p4u1/docker-cli
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
7,243 Commits 2 Branches 295 Tags
06e40ba2fadb4a7486c8a67346f2ca435f196a28
Commit Graph

123 Commits

Author SHA1 Message Date
Victor Vieux
c93b9fc839 Merge pull request #4953 from rhatdan/selinux 
These two patches should fix problems we see with running docker in the wild.
Upstream-commit: 9687c087ab09feb106b040628423e70b320a51e2
Component: engine
 2014-04-02 16:36:41 -07:00
unclejack
4675670b52 Merge pull request #4867 from crosbymichael/clean-shutdown 
Cleanly shutdown docker
Upstream-commit: 30ff3fa954676bfc8f48b73093f3afa1473d146e
Component: engine
 2014-04-02 01:48:03 +03:00
Michael Crosby
55905d7fbc Merge pull request #4942 from vieux/cleanup_dev_libcontainer 
remove setupDev from libcontainer
Upstream-commit: 9cf89f854256eace2b8f446b16c4fbe22ffa61b1
Component: engine
 2014-04-01 14:28:17 -07:00
Dan Walsh
94c4d19652 In certain cases, setting the process label will not happen. 
When the code attempts to set the ProcessLabel, it checks if SELinux Is
enabled.  We have seen a case with some of our patches where the code
is fooled by the container to think that SELinux is not enabled.  Calling
label.Init before setting up the rest of the container, tells the library that
SELinux is enabled and everything works fine.

Docker-DCO-1.1-Signed-off-by: Dan Walsh <dwalsh@redhat.com> (github: rhatdan)
Upstream-commit: 2224e0d65adfbd08e53430a1d7c750491f788257
Component: engine
 2014-04-01 13:30:10 -04:00
Michael Crosby
d0b2920666 Don't send prctl to be consistent with other drivers 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
Upstream-commit: 283daced0c919be760947d44d7e46c80e1054d64
Component: engine
 2014-04-01 07:12:50 +00:00
Michael Crosby
5f13c09028 Ensure a reliable way to kill ghost containers on reboot 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
Upstream-commit: 5bb82f6313d7f789783ffac854be85a44a56617e
Component: engine
 2014-04-01 07:11:41 +00:00
Victor Vieux
5505d168ef remove setupDev from libcontainer 
Docker-DCO-1.1-Signed-off-by: Victor Vieux <victor.vieux@docker.com> (github: vieux)
Upstream-commit: d52d24dd801f3ffe1b894226b8dba613de59bd87
Component: engine
 2014-04-01 00:28:44 +00:00
Alexander Larsson
4a0326289d cgroups: Splity out Apply/Cleanup to separate file/interface 
This leaves only the generic cgroup helper functions in cgroups.go and
will allow easy implementations of other cgroup managers.

This also wires up the call to Cleanup the cgroup which was missing
before.

Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
Upstream-commit: 7f7d8419a71d49b25e4d38196b36e93b568bb61d
Component: engine
 2014-03-27 21:47:47 +01:00
Michael Crosby
f4111a1ccb Merge branch 'master' into pluginflag 
Conflicts:
	pkg/cgroups/cgroups.go
	pkg/libcontainer/nsinit/exec.go
	pkg/libcontainer/nsinit/init.go
	pkg/libcontainer/nsinit/mount.go
	runconfig/hostconfig.go
	runconfig/parse.go
	runtime/execdriver/driver.go
	runtime/execdriver/lxc/lxc_template.go
	runtime/execdriver/lxc/lxc_template_unit_test.go
	runtime/execdriver/native/default_template.go
	runtime/execdriver/native/driver.go

Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
Upstream-commit: eab56ac007b263708b5526609c8be2bc19881467
Component: engine
 2014-03-27 08:00:18 +00:00
Dan Walsh
f757666ccd This patch adds SELinux labeling support. 
docker will run the process(es) within the container with an SELinux label and will label
all of  the content within the container with mount label.  Any temporary file systems
created within the container need to be mounted with the same mount label.

The user can override the process label by specifying

-Z With a string of space separated options.

-Z "user=unconfined_u role=unconfined_r type=unconfined_t level=s0"

Would cause the process label to run with unconfined_u:unconfined_r:unconfined_t:s0"

By default the processes will run execute within the container as svirt_lxc_net_t.
All of the content in the container as svirt_sandbox_file_t.

The process mcs level is based of the PID of the docker process that is creating the container.

If you run the container in --priv mode, the labeling will be disabled.

Docker-DCO-1.1-Signed-off-by: Dan Walsh <dwalsh@redhat.com> (github: rhatdan)
Upstream-commit: 4c4356692580afb3971094e322aea64abe0e2500
Component: engine
 2014-03-26 15:30:40 -04:00
Michael Crosby
9fad5483e0 Change placement of readonly filesystem 
We need to change it to read only at the very end so that bound,
copy dev nodes and other ops do not fail.
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
Upstream-commit: 2c58a1e2886433a4266615b1f492f829e7a6f53f
Component: engine
 2014-03-21 14:17:17 +00:00
Michael Crosby
ffa18d8ad0 Allow containers to join the net namespace of other conatiners 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
Upstream-commit: be5538d8a8820ac1192c7a5660e0d950927b42d0
Component: engine
 2014-03-21 00:48:17 +00:00
Michael Crosby
b80ed35d06 Merge branch 'proppy-nsinit' into pluginflag 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
Upstream-commit: 1bedae9107108156d6d272494f1ff27d8b4be590
Component: engine
 2014-03-21 00:36:23 +00:00
Michael Crosby
c42d40863c Add ability to work with individual namespaces 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
Upstream-commit: 70f3b9f4ce67ee54ec226814cdd26db01f69378d
Component: engine
 2014-03-21 00:23:34 +00:00
Michael Crosby
44fe86670a Allow caps to be toggled in native driver with plugin flag 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
Upstream-commit: 443a75d5f66e986e9d7740d3f2aaef080aef8ea0
Component: engine
 2014-03-21 00:10:24 +00:00
Michael Crosby
3490f03690 Dont use custom marshaling for caps and namespaces 
This also adds an enabled field to the types so that they
can be easily toggled.
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
Upstream-commit: c5f9c4bd6933c806490e4f7cb52557cee154dbed
Component: engine
 2014-03-20 23:09:01 +00:00
Johan Euphrosine
433a941c61 libcontainer: remove duplicate imports 
Docker-DCO-1.1-Signed-off-by: Johan Euphrosine <proppy@google.com> (github: proppy)
Upstream-commit: 5dbfe310fe624c66714f8c5017692f528af4c87f
Component: engine
 2014-03-18 16:25:26 -07:00
Johan Euphrosine
bf68195445 libcontainer: goimports 
Docker-DCO-1.1-Signed-off-by: Johan Euphrosine <proppy@google.com> (github: proppy)
Upstream-commit: f58757a699cf47c3b8770e13f371e1bbf493b5b1
Component: engine
 2014-03-18 16:18:34 -07:00
Johan Euphrosine
05b01b0f64 libcontainer/nsinit/init: move mount namespace after network 
Docker-DCO-1.1-Signed-off-by: Johan Euphrosine <proppy@google.com> (github: proppy)
Upstream-commit: b10b950b110c93db34a399753706dc79c71b94d3
Component: engine
 2014-03-18 16:18:04 -07:00
Johan Euphrosine
c37f607a5b libcontainer/network: add netns strategy 
Docker-DCO-1.1-Signed-off-by: Johan Euphrosine <proppy@google.com> (github: proppy)
Upstream-commit: f52b2fdcbb29258c5b492fdb2479d473fcb42ca0
Component: engine
 2014-03-18 16:17:28 -07:00
Michael Crosby
2d58b8bf60 Only unshare the mount namespace for execin 
Fixes #4728
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
Upstream-commit: 4b1513f9c394fbfdf21998db4318251b4e8b6bc0
Component: engine
 2014-03-17 18:52:56 -07:00
Timothy Hobbs
ccebbeffe2 Fix issue #4681 - No loopback interface within container when networking is disabled. 
Docker-DCO-1.1-Signed-off-by: Timothy Hobbs <timothyhobbs@seznam.cz> (github: https://github.com/timthelion)

Remove loopback code from veth strategy

Docker-DCO-1.1-Signed-off-by: Timothy Hobbs <timothyhobbs@seznam.cz> (github: https://github.com/timthelion)

Looback strategy: Get rid of uneeded code in Create
Docker-DCO-1.1-Signed-off-by: Timothy Hobbs <timothyhobbs@seznam.cz> (github: https://github.com/timthelion)

Use append when building network strategy list

Docker-DCO-1.1-Signed-off-by: Timothy Hobbs <timothyhobbs@seznam.cz> (github: https://github.com/timthelion)

Swap loopback and veth strategies in Networks list

Docker-DCO-1.1-Signed-off-by: Timothy Hobbs <timothyhobbs@seznam.cz> (github: https://github.com/timthelion)

Revert "Swap loopback and veth strategies in Networks list"

This reverts commit 3b8b2c8454171d79bed5e9a80165172617e92fc7.

Docker-DCO-1.1-Signed-off-by: Timothy Hobbs <timothyhobbs@seznam.cz> (github: https://github.com/timthelion)

When initializing networks, only return from the loop if there is an error

Docker-DCO-1.1-Signed-off-by: Timothy Hobbs <timothyhobbs@seznam.cz> (github: https://github.com/timthelion)
Upstream-commit: 353df19ab7009f6555dee506841ae0b690a08768
Component: engine
 2014-03-17 22:01:24 +01:00
Guillaume J. Charmes
4ff432cad1 Merge pull request #4645 from crosbymichael/add-logger 
Add logger to libcontainer
Upstream-commit: 597e0812fb8a40cf73388bcc44e6be74035a9846
Component: engine
 2014-03-17 11:30:14 -07:00
Brandon Philips
b1507c6b21 chore(libcontainer): small grammar fix in types_test 
Someone probably got really used to typing er on the end of contain :)

Docker-DCO-1.1-Signed-off-by: Brandon Philips <brandon.philips@coreos.com> (github: philips)
Upstream-commit: ad7e7d612390d09d3a54fd82dda9687deb3b0cbe
Component: engine
 2014-03-17 11:07:29 -07:00
Brandon Philips
ba77c9041d refactor(libcontainer): rename to CapabilitiesMask 
The Capabilities field on libcontainer is actually used as a mask.
Rename the field so that this is more clear.

Docker-DCO-1.1-Signed-off-by: Brandon Philips <brandon.philips@coreos.com> (github: philips)
Upstream-commit: 128381e0f0372f10f88a847087aa91a972770c4b
Component: engine
 2014-03-17 11:07:12 -07:00
Michael Crosby
842270ca38 Send sigterm to child instead of sigkill 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
Upstream-commit: 39037a91f85a4a072e5aa7e585d8c2f6b211df8a
Component: engine
 2014-03-14 15:42:05 -07:00
Michael Crosby
0d0170bb11 Add stderr log ouput if in debug 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
Upstream-commit: 0e863a584a6edfa1c3ec383c586b646663b66bc7
Component: engine
 2014-03-14 09:55:05 -07:00
Michael Crosby
3f944b4fd6 Add initial logging to libcontainer 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
Upstream-commit: 7294392c729de4c5884eb967f192b34a1d8857a7
Component: engine
 2014-03-14 09:55:05 -07:00
Michael Crosby
0e6df3669c Update libcontainer readme and todo list 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
Upstream-commit: cbd2a30cd6185d1469f82f8b6693d6158c93d54a
Component: engine
 2014-03-13 15:18:08 -07:00
Michael Crosby
1080c0f16b Merge pull request #4656 from crosbymichael/fix-ptmx-link 
Always symlink /dev/ptmx for libcontainer
Upstream-commit: 28994f86eef11074f613433893ef345321afef91
Component: engine
 2014-03-13 14:57:17 -07:00
Guillaume J. Charmes
596209d4bb Merge pull request #4422 from alexlarsson/internal-mounts 
Move all bind-mounts in the container inside the namespace
Upstream-commit: c7ea6e5da80af3d9ba7558f876efbf0801d988d8
Component: engine
 2014-03-13 14:55:29 -07:00
Michael Crosby
75217fbf0a Always symlink /dev/ptmx for libcontainer 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
Upstream-commit: 747275d30c4d4eb25ca798394cc04db00912adb2
Component: engine
 2014-03-13 14:31:09 -07:00
Alexander Larsson
746b307c72 Move all bind-mounts in the container inside the namespace 
This moves the bind mounts like /.dockerinit, /etc/hostname, volumes,
etc into the container namespace, by setting them up using lxc.

This is useful to avoid littering the global namespace with a lot of
mounts that are internal to each container and are not generally
needed on the outside. In particular, it seems that having a lot of
mounts is problematic wrt scaling to a lot of containers on systems
where the root filesystem is mounted --rshared.

Note that the "private" option is only supported by the native driver, as
lxc doesn't support setting this. This is not a huge problem, but it does
mean that some mounts are unnecessarily shared inside the container if you're
using the lxc driver.

Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
Upstream-commit: 6c266c4b42eeabe2d433a994753d86637fe52a0b
Component: engine
 2014-03-13 20:01:29 +01:00
Guillaume J. Charmes
69e0188d27 Fix issue when /etc/apparmor.d does not exists 
Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume@charmes.net> (github: creack)
Upstream-commit: 6a325f1c7a243689ecf01f257ac7afb95fea7ec2
Component: engine
 2014-03-12 11:13:24 -07:00
Guillaume J. Charmes
84def4f523 Update email + add self to pkg/signal 
Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume@charmes.net> (github: creack)
Upstream-commit: 915d967f556bc7bb3faea34db8a06ea64fd5de92
Component: engine
 2014-03-10 20:26:45 -07:00
srid
8f3c1c1399 nsinit: prefix errors with their source 
Docker-DCO-1.1-Signed-off-by: Sridhar Ratnakumar <github@srid.name> (github: srid)
Upstream-commit: 03211ecce07ab64f5263232e1aa3c6248530c5b4
Component: engine
 2014-03-10 17:08:50 -07:00
Michael Crosby
957f74b876 Add env var to toggle pivot root or ms_move 
Use the  DOCKER_RAMDISK env var to tell the native driver not to use
a pivot root when setting up the rootfs of a container.
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
Upstream-commit: 36dd124b16a76704a88142fa96bb4bb6260dd821
Component: engine
 2014-03-06 19:30:52 -08:00
Michael Crosby
6f0ad9195c Revert "Revert "libcontainer: Use pivot_root instead of chroot"" 
This reverts commit 82f797f14096430c3edbace1cd30e04a483ec41f.

Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
Upstream-commit: c38635020accaffa6868f19f308042be051132a0
Component: engine
 2014-03-06 17:19:59 -08:00
Michael Crosby
3e4d7be838 Revert "Revert "libcontainer: Use MS_PRIVATE instead of MS_SLAVE"" 
This reverts commit bd263f5b15b51747e3429179fef7fcb425ccbe4a.

Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
Upstream-commit: 557e4fef4418a251dd3a6817b97e5c1be055cbf3
Component: engine
 2014-03-06 17:19:47 -08:00
unclejack
9ba4572a15 Merge pull request #4512 from crosbymichael/no-pivot-root 
No pivot root because of ramdisk
Upstream-commit: 78dc1ede5202c8867e011582af8752810f817e9f
Component: engine
 2014-03-07 02:54:03 +02:00
Michael Crosby
d96ead6498 Revert "libcontainer: Use MS_PRIVATE instead of MS_SLAVE" 
This reverts commit 757b5775725fb90262cee1fa6068fa9dcbbff59f.

Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
Upstream-commit: bd263f5b15b51747e3429179fef7fcb425ccbe4a
Component: engine
 2014-03-06 16:41:03 -08:00
Michael Crosby
cf4ed6c883 Revert "libcontainer: Use pivot_root instead of chroot" 
This reverts commit 5b5c884cc8266d0c2a56da0bc2df14cc9d5d85e8.

Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
Upstream-commit: 82f797f14096430c3edbace1cd30e04a483ec41f
Component: engine
 2014-03-06 16:32:06 -08:00
Michael Crosby
c896586b70 Ensure that native containers die with the parent 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
Upstream-commit: ea9bce8724303656c87c05e9049272258c9827b3
Component: engine
 2014-03-06 16:30:56 -08:00
Michael Crosby
936f96cce5 Remove the ghosts and kill everything 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
Upstream-commit: 772ef99d2816b629d084e11fe7fba5953687b620
Component: engine
 2014-03-06 15:30:26 -08:00
Guillaume J. Charmes
ecf60ced9e Merge pull request #4506 from creack/fix_apparmor 
Use CGO for apparmor profile switch
Upstream-commit: b722aa21b7ddfd558c2a36c8301d61b011221197
Component: engine
 2014-03-06 13:37:34 -08:00
Tianon Gravi
24c5efffe2 Update build tags such that we can properly compile on all platforms (especially for packagers), and updated hack/PACKAGERS.md to mention the DOCKER_BUILDTAGS variable that will need to be set for binaries that might be used on AppArmor (such as Debian and especially Ubuntu) 
Docker-DCO-1.1-Signed-off-by: Andrew Page <admwiggin@gmail.com> (github: tianon)
Upstream-commit: 0b23393ba1901df3d08916fa977707db58699eca
Component: engine
 2014-03-06 13:39:17 -07:00
Guillaume J. Charmes
2ebfedab6d Add buildflags to allow crosscompilation for apparmor 
Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume.charmes@docker.com> (github: creack)
Upstream-commit: c89fa6645ef87e1863ef5812bd42176f5bd987ca
Component: engine
 2014-03-06 12:05:03 -08:00
Guillaume J. Charmes
feec772c9b Merge pull request #4503 from unclejack/attempt_to_fix_apparmor_profile 
remove dbus from apparmor profile for Ubuntu 12.04
Upstream-commit: 31f62b934b7edc4942a6535d28954c0122748509
Component: engine
 2014-03-06 11:20:06 -08:00
Guillaume J. Charmes
9f58f80f28 Use CGO for apparmor profile switch 
Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume.charmes@docker.com> (github: creack)
Upstream-commit: f0f833c6d795fc8b3fb4bb379f9916745f5c7ac9
Component: engine
 2014-03-06 11:10:58 -08:00
unclejack
22c0393b79 remove dbus from apparmor profile 
This removes the dbus entry from the apparmor profile Docker creates.

Docker-DCO-1.1-Signed-off-by: Cristian Staretu <cristian.staretu@gmail.com> (github: unclejack)
Upstream-commit: 46fdb6af8ecc804b204fc93ab6d8d4a5f7503860
Component: engine
 2014-03-06 19:47:03 +02:00