5a0ef08c94
gofmt -s -w
...
Docker-DCO-1.1-Signed-off-by: Victor Vieux <vieux@docker.com> (github: vieux)
2014-07-24 22:25:29 +00:00
b3ee9ac74e
update go import path and libcontainer
...
Docker-DCO-1.1-Signed-off-by: Victor Vieux <vieux@docker.com> (github: vieux)
2014-07-24 22:19:50 +00:00
29ecc95c31
Add AUDIT_WRITE cap
...
Fixes #6345
Thanks @larsks for outstanding investigation
Docker-DCO-1.1-Signed-off-by: Alexandr Morozov <lk4d4math@gmail.com> (github: LK4D4)
2014-07-23 09:57:41 +04:00
7a8ea91392
Fix cross compile non cgo and linux systems
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@docker.com> (github: crosbymichael)
2014-07-16 16:57:49 -07:00
0d67b420b5
Make tty term exec driver specific
...
lxc is special in that we cannot create the master outside of the
container without opening the slave because we have nothing to provide to the
cmd. We have to open both then do the crazy setup on command right now instead of
passing the console path to lxc and telling it to open up that console. we save a couple of
openfiles in the native driver because we can do this.
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@docker.com> (github: crosbymichael)
2014-07-16 16:57:49 -07:00
1501c342d8
Don't create pty slave in the daemon for native driver
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@docker.com> (github: crosbymichael)
2014-07-16 16:57:19 -07:00
f00e643576
Update native driver for libcontainer changes
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@docker.com> (github: crosbymichael)
2014-07-14 12:49:50 -07:00
7ebd49c49a
Merge pull request #6968 from vieux/cap_add_drop
...
Add support for --cap-add and --cap-drop
2014-07-14 10:42:29 -07:00
c04230c42b
add check for invalid caps
...
Docker-DCO-1.1-Signed-off-by: Victor Vieux <vieux@docker.com> (github: vieux)
2014-07-11 23:43:21 +00:00
f3ff323fb3
small refactoring
...
Docker-DCO-1.1-Signed-off-by: Victor Vieux <vieux@docker.com> (github: vieux)
2014-07-11 23:43:21 +00:00
94e6dc9781
Basic --cap-add and --cap-drop support for native
...
Docker-DCO-1.1-Signed-off-by: Victor Vieux <vieux@docker.com> (github: vieux)
2014-07-11 23:43:21 +00:00
e8762bfe39
add FSETID back to the caps whitelist
...
Docker-DCO-1.1-Signed-off-by: Victor Vieux <vieux@docker.com> (github: vieux)
2014-07-11 00:30:56 +00:00
d403936818
fix compilation and panic
...
Docker-DCO-1.1-Signed-off-by: Victor Vieux <vieux@docker.com> (github: vieux)
2014-07-02 00:54:08 +00:00
cccb64e863
Add backwards READ compatibility for the old libcontainer API
...
Docker-DCO-1.1-Signed-off-by: Tibor Vass <teabee89@gmail.com> (github: tiborvass)
2014-07-02 00:19:05 +00:00
262d45e0fe
Use new libcontainer.State API
...
Docker-DCO-1.1-Signed-off-by: Tibor Vass <teabee89@gmail.com> (github: tiborvass)
2014-06-30 18:27:15 -04:00
c9fdb08bda
Update libcontainer Context changes
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@docker.com> (github: crosbymichael)
2014-06-26 16:56:39 -07:00
1dc8e2ffab
Rename libcontainer.Container to libcontainer.Config
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@docker.com> (github: crosbymichael)
2014-06-24 11:31:03 -07:00
cee6f4506c
Update libcontainer references
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@docker.com> (github: crosbymichael)
2014-06-24 11:31:03 -07:00
8194556337
Update libcontainer imports
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-06-10 19:58:15 -07:00
bae6a5a616
Gofmt imports
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-06-09 16:01:57 -07:00
6158ccad97
Move libcontainer deps into libcontainer
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-06-09 15:52:12 -07:00
fa72eb3a58
Add CAP_KILL to unprivileged containers
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-06-07 15:18:18 -07:00
30ba7546cb
add wait4 after kill
...
Docker-DCO-1.1-Signed-off-by: Victor Vieux <vieux@docker.com> (github: vieux)
2014-06-06 00:32:14 +00:00
8aff01c0b4
Rename nsinit package to namespaces in libcontainer
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-06-04 15:47:57 -07:00
26246ebd53
Integrating systemd freeze functionality.
...
This pulls together #6061 and #6125
Docker-DCO-1.1-Signed-off-by: Chris Alfonso <calfonso@redhat.com> (github: calfonso)
2014-06-04 13:33:44 -06:00
b054569cde
Add ability to pause/unpause containers via cgroups freeze
...
This patch adds pause/unpause to the command line, api, and drivers
for use on containers. This is implemented using the cgroups/freeze
utility in libcontainer and lxc freeze/unfreeze.
Co-Authored-By: Eric Windisch <ewindisch@docker.com>
Co-Authored-By: Chris Alfonso <calfonso@redhat.com>
Docker-DCO-1.1-Signed-off-by: Ian Main <imain@redhat.com> (github: imain)
2014-06-04 13:33:44 -06:00
1ef3ca83d8
apparmor: write & load the profile on every start
...
Docker-DCO-1.1-Signed-off-by: Cristian Staretu <cristian.staretu@gmail.com> (github: unclejack)
2014-06-04 00:56:35 +03:00
41f7cef2bd
Add SYS_CHROOT cap to unprivileged containers
...
Fixes #6103
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-06-02 18:23:47 -07:00
69989b7c06
Ensure all dev nodes are copied for privileged
...
This also makes sure that devices are pointers to avoid copies
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-05-30 18:39:11 -07:00
0ef637722f
Merge pull request #6097 from timthelion/consistentdevices
...
Refactor device handling code
2014-05-31 03:34:52 +03:00
608702b980
Refactor device handling code
...
We now have one place that keeps track of (most) devices that are allowed and created within the container. That place is pkg/libcontainer/devices/devices.go
This fixes several inconsistencies between which devices were created in the lxc backend and the native backend. It also fixes inconsistencies between wich devices were created and which were allowed. For example, /dev/full was being created but it was not allowed within the cgroup. It also declares the file modes and permissions of the default devices, rather than copying them from the host. This is in line with docker's philosphy of not being host dependent.
Docker-DCO-1.1-Signed-off-by: Timothy Hobbs <timothyhobbs@seznam.cz> (github: https://github.com/timthelion )
2014-05-30 19:21:29 +00:00
64bd6a6a53
Fix race in native driver on activeContainers usage
...
Docker-DCO-1.1-Signed-off-by: Alexandr Morozov <lk4d4math@gmail.com> (github: LK4D4)
2014-05-30 14:16:00 +04:00
0abb52c7a9
add recursive device nodes
...
Docker-DCO-1.1-Signed-off-by: Victor Vieux <vieux@docker.com> (github: vieux)
2014-05-22 22:29:13 +00:00
55d41c3e21
Merge pull request #5976 from crosbymichael/getpids
...
Move get pid into cgroup implementation
2014-05-21 19:09:50 -07:00
811d93326b
Move get pid into cgroup implementation
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-05-21 21:14:07 +00:00
f042c3c157
Update code post codereview
...
Add specific types for Required and Optional DeviceNodes
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-05-21 00:40:41 +00:00
34c05c58c8
Mount /dev in tmpfs for privileged containers
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-05-20 22:51:24 +00:00
fcf2e9a910
native driver: Add required capabilities
...
We need SETFCAP to be able to mark files as having caps, which is
heavily used by fedora.
See https://github.com/dotcloud/docker/issues/5928
We also need SETPCAP, for instance systemd needs this to set caps
on its childen.
Both of these are safe in the sense that they can never ever
result in a process with a capability not in the bounding set of the
container.
We also add NET_BIND_SERVICE caps, to be able to bind to ports lower
than 1024.
Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
2014-05-20 11:31:39 +02:00
0abad3ae22
Don't drop CAP_FOWNER in the container. Also sorts the list of allowed
...
capabilities.
Docker-DCO-1.1-Signed-off-by: Victor Marmol <vmarmol@google.com> (github: vmarmol)
2014-05-19 16:52:39 +00:00
92614928ce
Make libcontainer's CapabilitiesMask into a []string (Capabilities).
...
Docker-DCO-1.1-Signed-off-by: Victor Marmol <vmarmol@google.com> (github: vmarmol)
2014-05-17 00:44:10 +00:00
01d10d6f13
Merge pull request #5810 from vmarmol/drop-caps
...
Change libcontainer to drop all capabilities by default.
2014-05-16 11:51:41 -07:00
9d6875d19d
Change libcontainer to drop all capabilities by default. Only keeps
...
those that were specified in the config. This commit also explicitly
adds a set of capabilities that we were silently not dropping and were
assumed by the tests.
Docker-DCO-1.1-Signed-off-by: Victor Marmol <vmarmol@google.com> (github: vmarmol)
2014-05-16 00:57:58 +00:00
3b7a19def6
Move cgroups package into libcontainer
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-05-14 15:21:44 -07:00
bc22c9948c
Merge pull request #5756 from crosbymichael/move-units-to-pkg
...
Move duration and size to units pkg
2014-05-14 11:36:14 -07:00
adbe3096e8
Add cpuset cpus support for docker
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-05-13 18:17:12 -07:00
d33b4655c4
Move duration and size to units pkg
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-05-12 17:05:07 -07:00
62e8ddb579
Set container pid for process in native driver
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-05-06 17:04:04 -07:00
0b15944cb0
Merge pull request #5354 from alexlarsson/cgroups-systemd-fixes
...
cgroups: Update systemd to match fs backend
2014-05-05 16:00:56 -07:00
01fec73ba4
Update after namespace refactor
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-05-05 13:56:18 -07:00
70fef1460a
Merge pull request #4441 from crosbymichael/add-net-flag
...
Add --net flag to docker run and allow host network stack
2014-05-05 13:54:55 -07:00
Victor Vieux
Alexandr Morozov
Michael Crosby
Tibor Vass
Michael Crosby
Chris Alfonso
Ian Main
unclejack
unclejack
Timothy Hobbs
Victor Vieux
Alexander Larsson
Victor Marmol
Guillaume J. Charmes