Browse code

Merge pull request #50 from crosbymichael/limit-dm

Prohibit more than 42 layers in the core

Guillaume J. Charmes authored on 2013/11/20 08:42:00
Showing 2 changed files
... ...
@@ -211,6 +211,25 @@ func (img *Image) getParentsSize(size int64) int64 {
211 211
 	return parentImage.getParentsSize(size)
212 212
 }
213 213
 
214
+// Depth returns the number of parents for a
215
+// current image
216
+func (img *Image) Depth() (int, error) {
217
+	var (
218
+		count  = 0
219
+		parent = img
220
+		err    error
221
+	)
222
+
223
+	for parent != nil {
224
+		count++
225
+		parent, err = parent.GetParent()
226
+		if err != nil {
227
+			return -1, err
228
+		}
229
+	}
230
+	return count, nil
231
+}
232
+
214 233
 // Build an Image object from raw json data
215 234
 func NewImgJSON(src []byte) (*Image, error) {
216 235
 	ret := &Image{}
... ...
@@ -24,6 +24,9 @@ import (
24 24
 	"time"
25 25
 )
26 26
 
27
+// Set the max depth to the aufs restriction
28
+const MaxImageDepth = 42
29
+
27 30
 var defaultDns = []string{"8.8.8.8", "8.8.4.4"}
28 31
 
29 32
 type Capabilities struct {
... ...
@@ -367,6 +370,17 @@ func (runtime *Runtime) Create(config *Config, name string) (*Container, []strin
367 367
 		return nil, nil, err
368 368
 	}
369 369
 
370
+	// We add 2 layers to the depth because the container's rw and
371
+	// init layer add to the restriction
372
+	depth, err := img.Depth()
373
+	if err != nil {
374
+		return nil, nil, err
375
+	}
376
+
377
+	if depth+2 >= MaxImageDepth {
378
+		return nil, nil, fmt.Errorf("Cannot create container with more than %d parents", MaxImageDepth)
379
+	}
380
+
370 381
 	checkDeprecatedExpose := func(config *Config) bool {
371 382
 		if config != nil {
372 383
 			if config.PortSpecs != nil {