6835a0cd51
Merge pull request #5506 from crosbymichael/add-system-maintainer
...
Add system maintainers
Upstream-commit: 2fc5bed61d14d22a5d50afc5416c87930c5fbd96
Component: engine
2014-04-30 14:14:21 -07:00
bf18e83e5d
Merge pull request #5464 from tianon/close-leftover-fds
...
Upstream-commit: e88ef454b7a8705570623e6d26f51731b8300e0f
Component: engine
2014-04-30 12:27:52 -07:00
b55f9defa8
Add system maintainers
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com > (github: crosbymichael)
Upstream-commit: 6203d8b462ee9dbc42b651ac8b6b2d83b9eef963
Component: engine
2014-04-30 12:01:06 -07:00
a71820a585
FIXES #5398 : pkg/graphdb build only dependent on cgo tag
...
Docker-DCO-1.1-Signed-off-by: Bryan Matsuo <bryan.matsuo@gmail.com > (github: bmatsuo)
Upstream-commit: 99284a24e76bf52582e5b70ad28b6371bd4f4b42
Component: engine
2014-04-30 11:57:10 -06:00
bde45636d6
Fix various MAINTAINERS format inconsistencies
...
Docker-DCO-1.1-Signed-off-by: Andrew Page <admwiggin@gmail.com > (github: tianon)
Upstream-commit: defecac2799ca0c72532b7e6ed6005cc54ee2e25
Component: engine
2014-04-30 11:22:11 -06:00
23a6b19cdc
beam: Add more tests to unix_test.go
...
These are failing, and indicate things that need to be fixed. The
primarily problem is the lack of framing between beam messages.
Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com > (github: alexlarsson)
[solomon@docker.com: rebased on master]
Signed-off-by: Solomon Hykes <solomon@docker.com>
Upstream-commit: e802b69146ac7a008d943a3a289fba56150b4f81
Component: engine
2014-04-30 02:10:09 -07:00
2256dd9cdf
Update pkg/apparmor to provide a better error message when apparmor_parser cannot be found
...
Docker-DCO-1.1-Signed-off-by: Andrew Page <admwiggin@gmail.com > (github: tianon)
Upstream-commit: a1a9baf926ff8ec2bd7ba0dd39cf3a9eb5fab1d3
Component: engine
2014-04-29 23:19:21 -06:00
614fad87b9
Close extraneous file descriptors in containers
...
Without this patch, containers inherit the open file descriptors of the daemon, so my "exec 42>&2" allows us to "echo >&42 some nasty error with some bad advice" directly into the daemon log. :)
Also, "hack/dind" was already doing this due to issues caused by the inheritance, so I'm removing that hack too since this patch obsoletes it by generalizing it for all containers.
Docker-DCO-1.1-Signed-off-by: Andrew Page <admwiggin@gmail.com > (github: tianon)
Upstream-commit: d5d62ff95574a48816890d8d6e0785a79f559c3c
Component: engine
2014-04-29 16:45:28 -06:00
fdcad5e0a4
Merge pull request #5476 from rjnagal/libcontainer-fixes
...
Cleanup cgroups on Set failures
Upstream-commit: bf59e6723274c6d20d7c78c683b5c8923a6d910e
Component: engine
2014-04-29 12:27:31 -07:00
3267a2a3bd
Cleanup existing controllers when cleanup fails mid-way.
...
Docker-DCO-1.1-Signed-off-by: Rohit Jnagal <jnagal@google.com > (github: rjnagal)
Upstream-commit: 070747a21365959d3179d8df627d3e614318e202
Component: engine
2014-04-29 18:59:20 +00:00
a55ecec598
Add mountlabel to dev
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com > (github: crosbymichael)
Upstream-commit: 0c7143b32386c62cccd529de69abf88df938757d
Component: engine
2014-04-29 03:41:44 -07:00
b1dafd91c1
Update process labels to be set at create not start
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com > (github: crosbymichael)
Upstream-commit: 46e05ed2d96efca9bdb466d20138fde1994769ba
Component: engine
2014-04-29 03:40:05 -07:00
58dae079fd
Fix SELinux errors caused by multi-threading
...
Occasionally the selinux_test program will fail because we are setting file
context based on the Process ID but not the TID. THis change will always
use the TID to set SELinux labels.
Docker-DCO-1.1-Signed-off-by: Daniel Walsh <dwalsh@redhat.com > (github: rhatdan)
Docker-DCO-1.1-Signed-off-by: Dan Walsh <dwalsh@redhat.com > (github: crosbymichael)
Upstream-commit: 12934ef3a40d814cb307dfea0cc86124ec997593
Component: engine
2014-04-29 03:40:05 -07:00
a5f91ab172
This patch reworks the SELinux patch to be only run on demand by the daemon
...
Added --selinux-enable switch to daemon to enable SELinux labeling.
The daemon will now generate a new unique random SELinux label when a
container starts, and remove it when the container is removed. The MCS
labels will be stored in the daemon memory. The labels of containers will
be stored in the container.json file.
When the daemon restarts on boot or if done by an admin, it will read all containers json files and reserve the MCS labels.
A potential problem would be conflicts if you setup thousands of containers,
current scheme would handle ~500,000 containers.
Docker-DCO-1.1-Signed-off-by: Dan Walsh <dwalsh@redhat.com > (github: rhatdan)
Docker-DCO-1.1-Signed-off-by: Dan Walsh <dwalsh@redhat.com > (github: crosbymichael)
Upstream-commit: b7942ec2ca7c7568df0c3b7eb554b05e2c3a3081
Component: engine
2014-04-29 03:40:05 -07:00
2acb87c29f
Initial work on selinux patch
...
This has every container using the docker daemon's pid for the processes
label so it does not work correctly.
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com > (github: crosbymichael)
Upstream-commit: f0e6e135a8d733af173bf0b8732c704c9ec716d7
Component: engine
2014-04-29 03:40:05 -07:00
d43500e59b
Merge pull request #5455 from rjnagal/cgroup-stats
...
Add throttling stats for cpu cgroup
Upstream-commit: 69d56acd455de019cb324c4607c629be8d6fcad5
Component: engine
2014-04-28 17:53:37 -07:00
f2e5f328eb
Another test to check for invalid stats.
...
Docker-DCO-1.1-Signed-off-by: Rohit Jnagal <jnagal@google.com > (github: rjnagal)
Upstream-commit: d724242297bf2981ad9c7745e5b130ab7fa8f067
Component: engine
2014-04-29 00:32:05 +00:00
28c69597af
Add cpu throttling stats.
...
Docker-DCO-1.1-Signed-off-by: Rohit Jnagal <jnagal@google.com > (github: rjnagal)
Upstream-commit: 61f156d5215b2c9d38e26bbd732c6e9cb9a3208e
Component: engine
2014-04-29 00:18:18 +00:00
efc42748f5
Merge pull request #5451 from vmarmol/add-memory-stats
...
Adding a unit test for stats in pkg/cgroup/fs/memory.go
Upstream-commit: 5b3f7851d89be189c8daf2fa02d6bc39317c466a
Component: engine
2014-04-28 16:38:34 -07:00
b3f05f4dd1
Merge pull request #5449 from tianon/remove-libcontainer-root-special-case
...
Remove "root" and "" special cases in libcontainer
Upstream-commit: eb6a1c9f499b5e0abbc1f5e040d69f1802deeb2f
Component: engine
2014-04-28 16:29:08 -07:00
7fb7f768a7
Merge branch 'master' into libcontainer-fixes
...
Conflicts:
pkg/libcontainer/README.md
pkg/libcontainer/container.json
Docker-DCO-1.1-Signed-off-by: Rohit Jnagal <jnagal@google.com > (github: rjnagal)
Upstream-commit: c44c51e3ce1680ec2a74fc62f246490f61d7590c
Component: engine
2014-04-28 23:04:04 +00:00
f9852087ba
Adding a unit test for pkg/cgroup/fs/memory.go
...
Docker-DCO-1.1-Signed-off-by: Victor Marmol <vmarmol@google.com > (github: vmarmol)
Upstream-commit: 76f95294a316c1b545abe1fd17536da74779490b
Component: engine
2014-04-28 22:58:25 +00:00
a196538cc3
Remove "root" and "" special cases in libcontainer
...
These are unnecessary since the user package handles these cases properly already (as evidenced by the LXC backend not having these special cases).
I also updated the errors returned to match the other libcontainer error messages in this same file.
Also, switching from Setresuid to Setuid directly isn't a problem, because the "setuid" system call will automatically do that if our own effective UID is root currently: (from `man 2 setuid`)
setuid() sets the effective user ID of the calling process. If the
effective UID of the caller is root, the real UID and saved set-user-
ID are also set.
Docker-DCO-1.1-Signed-off-by: Andrew Page <admwiggin@gmail.com > (github: tianon)
Upstream-commit: d98069030dc842741fdff16e1818f2a34ec0167f
Component: engine
2014-04-28 16:46:03 -06:00
243c5c4d55
Merge pull request #5412 from vmarmol/add-blkio-test
...
Adding a test for blkio stats.
Upstream-commit: b386f2f558693a6b2c3578e5b0d876585be60df2
Component: engine
2014-04-28 12:50:20 -07:00
3f86c0fccf
Merge pull request #5394 from vmarmol/add-croup-memory-stats
...
Add memory usage and max usage stats.
Upstream-commit: 3c5bac034862568f92e7bc5c7b8e4b313aea2b29
Component: engine
2014-04-28 12:44:34 -07:00
2e76f7d9a4
Adding a test for blkio stats.
...
Also adds a test utility we can use for other cgroup tests.
Docker-DCO-1.1-Signed-off-by: Victor Marmol <vmarmol@google.com > (github: vmarmol)
Upstream-commit: f4055ee2a467458d4848ad6f8e79fc0162d377f9
Component: engine
2014-04-26 07:29:13 +00:00
f2b5fc4e3c
Merge pull request #5411 from crosbymichael/lockdown
...
Update default restrictions for exec drivers
Upstream-commit: 44140f7909ac65206d300fa9a39ae06cc27d1847
Component: engine
2014-04-26 03:27:56 +03:00
c0a79693ae
Updated sample config to be usable. We should change the namespace
...
config to not need "value" later.
Docker-DCO-1.1-Signed-off-by: Rohit Jnagal <jnagal@google.com > (github: rjnagal)
Upstream-commit: 8cdb720d26197e448587a21894069ee8a20e8aa0
Component: engine
2014-04-25 21:10:23 +00:00
ecc3df07ca
Updated sample config and README to match the default template for
...
native execdriver.
Docker-DCO-1.1-Signed-off-by: Rohit Jnagal <jnagal@google.com > (github: rjnagal)
Upstream-commit: 24f978094dc5c9eae0ca60001b65256b2b30f2c8
Component: engine
2014-04-25 06:02:30 +00:00
6e7ac095e3
Add memory usage and max usage stats.
...
Docker-DCO-1.1-Signed-off-by: Victor Marmol <vmarmol@google.com > (github: vmarmol)
Upstream-commit: ad924959a9879af7477fa23c19d570882c1f378f
Component: engine
2014-04-25 02:51:28 +00:00
4c71977a35
Improved README formatting.
...
Docker-DCO-1.1-Signed-off-by: Rohit Jnagal <jnagal@google.com > (github: rjnagal)
Upstream-commit: 580c2620e7b92d9aee7c1cd033ca987dda161cf1
Component: engine
2014-04-25 01:23:48 +00:00
d8ab1ab869
Add enabled option to namespaces and capabilities spec in
...
container.json. Although we don't yet check for enabled everywhere.
Docker-DCO-1.1-Signed-off-by: Rohit Jnagal <jnagal@google.com > (github: rjnagal)
Upstream-commit: 569b23413502713342b605abaf917f664d206a4b
Component: engine
2014-04-25 01:10:11 +00:00
04161acf75
Fix typos in nsinit logs.
...
Docker-DCO-1.1-Signed-off-by: Rohit Jnagal <jnagal@google.com > (github: rjnagal)
Upstream-commit: 0aacca3ae6fa7d46a3e2c4e60e71f67c9a4c64e5
Component: engine
2014-04-25 00:20:14 +00:00
df00ac1430
Fix container.json sample to be loadable by nsinit.
...
Docker-DCO-1.1-Signed-off-by: Rohit Jnagal <jnagal@google.com > (github: rjnagal)
Upstream-commit: 14b2a9de874ab80aaaa942b7b8a226bb56dfcd7f
Component: engine
2014-04-25 00:17:45 +00:00
69a18c6508
Separating cgroup Memory and MemoryReservation.
...
This will allow for these to be set independently. Keep the current Docker behavior where Memory and MemoryReservation are set to the value of Memory.
Docker-DCO-1.1-Signed-off-by: Victor Marmol <vmarmol@google.com > (github: vmarmol)
Upstream-commit: f188b9f623e23ee624aca8654bf00f49ee3bae29
Component: engine
2014-04-24 11:09:38 -07:00
4269c4b6a6
Ignore isnot exists errors for proc paths
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com > (github: crosbymichael)
Upstream-commit: d5c9f61ecc1c8167322a8cc3b41f29a35c80b9b8
Component: engine
2014-04-24 10:35:20 -07:00
72d2138bac
Update init for new apparmor import path
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com > (github: crosbymichael)
Upstream-commit: fa5cabf9fe9e257d64638043ca2fd08a7bf96cb3
Component: engine
2014-04-24 10:35:20 -07:00
bccf8f7f86
Update container.json and readme
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com > (github: crosbymichael)
Upstream-commit: 2d31aeb911fc94baa88f975110c5ccd45d041acb
Component: engine
2014-04-24 10:35:20 -07:00
8ab9384720
Move capabilities into security pkg
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com > (github: crosbymichael)
Upstream-commit: 7a0b3610664c2269fd5932f294adae72e6e54020
Component: engine
2014-04-24 10:35:20 -07:00
28044eef7b
Move mounts into types.go
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com > (github: crosbymichael)
Upstream-commit: 156987c118f6f4067794e09e90aabeee0002d05c
Component: engine
2014-04-24 10:35:20 -07:00
c05360ff3b
Move rest of console functions to pkg
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com > (github: crosbymichael)
Upstream-commit: a949d39f195e7b87288b10b0ef31843e6a3d8eb0
Component: engine
2014-04-24 10:35:20 -07:00
0099e7d236
Refactor mounts into pkg to make changes easier
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com > (github: crosbymichael)
Upstream-commit: 05b611574f85c7ff7d479e04e01ac2b57b233591
Component: engine
2014-04-24 10:35:20 -07:00
0cfbbc14e7
Move console into its own package
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com > (github: crosbymichael)
Upstream-commit: de3d51b0a824e31d7e245aed958d53f436456699
Component: engine
2014-04-24 10:35:20 -07:00
a750afc31e
Mount over dev and only copy allowed nodes in
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com > (github: crosbymichael)
Upstream-commit: 5ba1242bdc309352c2b0b9a1ef9e07fe835e4857
Component: engine
2014-04-24 10:35:20 -07:00
20ba5d97da
No not mount sysfs by default for non privilged containers
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com > (github: crosbymichael)
Upstream-commit: 81e5026a6afb282589704fd5f6bcac9ed50108ea
Component: engine
2014-04-24 10:35:20 -07:00
9da373d6b1
Add restrictions to proc in libcontainer
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com > (github: crosbymichael)
Upstream-commit: 60a90970bc4add3547064004f08c19ab5027141b
Component: engine
2014-04-24 10:35:19 -07:00
4b4b1b7313
Move apparmor into security sub dir
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com > (github: crosbymichael)
Upstream-commit: d26ea78e42ebf18219b88e01c6252f30aa764aa2
Component: engine
2014-04-24 10:35:19 -07:00
4a39371d62
Add support for cpu hardcapping to cgroups.
...
Docker-DCO-1.1-Signed-off-by: Rohit Jnagal <jnagal@google.com > (github: rjnagal)
Upstream-commit: 264dc8a46bb7f7679439d0a2c41c79a09642acab
Component: engine
2014-04-24 14:43:02 +00:00
fba1cacd59
Fix Go formatting in beam and dockerscript
...
Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com > (github: shykes)
Upstream-commit: bf51f36d8f07d0c53f7b7b3c21ae372f7ca3be33
Component: engine
2014-04-22 16:16:29 -07:00
bd9345fd64
pkg/dockerscript: add MAINTAINERS file
...
Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com > (github: shykes)
Upstream-commit: 0bf2109121c3b6e12f781acc14016af451c5cd3d
Component: engine
2014-04-22 15:50:24 -07:00
Michael Crosby
Michael Crosby
Bryan Matsuo
Tianon Gravi
Alexander Larsson
Rohit Jnagal
Dan Walsh
Victor Vieux
Victor Marmol
unclejack
Solomon Hykes