Commit Graph

16 Commits

Author SHA1 Message Date
f2b5fc4e3c Merge pull request #5411 from crosbymichael/lockdown
Update default restrictions for exec drivers
Upstream-commit: 44140f7909ac65206d300fa9a39ae06cc27d1847
Component: engine
2014-04-26 03:27:56 +03:00
ef140af848 Merge pull request #5342 from danielnorberg/avoid-suicide
avoid suicide
Upstream-commit: 077b7d0359ca9d1a9ee38a5342ad07929692c54a
Component: engine
2014-04-25 21:44:45 +03:00
fc27b99e17 Merge pull request #5373 from vmarmol/master
Separating cgroup Memory and MemoryReservation.
Upstream-commit: 85540f6aa0c742c1623025b1fb235d7fd29cd9c7
Component: engine
2014-04-24 14:28:40 -07:00
d81d54cd3e Merge pull request #5335 from alexlarsson/remove-ghost
container: Remove Ghost state
Upstream-commit: 8af84c5e23cff006d7fe9c730613a618174f418c
Component: engine
2014-04-24 11:55:05 -07:00
69a18c6508 Separating cgroup Memory and MemoryReservation.
This will allow for these to be set independently. Keep the current Docker behavior where Memory and MemoryReservation are set to the value of Memory.

Docker-DCO-1.1-Signed-off-by: Victor Marmol <vmarmol@google.com> (github: vmarmol)
Upstream-commit: f188b9f623e23ee624aca8654bf00f49ee3bae29
Component: engine
2014-04-24 11:09:38 -07:00
b3bc92caaf Increment native driver version with these changes
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
Upstream-commit: 2d6c3674349c09318e8d1fb3ce43dbabc15c97da
Component: engine
2014-04-24 10:35:20 -07:00
a750afc31e Mount over dev and only copy allowed nodes in
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
Upstream-commit: 5ba1242bdc309352c2b0b9a1ef9e07fe835e4857
Component: engine
2014-04-24 10:35:20 -07:00
20ba5d97da No not mount sysfs by default for non privilged containers
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
Upstream-commit: 81e5026a6afb282589704fd5f6bcac9ed50108ea
Component: engine
2014-04-24 10:35:20 -07:00
bdab73285c Add lxc support for restricting proc
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
Upstream-commit: 0779a8c3287fbf7ff1938df10897b551b839cbee
Component: engine
2014-04-24 10:35:20 -07:00
9da373d6b1 Add restrictions to proc in libcontainer
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
Upstream-commit: 60a90970bc4add3547064004f08c19ab5027141b
Component: engine
2014-04-24 10:35:19 -07:00
291ddfb05a avoid suicide
container.Kill() might read a pid of 0 from
container.State.Pid due to losing a race with
container.monitor() calling
container.State.SetStopped(). Sending a SIGKILL to
pid 0 is undesirable as "If pid equals 0, then sig
is sent to every process in the process group of
the calling process."

Docker-DCO-1.1-Signed-off-by: Daniel Norberg <daniel.norberg@gmail.com> (github: danielnorberg)
Upstream-commit: b3ddc31b9581665eb15dedd0aa45bd37c1eb6815
Component: engine
2014-04-23 11:06:59 -04:00
505086c799 devicemapper: Don't mount in Create()
We used to mount in Create() to be able to create a few files that
needs to be in each device. However, this mount is problematic for
selinux, as we need to set the mount label at mount-time, and it
is not known at the time of Create().

This change just moves the file creation to first Get() call and
drops the mount from Create(). Additionally, this lets us remove
some complexities we had to avoid an extra unmount+mount cycle.

Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
Upstream-commit: 73d9ede12c9328c44e38699dbe3a04479d3926e6
Component: engine
2014-04-23 13:50:53 +02:00
db8bc036cb container: Remove Ghost state
container.Register() checks both IsRunning() and IsGhost(), but at
this point IsGhost() is always true if IsRunning() is true. For a
newly created container both are false, and for a restored-from-disk
container Daemon.load() sets Ghost to true if IsRunning is true. So we
just drop the IsGhost check.

This was the last call to IsGhost, so we remove It and all other
traces of the ghost state.

Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
Upstream-commit: cf997aa905c5c6f5a29fa3658d904ffc81a1a4a1
Component: engine
2014-04-22 09:49:53 +02:00
1ea14534fa Merge branch 'master' into load-profile
Conflicts:
	daemon/execdriver/native/create.go
	daemon/execdriver/native/driver.go

Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume@charmes.net> (github: creack)
Upstream-commit: 813cebc64fb4b628e2938405d86144060c330eb9
Component: engine
2014-04-21 10:32:13 -07:00
de47414003 Remove IsGhost checks around networking
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
Upstream-commit: eceeebc22d9e4d75630e333759895a868ceba234
Component: engine
2014-04-17 23:49:59 +00:00
f7be50364d Rename runtime/* to daemon/*
Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
Upstream-commit: 359b7df5d2af5733b8a1ea6746d062053053b23e
Component: engine
2014-04-17 14:43:01 -07:00