9e3da87a3a
Cleanup some statements from exec driver work
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-02-14 17:28:50 -08:00
408ea0771a
Mount-bind the PTY as container console - allow for tmux/screen to run
...
Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume.charmes@docker.com> (github: creack)
2014-02-13 17:23:09 -08:00
3c215ba410
Merge pull request #4059 from alexlarsson/no-netadmin-caps
...
lxc: Drop NET_ADMIN capability in non-privileged containers
2014-02-11 14:20:34 -05:00
02fddffd51
lxc: Drop NET_ADMIN capability in non-privileged containers
...
With this capability set the container can e.g. change the ip address
of his devices to that of another container on the docker0 bridge. In
a quick test I was able to listen to a port on a different ip than the
one docker assigned me, but was not able to hijack an open port
redirection that another container had open. Maybe its possible with
some more knowledge of networking though.
Anyway, network setup is meant to be handled by docker, not the apps,
so I believe denying this is generally in the spirit of docker, and
it closes down potential security issues.
Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
2014-02-11 11:17:34 +01:00
2dcb48af0f
Merge pull request #3524 from tianon/supplementary-groups
...
Add supplementary groups lookup in sysinit
2014-02-10 14:42:14 -08:00
036900a63a
Merge pull request #3871 from jdef/patch-1
...
Update lxc_template.go
2014-02-10 14:38:39 -08:00
7c06d5e34e
Remove panic in lxc driver.
...
Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume.charmes@docker.com> (github: creack)
2014-02-07 19:09:52 -08:00
17c124baf6
Update lxc_template.go
...
If networking is disabled, but then pipework is used later to add nics, the network still doesn't function. Using flags=up for empty networking fixes this.
Docker-DCO-1.1-Signed-off-by: James DeFelice <james.defelice@ishisystems.com> (github: jdef)
2014-02-03 16:14:15 -05:00
ee93f6185b
Move UserLookup functionality into a separate pkg/user submodule that implements proper parsing of /etc/passwd and /etc/group, and use that to add support for "docker run -u user:group" and for getting supplementary groups (if ":group" is not specified)
...
Docker-DCO-1.1-Signed-off-by: Andrew Page <admwiggin@gmail.com> (github: tianon)
2014-01-31 20:15:24 -07:00
523341d994
Merge pull request #3857 from creack/remove_darwin_files
...
Remove all darwin specific files and use more generic _unsupported with build tags.
2014-01-31 11:48:10 -08:00
f267938fb8
Merge pull request #3844 from clkao/lxc-kill-deprecation
...
Use lxc-stop -k instead of lxc-kill
2014-01-31 10:57:40 -08:00
065dd231dd
Update/fix build tags, Dockerfile, and release.sh for proper building and releasing of linux/386 and linux/arm cross-compiled client binaries
...
Docker-DCO-1.1-Signed-off-by: Andrew Page <admwiggin@gmail.com> (github: tianon)
2014-01-31 03:16:42 -07:00
45dd051e8e
Remove all darwin specific files and use more generic _unsupported with build tags.
...
Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume.charmes@docker.com> (github: creack)
2014-01-30 23:10:56 +00:00
720f64af18
fix TestExitCode
...
Docker-DCO-1.1-Signed-off-by: Victor Vieux <victor.vieux@docker.com> (github: vieux)
2014-01-30 22:59:21 +00:00
b111fc3646
Use lxc-stop -k when lxc-kill is not found
...
lxc-kill was removed in lxc/lxc@33ddfc2
Docker-DCO-1.1-Signed-off-by: Chia-liang Kao <clkao@clkao.org> (github: clkao)
2014-01-31 03:22:22 +08:00
c00cb1aca1
Merge pull request #3808 from alexlarsson/execdriver-get-pids-for-container
...
execdriver: Make GetPidsForContainer() a driver call
2014-01-29 10:38:10 -08:00
9ad70528b7
exexdriver: Make Command.GetExitCode an internal call
...
This code only works for backends that directly spawn the child
via the Command. It will not work for the libvirt backend. So
we move this code into the individual backends that need it.
Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
2014-01-28 19:20:35 +01:00
335bc39c9a
execdriver: Make GetPidsForContainer() a driver call
...
The current implementation is lxc specific.
Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
2014-01-28 16:21:49 +01:00
0dd856ee7f
Merge pull request #3724 from creack/extract-lxc-phase-2
...
Refactor process to command
2014-01-23 15:28:45 -08:00
ba8ca59862
Compile driver interface changes
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-01-22 14:05:01 -08:00
75e0357d69
Populate Command self cointainer (toward Restore())
...
Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume.charmes@docker.com> (github: creack)
2014-01-22 14:04:55 -08:00
08ab554195
Fix handling of shared roots
...
If rootIsShared() is detected we apply the shell stuff to early, before
the real command and arguments are added to the parameters. This
means they get passed on to unshare rather than docker-init, breaking
docker on e.g. fedora like:
goroutine 1 [running]:
runtime.panic(0x678340, 0x9b3fd7)
/usr/lib64/golang/src/pkg/runtime/panic.c:266 +0xb6
github.com/dotcloud/docker/execdriver/lxc.func·001(0xc21000a1b0, 0xc21001eab0, 0x7fff24715faf)
/home/alex/vcs/go/src/github.com/dotcloud/docker/execdriver/lxc/driver.go:41 +0x525
github.com/dotcloud/docker/sysinit.executeProgram(0xc21000a1b0, 0xc21000a1b0, 0xa)
/home/alex/vcs/go/src/github.com/dotcloud/docker/sysinit/sysinit.go:34 +0xca
github.com/dotcloud/docker/sysinit.SysInit()
/home/alex/vcs/go/src/github.com/dotcloud/docker/sysinit/sysinit.go:88 +0x791
main.main()
/home/alex/vcs/go/src/github.com/dotcloud/docker/dockerinit/dockerinit.go:14 +0x1a
The fix is to construct the full params array before escaping it.
Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
2014-01-21 10:22:13 +01:00
12468f2bc8
Rename Process to Command
...
Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume.charmes@docker.com> (github: creack)
2014-01-20 16:05:07 -08:00
71c1646ba3
Don't expose cgroups via the execdriver API.
...
Use Resources to represent container limits rather than a cgroup specific field.
Docker-DCO-1.1-Signed-off-by: Paul Nasrat <pnasrat@gmail.com> (github: pnasrat)
2014-01-20 17:06:24 -05:00
2553029959
Extract cgroups pkg.
...
Initial move before enhancing cgroups package.
Docker-DCO-1.1-Signed-off-by: Paul Nasrat <pnasrat@gmail.com> (github: pnasrat)
2014-01-20 14:15:44 -05:00
2e094db639
Extract mount into pkg.
...
Mount is self contained and generic, it should be in pkg, to allow other pkg modules to use it.
Docker-DCO-1.1-Signed-off-by: Paul Nasrat <pnasrat@gmail.com> (github: pnasrat)
2014-01-20 13:59:29 -05:00
d5112ffce6
Fix rebase for init error
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-01-17 17:42:58 -08:00
5c30c4379a
Add todos for driver changes
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-01-17 17:42:58 -08:00
97c8450705
Make sure drivers are registerd within sysinit
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-01-17 17:42:58 -08:00
cdfebc2a20
Change drvier name to append version
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-01-17 17:42:58 -08:00
70a5cb95b3
Move lxc template into lxc driver
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-01-17 17:42:58 -08:00
ca8dd73fbf
Small fixes to type names
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-01-17 17:42:22 -08:00
889b4b10ae
Cleanup + add Info to driver in order to have specific IsRunning()
...
Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume.charmes@docker.com> (github: creack)
Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume.charmes@docker.com> (github: crosbymichael)
2014-01-17 17:42:22 -08:00
f7684ea7f6
Move docker init into drivers functions
...
Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume.charmes@docker.com> (github: creack)
Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume.charmes@docker.com> (github: crosbymichael)
2014-01-17 17:42:22 -08:00
8c9f62d037
Improve wait for lxc and driver interface
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-01-17 17:42:22 -08:00
e765c67b47
Add json tags and comments to exedriver types
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-01-17 17:42:22 -08:00
f3f2456b04
Simplify chroot wait, address code review issues
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-01-17 17:42:22 -08:00
1e81387edc
Remove SysinitPath from process
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-01-17 17:42:22 -08:00
f846ecdc77
Make exec driver run a blocking command
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-01-17 17:42:22 -08:00
92e6db7beb
Improve chroot driver by mounting proc
...
Add -driver flag to dockerinit
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-01-17 17:42:22 -08:00
8e0741f5e4
Add chroot driver for testing
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-01-17 17:42:22 -08:00
1d8455e683
Move RootIsShared to lxc driver
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-01-17 17:42:22 -08:00
93ead2fe78
Update with lxc unconfined changes
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-01-17 17:42:22 -08:00
77936ba1a1
Fix race in set running
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-01-17 17:42:22 -08:00
ad9710685c
Fix race in TestRun
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-01-17 17:42:22 -08:00
8b60273f76
Update with container specific waitLock
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-01-17 17:42:22 -08:00
8e87835968
Rework monitor and waitlock inside of driver
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-01-17 17:42:22 -08:00
5a3d9bd432
WIP complete integration test run
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-01-17 17:42:21 -08:00
1c1cf54b0a
Fix tty set issue for ioctl error
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-01-17 17:42:21 -08:00
5573c744e4
Embed exec.Cmd on Process
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-01-17 17:42:21 -08:00
Michael Crosby
Guillaume J. Charmes
Alexander Larsson
Victor Vieux
James DeFelice
Tianon Gravi
Chia-liang Kao
Paul Nasrat