Commit Graph

188 Commits

Author SHA1 Message Date
4f6cc66699 Add CAP_KILL to unprivileged containers
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
Upstream-commit: fa72eb3a58ebfec8ef1b27d8e7aa8cbdb41733a2
Component: engine
2014-06-07 15:18:18 -07:00
5bfe5a532a add wait4 after kill
Docker-DCO-1.1-Signed-off-by: Victor Vieux <vieux@docker.com> (github: vieux)
Upstream-commit: 30ba7546cb5a1ff7e4915c5a25dd8d72b3bf735b
Component: engine
2014-06-06 00:32:14 +00:00
1d13810851 start containers after all of them are registered
Docker-DCO-1.1-Signed-off-by: Victor Vieux <vieux@docker.com> (github: vieux)
Upstream-commit: 34bd2d622910444ae0d30bd0ac32005e224074c1
Component: engine
2014-06-06 00:31:58 +00:00
12d535e2c7 Move remount as private to the graph drivers
If this is at the root directory for the daemon you could unmount
somones filesystem when you stop docker and this is actually only needed
for the palces that the graph drivers mount the container's root
    filesystems.
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
Upstream-commit: 3609b051b88565c0fe0615fd47ddb48eed549d27
Component: engine
2014-06-05 16:02:25 -07:00
9fb60c3559 Ensures files get closed properly. Closes #6213
Docker-DCO-1.1-Signed-off-by: Tibor Vass <teabee89@gmail.com> (github: tiborvass)
Upstream-commit: b1ac791d8426cd7b6fb5a19f5e918b26c83d83f6
Component: engine
2014-06-05 15:13:43 -07:00
3ee07ce41f devmapper: Add blkdiscard option and disable it on raw devices
The blkdiscard hack we do on container/image delete is pretty slow, but
required to restore space to the "host" root filesystem. However, it
is pretty useless on raw devices, and you may not need it in development
either.

In a simple test of the devicemapper backend on loopback the time to
delete 20 container went from 11 seconds to 0.4 seconds with
--storage-opt blkdiscard=false.

Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
Upstream-commit: 0434a2ce64c0ce07e97e9a516cef226be67d5f5b
Component: engine
2014-06-05 11:45:59 +02:00
af11ee865f devmapper: Add options for specifying block devices
This adds dm.datadev and dm.metadatadev options that you can use with
--storage-opt to set to specific devices to use for the thin
provisioning pool.

Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
Upstream-commit: a226168a8b877d632cb87c95dd0288f6092b9d8f
Component: engine
2014-06-05 11:45:55 +02:00
42f2781e59 devmapper: Allow specifying filesystem for thin devices
This adds the following --storage-opts for the daemon:
dm.fs: The filesystem to use for the base image
dm.mkfsarg: Add an argument to the mkfs command for the base image
dm.mountopt: Add a mount option for devicemapper mount

Currently supported filesystems are xfs and ext4.

Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
Upstream-commit: 807bc2cd049d97f31eab54ce3d5719d63240e3e7
Component: engine
2014-06-05 11:25:06 +02:00
28ddc63894 devicemapper: Probe what filesystem to use when mounting
Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
Upstream-commit: 10083f414017636065aa50610f07784738df8e7a
Component: engine
2014-06-05 11:03:19 +02:00
cb7dedffd7 devmapper: Add --storage-opt options for basic devicemapper settings
This allows setting these settings to be passed:
dm.basesize
dm.loopdatasize
dm.loopmetadatasize

Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
Upstream-commit: 7f5ba068f438ee159bfca7396de4987bcae45809
Component: engine
2014-06-05 10:50:07 +02:00
83cd706353 Add --storage-opt graph driver option and pass through to driver
This lets you add storage specific options for the daemon.

Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
Upstream-commit: 822ea97ffcf10645720bb93108a60f8b9ce9931d
Component: engine
2014-06-05 10:42:27 +02:00
d381e276cf devmapper: Fail init with ErrNotSupported if simple devmapper call fails
If we can't even get the current device mapper driver version, then
we cleanly fail the devmapper driver as not supported and fall back
on the next one.

Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
Upstream-commit: 948e54ac455f88c79524dcf117df80f2d4c3f96c
Component: engine
2014-06-05 10:42:27 +02:00
e29c2c6bde Totally remove insert feature
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
Upstream-commit: 7a145b022a3b50b0d04cb0471d517f7c6c5efc67
Component: engine
2014-06-04 17:35:15 -07:00
e9b3abdfc5 Rename nsinit package to namespaces in libcontainer
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
Upstream-commit: 8aff01c0b447fa4d68f053c44e8baf7b24247164
Component: engine
2014-06-04 15:47:57 -07:00
0fc07e0aef Integrating systemd freeze functionality.
This pulls together #6061 and #6125

Docker-DCO-1.1-Signed-off-by: Chris Alfonso <calfonso@redhat.com> (github: calfonso)
Upstream-commit: 26246ebd5379a83b2ed656668bd985c652e98167
Component: engine
2014-06-04 13:33:44 -06:00
77114664a4 Add ability to pause/unpause containers via cgroups freeze
This patch adds pause/unpause to the command line, api, and drivers
for use on containers.  This is implemented using the cgroups/freeze
utility in libcontainer and lxc freeze/unfreeze.

Co-Authored-By: Eric Windisch <ewindisch@docker.com>
Co-Authored-By: Chris Alfonso <calfonso@redhat.com>
Docker-DCO-1.1-Signed-off-by: Ian Main <imain@redhat.com> (github: imain)
Upstream-commit: b054569cde788b2111ddbc4080b215dcda89f06e
Component: engine
2014-06-04 13:33:44 -06:00
ba5ca66eca Merge pull request #6186 from unclejack/fix_typo_aufsgo
fix diffs->diff typo in aufs.go
Upstream-commit: 2a92c53a060685f3d719c703f7b6287537ba7852
Component: engine
2014-06-03 16:59:43 -07:00
974c92338e fix diffs->diff typo in aufs.go
Docker-DCO-1.1-Signed-off-by: Cristian Staretu <cristian.staretu@gmail.com> (github: unclejack)
Upstream-commit: 7a60b9063c109892f60165adb71682988d39d3d8
Component: engine
2014-06-04 02:46:55 +03:00
7d5cb46a54 apparmor: write & load the profile on every start
Docker-DCO-1.1-Signed-off-by: Cristian Staretu <cristian.staretu@gmail.com> (github: unclejack)
Upstream-commit: 1ef3ca83d8624aaaaed05cfce1f71282d70d84dd
Component: engine
2014-06-04 00:56:35 +03:00
b4a026cf85 Merge pull request #6172 from tianon/remove-duplicated-magic-values
Move duplicated FS "magic" values to the graphdriver package so they can be shared
Upstream-commit: dccf3362041b4c8f450428f34ec7b4d365b2feaa
Component: engine
2014-06-02 23:25:46 -07:00
55a81e78b4 Move duplicated FS "magic" values to the graphdriver package so they can be shared instead of duplicated
Docker-DCO-1.1-Signed-off-by: Andrew Page <admwiggin@gmail.com> (github: tianon)
Upstream-commit: 68476e277f953d1076c8e966691769d5a35e65b6
Component: engine
2014-06-02 19:56:47 -06:00
f363828126 Merge pull request #6171 from crosbymichael/add-chroot
Add SYS_CHROOT cap to unprivileged containers
Upstream-commit: 5bf4068d60222b1fdfc997e498aa2096b8df3cf9
Component: engine
2014-06-02 18:33:34 -07:00
382f8a23ad Add SYS_CHROOT cap to unprivileged containers
Fixes #6103
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
Upstream-commit: 41f7cef2bd186d321fc4489691ba53ab41eb48e5
Component: engine
2014-06-02 18:23:47 -07:00
4038755eae Ensure that ownership and perms are copied to volume
This only works if the file or dir is already created in
the image before setting it to be a volume.  There is no way around this
because we don't have the data avaliable to set the volume at the
beginning of the dockerfile
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
Upstream-commit: f41ced96af9dba56dd368e213e6e83fd02b85b03
Component: engine
2014-06-02 18:06:58 -07:00
fe1f6345d0 add volumes back to inspect
Docker-DCO-1.1-Signed-off-by: Victor Vieux <vieux@docker.com> (github: vieux)
Upstream-commit: 996133b9babbe4c4dfb42ee0d5aea9566568af14
Component: engine
2014-06-03 00:05:54 +00:00
b3478bf7eb Merge pull request #6138 from NERSC/6092-setuidrace
Fix for setuid race condition in LXC driver
Upstream-commit: 55230b3332f8a24b5100bfa54df5beedf078cd51
Component: engine
2014-06-02 12:16:00 -07:00
77921a7a55 Merge pull request #6130 from vieux/standardize_api_keys
Standardize api keys to CamelCase
Upstream-commit: 3e13aaec000aeaa16718e2408b0c371e4de69137
Component: engine
2014-06-02 12:03:11 -07:00
a710a9b84a Fix for setuid race condition in LXC driver
This is a fix for a race condition in the LXC driver.  This is described
more in issue #6092.

Closes #6092

Docker-DCO-1.1-Signed-off-by: Shane Canon <scanon@lbl.gov> (github: scanon)
Upstream-commit: f9705477d023c63fb316a30204761aa1e3cb3e6d
Component: engine
2014-05-31 10:42:48 -07:00
3248c6e81c Ensure all dev nodes are copied for privileged
This also makes sure that devices are pointers to avoid copies
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
Upstream-commit: 69989b7c06b0ca6737e83ddf8fcfa2dfccc57a7c
Component: engine
2014-05-30 18:39:11 -07:00
2a289bda14 Standardize API keys: CamelCase
Docker-DCO-1.1-Signed-off-by: Victor Vieux <vieux@docker.com> (github: vieux)
Upstream-commit: 68fb7f4b744bf71206898d32fe203556a6261e5d
Component: engine
2014-05-31 01:22:07 +00:00
bc9024a72e Merge pull request #6097 from timthelion/consistentdevices
Refactor device handling code
Upstream-commit: 0ef637722f69cff931b25c75d421e231ab75af75
Component: engine
2014-05-31 03:34:52 +03:00
fc5496269e Merge pull request #6123 from vieux/no_number_default
no default default number in names
Upstream-commit: b46449cb33be12efa89b740be15ae98e686ed97a
Component: engine
2014-05-31 00:55:11 +03:00
930b30cb1b Merge pull request #6065 from vieux/fix_race_waitlock
update container's state after we close the waitLock
Upstream-commit: c90faa47b66e3254521ef33eb5b2c8b99d741625
Component: engine
2014-05-31 00:38:35 +03:00
52c8a31f21 Refactor device handling code
We now have one place that keeps track of (most) devices that are allowed and created within the container.  That place is pkg/libcontainer/devices/devices.go

This fixes several inconsistencies between which devices were created in the lxc backend and the native backend.  It also fixes inconsistencies between wich devices were created and which were allowed.  For example, /dev/full was being created but it was not allowed within the cgroup.  It also declares the file modes and permissions of the default devices, rather than copying them from the host.  This is in line with docker's philosphy of not being host dependent.

Docker-DCO-1.1-Signed-off-by: Timothy Hobbs <timothyhobbs@seznam.cz> (github: https://github.com/timthelion)
Upstream-commit: 608702b98064a4dfd70b5ff0bd6fb45d2429f45b
Component: engine
2014-05-30 19:21:29 +00:00
13006a3fdc no default default number in names
Docker-DCO-1.1-Signed-off-by: Victor Vieux <vieux@docker.com> (github: vieux)
Upstream-commit: e70a5ab0149562609d3a16105aada365ed940cb5
Component: engine
2014-05-30 19:08:21 +00:00
1c65521b44 optimize restore & use Getenv less in daemon.go
Docker-DCO-1.1-Signed-off-by: Cristian Staretu <cristian.staretu@gmail.com> (github: unclejack)
Upstream-commit: 0fd0deb75d6e38973f154c5b41c7d4e22a9c4fef
Component: engine
2014-05-30 21:20:27 +03:00
f31e7878cf Goroutine-safe daemon.containers
Docker-DCO-1.1-Signed-off-by: Alexandr Morozov <lk4d4math@gmail.com> (github: LK4D4)
Upstream-commit: af17b01ad7ba0c4d243e2e234710e44a14b6dad4
Component: engine
2014-05-30 16:08:06 +04:00
57a9b63e5e Fix race in native driver on activeContainers usage
Docker-DCO-1.1-Signed-off-by: Alexandr Morozov <lk4d4math@gmail.com> (github: LK4D4)
Upstream-commit: 64bd6a6a5342c87db7096f60365d270d0d69e9d2
Component: engine
2014-05-30 14:16:00 +04:00
bfa0c1d204 Fix races in set/get currentInterfaces in networkdriver
Docker-DCO-1.1-Signed-off-by: Alexandr Morozov <lk4d4math@gmail.com> (github: LK4D4)
Upstream-commit: 4e5f6951f2af836c3d9163c8a150298ee87468d4
Component: engine
2014-05-30 14:16:00 +04:00
7903608c88 block aufs on incompatible file systems
Docker-DCO-1.1-Signed-off-by: Cristian Staretu <cristian.staretu@gmail.com> (github: unclejack)
Upstream-commit: e8a87120d459dfeffee5474c3253e787d38b2ac0
Component: engine
2014-05-30 02:32:27 +03:00
32c2485efa Add ErrPrerequisites to improve misleading errors
There are two cases where we can't use a graphdriver:

1) the graphdriver itself isn't supported by the system
2) the graphdriver is supported by some configuration/prerequisites are
missing

This introduces a new error for the 2) case and uses it when trying to
run docker with btrfs backend on a non-btrfs filesystem.

Docker-DCO-1.1-Signed-off-by: Johannes 'fish' Ziemke <github@freigeist.org> (github: discordianfish)
Upstream-commit: 75754e69f6cce80c34ebc72817ada0a807fd635a
Component: engine
2014-05-29 17:09:55 +02:00
ea766a12d8 Merge pull request #5868 from jhspaybar/5749-libcontainerroutes
libcontainer support for arbitrary route table entries
Upstream-commit: 5e2af0713735d6724179540d4d1b0827ab8c4570
Component: engine
2014-05-28 10:50:56 -07:00
fc7b9b154d Fixes #5749
libcontainer support for arbitrary route table entries

Docker-DCO-1.1-Signed-off-by: William Thurston <me@williamthurston.com> (github: jhspaybar)
Upstream-commit: bf7f360dcac38037d5c4f9e2e90d01adc240ed2b
Component: engine
2014-05-28 17:42:02 +00:00
5ea7137278 Return devmapper errors with additional text
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
Upstream-commit: 69640123826cf73d3d83182cb81e5de4ad0cc3a7
Component: engine
2014-05-27 19:03:57 -07:00
687a71e998 update container's state after we close the waitLock
Docker-DCO-1.1-Signed-off-by: Victor Vieux <vieux@docker.com> (github: vieux)
Upstream-commit: 1de52caedca11c083e92039e2ecd8671944dfc47
Component: engine
2014-05-28 00:18:51 +00:00
0ef8d97b63 Update lxc to use cmd.Wait()
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
Upstream-commit: 5310e8575f5a251000bbecd6d998eb11cb95fe04
Component: engine
2014-05-27 13:52:05 -07:00
e0a89dbf86 Merge pull request #6059 from erikh/fix-tests
Fix race condition in CLI tests: diff was not acquiring a container lock
Upstream-commit: a60537992710edce4095b987f6e19ad0aea34ffa
Component: engine
2014-05-27 13:19:32 -07:00
37b20aec53 Merge pull request #6025 from crosbymichael/concurrent-names
Improve name generation on concurrent requests
Upstream-commit: 0d9a5ce6dd061089a3a485bf359a054d83b74059
Component: engine
2014-05-27 23:18:19 +03:00
3ed3d24076 Fix race condition in CLI tests: diff was not acquiring a container lock
Docker-DCO-1.1-Signed-off-by: Erik Hollensbe <github@hollensbe.org> (github: erikh)
Upstream-commit: 8b77e0183eaa7b3a87921f9655e2799d300bf775
Component: engine
2014-05-27 12:28:31 -07:00
05b57dfef1 Add Wait() calls in the appropriate spots
Docker-DCO-1.1-Signed-off-by: Erik Hollensbe <github@hollensbe.org> (github: erikh)
Upstream-commit: 92e41a02ce40c7d3446b8ca7ec5c5671ac3d8917
Component: engine
2014-05-27 12:26:56 -07:00