Fixes#4741
Right now volumes from expected a dir and not a file so when the drivers
tried to do the bind mount, the destination was a dir, not a file so it
fails to run.
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
Upstream-commit: a57900e35f2c30026a070fdfdbdb0ce99b35e1ff
Component: engine
The change in commit a9fa1a13c3b0a654a96be01ff7ec19e8009b2094
made us only deactivate devices that were mounted. Unfortunately
this made us not deactivate the base device. Which caused
us to not be able to deactivate the pool.
This fixes that by always just deactivating the base device.
Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
Upstream-commit: 66c5e19f9bd057644fab475499ea45bb428ba2b2
Component: engine
If an admin mounts all file systems as -rshared (Default on RHEL and Fedora)
we see a scaling problem as the number of container increase.
Basically every new container needs to have it new mounts in /var/lib/docker
shared to all other containers, this ends up with us only able to scale to
around 100 containers, before the system slows down.
By simply bind mounting /var/lib/docker on its and then setting it private,
the scaling issue goes away.
Docker-DCO-1.1-Signed-off-by: Dan Walsh <dwalsh@redhat.com> (github: rhatdan)
Upstream-commit: 792bb41e524615486ef8266b7bf4804b4fe178f1
Component: engine
This implements cgroup.Apply() using the systemd apis.
We create a transient unit called "docker-$id.scope" that contains
the container processes. We also have a way to set unit specific
properties, currently only defining the Slice to put the
scope in.
Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
Upstream-commit: 6c7835050e53b733181ddfca6152c358fd625400
Component: engine
In order to handle special configuration for different drivers we
make the Config field a map to string array. This lets
us use it for lxc, by using the "lxc" key for those, and we can
later extend it easily for other backend-specific options.
Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
Upstream-commit: 7a3070a6000963d12be9dcd2698d911b848a33b6
Component: engine
docker will run the process(es) within the container with an SELinux label and will label
all of the content within the container with mount label. Any temporary file systems
created within the container need to be mounted with the same mount label.
The user can override the process label by specifying
-Z With a string of space separated options.
-Z "user=unconfined_u role=unconfined_r type=unconfined_t level=s0"
Would cause the process label to run with unconfined_u:unconfined_r:unconfined_t:s0"
By default the processes will run execute within the container as svirt_lxc_net_t.
All of the content in the container as svirt_sandbox_file_t.
The process mcs level is based of the PID of the docker process that is creating the container.
If you run the container in --priv mode, the labeling will be disabled.
Docker-DCO-1.1-Signed-off-by: Dan Walsh <dwalsh@redhat.com> (github: rhatdan)
Upstream-commit: 4c4356692580afb3971094e322aea64abe0e2500
Component: engine
When s.FinishedAt is zero, the since time exit in docker ps doesn't display correct time.
For example
```
Exited (0) 292.471209 years ago
```
This patch fixes the since time exit to display nothing if s.FinishedAt is zero.
Docker-DCO-1.1-Signed-off-by: Ken ICHIKAWA <ichikawa.ken@jp.fujitsu.com> (github: ichik1)
Upstream-commit: 4002eac8b8b4007de03e78dbd57232fac583d05b
Component: engine
Right now shutdown is looping over *all* devicemapper
devices and actively deactivating them, this is pretty
slow if you have a lot of non-active containers. We
instead only deactivate the devices that are mounted.
We also do the shutdown unmount using MNT_DETACH which
forces the unmount in the global namespace, even if it
is busy because of some container having it mounted.
This means the device will be freed when that container
exits.
Also, we move the call to waitClose to deactivateDevice
because all callers of any of them call both anyway.
Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
Upstream-commit: a9fa1a13c3b0a654a96be01ff7ec19e8009b2094
Component: engine
Add a --dns-search parameter and a DnsSearch
configuration field for specifying dns search
domains.
Docker-DCO-1.1-Signed-off-by: Daniel Norberg <daniel.norberg@gmail.com> (github: danielnorberg)
Upstream-commit: fbfac21ed4de550ce72d993810dc07a2c4877a88
Component: engine
correct filename and make the tag more readable
Docker-DCO-1.1-Signed-off-by: Vincent Batts <vbatts@redhat.com> (github: vbatts)
Upstream-commit: 5cfea26bcfc218ca72eac7115fa257833f28b9f2
Component: engine
Default to the same build behavior, but allow a go build tag to disable
building of the btrfs graphdriver
go build -tags no_btrfs' ...
$ go build
$ objdump -S docker | grep btrfs | wc -l
194
$ go build -tags no_btrfs
$ objdump -S docker | grep btrfs | wc -l
1
# that is a comment ;-)
Docker-DCO-1.1-Signed-off-by: Vincent Batts <vbatts@redhat.com> (github: vbatts)
Upstream-commit: 85a62d9b779bfb351e159f38c2fc95900a0532cd
Component: engine
Enable build tags for all the graphdrivers to be excludable.
As an example:
```
$ go build
$ ls -l docker
-rwxr-xr-x 1 vbatts vbatts 18400158 Mar 14 14:22 docker*
$ go build -tags "exclude_graphdriver_aufs exclude_graphdriver_vfs exclude_graphdriver_devicemapper"
$ ls -l docker
-rwxr-xr-x 1 vbatts vbatts 17467068 Mar 14 14:22 docker*
```
Docker-DCO-1.1-Signed-off-by: Vincent Batts <vbatts@redhat.com> (github: vbatts)
Upstream-commit: 670ce98c60dbac1d46a59bd69bd20b569f4794f1
Component: engine
