Prohibit more than 42 layers in the core
| ... | ... |
@@ -211,6 +211,25 @@ func (img *Image) getParentsSize(size int64) int64 {
|
| 211 | 211 |
return parentImage.getParentsSize(size) |
| 212 | 212 |
} |
| 213 | 213 |
|
| 214 |
+// Depth returns the number of parents for a |
|
| 215 |
+// current image |
|
| 216 |
+func (img *Image) Depth() (int, error) {
|
|
| 217 |
+ var ( |
|
| 218 |
+ count = 0 |
|
| 219 |
+ parent = img |
|
| 220 |
+ err error |
|
| 221 |
+ ) |
|
| 222 |
+ |
|
| 223 |
+ for parent != nil {
|
|
| 224 |
+ count++ |
|
| 225 |
+ parent, err = parent.GetParent() |
|
| 226 |
+ if err != nil {
|
|
| 227 |
+ return -1, err |
|
| 228 |
+ } |
|
| 229 |
+ } |
|
| 230 |
+ return count, nil |
|
| 231 |
+} |
|
| 232 |
+ |
|
| 214 | 233 |
// Build an Image object from raw json data |
| 215 | 234 |
func NewImgJSON(src []byte) (*Image, error) {
|
| 216 | 235 |
ret := &Image{}
|
| ... | ... |
@@ -24,6 +24,9 @@ import ( |
| 24 | 24 |
"time" |
| 25 | 25 |
) |
| 26 | 26 |
|
| 27 |
+// Set the max depth to the aufs restriction |
|
| 28 |
+const MaxImageDepth = 42 |
|
| 29 |
+ |
|
| 27 | 30 |
var defaultDns = []string{"8.8.8.8", "8.8.4.4"}
|
| 28 | 31 |
|
| 29 | 32 |
type Capabilities struct {
|
| ... | ... |
@@ -367,6 +370,17 @@ func (runtime *Runtime) Create(config *Config, name string) (*Container, []strin |
| 367 | 367 |
return nil, nil, err |
| 368 | 368 |
} |
| 369 | 369 |
|
| 370 |
+ // We add 2 layers to the depth because the container's rw and |
|
| 371 |
+ // init layer add to the restriction |
|
| 372 |
+ depth, err := img.Depth() |
|
| 373 |
+ if err != nil {
|
|
| 374 |
+ return nil, nil, err |
|
| 375 |
+ } |
|
| 376 |
+ |
|
| 377 |
+ if depth+2 >= MaxImageDepth {
|
|
| 378 |
+ return nil, nil, fmt.Errorf("Cannot create container with more than %d parents", MaxImageDepth)
|
|
| 379 |
+ } |
|
| 380 |
+ |
|
| 370 | 381 |
checkDeprecatedExpose := func(config *Config) bool {
|
| 371 | 382 |
if config != nil {
|
| 372 | 383 |
if config.PortSpecs != nil {
|