Commit Graph

201 Commits

Author SHA1 Message Date
Dan Walsh 23feaaa240 Allow the container to share the PID namespace with the host
We want to be able to use container without the PID namespace.  We basically
want containers that can manage the host os, which I call Super Privileged
Containers.  We eventually would like to get to the point where the only
namespace we use is the MNT namespace to bring the Apps userspace with it.

By eliminating the PID namespace we can get better communication between the
host and the clients and potentially tools like strace and gdb become easier
to use.  We also see tools like libvirtd running within a container telling
systemd to place a VM in a particular cgroup, we need to have communications of the PID.

I don't see us needing to share PID namespaces between containers, since this
is really what docker exec does.

So currently I see us just needing docker run --pid=host

Docker-DCO-1.1-Signed-off-by: Dan Walsh <dwalsh@redhat.com> (github: rhatdan)
2015-01-13 16:35:17 -08:00
Malte Janduda 813ff7f19d Adding IPv6 network support to docker
Signed-off-by: Malte Janduda <mail@janduda.net>
2015-01-09 00:13:09 +01:00
Alexander Morozov 50905a6d6c Update libcontainer to 1597c68f7b941fd97881155d7f077852e2914e7b
This commit contains changes for docker:
* user.GetGroupFile to user.GetGroupPath docker/libcontainer#301
* Add systemd support for OOM docker/libcontainer#307
* Support for custom namespaces docker/libcontainer#279, docker/libcontainer#312
* Fixes #9699 docker/libcontainer#308

Signed-off-by: Alexander Morozov <lk4d4@docker.com>
2014-12-23 12:10:03 -08:00
Alexander Morozov e7d086c2be Fix vet errors about unkeyed fields
Signed-off-by: Alexander Morozov <lk4d4@docker.com>
2014-12-12 10:44:59 -08:00
Michael Crosby 07996d82c7 Merge pull request #9074 from rhatdan/shm
Allow IPC namespace to be shared between containers or with the host
2014-11-14 10:34:00 -08:00
Dan Walsh 497fc8876e Allow IPC namespace to be shared between containers or with the host
Some workloads rely on IPC for communications with other processes.  We
would like to split workloads between two container but still allow them
to communicate though shared IPC.

This patch mimics the --net code to allow --ipc=host to not split off
the IPC Namespace.  ipc=container:CONTAINERID to share ipc between containers

If you share IPC between containers, then you need to make sure SELinux labels
match.

Docker-DCO-1.1-Signed-off-by: Dan Walsh <dwalsh@redhat.com> (github: rhatdan)
2014-11-12 11:29:58 -05:00
Vishnu Kannan 46f2944977 Address comments.
Docker-DCO-1.1-Signed-off-by: Vishnu Kannan <vishnuk@google.com> (github: vishh)
2014-11-08 00:14:08 +00:00
Vishnu Kannan f96e04ffc7 This patch adds ability in docker to detect out of memory conditions in containers.
Since the containers can handle the out of memory kernel kills gracefully, docker
will only provide out of memory information as an additional metadata as part of
container status.
Docker-DCO-1.1-Signed-off-by: Vishnu Kannan <vishnuk@google.com> (github: vishh)
2014-11-08 00:14:08 +00:00
Michael Crosby ed556fb38f Update docker with syncpipe changes
We removed the syncpipe package and replaced it with specific calls to
create a new *os.File from a specified fd passed to the process.  This
reduced code and an extra object to manage the container's init
lifecycle.

Signed-off-by: Michael Crosby <crosbymichael@gmail.com>
2014-11-06 01:14:13 +00:00
unclejack acd64278f1 pkg/reexec: move reexec code to a new package
Docker-DCO-1.1-Signed-off-by: Cristian Staretu <cristian.staretu@gmail.com> (github: unclejack)
2014-10-30 14:48:30 +02:00
Andrea Luzzardi 88e21c6a75 Support for consistent MAC address.
Right now, MAC addresses are randomly generated by the kernel when
creating the veth interfaces.

This causes different issues related to ARP, such as #4581, #5737 and #8269.

This change adds support for consistent MAC addresses, guaranteeing that
an IP address will always end up with the same MAC address, no matter
what.

Since IP addresses are already guaranteed to be unique by the
IPAllocator, MAC addresses will inherit this property as well for free.

Consistent mac addresses is also a requirement for stable networking (#8297)
since re-using the same IP address on a different MAC address triggers the ARP
issue.

Finally, this change makes the MAC address accessible through docker
inspect, which fixes #4033.

Signed-off-by: Andrea Luzzardi <aluzzardi@gmail.com>
2014-10-03 13:22:38 -07:00
Andrea Luzzardi d40ab6f123 Merge pull request #8299 from vieux/pr_7425
Add --security-opts options to allow user to customize container labels and apparmor profile
2014-09-30 17:53:11 -07:00
Victor Vieux c2c5e57a8e add apparmor:
Signed-off-by: Victor Vieux <vieux@docker.com>
2014-09-30 00:43:47 +00:00
Tianon Gravi 07179a7eb1 Merge pull request #8293 from crosbymichael/update-libcontainer-sep8
Update libcontainer to c744f6470e37be5ce1f1ae09b842c15c1bee120d
2014-09-29 18:09:25 -06:00
Michael Crosby 32dca1a7b0 Strongly type exec driver context
This also removes dead code in the native driver for a past feature that
was never fully implemented.

Signed-off-by: Michael Crosby <crosbymichael@gmail.com>
2014-09-29 22:40:26 +00:00
Michael Crosby 532c29ef7d Update native driver to set RootFs
Signed-off-by: Michael Crosby <crosbymichael@gmail.com>
2014-09-29 21:35:25 +00:00
Alexandr Morozov 623ebf203b Persistent directory for container in execdriver
This is needed for persistent namespaces

Signed-off-by: Alexandr Morozov <lk4d4math@gmail.com>
2014-09-22 22:48:26 +04:00
Alexandr Morozov 00fd008170 Merge pull request #8062 from vishh/run_in_phase2
Add support for 'docker exec' - phase 2
2014-09-16 23:56:12 +04:00
Vishnu Kannan 669561c2aa Address review comments.
Docker-DCO-1.1-Signed-off-by: Vishnu Kannan <vishnuk@google.com> (github: vishh)
2014-09-15 17:00:00 +00:00
Vishnu Kannan e1cf95b593 Import nsenter in docker.
Docker-DCO-1.1-Signed-off-by: Vishnu Kannan <vishnuk@google.com> (github: vishh)
2014-09-15 16:59:05 +00:00
Vishnu Kannan 5130fe5d38 Adding support for docker exec in daemon.
Docker-DCO-1.1-Signed-off-by: Vishnu Kannan <vishnuk@google.com> (github: vishh)
2014-09-15 16:57:52 +00:00
Vishnu Kannan f3c767d798 Adding Exec method to native execdriver.
Modified Attach() method to support docker exec.

Docker-DCO-1.1-Signed-off-by: Vishnu Kannan <vishnuk@google.com> (github: vishh)
2014-09-15 16:57:52 +00:00
Erik Hollensbe 09b700288e Allow /etc/hosts and /etc/resolv.conf to be updated both outside and
inside the container.

Docker-DCO-1.1-Signed-off-by: Erik Hollensbe <github@hollensbe.org> (github: erikh)
2014-09-13 11:27:34 -07:00
Michael Crosby 688741df31 Update mount struct with reference
Signed-off-by: Michael Crosby <crosbymichael@gmail.com>
2014-09-01 15:18:30 -07:00
Vishnu Kannan 3a7e07355a Rename 'StdConfig' to 'StreamConfig'.
Docker-DCO-1.1-Signed-off-by: Vishnu Kannan <vishnuk@google.com> (github: vishh)
2014-09-01 14:31:01 -07:00
Vishnu Kannan 4aa5da278f Refactoring execdriver.Command and Container structs to support 'docker exec' and other
similar features in the future.

Docker-DCO-1.1-Signed-off-by: Vishnu Kannan <vishnuk@google.com> (github: vishh)
2014-09-01 14:30:16 -07:00
Alexandr Morozov 391c35c822
Fix go vet warnings
Signed-off-by: Alexandr Morozov <lk4d4math@gmail.com>
2014-08-13 11:37:30 +04:00
Victor Vieux b06311a72e fix goroutines leak and exit code
Docker-DCO-1.1-Signed-off-by: Victor Vieux <vieux@docker.com> (github: vieux)

Signed-off-by: Victor Vieux <vieux@docker.com>
2014-08-13 00:03:56 +00:00
Michael Crosby 7321067176 Use argv0 as reexec implementation for dockerinit
This changes the way the exec drivers work by not specifing a -driver
flag on reexec.  For each of the exec  drivers they register their own
functions that will be matched aginst the argv 0 on exec and called if
they match.

This also allows any functionality to be added to docker so that the
binary can be reexec'd and any type of function can be called.  I moved
the flag parsing on docker exec to the specific initializers so that the
implementations do not bleed into one another.  This also allows for
more flexability within reexec initializers to specify their own flags
and options.

Signed-off-by: Michael Crosby <michael@docker.com>
2014-08-11 11:47:21 -07:00
Alexandr Morozov 93f6cf0351 Catch error on console creation
Signed-off-by: Alexandr Morozov <lk4d4math@gmail.com>
2014-08-09 22:10:44 +04:00
Tianon Gravi 60341f80d7 Purge the bits of pkg/system that moved to libcontainer/system
Signed-off-by: Andrew Page <admwiggin@gmail.com>
2014-08-02 01:35:04 -06:00
Victor Vieux 5a0ef08c94 gofmt -s -w
Docker-DCO-1.1-Signed-off-by: Victor Vieux <vieux@docker.com> (github: vieux)
2014-07-24 22:25:29 +00:00
Victor Vieux b3ee9ac74e update go import path and libcontainer
Docker-DCO-1.1-Signed-off-by: Victor Vieux <vieux@docker.com> (github: vieux)
2014-07-24 22:19:50 +00:00
Alexandr Morozov 29ecc95c31 Add AUDIT_WRITE cap
Fixes #6345

Thanks @larsks for outstanding investigation

Docker-DCO-1.1-Signed-off-by: Alexandr Morozov <lk4d4math@gmail.com> (github: LK4D4)
2014-07-23 09:57:41 +04:00
Michael Crosby 7a8ea91392 Fix cross compile non cgo and linux systems
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@docker.com> (github: crosbymichael)
2014-07-16 16:57:49 -07:00
Michael Crosby 0d67b420b5 Make tty term exec driver specific
lxc is special in that we cannot create the master outside of the
container without opening the slave because we have nothing to provide to the
cmd.  We have to open both then do the crazy setup on command right now instead of
passing the console path to lxc and telling it to open up that console.  we save a couple of
openfiles in the native driver because we can do this.
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@docker.com> (github: crosbymichael)
2014-07-16 16:57:49 -07:00
Michael Crosby 1501c342d8 Don't create pty slave in the daemon for native driver
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@docker.com> (github: crosbymichael)
2014-07-16 16:57:19 -07:00
Michael Crosby f00e643576 Update native driver for libcontainer changes
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@docker.com> (github: crosbymichael)
2014-07-14 12:49:50 -07:00
Michael Crosby 7ebd49c49a Merge pull request #6968 from vieux/cap_add_drop
Add support for --cap-add and --cap-drop
2014-07-14 10:42:29 -07:00
Victor Vieux c04230c42b add check for invalid caps
Docker-DCO-1.1-Signed-off-by: Victor Vieux <vieux@docker.com> (github: vieux)
2014-07-11 23:43:21 +00:00
Victor Vieux f3ff323fb3 small refactoring
Docker-DCO-1.1-Signed-off-by: Victor Vieux <vieux@docker.com> (github: vieux)
2014-07-11 23:43:21 +00:00
Victor Vieux 94e6dc9781 Basic --cap-add and --cap-drop support for native
Docker-DCO-1.1-Signed-off-by: Victor Vieux <vieux@docker.com> (github: vieux)
2014-07-11 23:43:21 +00:00
Victor Vieux e8762bfe39 add FSETID back to the caps whitelist
Docker-DCO-1.1-Signed-off-by: Victor Vieux <vieux@docker.com> (github: vieux)
2014-07-11 00:30:56 +00:00
Victor Vieux d403936818 fix compilation and panic
Docker-DCO-1.1-Signed-off-by: Victor Vieux <vieux@docker.com> (github: vieux)
2014-07-02 00:54:08 +00:00
Tibor Vass cccb64e863 Add backwards READ compatibility for the old libcontainer API
Docker-DCO-1.1-Signed-off-by: Tibor Vass <teabee89@gmail.com> (github: tiborvass)
2014-07-02 00:19:05 +00:00
Tibor Vass 262d45e0fe Use new libcontainer.State API
Docker-DCO-1.1-Signed-off-by: Tibor Vass <teabee89@gmail.com> (github: tiborvass)
2014-06-30 18:27:15 -04:00
Michael Crosby c9fdb08bda Update libcontainer Context changes
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@docker.com> (github: crosbymichael)
2014-06-26 16:56:39 -07:00
Michael Crosby 1dc8e2ffab Rename libcontainer.Container to libcontainer.Config
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@docker.com> (github: crosbymichael)
2014-06-24 11:31:03 -07:00
Michael Crosby cee6f4506c Update libcontainer references
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@docker.com> (github: crosbymichael)
2014-06-24 11:31:03 -07:00
Michael Crosby 8194556337 Update libcontainer imports
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-06-10 19:58:15 -07:00
Michael Crosby bae6a5a616 Gofmt imports
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-06-09 16:01:57 -07:00
Michael Crosby 6158ccad97 Move libcontainer deps into libcontainer
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-06-09 15:52:12 -07:00
Michael Crosby fa72eb3a58 Add CAP_KILL to unprivileged containers
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-06-07 15:18:18 -07:00
Victor Vieux 30ba7546cb add wait4 after kill
Docker-DCO-1.1-Signed-off-by: Victor Vieux <vieux@docker.com> (github: vieux)
2014-06-06 00:32:14 +00:00
Michael Crosby 8aff01c0b4 Rename nsinit package to namespaces in libcontainer
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-06-04 15:47:57 -07:00
Chris Alfonso 26246ebd53 Integrating systemd freeze functionality.
This pulls together #6061 and #6125

Docker-DCO-1.1-Signed-off-by: Chris Alfonso <calfonso@redhat.com> (github: calfonso)
2014-06-04 13:33:44 -06:00
Ian Main b054569cde Add ability to pause/unpause containers via cgroups freeze
This patch adds pause/unpause to the command line, api, and drivers
for use on containers.  This is implemented using the cgroups/freeze
utility in libcontainer and lxc freeze/unfreeze.

Co-Authored-By: Eric Windisch <ewindisch@docker.com>
Co-Authored-By: Chris Alfonso <calfonso@redhat.com>
Docker-DCO-1.1-Signed-off-by: Ian Main <imain@redhat.com> (github: imain)
2014-06-04 13:33:44 -06:00
unclejack 1ef3ca83d8 apparmor: write & load the profile on every start
Docker-DCO-1.1-Signed-off-by: Cristian Staretu <cristian.staretu@gmail.com> (github: unclejack)
2014-06-04 00:56:35 +03:00
Michael Crosby 41f7cef2bd Add SYS_CHROOT cap to unprivileged containers
Fixes #6103
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-06-02 18:23:47 -07:00
Michael Crosby 69989b7c06 Ensure all dev nodes are copied for privileged
This also makes sure that devices are pointers to avoid copies
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-05-30 18:39:11 -07:00
unclejack 0ef637722f Merge pull request #6097 from timthelion/consistentdevices
Refactor device handling code
2014-05-31 03:34:52 +03:00
Timothy Hobbs 608702b980 Refactor device handling code
We now have one place that keeps track of (most) devices that are allowed and created within the container.  That place is pkg/libcontainer/devices/devices.go

This fixes several inconsistencies between which devices were created in the lxc backend and the native backend.  It also fixes inconsistencies between wich devices were created and which were allowed.  For example, /dev/full was being created but it was not allowed within the cgroup.  It also declares the file modes and permissions of the default devices, rather than copying them from the host.  This is in line with docker's philosphy of not being host dependent.

Docker-DCO-1.1-Signed-off-by: Timothy Hobbs <timothyhobbs@seznam.cz> (github: https://github.com/timthelion)
2014-05-30 19:21:29 +00:00
Alexandr Morozov 64bd6a6a53 Fix race in native driver on activeContainers usage
Docker-DCO-1.1-Signed-off-by: Alexandr Morozov <lk4d4math@gmail.com> (github: LK4D4)
2014-05-30 14:16:00 +04:00
Victor Vieux 0abb52c7a9 add recursive device nodes
Docker-DCO-1.1-Signed-off-by: Victor Vieux <vieux@docker.com> (github: vieux)
2014-05-22 22:29:13 +00:00
Victor Vieux 55d41c3e21 Merge pull request #5976 from crosbymichael/getpids
Move get pid into cgroup implementation
2014-05-21 19:09:50 -07:00
Michael Crosby 811d93326b Move get pid into cgroup implementation
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-05-21 21:14:07 +00:00
Michael Crosby f042c3c157 Update code post codereview
Add specific types for Required and Optional DeviceNodes
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-05-21 00:40:41 +00:00
Michael Crosby 34c05c58c8 Mount /dev in tmpfs for privileged containers
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-05-20 22:51:24 +00:00
Alexander Larsson fcf2e9a910 native driver: Add required capabilities
We need SETFCAP to be able to mark files as having caps, which is
heavily used by fedora.
See https://github.com/dotcloud/docker/issues/5928

We also need SETPCAP, for instance systemd needs this to set caps
on its childen.

Both of these are safe in the sense that they can never ever
result in a process with a capability not in the bounding set of the
container.

We also add NET_BIND_SERVICE caps, to be able to bind to ports lower
than 1024.

Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
2014-05-20 11:31:39 +02:00
Victor Marmol 0abad3ae22 Don't drop CAP_FOWNER in the container. Also sorts the list of allowed
capabilities.

Docker-DCO-1.1-Signed-off-by: Victor Marmol <vmarmol@google.com> (github: vmarmol)
2014-05-19 16:52:39 +00:00
Victor Marmol 92614928ce Make libcontainer's CapabilitiesMask into a []string (Capabilities).
Docker-DCO-1.1-Signed-off-by: Victor Marmol <vmarmol@google.com> (github: vmarmol)
2014-05-17 00:44:10 +00:00
Victor Marmol 01d10d6f13 Merge pull request #5810 from vmarmol/drop-caps
Change libcontainer to drop all capabilities by default.
2014-05-16 11:51:41 -07:00
Victor Marmol 9d6875d19d Change libcontainer to drop all capabilities by default. Only keeps
those that were specified in the config. This commit also explicitly
adds a set of capabilities that we were silently not dropping and were
assumed by the tests.

Docker-DCO-1.1-Signed-off-by: Victor Marmol <vmarmol@google.com> (github: vmarmol)
2014-05-16 00:57:58 +00:00
Michael Crosby 3b7a19def6 Move cgroups package into libcontainer
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-05-14 15:21:44 -07:00
Victor Vieux bc22c9948c Merge pull request #5756 from crosbymichael/move-units-to-pkg
Move duration and size to units pkg
2014-05-14 11:36:14 -07:00
Michael Crosby adbe3096e8 Add cpuset cpus support for docker
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-05-13 18:17:12 -07:00
Michael Crosby d33b4655c4 Move duration and size to units pkg
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-05-12 17:05:07 -07:00
Michael Crosby 62e8ddb579 Set container pid for process in native driver
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-05-06 17:04:04 -07:00
Guillaume J. Charmes 0b15944cb0 Merge pull request #5354 from alexlarsson/cgroups-systemd-fixes
cgroups: Update systemd to match fs backend
2014-05-05 16:00:56 -07:00
Michael Crosby 01fec73ba4 Update after namespace refactor
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-05-05 13:56:18 -07:00
Guillaume J. Charmes 70fef1460a Merge pull request #4441 from crosbymichael/add-net-flag
Add --net flag to docker run and allow host network stack
2014-05-05 13:54:55 -07:00
Michael Crosby db5f6b4aa0 Improve libcontainer namespace and cap format
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-05-05 12:34:21 -07:00
Alexander Larsson 5b094530c0 cgroups: Update systemd to match fs backend
This updates systemd.Apply to match the fs backend by:
* Always join blockio controller (for stats)
* Support CpusetCpus
* Support MemorySwap

Also, it removes the generic UnitProperties in favour of a single
option to set the slice.

Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
2014-05-05 20:06:44 +02:00
Michael Crosby a785882b29 Setup host networking for lxc and native
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-05-05 10:08:59 -07:00
Johan Euphrosine a60159f3b1 runconfig: add -net container:name option
Docker-DCO-1.1-Signed-off-by: Johan Euphrosine <proppy@google.com> (github: proppy)
2014-05-05 10:08:59 -07:00
Michael Crosby f5139233b9 Update restrictions for better handling of mounts
This also cleans up some of the left over restriction paths code from
before.
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-05-01 15:26:58 -07:00
Jérôme Petazzoni 1c4202a614 Mount /proc and /sys read-only, except in privileged containers.
It has been pointed out that some files in /proc and /sys can be used
to break out of containers. However, if those filesystems are mounted
read-only, most of the known exploits are mitigated, since they rely
on writing some file in those filesystems.

This does not replace security modules (like SELinux or AppArmor), it
is just another layer of security. Likewise, it doesn't mean that the
other mitigations (shadowing parts of /proc or /sys with bind mounts)
are useless. Those measures are still useful. As such, the shadowing
of /proc/kcore is still enabled with both LXC and native drivers.

Special care has to be taken with /proc/1/attr, which still needs to
be mounted read-write in order to enable the AppArmor profile. It is
bind-mounted from a private read-write mount of procfs.

All that enforcement is done in dockerinit. The code doing the real
work is in libcontainer. The init function for the LXC driver calls
the function from libcontainer to avoid code duplication.

Docker-DCO-1.1-Signed-off-by: Jérôme Petazzoni <jerome@docker.com> (github: jpetazzo)
2014-05-01 15:26:58 -07:00
Eiichi Tsukata cac0cea03f drop CAP_SYSLOG capability
Kernel capabilities for privileged syslog operations are currently splitted into
CAP_SYS_ADMIN and CAP_SYSLOG since the following commit:
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=ce6ada35bdf710d16582cc4869c26722547e6f11

This patch drops CAP_SYSLOG to prevent containers from messing with
host's syslog (e.g. `dmesg -c` clears up host's printk ring buffer).

Closes #5491

Docker-DCO-1.1-Signed-off-by: Eiichi Tsukata <devel@etsukata.com> (github: Etsukata)
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-05-01 11:43:55 -07:00
Michael Crosby da0d6dbd7b Make native driver use Exec func with different CreateCommand
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-04-30 18:49:24 -07:00
Michael Crosby 60e4276f5a Integrate new structure into docker's native driver
This duplicates some of the Exec code but I think it it worth it because
the native driver is more straight forward and does not have the
complexity have handling the type issues for now.
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-04-30 18:20:01 -07:00
Michael Crosby f110401437 Remove statewriter interface, export more libcontainer funcs
This temp. expands the Exec method's signature but adds a more robust
way to know when the container's process is actually released and begins
to run.  The network interfaces are not guaranteed to be up yet but this
provides a more accurate view with a single callback at this time.
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-04-30 15:52:40 -07:00
Michael Crosby 162dafbcd5 Remove logger from nsinit struct
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-04-30 15:24:18 -07:00
Michael Crosby f0e6e135a8 Initial work on selinux patch
This has every container using the docker daemon's pid for the processes
label so it does not work correctly.
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-04-29 03:40:05 -07:00
unclejack 44140f7909 Merge pull request #5411 from crosbymichael/lockdown
Update default restrictions for exec drivers
2014-04-26 03:27:56 +03:00
Victor Marmol f188b9f623 Separating cgroup Memory and MemoryReservation.
This will allow for these to be set independently. Keep the current Docker behavior where Memory and MemoryReservation are set to the value of Memory.

Docker-DCO-1.1-Signed-off-by: Victor Marmol <vmarmol@google.com> (github: vmarmol)
2014-04-24 11:09:38 -07:00
Michael Crosby 2d6c367434 Increment native driver version with these changes
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-04-24 10:35:20 -07:00
Michael Crosby 5ba1242bdc Mount over dev and only copy allowed nodes in
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-04-24 10:35:20 -07:00
Michael Crosby 81e5026a6a No not mount sysfs by default for non privilged containers
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-04-24 10:35:20 -07:00
Michael Crosby 60a90970bc Add restrictions to proc in libcontainer
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-04-24 10:35:19 -07:00
Guillaume J. Charmes 813cebc64f
Merge branch 'master' into load-profile
Conflicts:
	daemon/execdriver/native/create.go
	daemon/execdriver/native/driver.go

Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume@charmes.net> (github: creack)
2014-04-21 10:32:13 -07:00
Alexander Larsson 359b7df5d2 Rename runtime/* to daemon/*
Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
2014-04-17 14:43:01 -07:00