if err := syncParentHooks(pipe); err != nil {
67
+		return err
68
+	}
62 69
 	if err := syscall.Chdir(config.Rootfs); err != nil {
63 70
 		return newSystemError(err)
64 71
 	}
... ...
@@ -75,6 +83,18 @@ func setupRootfs(config *configs.Config, console *linuxConsole) (err error) {
75 75
 			return newSystemError(err)
76 76
 		}
77 77
 	}
78
+	// remount dev as ro if specifed
79
+	for _, m := range config.Mounts {
80
+		if m.Destination == "/dev" {
81
+			if m.Flags&syscall.MS_RDONLY != 0 {
82
+				if err := remountReadonly(m.Destination); err != nil {
83
+					return newSystemError(err)
84
+				}
85
+			}
86
+			break
87
+		}
88
+	}
89
+	// set rootfs ( / ) as readonly
78 90
 	if config.Readonlyfs {
79 91
 		if err := setReadonly(); err != nil {
80 92
 			return newSystemError(err)
... ...
@@ -138,16 +158,6 @@ func mountToRootfs(m *configs.Mount, rootfs, mountLabel string) error {
138 138
 			}
139 139
 		}
140 140
 		return nil
141
-	case "devpts":
142
-		if err := os.MkdirAll(dest, 0755); err != nil {
143
-			return err
144
-		}
145
-		return mountPropagate(m, rootfs, mountLabel)
146
-	case "securityfs":
147
-		if err := os.MkdirAll(dest, 0755); err != nil {
148
-			return err
149
-		}
150
-		return mountPropagate(m, rootfs, mountLabel)
151 141
 	case "bind":
152 142
 		stat, err := os.Stat(m.Source)
153 143
 		if err != nil {
... ...
@@ -253,7 +263,10 @@ func mountToRootfs(m *configs.Mount, rootfs, mountLabel string) error {
253 253
 			}
254 254
 		}
255 255
 	default:
256
-		return fmt.Errorf("unknown mount device %q to %q", m.Device, m.Destination)
256
+		if err := os.MkdirAll(dest, 0755); err != nil {
257
+			return err
258
+		}
259
+		return mountPropagate(m, rootfs, mountLabel)
257 260
 	}
258 261
 	return nil
259 262
 }
... ...
@@ -552,7 +565,7 @@ func setupPtmx(config *configs.Config, console *linuxConsole) error {
552 552
 	return nil
553 553
 }
554 554
 
555
-func pivotRoot(rootfs, pivotBaseDir string) error {
555
+func pivotRoot(rootfs, pivotBaseDir string) (err error) {
556 556
 	if pivotBaseDir == "" {
557 557
 		pivotBaseDir = "/"
558 558
 	}
... ...
@@ -564,6 +577,12 @@ func pivotRoot(rootfs, pivotBaseDir string) error {
564 564
 	if err != nil {
565 565
 		return fmt.Errorf("can't create pivot_root dir %s, error %v", pivotDir, err)
566 566
 	}
567
+	defer func() {
568
+		errVal := os.Remove(pivotDir)
569
+		if err == nil {
570
+			err = errVal
571
+		}
572
+	}()
567 573
 	if err := syscall.PivotRoot(rootfs, pivotDir); err != nil {
568 574
 		return fmt.Errorf("pivot_root %s", err)
569 575
 	}
... ...
@@ -582,7 +601,7 @@ func pivotRoot(rootfs, pivotBaseDir string) error {
582 582
 	if err := syscall.Unmount(pivotDir, syscall.MNT_DETACH); err != nil {
583 583
 		return fmt.Errorf("unmount pivot_root dir %s", err)
584 584
 	}
585
-	return os.Remove(pivotDir)
585
+	return nil
586 586
 }
587 587
 
588 588
 func msMoveRoot(rootfs string) error {
... ...
@@ -671,14 +690,18 @@ func remount(m *configs.Mount, rootfs string) error {
671 671
 // of propagation flags.
672 672
 func mountPropagate(m *configs.Mount, rootfs string, mountLabel string) error {
673 673
 	var (
674
-		dest = m.Destination
675
-		data = label.FormatMountLabel(m.Data, mountLabel)
674
+		dest  = m.Destination
675
+		data  = label.FormatMountLabel(m.Data, mountLabel)
676
+		flags = m.Flags
676 677
 	)
678
+	if dest == "/dev" {
679
+		flags &= ^syscall.MS_RDONLY
680
+	}
677 681
 	if !strings.HasPrefix(dest, rootfs) {
678 682
 		dest = filepath.Join(rootfs, dest)
679 683
 	}
680 684
 
681
-	if err := syscall.Mount(m.Source, dest, m.Device, uintptr(m.Flags), data); err != nil {
685
+	if err := syscall.Mount(m.Source, dest, m.Device, uintptr(flags), data); err != nil {
682 686
 		return err
683 687
 	}
684 688
 
... ...
@@ -158,12 +158,14 @@ func Setfilecon(path string, scon string) error {
158 158
 // Getfilecon returns the SELinux label for this path or returns an error.
159 159
 func Getfilecon(path string) (string, error) {
160 160
 	con, err := system.Lgetxattr(path, xattrNameSelinux)
161
-
161
+	if err != nil {
162
+		return "", err
163
+	}
162 164
 	// Trim the NUL byte at the end of the byte buffer, if present.
163
-	if con[len(con)-1] == '\x00' {
165
+	if len(con) > 0 && con[len(con)-1] == '\x00' {
164 166
 		con = con[:len(con)-1]
165 167
 	}
166
-	return string(con), err
168
+	return string(con), nil
167 169
 }
168 170
 
169 171
 func Setfscreatecon(scon string) error {
... ...
@@ -3,6 +3,7 @@
3 3
 package libcontainer
4 4
 
5 5
 import (
6
+	"fmt"
6 7
 	"os"
7 8
 
8 9
 	"github.com/opencontainers/runc/libcontainer/apparmor"
... ...
@@ -18,18 +19,19 @@ type linuxSetnsInit struct {
18 18
 	config *initConfig
19 19
 }
20 20
 
21
+func (l *linuxSetnsInit) getSessionRingName() string {
22
+	return fmt.Sprintf("_ses.%s", l.config.ContainerId)
23
+}
24
+
21 25
 func (l *linuxSetnsInit) Init() error {
22 26
 	// do not inherit the parent's session keyring
23
-	if _, err := keyctl.JoinSessionKeyring("_ses"); err != nil {
27
+	if _, err := keyctl.JoinSessionKeyring(l.getSessionRingName()); err != nil {
24 28
 		return err
25 29
 	}
26 30
 	if err := setupRlimits(l.config.Config); err != nil {
27 31
 		return err
28 32
 	}
29
-	if err := setOomScoreAdj(l.config.Config.OomScoreAdj); err != nil {
30
-		return err
31
-	}
32
-	if l.config.Config.NoNewPrivileges {
33
+	if l.config.NoNewPrivileges {
33 34
 		if err := system.Prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); err != nil {
34 35
 			return err
35 36
 		}
... ...
@@ -42,11 +44,11 @@ func (l *linuxSetnsInit) Init() error {
42 42
 	if err := finalizeNamespace(l.config); err != nil {
43 43
 		return err
44 44
 	}
45
-	if err := apparmor.ApplyProfile(l.config.Config.AppArmorProfile); err != nil {
45
+	if err := apparmor.ApplyProfile(l.config.AppArmorProfile); err != nil {
46 46
 		return err
47 47
 	}
48
-	if l.config.Config.ProcessLabel != "" {
49
-		if err := label.SetProcessLabel(l.config.Config.ProcessLabel); err != nil {
48
+	if l.config.ProcessLabel != "" {
49
+		if err := label.SetProcessLabel(l.config.ProcessLabel); err != nil {
50 50
 			return err
51 51
 		}
52 52
 	}
... ...
@@ -3,6 +3,7 @@
3 3
 package libcontainer
4 4
 
5 5
 import (
6
+	"fmt"
6 7
 	"io"
7 8
 	"os"
8 9
 	"syscall"
... ...
@@ -21,27 +22,39 @@ type linuxStandardInit struct {
21 21
 	config    *initConfig
22 22
 }
23 23
 
24
+func (l *linuxStandardInit) getSessionRingParams() (string, uint32, uint32) {
25
+	var newperms uint32
26
+
27
+	if l.config.Config.Namespaces.Contains(configs.NEWUSER) {
28
+		// with user ns we need 'other' search permissions
29
+		newperms = 0x8
30
+	} else {
31
+		// without user ns we need 'UID' search permissions
32
+		newperms = 0x80000
33
+	}
34
+
35
+	// create a unique per session container name that we can
36
+	// join in setns; however, other containers can also join it
37
+	return fmt.Sprintf("_ses.%s", l.config.ContainerId), 0xffffffff, newperms
38
+}
39
+
24 40
 // PR_SET_NO_NEW_PRIVS isn't exposed in Golang so we define it ourselves copying the value
25 41
 // the kernel
26 42
 const PR_SET_NO_NEW_PRIVS = 0x26
27 43
 
28 44
 func (l *linuxStandardInit) Init() error {
45
+	ringname, keepperms, newperms := l.getSessionRingParams()
46
+
29 47
 	// do not inherit the parent's session keyring
30
-	sessKeyId, err := keyctl.JoinSessionKeyring("")
48
+	sessKeyId, err := keyctl.JoinSessionKeyring(ringname)
31 49
 	if err != nil {
32 50
 		return err
33 51
 	}
34 52
 	// make session keyring searcheable
35
-	// without user ns we need 'UID' search permissions
36
-	// with user ns we need 'other' search permissions
37
-	if err := keyctl.ModKeyringPerm(sessKeyId, 0xffffffff, 0x080008); err != nil {
53
+	if err := keyctl.ModKeyringPerm(sessKeyId, keepperms, newperms); err != nil {
38 54
 		return err
39 55
 	}
40 56
 
41
-	// join any namespaces via a path to the namespace fd if provided
42
-	if err := joinExistingNamespaces(l.config.Config.Namespaces); err != nil {
43
-		return err
44
-	}
45 57
 	var console *linuxConsole
46 58
 	if l.config.Console != "" {
47 59
 		console = newConsoleFromPath(l.config.Console)
... ...
@@ -49,9 +62,6 @@ func (l *linuxStandardInit) Init() error {
49 49
 			return err
50 50
 		}
51 51
 	}
52
-	if _, err := syscall.Setsid(); err != nil {
53
-		return err
54
-	}
55 52
 	if console != nil {
56 53
 		if err := system.Setctty(); err != nil {
57 54
 			return err
... ...
@@ -66,13 +76,11 @@ func (l *linuxStandardInit) Init() error {
66 66
 	if err := setupRlimits(l.config.Config); err != nil {
67 67
 		return err
68 68
 	}
69
-	if err := setOomScoreAdj(l.config.Config.OomScoreAdj); err != nil {
70
-		return err
71
-	}
69
+
72 70
 	label.Init()
73 71
 	// InitializeMountNamespace() can be executed only for a new mount namespace
74 72
 	if l.config.Config.Namespaces.Contains(configs.NEWNS) {
75
-		if err := setupRootfs(l.config.Config, console); err != nil {
73
+		if err := setupRootfs(l.config.Config, console, l.pipe); err != nil {
76 74
 			return err
77 75
 		}
78 76
 	}
... ...
@@ -81,10 +89,10 @@ func (l *linuxStandardInit) Init() error {
81 81
 			return err
82 82
 		}
83 83
 	}
84
-	if err := apparmor.ApplyProfile(l.config.Config.AppArmorProfile); err != nil {
84
+	if err := apparmor.ApplyProfile(l.config.AppArmorProfile); err != nil {
85 85
 		return err
86 86
 	}
87
-	if err := label.SetProcessLabel(l.config.Config.ProcessLabel); err != nil {
87
+	if err := label.SetProcessLabel(l.config.ProcessLabel); err != nil {
88 88
 		return err
89 89
 	}
90 90
 
... ...
@@ -107,7 +115,7 @@ func (l *linuxStandardInit) Init() error {
107 107
 	if err != nil {
108 108
 		return err
109 109
 	}
110
-	if l.config.Config.NoNewPrivileges {
110
+	if l.config.NoNewPrivileges {
111 111
 		if err := system.Prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); err != nil {
112 112
 			return err
113 113
 		}
114 114
new file mode 100644
... ...
@@ -0,0 +1,9 @@
0
+// +build !linux
1
+
2
+package system
3
+
4
+// RunningInUserNS is a stub for non-Linux systems
5
+// Always returns false
6
+func RunningInUserNS() bool {
7
+	return false
8
+}
0 9
new file mode 100644
... ...
@@ -0,0 +1,191 @@
0
+
1
+                                 Apache License
2
+                           Version 2.0, January 2004
3
+                        http://www.apache.org/licenses/
4
+
5
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
6
+
7
+   1. Definitions.
8
+
9
+      "License" shall mean the terms and conditions for use, reproduction,
10
+      and distribution as defined by Sections 1 through 9 of this document.
11
+
12
+      "Licensor" shall mean the copyright owner or entity authorized by
13
+      the copyright owner that is granting the License.
14
+
15
+      "Legal Entity" shall mean the union of the acting entity and all
16
+      other entities that control, are controlled by, or are under common
17
+      control with that entity. For the purposes of this definition,
18
+      "control" means (i) the power, direct or indirect, to cause the
19
+      direction or management of such entity, whether by contract or
20
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
21
+      outstanding shares, or (iii) beneficial ownership of such entity.
22
+
23
+      "You" (or "Your") shall mean an individual or Legal Entity
24
+      exercising permissions granted by this License.
25
+
26
+      "Source" form shall mean the preferred form for making modifications,
27
+      including but not limited to software source code, documentation
28
+      source, and configuration files.
29
+
30
+      "Object" form shall mean any form resulting from mechanical
31
+      transformation or translation of a Source form, including but
32
+      not limited to compiled object code, generated documentation,
33
+      and conversions to other media types.
34
+
35
+      "Work" shall mean the work of authorship, whether in Source or
36
+      Object form, made available under the License, as indicated by a
37
+      copyright notice that is included in or attached to the work
38
+      (an example is provided in the Appendix below).
39
+
40
+      "Derivative Works" shall mean any work, whether in Source or Object
41
+      form, that is based on (or derived from) the Work and for which the
42
+      editorial revisions, annotations, elaborations, or other modifications
43
+      represent, as a whole, an original work of authorship. For the purposes
44
+      of this License, Derivative Works shall not include works that remain
45
+      separable from, or merely link (or bind by name) to the interfaces of,
46
+      the Work and Derivative Works thereof.
47
+
48
+      "Contribution" shall mean any work of authorship, including
49
+      the original version of the Work and any modifications or additions
50
+      to that Work or Derivative Works thereof, that is intentionally
51
+      submitted to Licensor for inclusion in the Work by the copyright owner
52
+      or by an individual or Legal Entity authorized to submit on behalf of
53
+      the copyright owner. For the purposes of this definition, "submitted"
54
+      means any form of electronic, verbal, or written communication sent
55
+      to the Licensor or its representatives, including but not limited to
56
+      communication on electronic mailing lists, source code control systems,
57
+      and issue tracking systems that are managed by, or on behalf of, the
58
+      Licensor for the purpose of discussing and improving the Work, but
59
+      excluding communication that is conspicuously marked or otherwise
60
+      designated in writing by the copyright owner as "Not a Contribution."
61
+
62
+      "Contributor" shall mean Licensor and any individual or Legal Entity
63
+      on behalf of whom a Contribution has been received by Licensor and
64
+      subsequently incorporated within the Work.
65
+
66
+   2. Grant of Copyright License. Subject to the terms and conditions of
67
+      this License, each Contributor hereby grants to You a perpetual,
68
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
69
+      copyright license to reproduce, prepare Derivative Works of,
70
+      publicly display, publicly perform, sublicense, and distribute the
71
+      Work and such Derivative Works in Source or Object form.
72
+
73
+   3. Grant of Patent License. Subject to the terms and conditions of
74
+      this License, each Contributor hereby grants to You a perpetual,
75
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
76
+      (except as stated in this section) patent license to make, have made,
77
+      use, offer to sell, sell, import, and otherwise transfer the Work,
78
+      where such license applies only to those patent claims licensable
79
+      by such Contributor that are necessarily infringed by their
80
+      Contribution(s) alone or by combination of their Contribution(s)
81
+      with the Work to which such Contribution(s) was submitted. If You
82
+      institute patent litigation against any entity (including a
83
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
84
+      or a Contribution incorporated within the Work constitutes direct
85
+      or contributory patent infringement, then any patent licenses
86
+      granted to You under this License for that Work shall terminate
87
+      as of the date such litigation is filed.
88
+
89
+   4. Redistribution. You may reproduce and distribute copies of the
90
+      Work or Derivative Works thereof in any medium, with or without
91
+      modifications, and in Source or Object form, provided that You
92
+      meet the following conditions:
93
+
94
+      (a) You must give any other recipients of the Work or
95
+          Derivative Works a copy of this License; and
96
+
97
+      (b) You must cause any modified files to carry prominent notices
98
+          stating that You changed the files; and
99
+
100
+      (c) You must retain, in the Source form of any Derivative Works
101
+          that You distribute, all copyright, patent, trademark, and
102
+          attribution notices from the Source form of the Work,
103
+          excluding those notices that do not pertain to any part of
104
+          the Derivative Works; and
105
+
106
+      (d) If the Work includes a "NOTICE" text file as part of its
107
+          distribution, then any Derivative Works that You distribute must
108
+          include a readable copy of the attribution notices contained
109
+          within such NOTICE file, excluding those notices that do not
110
+          pertain to any part of the Derivative Works, in at least one
111
+          of the following places: within a NOTICE text file distributed
112
+          as part of the Derivative Works; within the Source form or
113
+          documentation, if provided along with the Derivative Works; or,
114
+          within a display generated by the Derivative Works, if and
115
+          wherever such third-party notices normally appear. The contents
116
+          of the NOTICE file are for informational purposes only and
117
+          do not modify the License. You may add Your own attribution
118
+          notices within Derivative Works that You distribute, alongside
119
+          or as an addendum to the NOTICE text from the Work, provided
120
+          that such additional attribution notices cannot be construed
121
+          as modifying the License.
122
+
123
+      You may add Your own copyright statement to Your modifications and
124
+      may provide additional or different license terms and conditions
125
+      for use, reproduction, or distribution of Your modifications, or
126
+      for any such Derivative Works as a whole, provided Your use,
127
+      reproduction, and distribution of the Work otherwise complies with
128
+      the conditions stated in this License.
129
+
130
+   5. Submission of Contributions. Unless You explicitly state otherwise,
131
+      any Contribution intentionally submitted for inclusion in the Work
132
+      by You to the Licensor shall be under the terms and conditions of
133
+      this License, without any additional terms or conditions.
134
+      Notwithstanding the above, nothing herein shall supersede or modify
135
+      the terms of any separate license agreement you may have executed
136
+      with Licensor regarding such Contributions.
137
+
138
+   6. Trademarks. This License does not grant permission to use the trade
139
+      names, trademarks, service marks, or product names of the Licensor,
140
+      except as required for reasonable and customary use in describing the
141
+      origin of the Work and reproducing the content of the NOTICE file.
142
+
143
+   7. Disclaimer of Warranty. Unless required by applicable law or
144
+      agreed to in writing, Licensor provides the Work (and each
145
+      Contributor provides its Contributions) on an "AS IS" BASIS,
146
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
147
+      implied, including, without limitation, any warranties or conditions
148
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
149
+      PARTICULAR PURPOSE. You are solely responsible for determining the
150
+      appropriateness of using or redistributing the Work and assume any
151
+      risks associated with Your exercise of permissions under this License.
152
+
153
+   8. Limitation of Liability. In no event and under no legal theory,
154
+      whether in tort (including negligence), contract, or otherwise,
155
+      unless required by applicable law (such as deliberate and grossly
156
+      negligent acts) or agreed to in writing, shall any Contributor be
157
+      liable to You for damages, including any direct, indirect, special,
158
+      incidental, or consequential damages of any character arising as a
159
+      result of this License or out of the use or inability to use the
160
+      Work (including but not limited to damages for loss of goodwill,
161
+      work stoppage, computer failure or malfunction, or any and all
162
+      other commercial damages or losses), even if such Contributor
163
+      has been advised of the possibility of such damages.
164
+
165
+   9. Accepting Warranty or Additional Liability. While redistributing
166
+      the Work or Derivative Works thereof, You may choose to offer,
167
+      and charge a fee for, acceptance of support, warranty, indemnity,
168
+      or other liability obligations and/or rights consistent with this
169
+      License. However, in accepting such obligations, You may act only
170
+      on Your own behalf and on Your sole responsibility, not on behalf
171
+      of any other Contributor, and only if You agree to indemnify,
172
+      defend, and hold each Contributor harmless for any liability
173
+      incurred by, or claims asserted against, such Contributor by reason
174
+      of your accepting any such warranty or additional liability.
175
+
176
+   END OF TERMS AND CONDITIONS
177
+
178
+   Copyright 2015 The Linux Foundation.
179
+
180
+   Licensed under the Apache License, Version 2.0 (the "License");
181
+   you may not use this file except in compliance with the License.
182
+   You may obtain a copy of the License at
183
+
184
+       http://www.apache.org/licenses/LICENSE-2.0
185
+
186
+   Unless required by applicable law or agreed to in writing, software
187
+   distributed under the License is distributed on an "AS IS" BASIS,
188
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
189
+   See the License for the specific language governing permissions and
190
+   limitations under the License.
0 191
new file mode 100644
... ...
@@ -0,0 +1,412 @@
0
+package specs
1
+
2
+import "os"
3
+
4
+// Spec is the base configuration for the container.  It specifies platform
5
+// independent configuration. This information must be included when the
6
+// bundle is packaged for distribution.
7
+type Spec struct {
8
+	// Version is the version of the specification that is supported.
9
+	Version string `json:"ociVersion"`
10
+	// Platform is the host information for OS and Arch.
11
+	Platform Platform `json:"platform"`
12
+	// Process is the container's main process.
13
+	Process Process `json:"process"`
14
+	// Root is the root information for the container's filesystem.
15
+	Root Root `json:"root"`
16
+	// Hostname is the container's host name.
17
+	Hostname string `json:"hostname,omitempty"`
18
+	// Mounts profile configuration for adding mounts to the container's filesystem.
19
+	Mounts []Mount `json:"mounts"`
20
+	// Hooks are the commands run at various lifecycle events of the container.
21
+	Hooks Hooks `json:"hooks"`
22
+	// Annotations is an unstructured key value map that may be set by external tools to store and retrieve arbitrary metadata.
23
+	Annotations map[string]string `json:"annotations,omitempty"`
24
+
25
+	// Linux is platform specific configuration for Linux based containers.
26
+	Linux Linux `json:"linux" platform:"linux"`
27
+}
28
+
29
+// Process contains information to start a specific application inside the container.
30
+type Process struct {
31
+	// Terminal creates an interactive terminal for the container.
32
+	Terminal bool `json:"terminal"`
33
+	// User specifies user information for the process.
34
+	User User `json:"user"`
35
+	// Args specifies the binary and arguments for the application to execute.
36
+	Args []string `json:"args"`
37
+	// Env populates the process environment for the process.
38
+	Env []string `json:"env,omitempty"`
39
+	// Cwd is the current working directory for the process and must be
40
+	// relative to the container's root.
41
+	Cwd string `json:"cwd"`
42
+	// Capabilities are Linux capabilities that are kept for the container.
43
+	Capabilities []string `json:"capabilities,omitempty" platform:"linux"`
44
+	// Rlimits specifies rlimit options to apply to the process.
45
+	Rlimits []Rlimit `json:"rlimits,omitempty"`
46
+	// NoNewPrivileges controls whether additional privileges could be gained by processes in the container.
47
+	NoNewPrivileges bool `json:"noNewPrivileges,omitempty"`
48
+
49
+	// ApparmorProfile specified the apparmor profile for the container. (this field is platform dependent)
50
+	ApparmorProfile string `json:"apparmorProfile,omitempty" platform:"linux"`
51
+	// SelinuxProcessLabel specifies the selinux context that the container process is run as. (this field is platform dependent)
52
+	SelinuxLabel string `json:"selinuxLabel,omitempty" platform:"linux"`
53
+}
54
+
55
+// User specifies Linux specific user and group information for the container's
56
+// main process.
57
+type User struct {
58
+	// UID is the user id. (this field is platform dependent)
59
+	UID uint32 `json:"uid,omitempty" platform:"linux"`
60
+	// GID is the group id. (this field is platform dependent)
61
+	GID uint32 `json:"gid,omitempty" platform:"linux"`
62
+	// AdditionalGids are additional group ids set for the container's process. (this field is platform dependent)
63
+	AdditionalGids []uint32 `json:"additionalGids,omitempty" platform:"linux"`
64
+}
65
+
66
+// Root contains information about the container's root filesystem on the host.
67
+type Root struct {
68
+	// Path is the absolute path to the container's root filesystem.
69
+	Path string `json:"path"`
70
+	// Readonly makes the root filesystem for the container readonly before the process is executed.
71
+	Readonly bool `json:"readonly"`
72
+}
73
+
74
+// Platform specifies OS and arch information for the host system that the container
75
+// is created for.
76
+type Platform struct {
77
+	// OS is the operating system.
78
+	OS string `json:"os"`
79
+	// Arch is the architecture
80
+	Arch string `json:"arch"`
81
+}
82
+
83
+// Mount specifies a mount for a container.
84
+type Mount struct {
85
+	// Destination is the path where the mount will be placed relative to the container's root.  The path and child directories MUST exist, a runtime MUST NOT create directories automatically to a mount point.
86
+	Destination string `json:"destination"`
87
+	// Type specifies the mount kind.
88
+	Type string `json:"type"`
89
+	// Source specifies the source path of the mount.  In the case of bind mounts on
90
+	// Linux based systems this would be the file on the host.
91
+	Source string `json:"source"`
92
+	// Options are fstab style mount options.
93
+	Options []string `json:"options,omitempty"`
94
+}
95
+
96
+// Hook specifies a command that is run at a particular event in the lifecycle of a container
97
+type Hook struct {
98
+	Path string   `json:"path"`
99
+	Args []string `json:"args,omitempty"`
100
+	Env  []string `json:"env,omitempty"`
101
+}
102
+
103
+// Hooks for container setup and teardown
104
+type Hooks struct {
105
+	// Prestart is a list of hooks to be run before the container process is executed.
106
+	// On Linux, they are run after the container namespaces are created.
107
+	Prestart []Hook `json:"prestart,omitempty"`
108
+	// Poststart is a list of hooks to be run after the container process is started.
109
+	Poststart []Hook `json:"poststart,omitempty"`
110
+	// Poststop is a list of hooks to be run after the container process exits.
111
+	Poststop []Hook `json:"poststop,omitempty"`
112
+}
113
+
114
+// Linux contains platform specific configuration for Linux based containers.
115
+type Linux struct {
116
+	// UIDMapping specifies user mappings for supporting user namespaces on Linux.
117
+	UIDMappings []IDMapping `json:"uidMappings,omitempty"`
118
+	// GIDMapping specifies group mappings for supporting user namespaces on Linux.
119
+	GIDMappings []IDMapping `json:"gidMappings,omitempty"`
120
+	// Sysctl are a set of key value pairs that are set for the container on start
121
+	Sysctl map[string]string `json:"sysctl,omitempty"`
122
+	// Resources contain cgroup information for handling resource constraints
123
+	// for the container
124
+	Resources *Resources `json:"resources,omitempty"`
125
+	// CgroupsPath specifies the path to cgroups that are created and/or joined by the container.
126
+	// The path is expected to be relative to the cgroups mountpoint.
127
+	// If resources are specified, the cgroups at CgroupsPath will be updated based on resources.
128
+	CgroupsPath *string `json:"cgroupsPath,omitempty"`
129
+	// Namespaces contains the namespaces that are created and/or joined by the container
130
+	Namespaces []Namespace `json:"namespaces"`
131
+	// Devices are a list of device nodes that are created for the container
132
+	Devices []Device `json:"devices"`
133
+	// Seccomp specifies the seccomp security settings for the container.
134
+	Seccomp *Seccomp `json:"seccomp,omitempty"`
135
+	// RootfsPropagation is the rootfs mount propagation mode for the container.
136
+	RootfsPropagation string `json:"rootfsPropagation,omitempty"`
137
+}
138
+
139
+// Namespace is the configuration for a Linux namespace
140
+type Namespace struct {
141
+	// Type is the type of Linux namespace
142
+	Type NamespaceType `json:"type"`
143
+	// Path is a path to an existing namespace persisted on disk that can be joined
144
+	// and is of the same type
145
+	Path string `json:"path,omitempty"`
146
+}
147
+
148
+// NamespaceType is one of the Linux namespaces
149
+type NamespaceType string
150
+
151
+const (
152
+	// PIDNamespace for isolating process IDs
153
+	PIDNamespace NamespaceType = "pid"
154
+	// NetworkNamespace for isolating network devices, stacks, ports, etc
155
+	NetworkNamespace = "network"
156
+	// MountNamespace for isolating mount points
157
+	MountNamespace = "mount"
158
+	// IPCNamespace for isolating System V IPC, POSIX message queues
159
+	IPCNamespace = "ipc"
160
+	// UTSNamespace for isolating hostname and NIS domain name
161
+	UTSNamespace = "uts"
162
+	// UserNamespace for isolating user and group IDs
163
+	UserNamespace = "user"
164
+)
165
+
166
+// IDMapping specifies UID/GID mappings
167
+type IDMapping struct {
168
+	// HostID is the UID/GID of the host user or group
169
+	HostID uint32 `json:"hostID"`
170
+	// ContainerID is the UID/GID of the container's user or group
171
+	ContainerID uint32 `json:"containerID"`
172
+	// Size is the length of the range of IDs mapped between the two namespaces
173
+	Size uint32 `json:"size"`
174
+}
175
+
176
+// Rlimit type and restrictions
177
+type Rlimit struct {
178
+	// Type of the rlimit to set
179
+	Type string `json:"type"`
180
+	// Hard is the hard limit for the specified type
181
+	Hard uint64 `json:"hard"`
182
+	// Soft is the soft limit for the specified type
183
+	Soft uint64 `json:"soft"`
184
+}
185
+
186
+// HugepageLimit structure corresponds to limiting kernel hugepages
187
+type HugepageLimit struct {
188
+	// Pagesize is the hugepage size
189
+	Pagesize *string `json:"pageSize,omitempty"`
190
+	// Limit is the limit of "hugepagesize" hugetlb usage
191
+	Limit *uint64 `json:"limit,omitempty"`
192
+}
193
+
194
+// InterfacePriority for network interfaces
195
+type InterfacePriority struct {
196
+	// Name is the name of the network interface
197
+	Name string `json:"name"`
198
+	// Priority for the interface
199
+	Priority uint32 `json:"priority"`
200
+}
201
+
202
+// blockIODevice holds major:minor format supported in blkio cgroup
203
+type blockIODevice struct {
204
+	// Major is the device's major number.
205
+	Major int64 `json:"major"`
206
+	// Minor is the device's minor number.
207
+	Minor int64 `json:"minor"`
208
+}
209
+
210
+// WeightDevice struct holds a `major:minor weight` pair for blkioWeightDevice
211
+type WeightDevice struct {
212
+	blockIODevice
213
+	// Weight is the bandwidth rate for the device, range is from 10 to 1000
214
+	Weight *uint16 `json:"weight,omitempty"`
215
+	// LeafWeight is the bandwidth rate for the device while competing with the cgroup's child cgroups, range is from 10 to 1000, CFQ scheduler only
216
+	LeafWeight *uint16 `json:"leafWeight,omitempty"`
217
+}
218
+
219
+// ThrottleDevice struct holds a `major:minor rate_per_second` pair
220
+type ThrottleDevice struct {
221
+	blockIODevice
222
+	// Rate is the IO rate limit per cgroup per device
223
+	Rate *uint64 `json:"rate,omitempty"`
224
+}
225
+
226
+// BlockIO for Linux cgroup 'blkio' resource management
227
+type BlockIO struct {
228
+	// Specifies per cgroup weight, range is from 10 to 1000
229
+	Weight *uint16 `json:"blkioWeight,omitempty"`
230
+	// Specifies tasks' weight in the given cgroup while competing with the cgroup's child cgroups, range is from 10 to 1000, CFQ scheduler only
231
+	LeafWeight *uint16 `json:"blkioLeafWeight,omitempty"`
232
+	// Weight per cgroup per device, can override BlkioWeight
233
+	WeightDevice []WeightDevice `json:"blkioWeightDevice,omitempty"`
234
+	// IO read rate limit per cgroup per device, bytes per second
235
+	ThrottleReadBpsDevice []ThrottleDevice `json:"blkioThrottleReadBpsDevice,omitempty"`
236
+	// IO write rate limit per cgroup per device, bytes per second
237
+	ThrottleWriteBpsDevice []ThrottleDevice `json:"blkioThrottleWriteBpsDevice,omitempty"`
238
+	// IO read rate limit per cgroup per device, IO per second
239
+	ThrottleReadIOPSDevice []ThrottleDevice `json:"blkioThrottleReadIOPSDevice,omitempty"`
240
+	// IO write rate limit per cgroup per device, IO per second
241
+	ThrottleWriteIOPSDevice []ThrottleDevice `json:"blkioThrottleWriteIOPSDevice,omitempty"`
242
+}
243
+
244
+// Memory for Linux cgroup 'memory' resource management
245
+type Memory struct {
246
+	// Memory limit (in bytes).
247
+	Limit *uint64 `json:"limit,omitempty"`
248
+	// Memory reservation or soft_limit (in bytes).
249
+	Reservation *uint64 `json:"reservation,omitempty"`
250
+	// Total memory limit (memory + swap).
251
+	Swap *uint64 `json:"swap,omitempty"`
252
+	// Kernel memory limit (in bytes).
253
+	Kernel *uint64 `json:"kernel,omitempty"`
254
+	// Kernel memory limit for tcp (in bytes)
255
+	KernelTCP *uint64 `json:"kernelTCP"`
256
+	// How aggressive the kernel will swap memory pages. Range from 0 to 100.
257
+	Swappiness *uint64 `json:"swappiness,omitempty"`
258
+}
259
+
260
+// CPU for Linux cgroup 'cpu' resource management
261
+type CPU struct {
262
+	// CPU shares (relative weight (ratio) vs. other cgroups with cpu shares).
263
+	Shares *uint64 `json:"shares,omitempty"`
264
+	// CPU hardcap limit (in usecs). Allowed cpu time in a given period.
265
+	Quota *uint64 `json:"quota,omitempty"`
266
+	// CPU period to be used for hardcapping (in usecs).
267
+	Period *uint64 `json:"period,omitempty"`
268
+	// How much time realtime scheduling may use (in usecs).
269
+	RealtimeRuntime *uint64 `json:"realtimeRuntime,omitempty"`
270
+	// CPU period to be used for realtime scheduling (in usecs).
271
+	RealtimePeriod *uint64 `json:"realtimePeriod,omitempty"`
272
+	// CPUs to use within the cpuset. Default is to use any CPU available.
273
+	Cpus *string `json:"cpus,omitempty"`
274
+	// List of memory nodes in the cpuset. Default is to use any available memory node.
275
+	Mems *string `json:"mems,omitempty"`
276
+}
277
+
278
+// Pids for Linux cgroup 'pids' resource management (Linux 4.3)
279
+type Pids struct {
280
+	// Maximum number of PIDs. Default is "no limit".
281
+	Limit *int64 `json:"limit,omitempty"`
282
+}
283
+
284
+// Network identification and priority configuration
285
+type Network struct {
286
+	// Set class identifier for container's network packets
287
+	ClassID *uint32 `json:"classID"`
288
+	// Set priority of network traffic for container
289
+	Priorities []InterfacePriority `json:"priorities,omitempty"`
290
+}
291
+
292
+// Resources has container runtime resource constraints
293
+type Resources struct {
294
+	// Devices are a list of device rules for the whitelist controller
295
+	Devices []DeviceCgroup `json:"devices"`
296
+	// DisableOOMKiller disables the OOM killer for out of memory conditions
297
+	DisableOOMKiller *bool `json:"disableOOMKiller,omitempty"`
298
+	// Specify an oom_score_adj for the container.
299
+	OOMScoreAdj *int `json:"oomScoreAdj,omitempty"`
300
+	// Memory restriction configuration
301
+	Memory *Memory `json:"memory,omitempty"`
302
+	// CPU resource restriction configuration
303
+	CPU *CPU `json:"cpu,omitempty"`
304
+	// Task resource restriction configuration.
305
+	Pids *Pids `json:"pids,omitempty"`
306
+	// BlockIO restriction configuration
307
+	BlockIO *BlockIO `json:"blockIO,omitempty"`
308
+	// Hugetlb limit (in bytes)
309
+	HugepageLimits []HugepageLimit `json:"hugepageLimits,omitempty"`
310
+	// Network restriction configuration
311
+	Network *Network `json:"network,omitempty"`
312
+}
313
+
314
+// Device represents the mknod information for a Linux special device file
315
+type Device struct {
316
+	// Path to the device.
317
+	Path string `json:"path"`
318
+	// Device type, block, char, etc.
319
+	Type string `json:"type"`
320
+	// Major is the device's major number.
321
+	Major int64 `json:"major"`
322
+	// Minor is the device's minor number.
323
+	Minor int64 `json:"minor"`
324
+	// FileMode permission bits for the device.
325
+	FileMode *os.FileMode `json:"fileMode,omitempty"`
326
+	// UID of the device.
327
+	UID *uint32 `json:"uid,omitempty"`
328
+	// Gid of the device.
329
+	GID *uint32 `json:"gid,omitempty"`
330
+}
331
+
332
+// DeviceCgroup represents a device rule for the whitelist controller
333
+type DeviceCgroup struct {
334
+	// Allow or deny
335
+	Allow bool `json:"allow"`
336
+	// Device type, block, char, etc.
337
+	Type *string `json:"type,omitempty"`
338
+	// Major is the device's major number.
339
+	Major *int64 `json:"major,omitempty"`
340
+	// Minor is the device's minor number.
341
+	Minor *int64 `json:"minor,omitempty"`
342
+	// Cgroup access permissions format, rwm.
343
+	Access *string `json:"access,omitempty"`
344
+}
345
+
346
+// Seccomp represents syscall restrictions
347
+type Seccomp struct {
348
+	DefaultAction Action    `json:"defaultAction"`
349
+	Architectures []Arch    `json:"architectures"`
350
+	Syscalls      []Syscall `json:"syscalls,omitempty"`
351
+}
352
+
353
+// Arch used for additional architectures
354
+type Arch string
355
+
356
+// Additional architectures permitted to be used for system calls
357
+// By default only the native architecture of the kernel is permitted
358
+const (
359
+	ArchX86         Arch = "SCMP_ARCH_X86"
360
+	ArchX86_64      Arch = "SCMP_ARCH_X86_64"
361
+	ArchX32         Arch = "SCMP_ARCH_X32"
362
+	ArchARM         Arch = "SCMP_ARCH_ARM"
363
+	ArchAARCH64     Arch = "SCMP_ARCH_AARCH64"
364
+	ArchMIPS        Arch = "SCMP_ARCH_MIPS"
365
+	ArchMIPS64      Arch = "SCMP_ARCH_MIPS64"
366
+	ArchMIPS64N32   Arch = "SCMP_ARCH_MIPS64N32"
367
+	ArchMIPSEL      Arch = "SCMP_ARCH_MIPSEL"
368
+	ArchMIPSEL64    Arch = "SCMP_ARCH_MIPSEL64"
369
+	ArchMIPSEL64N32 Arch = "SCMP_ARCH_MIPSEL64N32"
370
+)
371
+
372
+// Action taken upon Seccomp rule match
373
+type Action string
374
+
375
+// Define actions for Seccomp rules
376
+const (
377
+	ActKill  Action = "SCMP_ACT_KILL"
378
+	ActTrap  Action = "SCMP_ACT_TRAP"
379
+	ActErrno Action = "SCMP_ACT_ERRNO"
380
+	ActTrace Action = "SCMP_ACT_TRACE"
381
+	ActAllow Action = "SCMP_ACT_ALLOW"
382
+)
383
+
384
+// Operator used to match syscall arguments in Seccomp
385
+type Operator string
386
+
387
+// Define operators for syscall arguments in Seccomp
388
+const (
389
+	OpNotEqual     Operator = "SCMP_CMP_NE"
390
+	OpLessThan     Operator = "SCMP_CMP_LT"
391
+	OpLessEqual    Operator = "SCMP_CMP_LE"
392
+	OpEqualTo      Operator = "SCMP_CMP_EQ"
393
+	OpGreaterEqual Operator = "SCMP_CMP_GE"
394
+	OpGreaterThan  Operator = "SCMP_CMP_GT"
395
+	OpMaskedEqual  Operator = "SCMP_CMP_MASKED_EQ"
396
+)
397
+
398
+// Arg used for matching specific syscall arguments in Seccomp
399
+type Arg struct {
400
+	Index    uint     `json:"index"`
401
+	Value    uint64   `json:"value"`
402
+	ValueTwo uint64   `json:"valueTwo"`
403
+	Op       Operator `json:"op"`
404
+}
405
+
406
+// Syscall is used to match a syscall in Seccomp
407
+type Syscall struct {
408
+	Name   string `json:"name"`
409
+	Action Action `json:"action"`
410
+	Args   []Arg  `json:"args,omitempty"`
411
+}
0 412
new file mode 100644
... ...
@@ -0,0 +1,13 @@
0
+package specs
1
+
2
+// State holds information about the runtime state of the container.
3
+type State struct {
4
+	// Version is the version of the specification that is supported.
5
+	Version string `json:"version"`
6
+	// ID is the container ID
7
+	ID string `json:"id"`
8
+	// Pid is the process id for the container's main process.
9
+	Pid int `json:"pid"`
10
+	// BundlePath is the path to the container's bundle directory.
11
+	BundlePath string `json:"bundlePath"`
12
+}
0 13
new file mode 100644
... ...
@@ -0,0 +1,18 @@
0
+package specs
1
+
2
+import "fmt"
3
+
4
+const (
5
+	// VersionMajor is for an API incompatible changes
6
+	VersionMajor = 0
7
+	// VersionMinor is for functionality in a backwards-compatible manner
8
+	VersionMinor = 4
9
+	// VersionPatch is for backwards-compatible bug fixes
10
+	VersionPatch = 0
11
+
12
+	// VersionDev indicates development branch. Releases will be empty string.
13
+	VersionDev = ""
14
+)
15
+
16
+// Version is the specification version that the package types support.
17
+var Version = fmt.Sprintf("%d.%d.%d%s", VersionMajor, VersionMinor, VersionPatch, VersionDev)