FilesExpand file tree

 master

/

plugin_linux.go

Copy path

Blame

More file actions

Blame

More file actions

Latest commit

 

History

History

History

131 lines (114 loc) · 3.82 KB

 master

/

plugin_linux.go

Copy path

Top

File metadata and controls

• Code
• Blame

131 lines (114 loc) · 3.82 KB

Raw

Copy raw file

Download raw file

Open symbols panel

Edit and raw actions

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

79

80

81

82

83

84

85

86

87

88

89

90

91

92

93

94

95

96

97

98

99

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

// +build linux

package v2

import (

"os"

"path/filepath"

"strings"

"github.com/docker/docker/api/types"

"github.com/docker/docker/oci"

"github.com/docker/docker/pkg/system"

specs "github.com/opencontainers/runtime-spec/specs-go"

"github.com/pkg/errors"

)

// InitSpec creates an OCI spec from the plugin's config.

func (p *Plugin) InitSpec(execRoot string) (*specs.Spec, error) {

s := oci.DefaultSpec()

s.Root = specs.Root{

Path: p.Rootfs,

Readonly: false, // TODO: all plugins should be readonly? settable in config?

}

userMounts := make(map[string]struct{}, len(p.PluginObj.Settings.Mounts))

for _, m := range p.PluginObj.Settings.Mounts {

userMounts[m.Destination] = struct{}{}

}

execRoot = filepath.Join(execRoot, p.PluginObj.ID)

if err := os.MkdirAll(execRoot, 0700); err != nil {

return nil, errors.WithStack(err)

}

mounts := append(p.PluginObj.Config.Mounts, types.PluginMount{

Source: &execRoot,

Destination: defaultPluginRuntimeDestination,

Type: "bind",

Options: []string{"rbind", "rshared"},

})

if p.PluginObj.Config.Network.Type != "" {

// TODO: if net == bridge, use libnetwork controller to create a new plugin-specific bridge, bind mount /etc/hosts and /etc/resolv.conf look at the docker code (allocateNetwork, initialize)

if p.PluginObj.Config.Network.Type == "host" {

oci.RemoveNamespace(&s, specs.LinuxNamespaceType("network"))

}

etcHosts := "/etc/hosts"

resolvConf := "/etc/resolv.conf"

mounts = append(mounts,

types.PluginMount{

Source: &etcHosts,

Destination: etcHosts,

Type: "bind",

Options: []string{"rbind", "ro"},

},

types.PluginMount{

Source: &resolvConf,

Destination: resolvConf,

Type: "bind",

Options: []string{"rbind", "ro"},

})

}

if p.PluginObj.Config.PidHost {

oci.RemoveNamespace(&s, specs.LinuxNamespaceType("pid"))

}

if p.PluginObj.Config.IpcHost {

oci.RemoveNamespace(&s, specs.LinuxNamespaceType("ipc"))

}

for _, mnt := range mounts {

m := specs.Mount{

Destination: mnt.Destination,

Type: mnt.Type,

Options: mnt.Options,

}

if mnt.Source == nil {

return nil, errors.New("mount source is not specified")

}

m.Source = *mnt.Source

s.Mounts = append(s.Mounts, m)

}

for i, m := range s.Mounts {

if strings.HasPrefix(m.Destination, "/dev/") {

if _, ok := userMounts[m.Destination]; ok {

s.Mounts = append(s.Mounts[:i], s.Mounts[i+1:]...)

}

}

}

if p.PluginObj.Config.PropagatedMount != "" {

p.PropagatedMount = filepath.Join(p.Rootfs, p.PluginObj.Config.PropagatedMount)

s.Linux.RootfsPropagation = "rshared"

}

if p.PluginObj.Config.Linux.AllowAllDevices {

s.Linux.Resources.Devices = []specs.LinuxDeviceCgroup{{Allow: true, Access: "rwm"}}

}

for _, dev := range p.PluginObj.Settings.Devices {

path := *dev.Path

d, dPermissions, err := oci.DevicesFromPath(path, path, "rwm")

if err != nil {

return nil, errors.WithStack(err)

}

s.Linux.Devices = append(s.Linux.Devices, d...)

s.Linux.Resources.Devices = append(s.Linux.Resources.Devices, dPermissions...)

}

envs := make([]string, 1, len(p.PluginObj.Settings.Env)+1)

envs[0] = "PATH=" + system.DefaultPathEnv

envs = append(envs, p.PluginObj.Settings.Env...)

args := append(p.PluginObj.Config.Entrypoint, p.PluginObj.Settings.Args...)

cwd := p.PluginObj.Config.WorkDir

if len(cwd) == 0 {

cwd = "/"

}

s.Process.Terminal = false

s.Process.Args = args

s.Process.Cwd = cwd

s.Process.Env = envs

caps := s.Process.Capabilities

caps.Bounding = append(caps.Bounding, p.PluginObj.Config.Linux.Capabilities...)

caps.Permitted = append(caps.Permitted, p.PluginObj.Config.Linux.Capabilities...)

caps.Inheritable = append(caps.Inheritable, p.PluginObj.Config.Linux.Capabilities...)

caps.Effective = append(caps.Effective, p.PluginObj.Config.Linux.Capabilities...)

return &s, nil

}