From 6d69a9855a53483bf5f9e5aab9450f0605797a55 Mon Sep 17 00:00:00 2001 From: Madhan Raj Mookkandy Date: Thu, 15 Jun 2017 11:25:46 -0700 Subject: [PATCH 1/4] Enable HotAdd for Windows Signed-off-by: Madhan Raj Mookkandy Upstream-commit: 5c1cfb1d27a1a7f7c0cb9092e69c3f70717fbbef Component: engine --- components/engine/daemon/container_operations_windows.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/components/engine/daemon/container_operations_windows.go b/components/engine/daemon/container_operations_windows.go index 51762a2441..e624fe0525 100644 --- a/components/engine/daemon/container_operations_windows.go +++ b/components/engine/daemon/container_operations_windows.go @@ -153,7 +153,7 @@ func enableIPOnPredefinedNetwork() bool { } func (daemon *Daemon) isNetworkHotPluggable() bool { - return false + return true } func setupPathsAndSandboxOptions(container *container.Container, sboxOptions *[]libnetwork.SandboxOption) error { From fa06c65a30c882846ad4e7ef71743b29bc3dfeeb Mon Sep 17 00:00:00 2001 From: Dennis Chen Date: Mon, 5 Feb 2018 02:05:57 +0000 Subject: [PATCH 2/4] Daemon: passdown the `--oom-kill-disable` option to containerd Current implementaion of docke daemon doesn't pass down the `--oom-kill-disable` option specified by the end user to the containerd when spawning a new docker instance with help from `runc` component, which results in the `--oom-kill-disable` doesn't work no matter the flag is `true` or `false`. This PR will fix this issue reported by #36090 Signed-off-by: Dennis Chen Signed-off-by: Jianyong Wu Upstream-commit: 44b074d199de84b9af8cc94005fbed4f76bd9ab8 Component: engine --- components/engine/daemon/daemon_unix.go | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/components/engine/daemon/daemon_unix.go b/components/engine/daemon/daemon_unix.go index de9537c1b0..950de3f213 100644 --- a/components/engine/daemon/daemon_unix.go +++ b/components/engine/daemon/daemon_unix.go @@ -103,6 +103,10 @@ func getMemoryResources(config containertypes.Resources) *specs.LinuxMemory { memory.Swappiness = &swappiness } + if config.OomKillDisable != nil { + memory.DisableOOMKiller = config.OomKillDisable + } + if config.KernelMemory != 0 { memory.Kernel = &config.KernelMemory } From 607349c14fa4c6075b3474500f0a4b0d78c5719a Mon Sep 17 00:00:00 2001 From: Yong Tang Date: Sun, 4 Feb 2018 17:38:04 +0000 Subject: [PATCH 3/4] Migrates TestContainersAPINetworkMountsNoChown to api tests This fix migrates TestContainersAPINetworkMountsNoChown from integration-cli to api tests in integration. Signed-off-by: Yong Tang Upstream-commit: c028da3557cc0e9f80aee9b08118e9947e1fa57a Component: engine --- .../docker_api_containers_unix_test.go | 77 ------------------- .../container/mounts_linux_test.go | 59 ++++++++++++++ 2 files changed, 59 insertions(+), 77 deletions(-) delete mode 100644 components/engine/integration-cli/docker_api_containers_unix_test.go diff --git a/components/engine/integration-cli/docker_api_containers_unix_test.go b/components/engine/integration-cli/docker_api_containers_unix_test.go deleted file mode 100644 index 4964f52644..0000000000 --- a/components/engine/integration-cli/docker_api_containers_unix_test.go +++ /dev/null @@ -1,77 +0,0 @@ -// +build !windows - -package main - -import ( - "io/ioutil" - "os" - "path/filepath" - - "github.com/docker/docker/api/types" - containertypes "github.com/docker/docker/api/types/container" - mounttypes "github.com/docker/docker/api/types/mount" - networktypes "github.com/docker/docker/api/types/network" - "github.com/docker/docker/client" - "github.com/docker/docker/integration-cli/checker" - "github.com/docker/docker/pkg/ioutils" - "github.com/docker/docker/pkg/system" - "github.com/go-check/check" - "github.com/stretchr/testify/assert" - "golang.org/x/net/context" -) - -func (s *DockerSuite) TestContainersAPINetworkMountsNoChown(c *check.C) { - // chown only applies to Linux bind mounted volumes; must be same host to verify - testRequires(c, DaemonIsLinux, SameHostDaemon) - - tmpDir, err := ioutils.TempDir("", "test-network-mounts") - c.Assert(err, checker.IsNil) - defer os.RemoveAll(tmpDir) - - // make tmp dir readable by anyone to allow userns process to mount from - err = os.Chmod(tmpDir, 0755) - c.Assert(err, checker.IsNil) - // create temp files to use as network mounts - tmpNWFileMount := filepath.Join(tmpDir, "nwfile") - - err = ioutil.WriteFile(tmpNWFileMount, []byte("network file bind mount"), 0644) - c.Assert(err, checker.IsNil) - - config := containertypes.Config{ - Image: "busybox", - } - hostConfig := containertypes.HostConfig{ - Mounts: []mounttypes.Mount{ - { - Type: "bind", - Source: tmpNWFileMount, - Target: "/etc/resolv.conf", - }, - { - Type: "bind", - Source: tmpNWFileMount, - Target: "/etc/hostname", - }, - { - Type: "bind", - Source: tmpNWFileMount, - Target: "/etc/hosts", - }, - }, - } - - cli, err := client.NewEnvClient() - c.Assert(err, checker.IsNil) - defer cli.Close() - - ctrCreate, err := cli.ContainerCreate(context.Background(), &config, &hostConfig, &networktypes.NetworkingConfig{}, "") - c.Assert(err, checker.IsNil) - // container will exit immediately because of no tty, but we only need the start sequence to test the condition - err = cli.ContainerStart(context.Background(), ctrCreate.ID, types.ContainerStartOptions{}) - c.Assert(err, checker.IsNil) - - // check that host-located bind mount network file did not change ownership when the container was started - statT, err := system.Stat(tmpNWFileMount) - c.Assert(err, checker.IsNil) - assert.Equal(c, uint32(0), statT.UID(), "bind mounted network file should not change ownership from root") -} diff --git a/components/engine/integration/container/mounts_linux_test.go b/components/engine/integration/container/mounts_linux_test.go index 8c13258c30..eab0fd5d74 100644 --- a/components/engine/integration/container/mounts_linux_test.go +++ b/components/engine/integration/container/mounts_linux_test.go @@ -9,8 +9,15 @@ import ( "github.com/docker/docker/api/types" "github.com/docker/docker/api/types/container" "github.com/docker/docker/api/types/mount" + "github.com/docker/docker/api/types/network" + "github.com/docker/docker/client" "github.com/docker/docker/integration-cli/daemon" "github.com/docker/docker/pkg/stdcopy" + "github.com/docker/docker/pkg/system" + "github.com/gotestyourself/gotestyourself/fs" + "github.com/gotestyourself/gotestyourself/skip" + "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" ) func TestContainerShmNoLeak(t *testing.T) { @@ -82,3 +89,55 @@ func TestContainerShmNoLeak(t *testing.T) { t.Fatalf("mount leaked: %s", string(out)) } } + +func TestContainerNetworkMountsNoChown(t *testing.T) { + // chown only applies to Linux bind mounted volumes; must be same host to verify + skip.If(t, testEnv.DaemonInfo.OSType != "linux" || !testEnv.IsLocalDaemon()) + + defer setupTest(t)() + + ctx := context.Background() + + tmpDir := fs.NewDir(t, "network-file-mounts", fs.WithMode(0755), fs.WithFile("nwfile", "network file bind mount", fs.WithMode(0644))) + defer tmpDir.Remove() + + tmpNWFileMount := tmpDir.Join("nwfile") + + config := container.Config{ + Image: "busybox", + } + hostConfig := container.HostConfig{ + Mounts: []mount.Mount{ + { + Type: "bind", + Source: tmpNWFileMount, + Target: "/etc/resolv.conf", + }, + { + Type: "bind", + Source: tmpNWFileMount, + Target: "/etc/hostname", + }, + { + Type: "bind", + Source: tmpNWFileMount, + Target: "/etc/hosts", + }, + }, + } + + cli, err := client.NewEnvClient() + require.NoError(t, err) + defer cli.Close() + + ctrCreate, err := cli.ContainerCreate(ctx, &config, &hostConfig, &network.NetworkingConfig{}, "") + require.NoError(t, err) + // container will exit immediately because of no tty, but we only need the start sequence to test the condition + err = cli.ContainerStart(ctx, ctrCreate.ID, types.ContainerStartOptions{}) + require.NoError(t, err) + + // check that host-located bind mount network file did not change ownership when the container was started + statT, err := system.Stat(tmpNWFileMount) + require.NoError(t, err) + assert.Equal(t, uint32(0), statT.UID(), "bind mounted network file should not change ownership from root") +} From 20243d64215f2ce2952df9f28d175489ea682807 Mon Sep 17 00:00:00 2001 From: Yong Tang Date: Tue, 6 Feb 2018 17:11:39 +0000 Subject: [PATCH 4/4] Combine runSimpleContainer with runContainer for rename test As there is already a runSimpleContainer, I think it makes sense to combine runSimpleContainer with runContainer for rename test to reduce code duplication. Signed-off-by: Yong Tang Upstream-commit: 203d871658104b00099d818425b25f4cd1eff55b Component: engine --- .../integration/container/rename_test.go | 65 ++++--------------- 1 file changed, 11 insertions(+), 54 deletions(-) diff --git a/components/engine/integration/container/rename_test.go b/components/engine/integration/container/rename_test.go index cf3675734a..e7f648cae6 100644 --- a/components/engine/integration/container/rename_test.go +++ b/components/engine/integration/container/rename_test.go @@ -7,22 +7,11 @@ import ( "github.com/docker/docker/api/types" "github.com/docker/docker/api/types/container" "github.com/docker/docker/api/types/network" - "github.com/docker/docker/api/types/strslice" - "github.com/docker/docker/client" "github.com/docker/docker/integration/util/request" "github.com/stretchr/testify/assert" "github.com/stretchr/testify/require" ) -func runContainer(ctx context.Context, t *testing.T, client client.APIClient, cntCfg *container.Config, hstCfg *container.HostConfig, nwkCfg *network.NetworkingConfig, cntName string) string { - cnt, err := client.ContainerCreate(ctx, cntCfg, hstCfg, nwkCfg, cntName) - require.NoError(t, err) - - err = client.ContainerStart(ctx, cnt.ID, types.ContainerStartOptions{}) - require.NoError(t, err) - return cnt.ID -} - // This test simulates the scenario mentioned in #31392: // Having two linked container, renaming the target and bringing a replacement // and then deleting and recreating the source container linked to the new target. @@ -32,57 +21,25 @@ func TestRenameLinkedContainer(t *testing.T) { ctx := context.Background() client := request.NewAPIClient(t) - cntConfig := &container.Config{ - Image: "busybox", - Tty: true, - Cmd: strslice.StrSlice([]string{"top"}), - } + aID := runSimpleContainer(ctx, t, client, "a0") - var ( - aID, bID string - cntJSON types.ContainerJSON - err error - ) + bID := runSimpleContainer(ctx, t, client, "b0", func(config *container.Config, hostConfig *container.HostConfig, networkingConfig *network.NetworkingConfig) { + hostConfig.Links = []string{"a0"} + }) - aID = runContainer(ctx, t, client, - cntConfig, - &container.HostConfig{}, - &network.NetworkingConfig{}, - "a0", - ) - - bID = runContainer(ctx, t, client, - cntConfig, - &container.HostConfig{ - Links: []string{"a0"}, - }, - &network.NetworkingConfig{}, - "b0", - ) - - err = client.ContainerRename(ctx, aID, "a1") + err := client.ContainerRename(ctx, aID, "a1") require.NoError(t, err) - runContainer(ctx, t, client, - cntConfig, - &container.HostConfig{}, - &network.NetworkingConfig{}, - "a0", - ) + runSimpleContainer(ctx, t, client, "a0") err = client.ContainerRemove(ctx, bID, types.ContainerRemoveOptions{Force: true}) require.NoError(t, err) - bID = runContainer(ctx, t, client, - cntConfig, - &container.HostConfig{ - Links: []string{"a0"}, - }, - &network.NetworkingConfig{}, - "b0", - ) + bID = runSimpleContainer(ctx, t, client, "b0", func(config *container.Config, hostConfig *container.HostConfig, networkingConfig *network.NetworkingConfig) { + hostConfig.Links = []string{"a0"} + }) - cntJSON, err = client.ContainerInspect(ctx, bID) + inspect, err := client.ContainerInspect(ctx, bID) require.NoError(t, err) - assert.Equal(t, []string{"/a0:/b0/a0"}, cntJSON.HostConfig.Links) + assert.Equal(t, []string{"/a0:/b0/a0"}, inspect.HostConfig.Links) }