|  |  | @ -153,7 +153,7 @@ func parseSecurityOpt(container *container.Container, config *containertypes.Hos | 
			
		
	
		
		
			
				
					
					|  |  |  | 				con = strings.SplitN(opt, "=", 2) |  |  |  | 				con = strings.SplitN(opt, "=", 2) | 
			
		
	
		
		
			
				
					
					|  |  |  | 			} else if strings.Contains(opt, ":") { |  |  |  | 			} else if strings.Contains(opt, ":") { | 
			
		
	
		
		
			
				
					
					|  |  |  | 				con = strings.SplitN(opt, ":", 2) |  |  |  | 				con = strings.SplitN(opt, ":", 2) | 
			
		
	
		
		
			
				
					
					|  |  |  | 				logrus.Warnf("Security options with `:` as a separator are deprecated and will be completely unsupported in 1.13, use `=` instead.") |  |  |  | 				logrus.Warn("Security options with `:` as a separator are deprecated and will be completely unsupported in 1.13, use `=` instead.") | 
			
				
				
			
		
	
		
		
	
		
		
			
				
					
					|  |  |  | 			} |  |  |  | 			} | 
			
		
	
		
		
			
				
					
					|  |  |  | 
 |  |  |  | 
 | 
			
		
	
		
		
			
				
					
					|  |  |  | 			if len(con) != 2 { |  |  |  | 			if len(con) != 2 { | 
			
		
	
	
		
		
			
				
					|  |  | @ -197,7 +197,7 @@ func getBlkioThrottleDevices(devs []*blkiodev.ThrottleDevice) ([]specs.ThrottleD | 
			
		
	
		
		
			
				
					
					|  |  |  | 
 |  |  |  | 
 | 
			
		
	
		
		
			
				
					
					|  |  |  | func checkKernelVersion(k, major, minor int) bool { |  |  |  | func checkKernelVersion(k, major, minor int) bool { | 
			
		
	
		
		
			
				
					
					|  |  |  | 	if v, err := kernel.GetKernelVersion(); err != nil { |  |  |  | 	if v, err := kernel.GetKernelVersion(); err != nil { | 
			
		
	
		
		
			
				
					
					|  |  |  | 		logrus.Warnf("%s", err) |  |  |  | 		logrus.Warnf("error getting kernel version: %s", err) | 
			
				
				
			
		
	
		
		
	
		
		
			
				
					
					|  |  |  | 	} else { |  |  |  | 	} else { | 
			
		
	
		
		
			
				
					
					|  |  |  | 		if kernel.CompareKernelVersion(*v, kernel.VersionInfo{Kernel: k, Major: major, Minor: minor}) < 0 { |  |  |  | 		if kernel.CompareKernelVersion(*v, kernel.VersionInfo{Kernel: k, Major: major, Minor: minor}) < 0 { | 
			
		
	
		
		
			
				
					
					|  |  |  | 			return false |  |  |  | 			return false | 
			
		
	
	
		
		
			
				
					|  |  | @ -273,13 +273,13 @@ func verifyContainerResources(resources *containertypes.Resources, sysInfo *sysi | 
			
		
	
		
		
			
				
					
					|  |  |  | 	} |  |  |  | 	} | 
			
		
	
		
		
			
				
					
					|  |  |  | 	if resources.Memory > 0 && !sysInfo.MemoryLimit { |  |  |  | 	if resources.Memory > 0 && !sysInfo.MemoryLimit { | 
			
		
	
		
		
			
				
					
					|  |  |  | 		warnings = append(warnings, "Your kernel does not support memory limit capabilities. Limitation discarded.") |  |  |  | 		warnings = append(warnings, "Your kernel does not support memory limit capabilities. Limitation discarded.") | 
			
		
	
		
		
			
				
					
					|  |  |  | 		logrus.Warnf("Your kernel does not support memory limit capabilities. Limitation discarded.") |  |  |  | 		logrus.Warn("Your kernel does not support memory limit capabilities. Limitation discarded.") | 
			
				
				
			
		
	
		
		
	
		
		
			
				
					
					|  |  |  | 		resources.Memory = 0 |  |  |  | 		resources.Memory = 0 | 
			
		
	
		
		
			
				
					
					|  |  |  | 		resources.MemorySwap = -1 |  |  |  | 		resources.MemorySwap = -1 | 
			
		
	
		
		
			
				
					
					|  |  |  | 	} |  |  |  | 	} | 
			
		
	
		
		
			
				
					
					|  |  |  | 	if resources.Memory > 0 && resources.MemorySwap != -1 && !sysInfo.SwapLimit { |  |  |  | 	if resources.Memory > 0 && resources.MemorySwap != -1 && !sysInfo.SwapLimit { | 
			
		
	
		
		
			
				
					
					|  |  |  | 		warnings = append(warnings, "Your kernel does not support swap limit capabilities, memory limited without swap.") |  |  |  | 		warnings = append(warnings, "Your kernel does not support swap limit capabilities, memory limited without swap.") | 
			
		
	
		
		
			
				
					
					|  |  |  | 		logrus.Warnf("Your kernel does not support swap limit capabilities, memory limited without swap.") |  |  |  | 		logrus.Warn("Your kernel does not support swap limit capabilities, memory limited without swap.") | 
			
				
				
			
		
	
		
		
	
		
		
			
				
					
					|  |  |  | 		resources.MemorySwap = -1 |  |  |  | 		resources.MemorySwap = -1 | 
			
		
	
		
		
			
				
					
					|  |  |  | 	} |  |  |  | 	} | 
			
		
	
		
		
			
				
					
					|  |  |  | 	if resources.Memory > 0 && resources.MemorySwap > 0 && resources.MemorySwap < resources.Memory { |  |  |  | 	if resources.Memory > 0 && resources.MemorySwap > 0 && resources.MemorySwap < resources.Memory { | 
			
		
	
	
		
		
			
				
					|  |  | @ -290,7 +290,7 @@ func verifyContainerResources(resources *containertypes.Resources, sysInfo *sysi | 
			
		
	
		
		
			
				
					
					|  |  |  | 	} |  |  |  | 	} | 
			
		
	
		
		
			
				
					
					|  |  |  | 	if resources.MemorySwappiness != nil && *resources.MemorySwappiness != -1 && !sysInfo.MemorySwappiness { |  |  |  | 	if resources.MemorySwappiness != nil && *resources.MemorySwappiness != -1 && !sysInfo.MemorySwappiness { | 
			
		
	
		
		
			
				
					
					|  |  |  | 		warnings = append(warnings, "Your kernel does not support memory swappiness capabilities, memory swappiness discarded.") |  |  |  | 		warnings = append(warnings, "Your kernel does not support memory swappiness capabilities, memory swappiness discarded.") | 
			
		
	
		
		
			
				
					
					|  |  |  | 		logrus.Warnf("Your kernel does not support memory swappiness capabilities, memory swappiness discarded.") |  |  |  | 		logrus.Warn("Your kernel does not support memory swappiness capabilities, memory swappiness discarded.") | 
			
				
				
			
		
	
		
		
	
		
		
			
				
					
					|  |  |  | 		resources.MemorySwappiness = nil |  |  |  | 		resources.MemorySwappiness = nil | 
			
		
	
		
		
			
				
					
					|  |  |  | 	} |  |  |  | 	} | 
			
		
	
		
		
			
				
					
					|  |  |  | 	if resources.MemorySwappiness != nil { |  |  |  | 	if resources.MemorySwappiness != nil { | 
			
		
	
	
		
		
			
				
					|  |  | @ -301,7 +301,7 @@ func verifyContainerResources(resources *containertypes.Resources, sysInfo *sysi | 
			
		
	
		
		
			
				
					
					|  |  |  | 	} |  |  |  | 	} | 
			
		
	
		
		
			
				
					
					|  |  |  | 	if resources.MemoryReservation > 0 && !sysInfo.MemoryReservation { |  |  |  | 	if resources.MemoryReservation > 0 && !sysInfo.MemoryReservation { | 
			
		
	
		
		
			
				
					
					|  |  |  | 		warnings = append(warnings, "Your kernel does not support memory soft limit capabilities. Limitation discarded.") |  |  |  | 		warnings = append(warnings, "Your kernel does not support memory soft limit capabilities. Limitation discarded.") | 
			
		
	
		
		
			
				
					
					|  |  |  | 		logrus.Warnf("Your kernel does not support memory soft limit capabilities. Limitation discarded.") |  |  |  | 		logrus.Warn("Your kernel does not support memory soft limit capabilities. Limitation discarded.") | 
			
				
				
			
		
	
		
		
	
		
		
			
				
					
					|  |  |  | 		resources.MemoryReservation = 0 |  |  |  | 		resources.MemoryReservation = 0 | 
			
		
	
		
		
			
				
					
					|  |  |  | 	} |  |  |  | 	} | 
			
		
	
		
		
			
				
					
					|  |  |  | 	if resources.MemoryReservation > 0 && resources.MemoryReservation < linuxMinMemory { |  |  |  | 	if resources.MemoryReservation > 0 && resources.MemoryReservation < linuxMinMemory { | 
			
		
	
	
		
		
			
				
					|  |  | @ -312,7 +312,7 @@ func verifyContainerResources(resources *containertypes.Resources, sysInfo *sysi | 
			
		
	
		
		
			
				
					
					|  |  |  | 	} |  |  |  | 	} | 
			
		
	
		
		
			
				
					
					|  |  |  | 	if resources.KernelMemory > 0 && !sysInfo.KernelMemory { |  |  |  | 	if resources.KernelMemory > 0 && !sysInfo.KernelMemory { | 
			
		
	
		
		
			
				
					
					|  |  |  | 		warnings = append(warnings, "Your kernel does not support kernel memory limit capabilities. Limitation discarded.") |  |  |  | 		warnings = append(warnings, "Your kernel does not support kernel memory limit capabilities. Limitation discarded.") | 
			
		
	
		
		
			
				
					
					|  |  |  | 		logrus.Warnf("Your kernel does not support kernel memory limit capabilities. Limitation discarded.") |  |  |  | 		logrus.Warn("Your kernel does not support kernel memory limit capabilities. Limitation discarded.") | 
			
				
				
			
		
	
		
		
	
		
		
			
				
					
					|  |  |  | 		resources.KernelMemory = 0 |  |  |  | 		resources.KernelMemory = 0 | 
			
		
	
		
		
			
				
					
					|  |  |  | 	} |  |  |  | 	} | 
			
		
	
		
		
			
				
					
					|  |  |  | 	if resources.KernelMemory > 0 && resources.KernelMemory < linuxMinMemory { |  |  |  | 	if resources.KernelMemory > 0 && resources.KernelMemory < linuxMinMemory { | 
			
		
	
	
		
		
			
				
					|  |  | @ -320,33 +320,33 @@ func verifyContainerResources(resources *containertypes.Resources, sysInfo *sysi | 
			
		
	
		
		
			
				
					
					|  |  |  | 	} |  |  |  | 	} | 
			
		
	
		
		
			
				
					
					|  |  |  | 	if resources.KernelMemory > 0 && !checkKernelVersion(4, 0, 0) { |  |  |  | 	if resources.KernelMemory > 0 && !checkKernelVersion(4, 0, 0) { | 
			
		
	
		
		
			
				
					
					|  |  |  | 		warnings = append(warnings, "You specified a kernel memory limit on a kernel older than 4.0. Kernel memory limits are experimental on older kernels, it won't work as expected and can cause your system to be unstable.") |  |  |  | 		warnings = append(warnings, "You specified a kernel memory limit on a kernel older than 4.0. Kernel memory limits are experimental on older kernels, it won't work as expected and can cause your system to be unstable.") | 
			
		
	
		
		
			
				
					
					|  |  |  | 		logrus.Warnf("You specified a kernel memory limit on a kernel older than 4.0. Kernel memory limits are experimental on older kernels, it won't work as expected and can cause your system to be unstable.") |  |  |  | 		logrus.Warn("You specified a kernel memory limit on a kernel older than 4.0. Kernel memory limits are experimental on older kernels, it won't work as expected and can cause your system to be unstable.") | 
			
				
				
			
		
	
		
		
	
		
		
			
				
					
					|  |  |  | 	} |  |  |  | 	} | 
			
		
	
		
		
			
				
					
					|  |  |  | 	if resources.OomKillDisable != nil && !sysInfo.OomKillDisable { |  |  |  | 	if resources.OomKillDisable != nil && !sysInfo.OomKillDisable { | 
			
		
	
		
		
			
				
					
					|  |  |  | 		// only produce warnings if the setting wasn't to *disable* the OOM Kill; no point
 |  |  |  | 		// only produce warnings if the setting wasn't to *disable* the OOM Kill; no point
 | 
			
		
	
		
		
			
				
					
					|  |  |  | 		// warning the caller if they already wanted the feature to be off
 |  |  |  | 		// warning the caller if they already wanted the feature to be off
 | 
			
		
	
		
		
			
				
					
					|  |  |  | 		if *resources.OomKillDisable { |  |  |  | 		if *resources.OomKillDisable { | 
			
		
	
		
		
			
				
					
					|  |  |  | 			warnings = append(warnings, "Your kernel does not support OomKillDisable, OomKillDisable discarded.") |  |  |  | 			warnings = append(warnings, "Your kernel does not support OomKillDisable, OomKillDisable discarded.") | 
			
		
	
		
		
			
				
					
					|  |  |  | 			logrus.Warnf("Your kernel does not support OomKillDisable, OomKillDisable discarded.") |  |  |  | 			logrus.Warn("Your kernel does not support OomKillDisable, OomKillDisable discarded.") | 
			
				
				
			
		
	
		
		
	
		
		
			
				
					
					|  |  |  | 		} |  |  |  | 		} | 
			
		
	
		
		
			
				
					
					|  |  |  | 		resources.OomKillDisable = nil |  |  |  | 		resources.OomKillDisable = nil | 
			
		
	
		
		
			
				
					
					|  |  |  | 	} |  |  |  | 	} | 
			
		
	
		
		
			
				
					
					|  |  |  | 
 |  |  |  | 
 | 
			
		
	
		
		
			
				
					
					|  |  |  | 	if resources.PidsLimit != 0 && !sysInfo.PidsLimit { |  |  |  | 	if resources.PidsLimit != 0 && !sysInfo.PidsLimit { | 
			
		
	
		
		
			
				
					
					|  |  |  | 		warnings = append(warnings, "Your kernel does not support pids limit capabilities, pids limit discarded.") |  |  |  | 		warnings = append(warnings, "Your kernel does not support pids limit capabilities, pids limit discarded.") | 
			
		
	
		
		
			
				
					
					|  |  |  | 		logrus.Warnf("Your kernel does not support pids limit capabilities, pids limit discarded.") |  |  |  | 		logrus.Warn("Your kernel does not support pids limit capabilities, pids limit discarded.") | 
			
				
				
			
		
	
		
		
	
		
		
			
				
					
					|  |  |  | 		resources.PidsLimit = 0 |  |  |  | 		resources.PidsLimit = 0 | 
			
		
	
		
		
			
				
					
					|  |  |  | 	} |  |  |  | 	} | 
			
		
	
		
		
			
				
					
					|  |  |  | 
 |  |  |  | 
 | 
			
		
	
		
		
			
				
					
					|  |  |  | 	// cpu subsystem checks and adjustments
 |  |  |  | 	// cpu subsystem checks and adjustments
 | 
			
		
	
		
		
			
				
					
					|  |  |  | 	if resources.CPUShares > 0 && !sysInfo.CPUShares { |  |  |  | 	if resources.CPUShares > 0 && !sysInfo.CPUShares { | 
			
		
	
		
		
			
				
					
					|  |  |  | 		warnings = append(warnings, "Your kernel does not support CPU shares. Shares discarded.") |  |  |  | 		warnings = append(warnings, "Your kernel does not support CPU shares. Shares discarded.") | 
			
		
	
		
		
			
				
					
					|  |  |  | 		logrus.Warnf("Your kernel does not support CPU shares. Shares discarded.") |  |  |  | 		logrus.Warn("Your kernel does not support CPU shares. Shares discarded.") | 
			
				
				
			
		
	
		
		
	
		
		
			
				
					
					|  |  |  | 		resources.CPUShares = 0 |  |  |  | 		resources.CPUShares = 0 | 
			
		
	
		
		
			
				
					
					|  |  |  | 	} |  |  |  | 	} | 
			
		
	
		
		
			
				
					
					|  |  |  | 	if resources.CPUPeriod > 0 && !sysInfo.CPUCfsPeriod { |  |  |  | 	if resources.CPUPeriod > 0 && !sysInfo.CPUCfsPeriod { | 
			
		
	
		
		
			
				
					
					|  |  |  | 		warnings = append(warnings, "Your kernel does not support CPU cfs period. Period discarded.") |  |  |  | 		warnings = append(warnings, "Your kernel does not support CPU cfs period. Period discarded.") | 
			
		
	
		
		
			
				
					
					|  |  |  | 		logrus.Warnf("Your kernel does not support CPU cfs period. Period discarded.") |  |  |  | 		logrus.Warn("Your kernel does not support CPU cfs period. Period discarded.") | 
			
				
				
			
		
	
		
		
	
		
		
			
				
					
					|  |  |  | 		resources.CPUPeriod = 0 |  |  |  | 		resources.CPUPeriod = 0 | 
			
		
	
		
		
			
				
					
					|  |  |  | 	} |  |  |  | 	} | 
			
		
	
		
		
			
				
					
					|  |  |  | 	if resources.CPUPeriod != 0 && (resources.CPUPeriod < 1000 || resources.CPUPeriod > 1000000) { |  |  |  | 	if resources.CPUPeriod != 0 && (resources.CPUPeriod < 1000 || resources.CPUPeriod > 1000000) { | 
			
		
	
	
		
		
			
				
					|  |  | @ -354,7 +354,7 @@ func verifyContainerResources(resources *containertypes.Resources, sysInfo *sysi | 
			
		
	
		
		
			
				
					
					|  |  |  | 	} |  |  |  | 	} | 
			
		
	
		
		
			
				
					
					|  |  |  | 	if resources.CPUQuota > 0 && !sysInfo.CPUCfsQuota { |  |  |  | 	if resources.CPUQuota > 0 && !sysInfo.CPUCfsQuota { | 
			
		
	
		
		
			
				
					
					|  |  |  | 		warnings = append(warnings, "Your kernel does not support CPU cfs quota. Quota discarded.") |  |  |  | 		warnings = append(warnings, "Your kernel does not support CPU cfs quota. Quota discarded.") | 
			
		
	
		
		
			
				
					
					|  |  |  | 		logrus.Warnf("Your kernel does not support CPU cfs quota. Quota discarded.") |  |  |  | 		logrus.Warn("Your kernel does not support CPU cfs quota. Quota discarded.") | 
			
				
				
			
		
	
		
		
	
		
		
			
				
					
					|  |  |  | 		resources.CPUQuota = 0 |  |  |  | 		resources.CPUQuota = 0 | 
			
		
	
		
		
			
				
					
					|  |  |  | 	} |  |  |  | 	} | 
			
		
	
		
		
			
				
					
					|  |  |  | 	if resources.CPUQuota > 0 && resources.CPUQuota < 1000 { |  |  |  | 	if resources.CPUQuota > 0 && resources.CPUQuota < 1000 { | 
			
		
	
	
		
		
			
				
					|  |  | @ -362,14 +362,14 @@ func verifyContainerResources(resources *containertypes.Resources, sysInfo *sysi | 
			
		
	
		
		
			
				
					
					|  |  |  | 	} |  |  |  | 	} | 
			
		
	
		
		
			
				
					
					|  |  |  | 	if resources.CPUPercent > 0 { |  |  |  | 	if resources.CPUPercent > 0 { | 
			
		
	
		
		
			
				
					
					|  |  |  | 		warnings = append(warnings, "%s does not support CPU percent. Percent discarded.", runtime.GOOS) |  |  |  | 		warnings = append(warnings, "%s does not support CPU percent. Percent discarded.", runtime.GOOS) | 
			
		
	
		
		
			
				
					
					|  |  |  | 		logrus.Warnf("%s does not support CPU percent. Percent discarded.", runtime.GOOS) |  |  |  | 		logrus.Warn("%s does not support CPU percent. Percent discarded.", runtime.GOOS) | 
			
				
				
			
		
	
		
		
	
		
		
			
				
					
					|  |  |  | 		resources.CPUPercent = 0 |  |  |  | 		resources.CPUPercent = 0 | 
			
		
	
		
		
			
				
					
					|  |  |  | 	} |  |  |  | 	} | 
			
		
	
		
		
			
				
					
					|  |  |  | 
 |  |  |  | 
 | 
			
		
	
		
		
			
				
					
					|  |  |  | 	// cpuset subsystem checks and adjustments
 |  |  |  | 	// cpuset subsystem checks and adjustments
 | 
			
		
	
		
		
			
				
					
					|  |  |  | 	if (resources.CpusetCpus != "" || resources.CpusetMems != "") && !sysInfo.Cpuset { |  |  |  | 	if (resources.CpusetCpus != "" || resources.CpusetMems != "") && !sysInfo.Cpuset { | 
			
		
	
		
		
			
				
					
					|  |  |  | 		warnings = append(warnings, "Your kernel does not support cpuset. Cpuset discarded.") |  |  |  | 		warnings = append(warnings, "Your kernel does not support cpuset. Cpuset discarded.") | 
			
		
	
		
		
			
				
					
					|  |  |  | 		logrus.Warnf("Your kernel does not support cpuset. Cpuset discarded.") |  |  |  | 		logrus.Warn("Your kernel does not support cpuset. Cpuset discarded.") | 
			
				
				
			
		
	
		
		
	
		
		
			
				
					
					|  |  |  | 		resources.CpusetCpus = "" |  |  |  | 		resources.CpusetCpus = "" | 
			
		
	
		
		
			
				
					
					|  |  |  | 		resources.CpusetMems = "" |  |  |  | 		resources.CpusetMems = "" | 
			
		
	
		
		
			
				
					
					|  |  |  | 	} |  |  |  | 	} | 
			
		
	
	
		
		
			
				
					|  |  | @ -391,7 +391,7 @@ func verifyContainerResources(resources *containertypes.Resources, sysInfo *sysi | 
			
		
	
		
		
			
				
					
					|  |  |  | 	// blkio subsystem checks and adjustments
 |  |  |  | 	// blkio subsystem checks and adjustments
 | 
			
		
	
		
		
			
				
					
					|  |  |  | 	if resources.BlkioWeight > 0 && !sysInfo.BlkioWeight { |  |  |  | 	if resources.BlkioWeight > 0 && !sysInfo.BlkioWeight { | 
			
		
	
		
		
			
				
					
					|  |  |  | 		warnings = append(warnings, "Your kernel does not support Block I/O weight. Weight discarded.") |  |  |  | 		warnings = append(warnings, "Your kernel does not support Block I/O weight. Weight discarded.") | 
			
		
	
		
		
			
				
					
					|  |  |  | 		logrus.Warnf("Your kernel does not support Block I/O weight. Weight discarded.") |  |  |  | 		logrus.Warn("Your kernel does not support Block I/O weight. Weight discarded.") | 
			
				
				
			
		
	
		
		
	
		
		
			
				
					
					|  |  |  | 		resources.BlkioWeight = 0 |  |  |  | 		resources.BlkioWeight = 0 | 
			
		
	
		
		
			
				
					
					|  |  |  | 	} |  |  |  | 	} | 
			
		
	
		
		
			
				
					
					|  |  |  | 	if resources.BlkioWeight > 0 && (resources.BlkioWeight < 10 || resources.BlkioWeight > 1000) { |  |  |  | 	if resources.BlkioWeight > 0 && (resources.BlkioWeight < 10 || resources.BlkioWeight > 1000) { | 
			
		
	
	
		
		
			
				
					|  |  | @ -402,27 +402,27 @@ func verifyContainerResources(resources *containertypes.Resources, sysInfo *sysi | 
			
		
	
		
		
			
				
					
					|  |  |  | 	} |  |  |  | 	} | 
			
		
	
		
		
			
				
					
					|  |  |  | 	if len(resources.BlkioWeightDevice) > 0 && !sysInfo.BlkioWeightDevice { |  |  |  | 	if len(resources.BlkioWeightDevice) > 0 && !sysInfo.BlkioWeightDevice { | 
			
		
	
		
		
			
				
					
					|  |  |  | 		warnings = append(warnings, "Your kernel does not support Block I/O weight_device.") |  |  |  | 		warnings = append(warnings, "Your kernel does not support Block I/O weight_device.") | 
			
		
	
		
		
			
				
					
					|  |  |  | 		logrus.Warnf("Your kernel does not support Block I/O weight_device. Weight-device discarded.") |  |  |  | 		logrus.Warn("Your kernel does not support Block I/O weight_device. Weight-device discarded.") | 
			
				
				
			
		
	
		
		
	
		
		
			
				
					
					|  |  |  | 		resources.BlkioWeightDevice = []*pblkiodev.WeightDevice{} |  |  |  | 		resources.BlkioWeightDevice = []*pblkiodev.WeightDevice{} | 
			
		
	
		
		
			
				
					
					|  |  |  | 	} |  |  |  | 	} | 
			
		
	
		
		
			
				
					
					|  |  |  | 	if len(resources.BlkioDeviceReadBps) > 0 && !sysInfo.BlkioReadBpsDevice { |  |  |  | 	if len(resources.BlkioDeviceReadBps) > 0 && !sysInfo.BlkioReadBpsDevice { | 
			
		
	
		
		
			
				
					
					|  |  |  | 		warnings = append(warnings, "Your kernel does not support Block read limit in bytes per second.") |  |  |  | 		warnings = append(warnings, "Your kernel does not support Block read limit in bytes per second.") | 
			
		
	
		
		
			
				
					
					|  |  |  | 		logrus.Warnf("Your kernel does not support Block I/O read limit in bytes per second. --device-read-bps discarded.") |  |  |  | 		logrus.Warn("Your kernel does not support Block I/O read limit in bytes per second. --device-read-bps discarded.") | 
			
				
				
			
		
	
		
		
	
		
		
			
				
					
					|  |  |  | 		resources.BlkioDeviceReadBps = []*pblkiodev.ThrottleDevice{} |  |  |  | 		resources.BlkioDeviceReadBps = []*pblkiodev.ThrottleDevice{} | 
			
		
	
		
		
			
				
					
					|  |  |  | 	} |  |  |  | 	} | 
			
		
	
		
		
			
				
					
					|  |  |  | 	if len(resources.BlkioDeviceWriteBps) > 0 && !sysInfo.BlkioWriteBpsDevice { |  |  |  | 	if len(resources.BlkioDeviceWriteBps) > 0 && !sysInfo.BlkioWriteBpsDevice { | 
			
		
	
		
		
			
				
					
					|  |  |  | 		warnings = append(warnings, "Your kernel does not support Block write limit in bytes per second.") |  |  |  | 		warnings = append(warnings, "Your kernel does not support Block write limit in bytes per second.") | 
			
		
	
		
		
			
				
					
					|  |  |  | 		logrus.Warnf("Your kernel does not support Block I/O write limit in bytes per second. --device-write-bps discarded.") |  |  |  | 		logrus.Warn("Your kernel does not support Block I/O write limit in bytes per second. --device-write-bps discarded.") | 
			
				
				
			
		
	
		
		
	
		
		
			
				
					
					|  |  |  | 		resources.BlkioDeviceWriteBps = []*pblkiodev.ThrottleDevice{} |  |  |  | 		resources.BlkioDeviceWriteBps = []*pblkiodev.ThrottleDevice{} | 
			
		
	
		
		
			
				
					
					|  |  |  | 	} |  |  |  | 	} | 
			
		
	
		
		
			
				
					
					|  |  |  | 	if len(resources.BlkioDeviceReadIOps) > 0 && !sysInfo.BlkioReadIOpsDevice { |  |  |  | 	if len(resources.BlkioDeviceReadIOps) > 0 && !sysInfo.BlkioReadIOpsDevice { | 
			
		
	
		
		
			
				
					
					|  |  |  | 		warnings = append(warnings, "Your kernel does not support Block read limit in IO per second.") |  |  |  | 		warnings = append(warnings, "Your kernel does not support Block read limit in IO per second.") | 
			
		
	
		
		
			
				
					
					|  |  |  | 		logrus.Warnf("Your kernel does not support Block I/O read limit in IO per second. -device-read-iops discarded.") |  |  |  | 		logrus.Warn("Your kernel does not support Block I/O read limit in IO per second. -device-read-iops discarded.") | 
			
				
				
			
		
	
		
		
	
		
		
			
				
					
					|  |  |  | 		resources.BlkioDeviceReadIOps = []*pblkiodev.ThrottleDevice{} |  |  |  | 		resources.BlkioDeviceReadIOps = []*pblkiodev.ThrottleDevice{} | 
			
		
	
		
		
			
				
					
					|  |  |  | 	} |  |  |  | 	} | 
			
		
	
		
		
			
				
					
					|  |  |  | 	if len(resources.BlkioDeviceWriteIOps) > 0 && !sysInfo.BlkioWriteIOpsDevice { |  |  |  | 	if len(resources.BlkioDeviceWriteIOps) > 0 && !sysInfo.BlkioWriteIOpsDevice { | 
			
		
	
		
		
			
				
					
					|  |  |  | 		warnings = append(warnings, "Your kernel does not support Block write limit in IO per second.") |  |  |  | 		warnings = append(warnings, "Your kernel does not support Block write limit in IO per second.") | 
			
		
	
		
		
			
				
					
					|  |  |  | 		logrus.Warnf("Your kernel does not support Block I/O write limit in IO per second. --device-write-iops discarded.") |  |  |  | 		logrus.Warn("Your kernel does not support Block I/O write limit in IO per second. --device-write-iops discarded.") | 
			
				
				
			
		
	
		
		
	
		
		
			
				
					
					|  |  |  | 		resources.BlkioDeviceWriteIOps = []*pblkiodev.ThrottleDevice{} |  |  |  | 		resources.BlkioDeviceWriteIOps = []*pblkiodev.ThrottleDevice{} | 
			
		
	
		
		
			
				
					
					|  |  |  | 	} |  |  |  | 	} | 
			
		
	
		
		
			
				
					
					|  |  |  | 
 |  |  |  | 
 | 
			
		
	
	
		
		
			
				
					|  |  | @ -492,7 +492,7 @@ func verifyPlatformContainerSettings(daemon *Daemon, hostConfig *containertypes. | 
			
		
	
		
		
			
				
					
					|  |  |  | 	// ip-forwarding does not affect container with '--net=host' (or '--net=none')
 |  |  |  | 	// ip-forwarding does not affect container with '--net=host' (or '--net=none')
 | 
			
		
	
		
		
			
				
					
					|  |  |  | 	if sysInfo.IPv4ForwardingDisabled && !(hostConfig.NetworkMode.IsHost() || hostConfig.NetworkMode.IsNone()) { |  |  |  | 	if sysInfo.IPv4ForwardingDisabled && !(hostConfig.NetworkMode.IsHost() || hostConfig.NetworkMode.IsNone()) { | 
			
		
	
		
		
			
				
					
					|  |  |  | 		warnings = append(warnings, "IPv4 forwarding is disabled. Networking will not work.") |  |  |  | 		warnings = append(warnings, "IPv4 forwarding is disabled. Networking will not work.") | 
			
		
	
		
		
			
				
					
					|  |  |  | 		logrus.Warnf("IPv4 forwarding is disabled. Networking will not work") |  |  |  | 		logrus.Warn("IPv4 forwarding is disabled. Networking will not work") | 
			
				
				
			
		
	
		
		
	
		
		
			
				
					
					|  |  |  | 	} |  |  |  | 	} | 
			
		
	
		
		
			
				
					
					|  |  |  | 	// check for various conflicting options with user namespaces
 |  |  |  | 	// check for various conflicting options with user namespaces
 | 
			
		
	
		
		
			
				
					
					|  |  |  | 	if daemon.configStore.RemappedRoot != "" && hostConfig.UsernsMode.IsPrivate() { |  |  |  | 	if daemon.configStore.RemappedRoot != "" && hostConfig.UsernsMode.IsPrivate() { | 
			
		
	
	
		
		
			
				
					|  |  | @ -916,7 +916,7 @@ func setupRemappedRoot(config *Config) ([]idtools.IDMap, []idtools.IDMap, error) | 
			
		
	
		
		
			
				
					
					|  |  |  | 		if username == "root" { |  |  |  | 		if username == "root" { | 
			
		
	
		
		
			
				
					
					|  |  |  | 			// Cannot setup user namespaces with a 1-to-1 mapping; "--root=0:0" is a no-op
 |  |  |  | 			// Cannot setup user namespaces with a 1-to-1 mapping; "--root=0:0" is a no-op
 | 
			
		
	
		
		
			
				
					
					|  |  |  | 			// effectively
 |  |  |  | 			// effectively
 | 
			
		
	
		
		
			
				
					
					|  |  |  | 			logrus.Warnf("User namespaces: root cannot be remapped with itself; user namespaces are OFF") |  |  |  | 			logrus.Warn("User namespaces: root cannot be remapped with itself; user namespaces are OFF") | 
			
				
				
			
		
	
		
		
	
		
		
			
				
					
					|  |  |  | 			return uidMaps, gidMaps, nil |  |  |  | 			return uidMaps, gidMaps, nil | 
			
		
	
		
		
			
				
					
					|  |  |  | 		} |  |  |  | 		} | 
			
		
	
		
		
			
				
					
					|  |  |  | 		logrus.Infof("User namespaces: ID ranges will be mapped to subuid/subgid ranges of: %s:%s", username, groupname) |  |  |  | 		logrus.Infof("User namespaces: ID ranges will be mapped to subuid/subgid ranges of: %s:%s", username, groupname) | 
			
		
	
	
		
		
			
				
					|  |  | 
 |