From b9b66d0e1b70cd0475d6fbba33eba5632f852dde Mon Sep 17 00:00:00 2001 From: Andrea Luzzardi Date: Wed, 20 Feb 2013 17:45:46 -0800 Subject: [PATCH 01/14] sysinit: Support for the -g (gateway) flag used in networking setup --- sysinit.go | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/sysinit.go b/sysinit.go index 99bf43d25f..f701417978 100644 --- a/sysinit.go +++ b/sysinit.go @@ -11,6 +11,17 @@ import ( "syscall" ) +// Setup networking +func setupNetworking(gw string) { + if gw == "" { + return + } + cmd := exec.Command("/sbin/route", "add", "default", "gw", gw) + if err := cmd.Run(); err != nil { + log.Fatalf("Unable to set up networking: %v", err) + } +} + // Takes care of dropping privileges to the desired user func changeUser(u string) { if u == "" { @@ -62,8 +73,11 @@ func SysInit() { os.Exit(1) } var u = flag.String("u", "", "username or uid") + var gw = flag.String("g", "", "gateway address") flag.Parse() + + setupNetworking(*gw) changeUser(*u) executeProgram(flag.Arg(0), flag.Args()) } From 5cecd548cd48cec8967f7ad0b0b42b30fa3ec7a0 Mon Sep 17 00:00:00 2001 From: Andrea Luzzardi Date: Wed, 20 Feb 2013 17:47:09 -0800 Subject: [PATCH 02/14] Basic networking support with hardcoded addresses. Work in progress. --- container.go | 13 +++++++++++++ lxc_template.go | 14 +++++++------- network.go | 29 +++++++++++++++++++++++++++++ 3 files changed, 49 insertions(+), 7 deletions(-) create mode 100644 network.go diff --git a/container.go b/container.go index 57ec531737..50ac5e715e 100644 --- a/container.go +++ b/container.go @@ -33,6 +33,7 @@ type Container struct { Config *Config Filesystem *Filesystem + Network *NetworkInterface State *State SysInitPath string @@ -87,6 +88,10 @@ func createContainer(id string, root string, command string, args []string, laye if err := container.Filesystem.createMountPoints(); err != nil { return nil, err } + var err error + if container.Network, err = allocateNetwork(); err != nil { + return nil, err + } if err := container.save(); err != nil { return nil, err } @@ -272,11 +277,19 @@ func (container *Container) Start() error { "--", "/sbin/init", } + + // Networking + params = append(params, "-g", container.Network.Gateway.String()) + + // User if container.Config.User != "" { params = append(params, "-u", container.Config.User) } + + // Program params = append(params, "--", container.Path) params = append(params, container.Args...) + container.cmd = exec.Command("/usr/bin/lxc-start", params...) var err error diff --git a/lxc_template.go b/lxc_template.go index 4ac72da273..48e6dc732b 100755 --- a/lxc_template.go +++ b/lxc_template.go @@ -14,12 +14,12 @@ lxc.utsname = {{.Id}} #lxc.aa_profile = unconfined # network configuration -#lxc.network.type = veth -#lxc.network.flags = up -#lxc.network.link = br0 -#lxc.network.name = eth0 # Internal container network interface name -#lxc.network.mtu = 1500 -#lxc.network.ipv4 = {ip_address}/{ip_prefix_len} +lxc.network.type = veth +lxc.network.flags = up +lxc.network.link = lxcbr0 +lxc.network.name = eth0 +lxc.network.mtu = 1500 +lxc.network.ipv4 = {{.Network.IpAddress}}/{{.Network.IpPrefixLen}} # root filesystem {{$ROOTFS := .Filesystem.RootFS}} @@ -82,7 +82,7 @@ lxc.mount.entry = /etc/resolv.conf {{$ROOTFS}}/etc/resolv.conf none bind,ro 0 0 # drop linux capabilities (apply mainly to the user root in the container) -lxc.cap.drop = audit_control audit_write mac_admin mac_override mknod net_raw setfcap setpcap sys_admin sys_boot sys_module sys_nice sys_pacct sys_rawio sys_resource sys_time sys_tty_config +#lxc.cap.drop = audit_control audit_write mac_admin mac_override mknod net_raw setfcap setpcap sys_admin sys_boot sys_module sys_nice sys_pacct sys_rawio sys_resource sys_time sys_tty_config # limits {{if .Config.Ram}} diff --git a/network.go b/network.go new file mode 100644 index 0000000000..234086c64c --- /dev/null +++ b/network.go @@ -0,0 +1,29 @@ +package docker + +import ( + "net" +) + +const ( + networkGateway = "10.0.3.1" + networkPrefixLen = 24 +) + +type NetworkInterface struct { + IpAddress string + IpPrefixLen int + Gateway net.IP +} + +func allocateIPAddress() string { + return "10.0.3.2" +} + +func allocateNetwork() (*NetworkInterface, error) { + iface := &NetworkInterface{ + IpAddress: allocateIPAddress(), + IpPrefixLen: networkPrefixLen, + Gateway: net.ParseIP(networkGateway), + } + return iface, nil +} From 5039d4a2804561885e32f2a93cb2a51cbaa8e847 Mon Sep 17 00:00:00 2001 From: Andrea Luzzardi Date: Wed, 20 Feb 2013 18:20:18 -0800 Subject: [PATCH 03/14] Network: Automatically figure out the gateway and netmask by inspecting the lxc bridge interface --- network.go | 39 +++++++++++++++++++++++++++++++++++---- 1 file changed, 35 insertions(+), 4 deletions(-) diff --git a/network.go b/network.go index 234086c64c..0a6d1b8598 100644 --- a/network.go +++ b/network.go @@ -1,12 +1,12 @@ package docker import ( + "fmt" "net" ) const ( - networkGateway = "10.0.3.1" - networkPrefixLen = 24 + networkBridgeIface = "lxcbr0" ) type NetworkInterface struct { @@ -19,11 +19,42 @@ func allocateIPAddress() string { return "10.0.3.2" } +func getBridgeAddr(name string) (net.Addr, error) { + iface, err := net.InterfaceByName(name) + if err != nil { + return nil, err + } + addrs, err := iface.Addrs() + if err != nil { + return nil, err + } + var addrs4 []net.Addr + for _, addr := range addrs { + ip := (addr.(*net.IPNet)).IP + if ip4 := ip.To4(); len(ip4) == net.IPv4len { + addrs4 = append(addrs4, addr) + } + } + switch { + case len(addrs4) == 0: + return nil, fmt.Errorf("Bridge %v has no IP addresses", name) + case len(addrs4) > 1: + return nil, fmt.Errorf("Bridge %v has more than 1 IPv4 address", name) + } + return addrs4[0], nil +} + func allocateNetwork() (*NetworkInterface, error) { + bridgeAddr, err := getBridgeAddr(networkBridgeIface) + if err != nil { + return nil, err + } + bridge := bridgeAddr.(*net.IPNet) + ipPrefixLen, _ := bridge.Mask.Size() iface := &NetworkInterface{ IpAddress: allocateIPAddress(), - IpPrefixLen: networkPrefixLen, - Gateway: net.ParseIP(networkGateway), + IpPrefixLen: ipPrefixLen, + Gateway: bridge.IP, } return iface, nil } From 6124c5eb31ab8f9db4db288002388554d6181c86 Mon Sep 17 00:00:00 2001 From: Andrea Luzzardi Date: Wed, 20 Feb 2013 19:18:01 -0800 Subject: [PATCH 04/14] Network: Simple random IP allocation on the bridge network. --- network.go | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/network.go b/network.go index 0a6d1b8598..75f4ceae3b 100644 --- a/network.go +++ b/network.go @@ -2,6 +2,7 @@ package docker import ( "fmt" + "math/rand" "net" ) @@ -15,8 +16,10 @@ type NetworkInterface struct { Gateway net.IP } -func allocateIPAddress() string { - return "10.0.3.2" +func allocateIPAddress(network *net.IPNet) net.IP { + ip := network.IP.Mask(network.Mask) + ip[3] = byte(rand.Intn(254)) + return ip } func getBridgeAddr(name string) (net.Addr, error) { @@ -52,7 +55,7 @@ func allocateNetwork() (*NetworkInterface, error) { bridge := bridgeAddr.(*net.IPNet) ipPrefixLen, _ := bridge.Mask.Size() iface := &NetworkInterface{ - IpAddress: allocateIPAddress(), + IpAddress: allocateIPAddress(bridge).String(), IpPrefixLen: ipPrefixLen, Gateway: bridge.IP, } From e0e49b9a2259d779b31055339e67b054c8dffc3b Mon Sep 17 00:00:00 2001 From: Andrea Luzzardi Date: Thu, 21 Feb 2013 18:33:23 -0800 Subject: [PATCH 05/14] Network: Do not assume that we are using a class C. Instead, compute the IP addresses range and network size in order to allocate an IP address. --- network.go | 67 ++++++++++++++++++++++++++++++++++++++++++++++++++---- 1 file changed, 62 insertions(+), 5 deletions(-) diff --git a/network.go b/network.go index 75f4ceae3b..1e9a2edd5d 100644 --- a/network.go +++ b/network.go @@ -1,6 +1,8 @@ package docker import ( + "bytes" + "encoding/binary" "fmt" "math/rand" "net" @@ -16,10 +18,61 @@ type NetworkInterface struct { Gateway net.IP } -func allocateIPAddress(network *net.IPNet) net.IP { - ip := network.IP.Mask(network.Mask) - ip[3] = byte(rand.Intn(254)) - return ip +func networkRange(network *net.IPNet) (net.IP, net.IP) { + netIP := network.IP.To4() + firstIP := netIP.Mask(network.Mask) + lastIP := net.IPv4(0, 0, 0, 0).To4() + for i := 0; i < len(lastIP); i++ { + lastIP[i] = netIP[i] | ^network.Mask[i] + } + return firstIP, lastIP +} + +func ipToInt(ip net.IP) (int32, error) { + buf := bytes.NewBuffer(ip.To4()) + var n int32 + if err := binary.Read(buf, binary.BigEndian, &n); err != nil { + return 0, err + } + return n, nil +} + +func intToIp(n int32) (net.IP, error) { + var buf bytes.Buffer + if err := binary.Write(&buf, binary.BigEndian, &n); err != nil { + return net.IP{}, err + } + ip := net.IPv4(0, 0, 0, 0).To4() + for i := 0; i < net.IPv4len; i++ { + ip[i] = buf.Bytes()[i] + } + return ip, nil +} + +func networkSize(mask net.IPMask) (int32, error) { + for i := 0; i < net.IPv4len; i++ { + mask[i] = ^mask[i] + } + buf := bytes.NewBuffer(mask) + var n int32 + if err := binary.Read(buf, binary.BigEndian, &n); err != nil { + return 0, err + } + return n + 1, nil +} + +func allocateIPAddress(network *net.IPNet) (net.IP, error) { + ip, _ := networkRange(network) + netSize, err := networkSize(network.Mask) + if err != nil { + return net.IP{}, err + } + numIp, err := ipToInt(ip) + if err != nil { + return net.IP{}, err + } + numIp += rand.Int31n(netSize) + return intToIp(numIp) } func getBridgeAddr(name string) (net.Addr, error) { @@ -54,8 +107,12 @@ func allocateNetwork() (*NetworkInterface, error) { } bridge := bridgeAddr.(*net.IPNet) ipPrefixLen, _ := bridge.Mask.Size() + ip, err := allocateIPAddress(bridge) + if err != nil { + return nil, err + } iface := &NetworkInterface{ - IpAddress: allocateIPAddress(bridge).String(), + IpAddress: ip.String(), IpPrefixLen: ipPrefixLen, Gateway: bridge.IP, } From 149badc22b45acb171c3e583f6e820a06e4ced87 Mon Sep 17 00:00:00 2001 From: Andrea Luzzardi Date: Thu, 21 Feb 2013 18:34:35 -0800 Subject: [PATCH 06/14] Network tests --- network_test.go | 101 ++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 101 insertions(+) create mode 100644 network_test.go diff --git a/network_test.go b/network_test.go new file mode 100644 index 0000000000..c1ea382783 --- /dev/null +++ b/network_test.go @@ -0,0 +1,101 @@ +package docker + +import ( + "net" + "testing" +) + +func TestNetworkRange(t *testing.T) { + // Simple class C test + _, network, _ := net.ParseCIDR("192.168.0.1/24") + first, last := networkRange(network) + if !first.Equal(net.ParseIP("192.168.0.0")) { + t.Error(first.String()) + } + if !last.Equal(net.ParseIP("192.168.0.255")) { + t.Error(last.String()) + } + if size, err := networkSize(network.Mask); err != nil || size != 256 { + t.Error(size, err) + } + + // Class A test + _, network, _ = net.ParseCIDR("10.0.0.1/8") + first, last = networkRange(network) + if !first.Equal(net.ParseIP("10.0.0.0")) { + t.Error(first.String()) + } + if !last.Equal(net.ParseIP("10.255.255.255")) { + t.Error(last.String()) + } + if size, err := networkSize(network.Mask); err != nil || size != 16777216 { + t.Error(size, err) + } + + // Class A, random IP address + _, network, _ = net.ParseCIDR("10.1.2.3/8") + first, last = networkRange(network) + if !first.Equal(net.ParseIP("10.0.0.0")) { + t.Error(first.String()) + } + if !last.Equal(net.ParseIP("10.255.255.255")) { + t.Error(last.String()) + } + + // 32bit mask + _, network, _ = net.ParseCIDR("10.1.2.3/32") + first, last = networkRange(network) + if !first.Equal(net.ParseIP("10.1.2.3")) { + t.Error(first.String()) + } + if !last.Equal(net.ParseIP("10.1.2.3")) { + t.Error(last.String()) + } + if size, err := networkSize(network.Mask); err != nil || size != 1 { + t.Error(size, err) + } + + // 31bit mask + _, network, _ = net.ParseCIDR("10.1.2.3/31") + first, last = networkRange(network) + if !first.Equal(net.ParseIP("10.1.2.2")) { + t.Error(first.String()) + } + if !last.Equal(net.ParseIP("10.1.2.3")) { + t.Error(last.String()) + } + if size, err := networkSize(network.Mask); err != nil || size != 2 { + t.Error(size, err) + } + + // 26bit mask + _, network, _ = net.ParseCIDR("10.1.2.3/26") + first, last = networkRange(network) + if !first.Equal(net.ParseIP("10.1.2.0")) { + t.Error(first.String()) + } + if !last.Equal(net.ParseIP("10.1.2.63")) { + t.Error(last.String()) + } + if size, err := networkSize(network.Mask); err != nil || size != 64 { + t.Error(size, err) + } +} + +func TestConversion(t *testing.T) { + ip := net.ParseIP("127.0.0.1") + i, err := ipToInt(ip) + if err != nil { + t.Fatal(err) + } + if i == 0 { + t.Fatal("converted to zero") + } + conv, err := intToIp(i) + if err != nil { + t.Fatal(err) + } + if !ip.Equal(conv) { + t.Error(conv.String()) + } +} From 797bb6e75b8f33fe44932bf90145cf069f342e44 Mon Sep 17 00:00:00 2001 From: Andrea Luzzardi Date: Mon, 25 Feb 2013 10:45:23 -0800 Subject: [PATCH 07/14] Network allocator --- network.go | 63 +++++++++++++++++++++++++++++++++++++++++++++++++ network_test.go | 27 +++++++++++++++++++++ 2 files changed, 90 insertions(+) diff --git a/network.go b/network.go index 1e9a2edd5d..977db53c90 100644 --- a/network.go +++ b/network.go @@ -3,6 +3,7 @@ package docker import ( "bytes" "encoding/binary" + "errors" "fmt" "math/rand" "net" @@ -118,3 +119,65 @@ func allocateNetwork() (*NetworkInterface, error) { } return iface, nil } + +type NetworkAllocator struct { + iface string + queue chan (net.IP) +} + +func (alloc *NetworkAllocator) Acquire() (net.IP, error) { + select { + case ip := <-alloc.queue: + return ip, nil + default: + return net.IP{}, errors.New("No more IP addresses available") + } + return net.IP{}, nil +} + +func (alloc *NetworkAllocator) Release(ip net.IP) error { + select { + case alloc.queue <- ip: + return nil + default: + return errors.New("Too many IP addresses have been released") + } + return nil +} + +func (alloc *NetworkAllocator) PopulateFromNetwork(network *net.IPNet) error { + firstIP, _ := networkRange(network) + size, err := networkSize(network.Mask) + if err != nil { + return err + } + // The queue size should be the network size - 3 + // -1 for the network address, -1 for the broadcast address and + // -1 for the gateway address + alloc.queue = make(chan net.IP, size-3) + for i := int32(1); i < size-1; i++ { + ipNum, err := ipToInt(firstIP) + if err != nil { + return err + } + ip, err := intToIp(ipNum + int32(i)) + if err != nil { + return err + } + // Discard the network IP (that's the host IP address) + if ip.Equal(network.IP) { + continue + } + alloc.Release(ip) + } + return nil +} + +func (alloc *NetworkAllocator) PopulateFromInterface(iface string) error { + addr, err := getBridgeAddr(iface) + if err != nil { + return err + } + network := addr.(*net.IPNet) + return alloc.PopulateFromNetwork(network) +} diff --git a/network_test.go b/network_test.go index c1ea382783..c3de398681 100644 --- a/network_test.go +++ b/network_test.go @@ -99,3 +99,30 @@ func TestConversion(t *testing.T) { t.Error(conv.String()) } } + +func TestNetworkAllocator(t *testing.T) { + alloc := NetworkAllocator{} + _, n, _ := net.ParseCIDR("127.0.0.1/29") + alloc.PopulateFromNetwork(n) + var lastIP net.IP + for i := 0; i < 5; i++ { + ip, err := alloc.Acquire() + if err != nil { + t.Fatal(err) + } + lastIP = ip + } + ip, err := alloc.Acquire() + if err == nil { + t.Fatal("There shouldn't be any IP addresses at this point") + } + // Release 1 IP + alloc.Release(lastIP) + ip, err = alloc.Acquire() + if err != nil { + t.Fatal(err) + } + if !ip.Equal(lastIP) { + t.Fatal(ip.String()) + } +} From c08f5b2b8460f13f2094bae2a496bf308f7645bb Mon Sep 17 00:00:00 2001 From: Andrea Luzzardi Date: Mon, 25 Feb 2013 14:06:22 -0800 Subject: [PATCH 08/14] Integrated the network allocator into Docker. A networking environment is assigned to each container upon Start and released whenever the container exits. --- container.go | 75 ++++++++++++++++++++++++++++++++-------------- docker.go | 22 +++++++++----- lxc_template.go | 2 +- network.go | 79 +++++++++++++++++++++++-------------------------- network_test.go | 10 +++---- 5 files changed, 110 insertions(+), 78 deletions(-) diff --git a/container.go b/container.go index 50ac5e715e..67c450282f 100644 --- a/container.go +++ b/container.go @@ -33,9 +33,12 @@ type Container struct { Config *Config Filesystem *Filesystem - Network *NetworkInterface State *State + network *NetworkInterface + networkAllocator *NetworkAllocator + NetworkConfig *NetworkConfig + SysInitPath string lxcConfigPath string cmd *exec.Cmd @@ -56,16 +59,23 @@ type Config struct { OpenStdin bool // Open stdin } -func createContainer(id string, root string, command string, args []string, layers []string, config *Config) (*Container, error) { +type NetworkConfig struct { + IpAddress string + IpPrefixLen int +} + +func createContainer(id string, root string, command string, args []string, layers []string, config *Config, netAllocator *NetworkAllocator) (*Container, error) { container := &Container{ - Id: id, - Root: root, - Created: time.Now(), - Path: command, - Args: args, - Config: config, - Filesystem: newFilesystem(path.Join(root, "rootfs"), path.Join(root, "rw"), layers), - State: newState(), + Id: id, + Root: root, + Created: time.Now(), + Path: command, + Args: args, + Config: config, + Filesystem: newFilesystem(path.Join(root, "rootfs"), path.Join(root, "rw"), layers), + State: newState(), + networkAllocator: netAllocator, + NetworkConfig: &NetworkConfig{}, SysInitPath: sysInitPath, lxcConfigPath: path.Join(root, "config.lxc"), @@ -88,27 +98,25 @@ func createContainer(id string, root string, command string, args []string, laye if err := container.Filesystem.createMountPoints(); err != nil { return nil, err } - var err error - if container.Network, err = allocateNetwork(); err != nil { - return nil, err - } if err := container.save(); err != nil { return nil, err } return container, nil } -func loadContainer(containerPath string) (*Container, error) { +func loadContainer(containerPath string, netAllocator *NetworkAllocator) (*Container, error) { data, err := ioutil.ReadFile(path.Join(containerPath, "config.json")) if err != nil { return nil, err } container := &Container{ - stdout: newWriteBroadcaster(), - stderr: newWriteBroadcaster(), - stdoutLog: new(bytes.Buffer), - stderrLog: new(bytes.Buffer), - lxcConfigPath: path.Join(containerPath, "config.lxc"), + stdout: newWriteBroadcaster(), + stderr: newWriteBroadcaster(), + stdoutLog: new(bytes.Buffer), + stderrLog: new(bytes.Buffer), + lxcConfigPath: path.Join(containerPath, "config.lxc"), + networkAllocator: netAllocator, + NetworkConfig: &NetworkConfig{}, } if err := json.Unmarshal(data, container); err != nil { return nil, err @@ -268,6 +276,9 @@ func (container *Container) Start() error { if err := container.Filesystem.EnsureMounted(); err != nil { return err } + if err := container.allocateNetwork(); err != nil { + return err + } if err := container.generateLXCConfig(); err != nil { return err } @@ -279,7 +290,7 @@ func (container *Container) Start() error { } // Networking - params = append(params, "-g", container.Network.Gateway.String()) + params = append(params, "-g", container.network.Gateway.String()) // User if container.Config.User != "" { @@ -356,12 +367,33 @@ func (container *Container) StderrLog() io.Reader { return strings.NewReader(container.stderrLog.String()) } +func (container *Container) allocateNetwork() error { + iface, err := container.networkAllocator.Allocate() + if err != nil { + return err + } + container.network = iface + container.NetworkConfig.IpAddress = iface.IPNet.IP.String() + container.NetworkConfig.IpPrefixLen, _ = iface.IPNet.Mask.Size() + return nil +} + +func (container *Container) releaseNetwork() error { + err := container.networkAllocator.Release(container.network) + container.network = nil + container.NetworkConfig = &NetworkConfig{} + return err +} + func (container *Container) monitor() { // Wait for the program to exit container.cmd.Wait() exitCode := container.cmd.ProcessState.Sys().(syscall.WaitStatus).ExitStatus() // Cleanup + if err := container.releaseNetwork(); err != nil { + log.Printf("%v: Failed to release network: %v", container.Id, err) + } container.stdout.Close() container.stderr.Close() if err := container.Filesystem.Umount(); err != nil { @@ -429,7 +461,6 @@ func (container *Container) Restart() error { } func (container *Container) Wait() { - for container.State.Running { container.State.wait() } diff --git a/docker.go b/docker.go index abe2d3777d..f44eb04059 100644 --- a/docker.go +++ b/docker.go @@ -11,9 +11,10 @@ import ( ) type Docker struct { - root string - repository string - containers *list.List + root string + repository string + containers *list.List + networkAllocator *NetworkAllocator } func (docker *Docker) List() []*Container { @@ -51,7 +52,7 @@ func (docker *Docker) Create(id string, command string, args []string, layers [] return nil, fmt.Errorf("Container %v already exists", id) } root := path.Join(docker.repository, id) - container, err := createContainer(id, root, command, args, layers, config) + container, err := createContainer(id, root, command, args, layers, config, docker.networkAllocator) if err != nil { return nil, err } @@ -86,7 +87,7 @@ func (docker *Docker) restore() error { return err } for _, v := range dir { - container, err := loadContainer(path.Join(docker.repository, v.Name())) + container, err := loadContainer(path.Join(docker.repository, v.Name()), docker.networkAllocator) if err != nil { log.Printf("Failed to load container %v: %v", v.Name(), err) continue @@ -101,10 +102,15 @@ func New() (*Docker, error) { } func NewFromDirectory(root string) (*Docker, error) { + alloc, err := newNetworkAllocator(networkBridgeIface) + if err != nil { + return nil, err + } docker := &Docker{ - root: root, - repository: path.Join(root, "containers"), - containers: list.New(), + root: root, + repository: path.Join(root, "containers"), + containers: list.New(), + networkAllocator: alloc, } if err := os.MkdirAll(docker.repository, 0700); err != nil && !os.IsExist(err) { diff --git a/lxc_template.go b/lxc_template.go index 48e6dc732b..3e66885460 100755 --- a/lxc_template.go +++ b/lxc_template.go @@ -19,7 +19,7 @@ lxc.network.flags = up lxc.network.link = lxcbr0 lxc.network.name = eth0 lxc.network.mtu = 1500 -lxc.network.ipv4 = {{.Network.IpAddress}}/{{.Network.IpPrefixLen}} +lxc.network.ipv4 = {{.NetworkConfig.IpAddress}}/{{.NetworkConfig.IpPrefixLen}} # root filesystem {{$ROOTFS := .Filesystem.RootFS}} diff --git a/network.go b/network.go index 977db53c90..db4048feb5 100644 --- a/network.go +++ b/network.go @@ -5,7 +5,6 @@ import ( "encoding/binary" "errors" "fmt" - "math/rand" "net" ) @@ -14,11 +13,12 @@ const ( ) type NetworkInterface struct { - IpAddress string - IpPrefixLen int - Gateway net.IP + IPNet net.IPNet + Gateway net.IP } +// IP utils + func networkRange(network *net.IPNet) (net.IP, net.IP) { netIP := network.IP.To4() firstIP := netIP.Mask(network.Mask) @@ -51,10 +51,11 @@ func intToIp(n int32) (net.IP, error) { } func networkSize(mask net.IPMask) (int32, error) { + m := net.IPv4Mask(0, 0, 0, 0) for i := 0; i < net.IPv4len; i++ { - mask[i] = ^mask[i] + m[i] = ^mask[i] } - buf := bytes.NewBuffer(mask) + buf := bytes.NewBuffer(m) var n int32 if err := binary.Read(buf, binary.BigEndian, &n); err != nil { return 0, err @@ -62,21 +63,7 @@ func networkSize(mask net.IPMask) (int32, error) { return n + 1, nil } -func allocateIPAddress(network *net.IPNet) (net.IP, error) { - ip, _ := networkRange(network) - netSize, err := networkSize(network.Mask) - if err != nil { - return net.IP{}, err - } - numIp, err := ipToInt(ip) - if err != nil { - return net.IP{}, err - } - numIp += rand.Int31n(netSize) - return intToIp(numIp) -} - -func getBridgeAddr(name string) (net.Addr, error) { +func getIfaceAddr(name string) (net.Addr, error) { iface, err := net.InterfaceByName(name) if err != nil { return nil, err @@ -101,31 +88,31 @@ func getBridgeAddr(name string) (net.Addr, error) { return addrs4[0], nil } -func allocateNetwork() (*NetworkInterface, error) { - bridgeAddr, err := getBridgeAddr(networkBridgeIface) +// Network allocator +func newNetworkAllocator(iface string) (*NetworkAllocator, error) { + addr, err := getIfaceAddr(iface) if err != nil { return nil, err } - bridge := bridgeAddr.(*net.IPNet) - ipPrefixLen, _ := bridge.Mask.Size() - ip, err := allocateIPAddress(bridge) - if err != nil { + network := addr.(*net.IPNet) + + alloc := &NetworkAllocator{ + iface: iface, + net: network, + } + if err := alloc.populateFromNetwork(network); err != nil { return nil, err } - iface := &NetworkInterface{ - IpAddress: ip.String(), - IpPrefixLen: ipPrefixLen, - Gateway: bridge.IP, - } - return iface, nil + return alloc, nil } type NetworkAllocator struct { iface string + net *net.IPNet queue chan (net.IP) } -func (alloc *NetworkAllocator) Acquire() (net.IP, error) { +func (alloc *NetworkAllocator) acquireIP() (net.IP, error) { select { case ip := <-alloc.queue: return ip, nil @@ -135,7 +122,7 @@ func (alloc *NetworkAllocator) Acquire() (net.IP, error) { return net.IP{}, nil } -func (alloc *NetworkAllocator) Release(ip net.IP) error { +func (alloc *NetworkAllocator) releaseIP(ip net.IP) error { select { case alloc.queue <- ip: return nil @@ -145,7 +132,7 @@ func (alloc *NetworkAllocator) Release(ip net.IP) error { return nil } -func (alloc *NetworkAllocator) PopulateFromNetwork(network *net.IPNet) error { +func (alloc *NetworkAllocator) populateFromNetwork(network *net.IPNet) error { firstIP, _ := networkRange(network) size, err := networkSize(network.Mask) if err != nil { @@ -168,16 +155,24 @@ func (alloc *NetworkAllocator) PopulateFromNetwork(network *net.IPNet) error { if ip.Equal(network.IP) { continue } - alloc.Release(ip) + alloc.releaseIP(ip) } return nil } -func (alloc *NetworkAllocator) PopulateFromInterface(iface string) error { - addr, err := getBridgeAddr(iface) +func (alloc *NetworkAllocator) Allocate() (*NetworkInterface, error) { + // ipPrefixLen, _ := alloc.net.Mask.Size() + ip, err := alloc.acquireIP() if err != nil { - return err + return nil, err } - network := addr.(*net.IPNet) - return alloc.PopulateFromNetwork(network) + iface := &NetworkInterface{ + IPNet: net.IPNet{ip, alloc.net.Mask}, + Gateway: alloc.net.IP, + } + return iface, nil +} + +func (alloc *NetworkAllocator) Release(iface *NetworkInterface) error { + return alloc.releaseIP(iface.IPNet.IP) } diff --git a/network_test.go b/network_test.go index c3de398681..d66e7e5393 100644 --- a/network_test.go +++ b/network_test.go @@ -103,22 +103,22 @@ func TestConversion(t *testing.T) { func TestNetworkAllocator(t *testing.T) { alloc := NetworkAllocator{} _, n, _ := net.ParseCIDR("127.0.0.1/29") - alloc.PopulateFromNetwork(n) + alloc.populateFromNetwork(n) var lastIP net.IP for i := 0; i < 5; i++ { - ip, err := alloc.Acquire() + ip, err := alloc.acquireIP() if err != nil { t.Fatal(err) } lastIP = ip } - ip, err := alloc.Acquire() + ip, err := alloc.acquireIP() if err == nil { t.Fatal("There shouldn't be any IP addresses at this point") } // Release 1 IP - alloc.Release(lastIP) - ip, err = alloc.Acquire() + alloc.releaseIP(lastIP) + ip, err = alloc.acquireIP() if err != nil { t.Fatal(err) } From 799ffa176399877e610ff2049dbf84610037a2be Mon Sep 17 00:00:00 2001 From: Andrea Luzzardi Date: Thu, 28 Feb 2013 11:50:02 -0800 Subject: [PATCH 09/14] Network: Port mapping support. Implemented a port allocator and a port mapper that is able to forward TCP ports from the host to the container. --- network.go | 290 ++++++++++++++++++++++++++++++++++++++---------- network_test.go | 18 +-- 2 files changed, 244 insertions(+), 64 deletions(-) diff --git a/network.go b/network.go index db4048feb5..1b6395b0b1 100644 --- a/network.go +++ b/network.go @@ -5,20 +5,20 @@ import ( "encoding/binary" "errors" "fmt" + "log" "net" + "os/exec" + "strconv" + "strings" ) const ( networkBridgeIface = "lxcbr0" + portRangeStart = 49153 + portRangeEnd = 65535 ) -type NetworkInterface struct { - IPNet net.IPNet - Gateway net.IP -} - -// IP utils - +// Calculates the first and last IP addresses in an IPNet func networkRange(network *net.IPNet) (net.IP, net.IP) { netIP := network.IP.To4() firstIP := netIP.Mask(network.Mask) @@ -29,6 +29,7 @@ func networkRange(network *net.IPNet) (net.IP, net.IP) { return firstIP, lastIP } +// Converts a 4 bytes IP into a 32 bit integer func ipToInt(ip net.IP) (int32, error) { buf := bytes.NewBuffer(ip.To4()) var n int32 @@ -38,6 +39,7 @@ func ipToInt(ip net.IP) (int32, error) { return n, nil } +// Converts 32 bit integer into a 4 bytes IP address func intToIp(n int32) (net.IP, error) { var buf bytes.Buffer if err := binary.Write(&buf, binary.BigEndian, &n); err != nil { @@ -50,6 +52,7 @@ func intToIp(n int32) (net.IP, error) { return ip, nil } +// Given a netmask, calculates the number of available hosts func networkSize(mask net.IPMask) (int32, error) { m := net.IPv4Mask(0, 0, 0, 0) for i := 0; i < net.IPv4len; i++ { @@ -63,6 +66,15 @@ func networkSize(mask net.IPMask) (int32, error) { return n + 1, nil } +// Wrapper around the iptables command +func iptables(args ...string) error { + if err := exec.Command("/sbin/iptables", args...).Run(); err != nil { + return fmt.Errorf("iptables failed: iptables %v", strings.Join(args, " ")) + } + return nil +} + +// Return the IPv4 address of a network interface func getIfaceAddr(name string) (net.Addr, error) { iface, err := net.InterfaceByName(name) if err != nil { @@ -81,60 +93,122 @@ func getIfaceAddr(name string) (net.Addr, error) { } switch { case len(addrs4) == 0: - return nil, fmt.Errorf("Bridge %v has no IP addresses", name) + return nil, fmt.Errorf("Interface %v has no IP addresses", name) case len(addrs4) > 1: - return nil, fmt.Errorf("Bridge %v has more than 1 IPv4 address", name) + return nil, fmt.Errorf("Interface %v has more than 1 IPv4 address", name) } return addrs4[0], nil } -// Network allocator -func newNetworkAllocator(iface string) (*NetworkAllocator, error) { - addr, err := getIfaceAddr(iface) - if err != nil { - return nil, err - } - network := addr.(*net.IPNet) - - alloc := &NetworkAllocator{ - iface: iface, - net: network, - } - if err := alloc.populateFromNetwork(network); err != nil { - return nil, err - } - return alloc, nil +// Port mapper takes care of mapping external ports to containers by setting +// up iptables rules. +// It keeps track of all mappings and is able to unmap at will +type PortMapper struct { + mapping map[int]net.TCPAddr } -type NetworkAllocator struct { - iface string - net *net.IPNet - queue chan (net.IP) +func (mapper *PortMapper) cleanup() error { + // Ignore errors - This could mean the chains were never set up + iptables("-t", "nat", "-D", "PREROUTING", "-j", "DOCKER") + iptables("-t", "nat", "-F", "DOCKER") + iptables("-t", "nat", "-X", "DOCKER") + mapper.mapping = make(map[int]net.TCPAddr) + return nil } -func (alloc *NetworkAllocator) acquireIP() (net.IP, error) { - select { - case ip := <-alloc.queue: - return ip, nil - default: - return net.IP{}, errors.New("No more IP addresses available") +func (mapper *PortMapper) setup() error { + if err := iptables("-t", "nat", "-N", "DOCKER"); err != nil { + return errors.New("Unable to setup port networking: Failed to create DOCKER chain") } - return net.IP{}, nil -} - -func (alloc *NetworkAllocator) releaseIP(ip net.IP) error { - select { - case alloc.queue <- ip: - return nil - default: - return errors.New("Too many IP addresses have been released") + if err := iptables("-t", "nat", "-A", "PREROUTING", "-j", "DOCKER"); err != nil { + return errors.New("Unable to setup port networking: Failed to inject docker in PREROUTING chain") } return nil } -func (alloc *NetworkAllocator) populateFromNetwork(network *net.IPNet) error { - firstIP, _ := networkRange(network) - size, err := networkSize(network.Mask) +func (mapper *PortMapper) iptablesForward(rule string, port int, dest net.TCPAddr) error { + return iptables("-t", "nat", rule, "DOCKER", "-p", "tcp", "--dport", strconv.Itoa(port), + "-j", "DNAT", "--to-destination", net.JoinHostPort(dest.IP.String(), strconv.Itoa(dest.Port))) +} + +func (mapper *PortMapper) Map(port int, dest net.TCPAddr) error { + if err := mapper.iptablesForward("-A", port, dest); err != nil { + return err + } + mapper.mapping[port] = dest + return nil +} + +func (mapper *PortMapper) Unmap(port int) error { + dest, ok := mapper.mapping[port] + if !ok { + return errors.New("Port is not mapped") + } + if err := mapper.iptablesForward("-D", port, dest); err != nil { + return err + } + delete(mapper.mapping, port) + return nil +} + +func newPortMapper() (*PortMapper, error) { + mapper := &PortMapper{} + if err := mapper.cleanup(); err != nil { + return nil, err + } + if err := mapper.setup(); err != nil { + return nil, err + } + return mapper, nil +} + +// Port allocator: Atomatically allocate and release networking ports +type PortAllocator struct { + ports chan (int) +} + +func (alloc *PortAllocator) populate(start, end int) { + alloc.ports = make(chan int, end-start) + for port := start; port < end; port++ { + alloc.ports <- port + } +} + +func (alloc *PortAllocator) Acquire() (int, error) { + select { + case port := <-alloc.ports: + return port, nil + default: + return -1, errors.New("No more ports available") + } + return -1, nil +} + +func (alloc *PortAllocator) Release(port int) error { + select { + case alloc.ports <- port: + return nil + default: + return errors.New("Too many ports have been released") + } + return nil +} + +func newPortAllocator(start, end int) (*PortAllocator, error) { + allocator := &PortAllocator{} + allocator.populate(start, end) + return allocator, nil +} + +// IP allocator: Atomatically allocate and release networking ports +type IPAllocator struct { + network *net.IPNet + queue chan (net.IP) +} + +func (alloc *IPAllocator) populate() error { + firstIP, _ := networkRange(alloc.network) + size, err := networkSize(alloc.network.Mask) if err != nil { return err } @@ -152,27 +226,131 @@ func (alloc *NetworkAllocator) populateFromNetwork(network *net.IPNet) error { return err } // Discard the network IP (that's the host IP address) - if ip.Equal(network.IP) { + if ip.Equal(alloc.network.IP) { continue } - alloc.releaseIP(ip) + alloc.queue <- ip } return nil } -func (alloc *NetworkAllocator) Allocate() (*NetworkInterface, error) { - // ipPrefixLen, _ := alloc.net.Mask.Size() - ip, err := alloc.acquireIP() +func (alloc *IPAllocator) Acquire() (net.IP, error) { + select { + case ip := <-alloc.queue: + return ip, nil + default: + return net.IP{}, errors.New("No more IP addresses available") + } + return net.IP{}, nil +} + +func (alloc *IPAllocator) Release(ip net.IP) error { + select { + case alloc.queue <- ip: + return nil + default: + return errors.New("Too many IP addresses have been released") + } + return nil +} + +func newIPAllocator(network *net.IPNet) (*IPAllocator, error) { + alloc := &IPAllocator{ + network: network, + } + if err := alloc.populate(); err != nil { + return nil, err + } + return alloc, nil +} + +// Network interface represents the networking stack of a container +type NetworkInterface struct { + IPNet net.IPNet + Gateway net.IP + + manager *NetworkManager + extPorts []int +} + +// Allocate an external TCP port and map it to the interface +func (iface *NetworkInterface) AllocatePort(port int) (int, error) { + extPort, err := iface.manager.portAllocator.Acquire() + if err != nil { + return -1, err + } + if err := iface.manager.portMapper.Map(extPort, net.TCPAddr{iface.IPNet.IP, port}); err != nil { + iface.manager.portAllocator.Release(extPort) + return -1, err + } + iface.extPorts = append(iface.extPorts, extPort) + return extPort, nil +} + +// Release: Network cleanup - release all resources +func (iface *NetworkInterface) Release() error { + for _, port := range iface.extPorts { + if err := iface.manager.portMapper.Unmap(port); err != nil { + log.Printf("Unable to unmap port %v: %v", port, err) + } + if err := iface.manager.portAllocator.Release(port); err != nil { + log.Printf("Unable to release port %v: %v", port, err) + } + + } + return iface.manager.ipAllocator.Release(iface.IPNet.IP) +} + +// Network Manager manages a set of network interfaces +// Only *one* manager per host machine should be used +type NetworkManager struct { + bridgeIface string + bridgeNetwork *net.IPNet + + ipAllocator *IPAllocator + portAllocator *PortAllocator + portMapper *PortMapper +} + +// Allocate a network interface +func (manager *NetworkManager) Allocate() (*NetworkInterface, error) { + ip, err := manager.ipAllocator.Acquire() if err != nil { return nil, err } iface := &NetworkInterface{ - IPNet: net.IPNet{ip, alloc.net.Mask}, - Gateway: alloc.net.IP, + IPNet: net.IPNet{ip, manager.bridgeNetwork.Mask}, + Gateway: manager.bridgeNetwork.IP, + manager: manager, } return iface, nil } -func (alloc *NetworkAllocator) Release(iface *NetworkInterface) error { - return alloc.releaseIP(iface.IPNet.IP) +func newNetworkManager(bridgeIface string) (*NetworkManager, error) { + addr, err := getIfaceAddr(bridgeIface) + if err != nil { + return nil, err + } + network := addr.(*net.IPNet) + + ipAllocator, err := newIPAllocator(network) + if err != nil { + return nil, err + } + + portAllocator, err := newPortAllocator(portRangeStart, portRangeEnd) + if err != nil { + return nil, err + } + + portMapper, err := newPortMapper() + + manager := &NetworkManager{ + bridgeIface: bridgeIface, + bridgeNetwork: network, + ipAllocator: ipAllocator, + portAllocator: portAllocator, + portMapper: portMapper, + } + return manager, nil } diff --git a/network_test.go b/network_test.go index d66e7e5393..c456b54838 100644 --- a/network_test.go +++ b/network_test.go @@ -100,25 +100,27 @@ func TestConversion(t *testing.T) { } } -func TestNetworkAllocator(t *testing.T) { - alloc := NetworkAllocator{} - _, n, _ := net.ParseCIDR("127.0.0.1/29") - alloc.populateFromNetwork(n) +func TestIPAllocator(t *testing.T) { + gwIP, n, _ := net.ParseCIDR("127.0.0.1/29") + alloc, err := newIPAllocator(&net.IPNet{gwIP, n.Mask}) + if err != nil { + t.Fatal(err) + } var lastIP net.IP for i := 0; i < 5; i++ { - ip, err := alloc.acquireIP() + ip, err := alloc.Acquire() if err != nil { t.Fatal(err) } lastIP = ip } - ip, err := alloc.acquireIP() + ip, err := alloc.Acquire() if err == nil { t.Fatal("There shouldn't be any IP addresses at this point") } // Release 1 IP - alloc.releaseIP(lastIP) - ip, err = alloc.acquireIP() + alloc.Release(lastIP) + ip, err = alloc.Acquire() if err != nil { t.Fatal(err) } From 09eacdfadec36f79cec74f037484b10ddfae6791 Mon Sep 17 00:00:00 2001 From: Andrea Luzzardi Date: Thu, 28 Feb 2013 11:51:14 -0800 Subject: [PATCH 10/14] Container can now take a list of ports to expose in its config --- container.go | 83 ++++++++++++++++++++++++++++--------------------- lxc_template.go | 2 +- 2 files changed, 49 insertions(+), 36 deletions(-) diff --git a/container.go b/container.go index 7f5d592e81..aa28c7922b 100644 --- a/container.go +++ b/container.go @@ -11,6 +11,7 @@ import ( "os" "os/exec" "path" + "strconv" "strings" "syscall" "time" @@ -35,9 +36,9 @@ type Container struct { Filesystem *Filesystem State *State - network *NetworkInterface - networkAllocator *NetworkAllocator - NetworkConfig *NetworkConfig + network *NetworkInterface + networkManager *NetworkManager + NetworkSettings *NetworkSettings SysInitPath string lxcConfigPath string @@ -55,34 +56,36 @@ type Config struct { Hostname string User string Ram int64 + Ports []int Tty bool // Attach standard streams to a tty, including stdin if it is not closed. OpenStdin bool // Open stdin } -type NetworkConfig struct { +type NetworkSettings struct { IpAddress string IpPrefixLen int + Gateway string + PortMapping map[string]string } -func createContainer(id string, root string, command string, args []string, layers []string, config *Config, netAllocator *NetworkAllocator) (*Container, error) { +func createContainer(id string, root string, command string, args []string, layers []string, config *Config, netManager *NetworkManager) (*Container, error) { container := &Container{ - Id: id, - Root: root, - Created: time.Now(), - Path: command, - Args: args, - Config: config, - Filesystem: newFilesystem(path.Join(root, "rootfs"), path.Join(root, "rw"), layers), - State: newState(), - networkAllocator: netAllocator, - NetworkConfig: &NetworkConfig{}, - - SysInitPath: sysInitPath, - lxcConfigPath: path.Join(root, "config.lxc"), - stdout: newWriteBroadcaster(), - stderr: newWriteBroadcaster(), - stdoutLog: new(bytes.Buffer), - stderrLog: new(bytes.Buffer), + Id: id, + Root: root, + Created: time.Now(), + Path: command, + Args: args, + Config: config, + Filesystem: newFilesystem(path.Join(root, "rootfs"), path.Join(root, "rw"), layers), + State: newState(), + networkManager: netManager, + NetworkSettings: &NetworkSettings{}, + SysInitPath: sysInitPath, + lxcConfigPath: path.Join(root, "config.lxc"), + stdout: newWriteBroadcaster(), + stderr: newWriteBroadcaster(), + stdoutLog: new(bytes.Buffer), + stderrLog: new(bytes.Buffer), } if container.Config.OpenStdin { container.stdin, container.stdinPipe = io.Pipe() @@ -104,19 +107,19 @@ func createContainer(id string, root string, command string, args []string, laye return container, nil } -func loadContainer(containerPath string, netAllocator *NetworkAllocator) (*Container, error) { +func loadContainer(containerPath string, netManager *NetworkManager) (*Container, error) { data, err := ioutil.ReadFile(path.Join(containerPath, "config.json")) if err != nil { return nil, err } container := &Container{ - stdout: newWriteBroadcaster(), - stderr: newWriteBroadcaster(), - stdoutLog: new(bytes.Buffer), - stderrLog: new(bytes.Buffer), - lxcConfigPath: path.Join(containerPath, "config.lxc"), - networkAllocator: netAllocator, - NetworkConfig: &NetworkConfig{}, + stdout: newWriteBroadcaster(), + stderr: newWriteBroadcaster(), + stdoutLog: new(bytes.Buffer), + stderrLog: new(bytes.Buffer), + lxcConfigPath: path.Join(containerPath, "config.lxc"), + networkManager: netManager, + NetworkSettings: &NetworkSettings{}, } if err := json.Unmarshal(data, container); err != nil { return nil, err @@ -368,20 +371,30 @@ func (container *Container) StderrLog() io.Reader { } func (container *Container) allocateNetwork() error { - iface, err := container.networkAllocator.Allocate() + iface, err := container.networkManager.Allocate() if err != nil { return err } + container.NetworkSettings.PortMapping = make(map[string]string) + for _, port := range container.Config.Ports { + if extPort, err := iface.AllocatePort(port); err != nil { + iface.Release() + return err + } else { + container.NetworkSettings.PortMapping[strconv.Itoa(port)] = strconv.Itoa(extPort) + } + } container.network = iface - container.NetworkConfig.IpAddress = iface.IPNet.IP.String() - container.NetworkConfig.IpPrefixLen, _ = iface.IPNet.Mask.Size() + container.NetworkSettings.IpAddress = iface.IPNet.IP.String() + container.NetworkSettings.IpPrefixLen, _ = iface.IPNet.Mask.Size() + container.NetworkSettings.Gateway = iface.Gateway.String() return nil } func (container *Container) releaseNetwork() error { - err := container.networkAllocator.Release(container.network) + err := container.network.Release() container.network = nil - container.NetworkConfig = &NetworkConfig{} + container.NetworkSettings = &NetworkSettings{} return err } diff --git a/lxc_template.go b/lxc_template.go index 3e66885460..283391bfb3 100755 --- a/lxc_template.go +++ b/lxc_template.go @@ -19,7 +19,7 @@ lxc.network.flags = up lxc.network.link = lxcbr0 lxc.network.name = eth0 lxc.network.mtu = 1500 -lxc.network.ipv4 = {{.NetworkConfig.IpAddress}}/{{.NetworkConfig.IpPrefixLen}} +lxc.network.ipv4 = {{.NetworkSettings.IpAddress}}/{{.NetworkSettings.IpPrefixLen}} # root filesystem {{$ROOTFS := .Filesystem.RootFS}} From bd2f51290f4c34daec08474c0bd78952030be6ff Mon Sep 17 00:00:00 2001 From: Andrea Luzzardi Date: Thu, 28 Feb 2013 11:52:07 -0800 Subject: [PATCH 11/14] Docker: Network manager integration --- docker.go | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-) diff --git a/docker.go b/docker.go index f44eb04059..67b67f7cdf 100644 --- a/docker.go +++ b/docker.go @@ -11,10 +11,10 @@ import ( ) type Docker struct { - root string - repository string - containers *list.List - networkAllocator *NetworkAllocator + root string + repository string + containers *list.List + networkManager *NetworkManager } func (docker *Docker) List() []*Container { @@ -52,7 +52,7 @@ func (docker *Docker) Create(id string, command string, args []string, layers [] return nil, fmt.Errorf("Container %v already exists", id) } root := path.Join(docker.repository, id) - container, err := createContainer(id, root, command, args, layers, config, docker.networkAllocator) + container, err := createContainer(id, root, command, args, layers, config, docker.networkManager) if err != nil { return nil, err } @@ -87,7 +87,7 @@ func (docker *Docker) restore() error { return err } for _, v := range dir { - container, err := loadContainer(path.Join(docker.repository, v.Name()), docker.networkAllocator) + container, err := loadContainer(path.Join(docker.repository, v.Name()), docker.networkManager) if err != nil { log.Printf("Failed to load container %v: %v", v.Name(), err) continue @@ -102,15 +102,15 @@ func New() (*Docker, error) { } func NewFromDirectory(root string) (*Docker, error) { - alloc, err := newNetworkAllocator(networkBridgeIface) + netManager, err := newNetworkManager(networkBridgeIface) if err != nil { return nil, err } docker := &Docker{ - root: root, - repository: path.Join(root, "containers"), - containers: list.New(), - networkAllocator: alloc, + root: root, + repository: path.Join(root, "containers"), + containers: list.New(), + networkManager: netManager, } if err := os.MkdirAll(docker.repository, 0700); err != nil && !os.IsExist(err) { From f857fa0dddbf48b959b0876582027ebc46dc5e9e Mon Sep 17 00:00:00 2001 From: Andrea Luzzardi Date: Thu, 28 Feb 2013 11:52:22 -0800 Subject: [PATCH 12/14] Server: -p option to export TCP ports --- server/server.go | 55 ++++++++++++++++++++++++++++++++---------------- 1 file changed, 37 insertions(+), 18 deletions(-) diff --git a/server/server.go b/server/server.go index 2ef42f8b16..75acd8ddd3 100644 --- a/server/server.go +++ b/server/server.go @@ -11,10 +11,11 @@ import ( "github.com/dotcloud/docker/image" "github.com/dotcloud/docker/rcli" "io" - "net/http" + // "net/http" "net/url" "os" "path" + "strconv" "strings" "sync" "text/tabwriter" @@ -392,20 +393,20 @@ func (srv *Server) CmdPull(stdin io.ReadCloser, stdout io.Writer, args ...string fmt.Fprintf(stdout, "Downloading from %s\n", u.String()) // Download with curl (pretty progress bar) // If curl is not available, fallback to http.Get() - archive, err := future.Curl(u.String(), stdout) - if err != nil { - if resp, err := http.Get(u.String()); err != nil { - return err - } else { - archive = resp.Body - } - } - fmt.Fprintf(stdout, "Unpacking to %s\n", name) - img, err := srv.images.Import(name, archive, nil) - if err != nil { - return err - } - fmt.Fprintln(stdout, img.Id) + // archive, err := future.Curl(u.String(), stdout) + // if err != nil { + // if resp, err := http.Get(u.String()); err != nil { + // return err + // } else { + // archive = resp.Body + // } + // } + // fmt.Fprintf(stdout, "Unpacking to %s\n", name) + // img, err := srv.images.Import(name, archive, nil) + // if err != nil { + // return err + // } + // fmt.Fprintln(stdout, img.Id) return nil } @@ -679,10 +680,10 @@ func (srv *Server) CmdLogs(stdin io.ReadCloser, stdout io.Writer, args ...string return errors.New("No such container: " + cmd.Arg(0)) } -func (srv *Server) CreateContainer(img *image.Image, user string, tty bool, openStdin bool, comment string, cmd string, args ...string) (*docker.Container, error) { +func (srv *Server) CreateContainer(img *image.Image, ports []int, user string, tty bool, openStdin bool, comment string, cmd string, args ...string) (*docker.Container, error) { id := future.RandomId()[:8] container, err := srv.containers.Create(id, cmd, args, img.Layers, - &docker.Config{Hostname: id, User: user, Tty: tty, OpenStdin: openStdin}) + &docker.Config{Hostname: id, Ports: ports, User: user, Tty: tty, OpenStdin: openStdin}) if err != nil { return nil, err } @@ -743,6 +744,22 @@ func (srv *Server) CmdAttach(stdin io.ReadCloser, stdout io.Writer, args ...stri return nil } +// Ports type - Used to parse multiple -p flags +type ports []int + +func (p *ports) String() string { + return fmt.Sprint(*p) +} + +func (p *ports) Set(value string) error { + port, err := strconv.Atoi(value) + if err != nil { + return fmt.Errorf("Invalid port: %v", value) + } + *p = append(*p, port) + return nil +} + func (srv *Server) CmdRun(stdin io.ReadCloser, stdout io.Writer, args ...string) error { cmd := rcli.Subcmd(stdout, "run", "[OPTIONS] IMAGE COMMAND [ARG...]", "Run a command in a new container") fl_user := cmd.String("u", "", "Username or UID") @@ -750,6 +767,8 @@ func (srv *Server) CmdRun(stdin io.ReadCloser, stdout io.Writer, args ...string) fl_stdin := cmd.Bool("i", false, "Keep stdin open even if not attached") fl_tty := cmd.Bool("t", false, "Allocate a pseudo-tty") fl_comment := cmd.String("c", "", "Comment") + var fl_ports ports + cmd.Var(&fl_ports, "p", "Map a network port to the container") if err := cmd.Parse(args); err != nil { return nil } @@ -775,7 +794,7 @@ func (srv *Server) CmdRun(stdin io.ReadCloser, stdout io.Writer, args ...string) return errors.New("No such image: " + name) } // Create new container - container, err := srv.CreateContainer(img, *fl_user, *fl_tty, *fl_stdin, *fl_comment, cmdline[0], cmdline[1:]...) + container, err := srv.CreateContainer(img, fl_ports, *fl_user, *fl_tty, *fl_stdin, *fl_comment, cmdline[0], cmdline[1:]...) if err != nil { return errors.New("Error creating container: " + err.Error()) } From 2192d3371ceb7431a6dacd170ddadd4ef26d5783 Mon Sep 17 00:00:00 2001 From: Andrea Luzzardi Date: Thu, 28 Feb 2013 11:57:57 -0800 Subject: [PATCH 13/14] Re-enabled lxc capabilities drop --- lxc_template.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lxc_template.go b/lxc_template.go index 283391bfb3..931095c99d 100755 --- a/lxc_template.go +++ b/lxc_template.go @@ -82,7 +82,7 @@ lxc.mount.entry = /etc/resolv.conf {{$ROOTFS}}/etc/resolv.conf none bind,ro 0 0 # drop linux capabilities (apply mainly to the user root in the container) -#lxc.cap.drop = audit_control audit_write mac_admin mac_override mknod net_raw setfcap setpcap sys_admin sys_boot sys_module sys_nice sys_pacct sys_rawio sys_resource sys_time sys_tty_config +lxc.cap.drop = audit_control audit_write mac_admin mac_override mknod net_raw setfcap setpcap sys_admin sys_boot sys_module sys_nice sys_pacct sys_rawio sys_resource sys_time sys_tty_config # limits {{if .Config.Ram}} From 5675439b9100b40529b8eb87447231a2f5a01ad2 Mon Sep 17 00:00:00 2001 From: Solomon Hykes Date: Thu, 28 Feb 2013 16:30:31 -0800 Subject: [PATCH 14/14] Re-enabled CmdPull progress bar code which had been temporarily disabled --- server/server.go | 30 +++++++++++++++--------------- 1 file changed, 15 insertions(+), 15 deletions(-) diff --git a/server/server.go b/server/server.go index 75acd8ddd3..86fff3dcfe 100644 --- a/server/server.go +++ b/server/server.go @@ -11,7 +11,7 @@ import ( "github.com/dotcloud/docker/image" "github.com/dotcloud/docker/rcli" "io" - // "net/http" + "net/http" "net/url" "os" "path" @@ -393,20 +393,20 @@ func (srv *Server) CmdPull(stdin io.ReadCloser, stdout io.Writer, args ...string fmt.Fprintf(stdout, "Downloading from %s\n", u.String()) // Download with curl (pretty progress bar) // If curl is not available, fallback to http.Get() - // archive, err := future.Curl(u.String(), stdout) - // if err != nil { - // if resp, err := http.Get(u.String()); err != nil { - // return err - // } else { - // archive = resp.Body - // } - // } - // fmt.Fprintf(stdout, "Unpacking to %s\n", name) - // img, err := srv.images.Import(name, archive, nil) - // if err != nil { - // return err - // } - // fmt.Fprintln(stdout, img.Id) + archive, err := future.Curl(u.String(), stdout) + if err != nil { + if resp, err := http.Get(u.String()); err != nil { + return err + } else { + archive = resp.Body + } + } + fmt.Fprintf(stdout, "Unpacking to %s\n", name) + img, err := srv.images.Import(name, archive, nil) + if err != nil { + return err + } + fmt.Fprintln(stdout, img.Id) return nil }