toolshed/docker-cli
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
7,752 Commits 3 Branches 295 Tags
da3f4afb39dfd96f74f7c13666b1f81d15023ef6
Commit Graph

109 Commits

Author SHA1 Message Date
Michael Crosby
72d2138bac Update init for new apparmor import path 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
Upstream-commit: fa5cabf9fe9e257d64638043ca2fd08a7bf96cb3
Component: engine
 2014-04-24 10:35:20 -07:00
Michael Crosby
8ab9384720 Move capabilities into security pkg 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
Upstream-commit: 7a0b3610664c2269fd5932f294adae72e6e54020
Component: engine
 2014-04-24 10:35:20 -07:00
Michael Crosby
c05360ff3b Move rest of console functions to pkg 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
Upstream-commit: a949d39f195e7b87288b10b0ef31843e6a3d8eb0
Component: engine
 2014-04-24 10:35:20 -07:00
Michael Crosby
0099e7d236 Refactor mounts into pkg to make changes easier 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
Upstream-commit: 05b611574f85c7ff7d479e04e01ac2b57b233591
Component: engine
 2014-04-24 10:35:20 -07:00
Michael Crosby
0cfbbc14e7 Move console into its own package 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
Upstream-commit: de3d51b0a824e31d7e245aed958d53f436456699
Component: engine
 2014-04-24 10:35:20 -07:00
Michael Crosby
a750afc31e Mount over dev and only copy allowed nodes in 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
Upstream-commit: 5ba1242bdc309352c2b0b9a1ef9e07fe835e4857
Component: engine
 2014-04-24 10:35:20 -07:00
Michael Crosby
20ba5d97da No not mount sysfs by default for non privilged containers 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
Upstream-commit: 81e5026a6afb282589704fd5f6bcac9ed50108ea
Component: engine
 2014-04-24 10:35:20 -07:00
Michael Crosby
9da373d6b1 Add restrictions to proc in libcontainer 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
Upstream-commit: 60a90970bc4add3547064004f08c19ab5027141b
Component: engine
 2014-04-24 10:35:19 -07:00
Michael Crosby
4b4b1b7313 Move apparmor into security sub dir 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
Upstream-commit: d26ea78e42ebf18219b88e01c6252f30aa764aa2
Component: engine
 2014-04-24 10:35:19 -07:00
Guillaume J. Charmes
e178abd17a Merge pull request #5328 from crosbymichael/refactor-cgroups 
Refactor cgroups into subsystems and support metrics
Upstream-commit: 781671245778c8cfdde1892204bb10899020b0d8
Component: engine
 2014-04-21 14:06:17 -07:00
Michael Crosby
fec63c3950 Move raw cgroups into fs package (filesystem) 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
Upstream-commit: 06db0604e5e5438dc14e13a069ebddcab7bb4bc6
Component: engine
 2014-04-18 21:34:26 -07:00
Michael Crosby
91235494a6 Move systemd code into pkg 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
Upstream-commit: ec43ec50b44cff3f043c78cad97466c68e2ba8cd
Component: engine
 2014-04-18 21:30:08 -07:00
Michael Crosby
0b62a2c5be Refactor cgroups file locations 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
Upstream-commit: 42fb2973c690fe4e4f65da235ce4dfa4c388e8a3
Component: engine
 2014-04-18 21:14:58 -07:00
Michael Crosby
ebb2ad0565 Move apparmor to top level pkg 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
Upstream-commit: 052cc5a6378ee4bbe1ef79e5632e2439d68ddbde
Component: engine
 2014-04-13 23:33:25 +00:00
Michael Crosby
855754fa1c Change shm mode to 1777 
Fixes #5126
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
Upstream-commit: 986cf931c38b8cdc51da44af0313502ca1156cfc
Component: engine
 2014-04-09 10:53:32 +00:00
Michael Crosby
ba83763b84 Ensure that ro mounts are remounted 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
Upstream-commit: b6042f252dd8a0c7a75da481b667f89c2e4ab071
Component: engine
 2014-04-07 18:23:22 -07:00
Michael Crosby
f11e4187aa Remove loopback setup for native driver 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
Upstream-commit: 18ef3cc24a933cbf403c2aaf8b374cfc84a722a4
Component: engine
 2014-04-02 13:12:52 +00:00
Victor Vieux
c93b9fc839 Merge pull request #4953 from rhatdan/selinux 
These two patches should fix problems we see with running docker in the wild.
Upstream-commit: 9687c087ab09feb106b040628423e70b320a51e2
Component: engine
 2014-04-02 16:36:41 -07:00
unclejack
4675670b52 Merge pull request #4867 from crosbymichael/clean-shutdown 
Cleanly shutdown docker
Upstream-commit: 30ff3fa954676bfc8f48b73093f3afa1473d146e
Component: engine
 2014-04-02 01:48:03 +03:00
Michael Crosby
55905d7fbc Merge pull request #4942 from vieux/cleanup_dev_libcontainer 
remove setupDev from libcontainer
Upstream-commit: 9cf89f854256eace2b8f446b16c4fbe22ffa61b1
Component: engine
 2014-04-01 14:28:17 -07:00
Dan Walsh
94c4d19652 In certain cases, setting the process label will not happen. 
When the code attempts to set the ProcessLabel, it checks if SELinux Is
enabled.  We have seen a case with some of our patches where the code
is fooled by the container to think that SELinux is not enabled.  Calling
label.Init before setting up the rest of the container, tells the library that
SELinux is enabled and everything works fine.

Docker-DCO-1.1-Signed-off-by: Dan Walsh <dwalsh@redhat.com> (github: rhatdan)
Upstream-commit: 2224e0d65adfbd08e53430a1d7c750491f788257
Component: engine
 2014-04-01 13:30:10 -04:00
Michael Crosby
d0b2920666 Don't send prctl to be consistent with other drivers 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
Upstream-commit: 283daced0c919be760947d44d7e46c80e1054d64
Component: engine
 2014-04-01 07:12:50 +00:00
Michael Crosby
5f13c09028 Ensure a reliable way to kill ghost containers on reboot 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
Upstream-commit: 5bb82f6313d7f789783ffac854be85a44a56617e
Component: engine
 2014-04-01 07:11:41 +00:00
Victor Vieux
5505d168ef remove setupDev from libcontainer 
Docker-DCO-1.1-Signed-off-by: Victor Vieux <victor.vieux@docker.com> (github: vieux)
Upstream-commit: d52d24dd801f3ffe1b894226b8dba613de59bd87
Component: engine
 2014-04-01 00:28:44 +00:00
Alexander Larsson
4a0326289d cgroups: Splity out Apply/Cleanup to separate file/interface 
This leaves only the generic cgroup helper functions in cgroups.go and
will allow easy implementations of other cgroup managers.

This also wires up the call to Cleanup the cgroup which was missing
before.

Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
Upstream-commit: 7f7d8419a71d49b25e4d38196b36e93b568bb61d
Component: engine
 2014-03-27 21:47:47 +01:00
Michael Crosby
f4111a1ccb Merge branch 'master' into pluginflag 
Conflicts:
	pkg/cgroups/cgroups.go
	pkg/libcontainer/nsinit/exec.go
	pkg/libcontainer/nsinit/init.go
	pkg/libcontainer/nsinit/mount.go
	runconfig/hostconfig.go
	runconfig/parse.go
	runtime/execdriver/driver.go
	runtime/execdriver/lxc/lxc_template.go
	runtime/execdriver/lxc/lxc_template_unit_test.go
	runtime/execdriver/native/default_template.go
	runtime/execdriver/native/driver.go

Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
Upstream-commit: eab56ac007b263708b5526609c8be2bc19881467
Component: engine
 2014-03-27 08:00:18 +00:00
Dan Walsh
f757666ccd This patch adds SELinux labeling support. 
docker will run the process(es) within the container with an SELinux label and will label
all of  the content within the container with mount label.  Any temporary file systems
created within the container need to be mounted with the same mount label.

The user can override the process label by specifying

-Z With a string of space separated options.

-Z "user=unconfined_u role=unconfined_r type=unconfined_t level=s0"

Would cause the process label to run with unconfined_u:unconfined_r:unconfined_t:s0"

By default the processes will run execute within the container as svirt_lxc_net_t.
All of the content in the container as svirt_sandbox_file_t.

The process mcs level is based of the PID of the docker process that is creating the container.

If you run the container in --priv mode, the labeling will be disabled.

Docker-DCO-1.1-Signed-off-by: Dan Walsh <dwalsh@redhat.com> (github: rhatdan)
Upstream-commit: 4c4356692580afb3971094e322aea64abe0e2500
Component: engine
 2014-03-26 15:30:40 -04:00
Michael Crosby
9fad5483e0 Change placement of readonly filesystem 
We need to change it to read only at the very end so that bound,
copy dev nodes and other ops do not fail.
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
Upstream-commit: 2c58a1e2886433a4266615b1f492f829e7a6f53f
Component: engine
 2014-03-21 14:17:17 +00:00
Michael Crosby
b80ed35d06 Merge branch 'proppy-nsinit' into pluginflag 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
Upstream-commit: 1bedae9107108156d6d272494f1ff27d8b4be590
Component: engine
 2014-03-21 00:36:23 +00:00
Michael Crosby
c42d40863c Add ability to work with individual namespaces 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
Upstream-commit: 70f3b9f4ce67ee54ec226814cdd26db01f69378d
Component: engine
 2014-03-21 00:23:34 +00:00
Johan Euphrosine
433a941c61 libcontainer: remove duplicate imports 
Docker-DCO-1.1-Signed-off-by: Johan Euphrosine <proppy@google.com> (github: proppy)
Upstream-commit: 5dbfe310fe624c66714f8c5017692f528af4c87f
Component: engine
 2014-03-18 16:25:26 -07:00
Johan Euphrosine
bf68195445 libcontainer: goimports 
Docker-DCO-1.1-Signed-off-by: Johan Euphrosine <proppy@google.com> (github: proppy)
Upstream-commit: f58757a699cf47c3b8770e13f371e1bbf493b5b1
Component: engine
 2014-03-18 16:18:34 -07:00
Johan Euphrosine
05b01b0f64 libcontainer/nsinit/init: move mount namespace after network 
Docker-DCO-1.1-Signed-off-by: Johan Euphrosine <proppy@google.com> (github: proppy)
Upstream-commit: b10b950b110c93db34a399753706dc79c71b94d3
Component: engine
 2014-03-18 16:18:04 -07:00
Michael Crosby
2d58b8bf60 Only unshare the mount namespace for execin 
Fixes #4728
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
Upstream-commit: 4b1513f9c394fbfdf21998db4318251b4e8b6bc0
Component: engine
 2014-03-17 18:52:56 -07:00
Timothy Hobbs
ccebbeffe2 Fix issue #4681 - No loopback interface within container when networking is disabled. 
Docker-DCO-1.1-Signed-off-by: Timothy Hobbs <timothyhobbs@seznam.cz> (github: https://github.com/timthelion)

Remove loopback code from veth strategy

Docker-DCO-1.1-Signed-off-by: Timothy Hobbs <timothyhobbs@seznam.cz> (github: https://github.com/timthelion)

Looback strategy: Get rid of uneeded code in Create
Docker-DCO-1.1-Signed-off-by: Timothy Hobbs <timothyhobbs@seznam.cz> (github: https://github.com/timthelion)

Use append when building network strategy list

Docker-DCO-1.1-Signed-off-by: Timothy Hobbs <timothyhobbs@seznam.cz> (github: https://github.com/timthelion)

Swap loopback and veth strategies in Networks list

Docker-DCO-1.1-Signed-off-by: Timothy Hobbs <timothyhobbs@seznam.cz> (github: https://github.com/timthelion)

Revert "Swap loopback and veth strategies in Networks list"

This reverts commit 3b8b2c8454171d79bed5e9a80165172617e92fc7.

Docker-DCO-1.1-Signed-off-by: Timothy Hobbs <timothyhobbs@seznam.cz> (github: https://github.com/timthelion)

When initializing networks, only return from the loop if there is an error

Docker-DCO-1.1-Signed-off-by: Timothy Hobbs <timothyhobbs@seznam.cz> (github: https://github.com/timthelion)
Upstream-commit: 353df19ab7009f6555dee506841ae0b690a08768
Component: engine
 2014-03-17 22:01:24 +01:00
Guillaume J. Charmes
4ff432cad1 Merge pull request #4645 from crosbymichael/add-logger 
Add logger to libcontainer
Upstream-commit: 597e0812fb8a40cf73388bcc44e6be74035a9846
Component: engine
 2014-03-17 11:30:14 -07:00
Michael Crosby
842270ca38 Send sigterm to child instead of sigkill 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
Upstream-commit: 39037a91f85a4a072e5aa7e585d8c2f6b211df8a
Component: engine
 2014-03-14 15:42:05 -07:00
Michael Crosby
0d0170bb11 Add stderr log ouput if in debug 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
Upstream-commit: 0e863a584a6edfa1c3ec383c586b646663b66bc7
Component: engine
 2014-03-14 09:55:05 -07:00
Michael Crosby
3f944b4fd6 Add initial logging to libcontainer 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
Upstream-commit: 7294392c729de4c5884eb967f192b34a1d8857a7
Component: engine
 2014-03-14 09:55:05 -07:00
Michael Crosby
1080c0f16b Merge pull request #4656 from crosbymichael/fix-ptmx-link 
Always symlink /dev/ptmx for libcontainer
Upstream-commit: 28994f86eef11074f613433893ef345321afef91
Component: engine
 2014-03-13 14:57:17 -07:00
Michael Crosby
75217fbf0a Always symlink /dev/ptmx for libcontainer 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
Upstream-commit: 747275d30c4d4eb25ca798394cc04db00912adb2
Component: engine
 2014-03-13 14:31:09 -07:00
Alexander Larsson
746b307c72 Move all bind-mounts in the container inside the namespace 
This moves the bind mounts like /.dockerinit, /etc/hostname, volumes,
etc into the container namespace, by setting them up using lxc.

This is useful to avoid littering the global namespace with a lot of
mounts that are internal to each container and are not generally
needed on the outside. In particular, it seems that having a lot of
mounts is problematic wrt scaling to a lot of containers on systems
where the root filesystem is mounted --rshared.

Note that the "private" option is only supported by the native driver, as
lxc doesn't support setting this. This is not a huge problem, but it does
mean that some mounts are unnecessarily shared inside the container if you're
using the lxc driver.

Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
Upstream-commit: 6c266c4b42eeabe2d433a994753d86637fe52a0b
Component: engine
 2014-03-13 20:01:29 +01:00
srid
8f3c1c1399 nsinit: prefix errors with their source 
Docker-DCO-1.1-Signed-off-by: Sridhar Ratnakumar <github@srid.name> (github: srid)
Upstream-commit: 03211ecce07ab64f5263232e1aa3c6248530c5b4
Component: engine
 2014-03-10 17:08:50 -07:00
Michael Crosby
957f74b876 Add env var to toggle pivot root or ms_move 
Use the  DOCKER_RAMDISK env var to tell the native driver not to use
a pivot root when setting up the rootfs of a container.
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
Upstream-commit: 36dd124b16a76704a88142fa96bb4bb6260dd821
Component: engine
 2014-03-06 19:30:52 -08:00
Michael Crosby
6f0ad9195c Revert "Revert "libcontainer: Use pivot_root instead of chroot"" 
This reverts commit 82f797f14096430c3edbace1cd30e04a483ec41f.

Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
Upstream-commit: c38635020accaffa6868f19f308042be051132a0
Component: engine
 2014-03-06 17:19:59 -08:00
Michael Crosby
3e4d7be838 Revert "Revert "libcontainer: Use MS_PRIVATE instead of MS_SLAVE"" 
This reverts commit bd263f5b15b51747e3429179fef7fcb425ccbe4a.

Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
Upstream-commit: 557e4fef4418a251dd3a6817b97e5c1be055cbf3
Component: engine
 2014-03-06 17:19:47 -08:00
unclejack
9ba4572a15 Merge pull request #4512 from crosbymichael/no-pivot-root 
No pivot root because of ramdisk
Upstream-commit: 78dc1ede5202c8867e011582af8752810f817e9f
Component: engine
 2014-03-07 02:54:03 +02:00
Michael Crosby
d96ead6498 Revert "libcontainer: Use MS_PRIVATE instead of MS_SLAVE" 
This reverts commit 757b5775725fb90262cee1fa6068fa9dcbbff59f.

Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
Upstream-commit: bd263f5b15b51747e3429179fef7fcb425ccbe4a
Component: engine
 2014-03-06 16:41:03 -08:00
Michael Crosby
cf4ed6c883 Revert "libcontainer: Use pivot_root instead of chroot" 
This reverts commit 5b5c884cc8266d0c2a56da0bc2df14cc9d5d85e8.

Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
Upstream-commit: 82f797f14096430c3edbace1cd30e04a483ec41f
Component: engine
 2014-03-06 16:32:06 -08:00
Michael Crosby
c896586b70 Ensure that native containers die with the parent 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
Upstream-commit: ea9bce8724303656c87c05e9049272258c9827b3
Component: engine
 2014-03-06 16:30:56 -08:00