mirror of https://github.com/docker/docs.git
110 lines
2.8 KiB
Go
110 lines
2.8 KiB
Go
package configuration
|
|
|
|
import (
|
|
"fmt"
|
|
"github.com/dotcloud/docker/pkg/libcontainer"
|
|
"os/exec"
|
|
"path/filepath"
|
|
"strings"
|
|
)
|
|
|
|
type Action func(*libcontainer.Container, interface{}, string) error
|
|
|
|
var actions = map[string]Action{
|
|
"cap.add": addCap,
|
|
"cap.drop": dropCap,
|
|
"fs.readonly": readonlyFs,
|
|
"ns.add": addNamespace,
|
|
"ns.drop": dropNamespace,
|
|
"net.join": joinNetNamespace,
|
|
}
|
|
|
|
func addCap(container *libcontainer.Container, context interface{}, value string) error {
|
|
c := container.CapabilitiesMask.Get(value)
|
|
if c == nil {
|
|
return fmt.Errorf("%s is not a valid capability", value)
|
|
}
|
|
c.Enabled = true
|
|
return nil
|
|
}
|
|
|
|
func dropCap(container *libcontainer.Container, context interface{}, value string) error {
|
|
c := container.CapabilitiesMask.Get(value)
|
|
if c == nil {
|
|
return fmt.Errorf("%s is not a valid capability", value)
|
|
}
|
|
c.Enabled = false
|
|
return nil
|
|
}
|
|
|
|
func addNamespace(container *libcontainer.Container, context interface{}, value string) error {
|
|
ns := container.Namespaces.Get(value)
|
|
if ns == nil {
|
|
return fmt.Errorf("%s is not a valid namespace", value[1:])
|
|
}
|
|
ns.Enabled = true
|
|
return nil
|
|
}
|
|
|
|
func dropNamespace(container *libcontainer.Container, context interface{}, value string) error {
|
|
ns := container.Namespaces.Get(value)
|
|
if ns == nil {
|
|
return fmt.Errorf("%s is not a valid namespace", value[1:])
|
|
}
|
|
ns.Enabled = false
|
|
return nil
|
|
}
|
|
|
|
func readonlyFs(container *libcontainer.Container, context interface{}, value string) error {
|
|
switch value {
|
|
case "1", "true":
|
|
container.ReadonlyFs = true
|
|
default:
|
|
container.ReadonlyFs = false
|
|
}
|
|
return nil
|
|
}
|
|
|
|
func joinNetNamespace(container *libcontainer.Container, context interface{}, value string) error {
|
|
var (
|
|
running = context.(map[string]*exec.Cmd)
|
|
cmd = running[value]
|
|
)
|
|
|
|
if cmd == nil || cmd.Process == nil {
|
|
return fmt.Errorf("%s is not a valid running container to join", value)
|
|
}
|
|
nspath := filepath.Join("/proc", fmt.Sprint(cmd.Process.Pid), "ns", "net")
|
|
container.Networks = append(container.Networks, &libcontainer.Network{
|
|
Type: "netns",
|
|
Context: libcontainer.Context{
|
|
"nspath": nspath,
|
|
},
|
|
})
|
|
return nil
|
|
}
|
|
|
|
// configureCustomOptions takes string commands from the user and allows modification of the
|
|
// container's default configuration.
|
|
//
|
|
// format: <key> <...value>
|
|
// i.e: cgroup devices.allow *:*
|
|
func ParseConfiguration(container *libcontainer.Container, running map[string]*exec.Cmd, opts []string) error {
|
|
for _, opt := range opts {
|
|
kv := strings.SplitN(opt, "=", 2)
|
|
if len(kv) < 2 {
|
|
return fmt.Errorf("invalid format for %s", opt)
|
|
}
|
|
|
|
action, exists := actions[kv[0]]
|
|
if !exists {
|
|
return fmt.Errorf("%s is not a valid option for the native driver", kv[0])
|
|
}
|
|
|
|
if err := action(container, running, kv[1]); err != nil {
|
|
return err
|
|
}
|
|
}
|
|
return nil
|
|
}
|