Victor Marmol
adb5b13fc3
Merge pull request #5792 from bernerdschaefer/nsinit-supports-pdeathsig
...
Add PDEATHSIG support to nsinit library
Upstream-commit: cb7680b9b919fdc845a857fafc52178c656cf5be
Component: engine
2014-05-19 11:13:23 -07:00
Michael Crosby
1bd174defc
Merge pull request #5865 from crosbymichael/add-all-caps
...
Add the rest of the caps so that they are retained in privilged mode
Upstream-commit: 265de539ff4a6fc54c5bf72c8c67d00a533d7f55
Component: engine
2014-05-19 09:56:55 -07:00
Michael Crosby
f3abdf9b7d
Add the rest of the caps so that they are retained in privilged mode
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com > (github: crosbymichael)
Upstream-commit: e1c7abe8905d4cc034f1ed49e9d102846e412424
Component: engine
2014-05-19 16:43:31 +00:00
Alexandr Morozov
823bf4bfec
Check uid ranges
...
Fixes #5647
Docker-DCO-1.1-Signed-off-by: Alexandr Morozov <lk4d4math@gmail.com > (github: LK4D4)
Upstream-commit: 72d1e40c4a3b190319cfa5cb44b5e6f1694100fc
Component: engine
2014-05-18 20:49:08 +04:00
Victor Vieux
cc28bc2288
add support for CAP_FOWNER
...
Docker-DCO-1.1-Signed-off-by: Victor Vieux <vieux@docker.com > (github: vieux)
Upstream-commit: a0070f0c17b4f65bdfc5368b93d0fa8636eda03d
Component: engine
2014-05-17 01:16:07 +00:00
Victor Marmol
e3742d2641
Make libcontainer's CapabilitiesMask into a []string (Capabilities).
...
Docker-DCO-1.1-Signed-off-by: Victor Marmol <vmarmol@google.com > (github: vmarmol)
Upstream-commit: 92614928cecd48b241011e614fa856c4fdbac1f6
Component: engine
2014-05-17 00:44:10 +00:00
Michael Crosby
538811ef9a
Merge pull request #5833 from ActiveState/fix_nsinit_env_panic
...
fix panic when passing empty environment
Upstream-commit: 62c3183fc88779479905df8c2f7561c46a08d2ee
Component: engine
2014-05-16 12:03:26 -07:00
Sridhar Ratnakumar
919aaa7d95
fix panic when passing empty environment
...
Docker-DCO-1.1-Signed-off-by: Sridhar Ratnakumar <github@srid.name > (github: srid)
Upstream-commit: d787f2731e4242f244e88f047032ad9650f1f8d7
Component: engine
2014-05-16 11:55:34 -07:00
Victor Marmol
25e8afd42a
Merge pull request #5810 from vmarmol/drop-caps
...
Change libcontainer to drop all capabilities by default.
Upstream-commit: 01d10d6f13d62d74f850fea2a685b24b7983244e
Component: engine
2014-05-16 11:51:41 -07:00
Bernerd Schaefer
0b78fad0c6
nsinit.DefaultCreateCommand sets Pdeathsig to SIGKILL
...
Docker-DCO-1.1-Signed-off-by: Bernerd Schaefer <bj.schaefer@gmail.com > (github: bernerdschaefer)
Upstream-commit: 6a1d76bc7bc589b53530c03720022f0095b65d55
Component: engine
2014-05-16 13:48:41 +02:00
Bernerd Schaefer
da3598172a
nsinit.Init() restores parent death signal before exec
...
Docker-DCO-1.1-Signed-off-by: Bernerd Schaefer <bj.schaefer@gmail.com > (github: bernerdschaefer)
Upstream-commit: 00e1adfeada87100e5e88707309bcdcd674082d6
Component: engine
2014-05-16 13:48:41 +02:00
Victor Marmol
48bd5989f0
Change libcontainer to drop all capabilities by default. Only keeps
...
those that were specified in the config. This commit also explicitly
adds a set of capabilities that we were silently not dropping and were
assumed by the tests.
Docker-DCO-1.1-Signed-off-by: Victor Marmol <vmarmol@google.com > (github: vmarmol)
Upstream-commit: 9d6875d19d3926faf6287487234ad0b2f1310e9d
Component: engine
2014-05-16 00:57:58 +00:00
lalyos
dba2ddd068
Fixes 5370 infinite/maxLoopCount loop for relative symlinks
...
use path.IsAbs() instead of checking if first char is '/'
Docker-DCO-1.1-Signed-off-by: Lajos Papp <lajos.papp@sequenceiq.com > (github: lalyos)
Upstream-commit: ad35d522dbfac124225e27f58bf07c61a34d78b5
Component: engine
2014-05-16 01:03:11 +02:00
lalyos
1092af80f9
Defend against infinite loop when following symlinks
...
ideally it should never reach it, but there was already multiple issues with infinite loop
at following symlinks. this fixes hanging unit tests
Docker-DCO-1.1-Signed-off-by: Lajos Papp <lajos.papp@sequenceiq.com > (github: lalyos)
Upstream-commit: b51c366bfc963687b8cc14df614a2fc10bad6306
Component: engine
2014-05-16 00:47:20 +02:00
lalyos
28ce705ffc
Adding test case for symlink causes infinit loop, reproduces: dotcloud#5370
...
normally symlinks are created as either
ln -s /path/existing /path/new-name
or
cd /path && ln -s ./existing new-name
but one can create it this way
cd /path && ln -s existing new-name
this drives FollowSymlinkInScope into infinite loop
Docker-DCO-1.1-Signed-off-by: Lajos Papp <lajos.papp@sequenceiq.com > (github: lalyos)
Upstream-commit: 8b77a5b7aedb1168707f486ed540edf3e5de8819
Component: engine
2014-05-16 00:47:20 +02:00
Bernerd Schaefer
ebf36b41a1
Add GetParentDeathSignal() to pkg/system
...
Docker-DCO-1.1-Signed-off-by: Bernerd Schaefer <bj.schaefer@gmail.com > (github: bernerdschaefer)
Upstream-commit: 002aa8fc207d803349777cde61426603976ca8ee
Component: engine
2014-05-15 10:17:44 +02:00
Michael Crosby
1aafe01162
Remove the cgroups maintainer file
...
We don't need this because it is covered by the libcontainer MAINTAINERS
file
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com > (github: crosbymichael)
Upstream-commit: b22d10e3c541c46cebe7da44fd2f521c4bc653f4
Component: engine
2014-05-14 16:01:45 -07:00
Michael Crosby
910f9d50e2
Move cgroups package into libcontainer
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com > (github: crosbymichael)
Upstream-commit: 3b7a19def609c8fbadc6559e7f47f8a5a7769a5b
Component: engine
2014-05-14 15:21:44 -07:00
Bernerd Schaefer
66a02eb50b
Setup standard /dev symlinks
...
After copying allowed device nodes, set up "/dev/fd", "/dev/stdin",
"/dev/stdout", and "/dev/stderr" symlinks.
Docker-DCO-1.1-Signed-off-by: Bernerd Schaefer <bj.schaefer@gmail.com > (github: bernerdschaefer)
[rebased by @crosbymichael]
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com > (github: crosbymichael)
Upstream-commit: 2bc34036b9106318f8564ee36b696ad070b02573
Component: engine
2014-05-14 13:59:13 -07:00
Guillaume J. Charmes
1394048dd1
Merge pull request #5783 from LK4D4/fix_duplicate_ip_allocation_#5729
...
Fix duplicate ip allocation
Upstream-commit: 17a1f470ae3e6f1d7a7c4545983e37bfcfe981ab
Component: engine
2014-05-14 13:32:27 -07:00
Victor Vieux
94d0641f06
Merge pull request #5756 from crosbymichael/move-units-to-pkg
...
Move duration and size to units pkg
Upstream-commit: bc22c9948c5380715338aef63fcc6cccd1a16bd7
Component: engine
2014-05-14 11:36:14 -07:00
Michael Crosby
ffbe025292
Merge pull request #5791 from bernerdschaefer/nsinit-exec-forwards-signals
...
"nsinit exec ..." forwards signals to container
Upstream-commit: 432e42e7154ddc97e57783778a02edb5a95bfaa0
Component: engine
2014-05-14 11:05:27 -07:00
Victor Vieux
1bdce7b716
Merge pull request #5781 from creack/remove_bind_console
...
Remove the bind mount for dev/console which override the mknod/label
Upstream-commit: 3bf1b562e39bed0a4ecdad9b23c6274b80bdc82d
Component: engine
2014-05-14 10:57:21 -07:00
Bernerd Schaefer
64ee7b470d
"nsinit exec ..." forwards signals to container
...
Docker-DCO-1.1-Signed-off-by: Bernerd Schaefer <bj.schaefer@gmail.com > (github: bernerdschaefer)
Upstream-commit: 830c2d7fa3f19a2fba50464273ae19cd2113e689
Component: engine
2014-05-14 11:01:02 +02:00
Alexandr Morozov
0291829e72
Refactoring collections/orderedintset and benchmarks for it
...
Docker-DCO-1.1-Signed-off-by: Alexandr Morozov <lk4d4math@gmail.com > (github: LK4D4)
Upstream-commit: 5128feb690e8fd0244d1fecef5f3f5f77598bbfa
Component: engine
2014-05-14 06:04:12 +04:00
Michael Crosby
396c5aa745
Copy parents cpus and mems for cpuset
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com > (github: crosbymichael)
Upstream-commit: 3de15bda7e1d3ab193094e6e07a5b2e42ea828bd
Component: engine
2014-05-13 18:01:31 -07:00
Guillaume J. Charmes
435045ce97
Remove the bind mount for dev/console which override the mknod/label
...
Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume@charmes.net > (github: creack)
Upstream-commit: ae85dd54582e94d36b146ab1688844ed58cc8df3
Component: engine
2014-05-13 11:59:27 -07:00
Michael Crosby
057bbc9d6a
Add MAINTAINERS file to symlink pkg
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com > (github: crosbymichael)
Upstream-commit: ea7647099fcabd73077a403d461e9a0778dda12f
Component: engine
2014-05-13 11:27:24 -07:00
Michael Crosby
740073112a
Update code to handle new path to Follow Symlink func
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com > (github: crosbymichael)
Upstream-commit: ca040b1a377c467a9504ffa256ae77d9e3d29f0c
Component: engine
2014-05-13 10:54:08 -07:00
Michael Crosby
7c5b416146
Move Follow symlink to pkg
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com > (github: crosbymichael)
Upstream-commit: dcf81f95fdfe3ac8e97602d2ef2fef03288c15b1
Component: engine
2014-05-13 10:35:57 -07:00
Alexander Larsson
23ad200555
libcontainer: Ensure bind mount target files are inside rootfs
...
Before we create any files to bind-mount on, make sure they are
inside the container rootfs, handling for instance absolute symbolic
links inside the container.
Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com > (github: alexlarsson)
Upstream-commit: b7c7b851dce28bb679e0289168da382d7cdad74b
Component: engine
2014-05-13 10:24:52 -07:00
unclejack
84adeaa2ea
Merge pull request #5655 from alexlarsson/mount-run-dir
...
Always mount a /run tmpfs in the container
Upstream-commit: f1eabe436a1d40f5e3285b5df955297c49441874
Component: engine
2014-05-13 11:51:14 +03:00
Michael Crosby
d39f282a2b
Move duration and size to units pkg
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com > (github: crosbymichael)
Upstream-commit: d33b4655c4339dcbbf9f78948598e216ac3c06b4
Component: engine
2014-05-12 17:05:07 -07:00
Alexander Larsson
23c5da98b4
Always mount a /run tmpfs in the container
...
All modern distros set up /run to be a tmpfs, see for instance:
https://wiki.debian.org/ReleaseGoals/RunDirectory
Its a very useful place to store pid-files, sockets and other things
that only live at runtime and that should not be stored in the image.
This is also useful when running systemd inside a container, as it
will try to mount /run if not already mounted, which will fail for
non-privileged container.
Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com > (github: alexlarsson)
Upstream-commit: 905795ece624675abe2ec2622b0bbafdb9d7f44c
Component: engine
2014-05-12 21:41:04 +02:00
Michael Crosby
ed72957edf
Merge pull request #5748 from crosbymichael/libcontainer-bindmounts
...
libcontainer: Create dirs/files as needed for bind mounts
Upstream-commit: 30a40de205c6c29ae8e2379c39d69186ef04bf6e
Component: engine
2014-05-12 12:27:18 -07:00
Michael Crosby
fba87d75f1
Remove newline char in error message
...
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com > (github: crosbymichael)
Upstream-commit: cc678a7078b417a330e8d4e3604b74f9e5d4cda4
Component: engine
2014-05-12 12:24:30 -07:00
Vishnu Kannan
616f1c2db1
Correct a comment in libcontainer Mount Namespace setup.
...
Docker-DCO-1.1-Signed-off-by: Vishnu Kannan <vishnuk@google.com > (github: vishh)
Upstream-commit: fee1bbd79ef8767ed149c1b1af4a39ad35e07772
Component: engine
2014-05-12 19:01:36 +00:00
Alexander Larsson
9844c82806
libcontainer: Create dirs/files as needed for bind mounts
...
If you specify a bind mount in a place that doesn't have a file yet we
create that (and parent directories). This is needed because otherwise
you can't use volumes like e.g. /dev/log, as that gets covered by the
/dev tmpfs mounts.
Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com > (github: alexlarsson)
Upstream-commit: 70ef53f25e177e42046170ef59bb29ebd77a3016
Component: engine
2014-05-12 09:57:15 +02:00
Guillaume J. Charmes
c178af9458
Use int64 instead of int
...
Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume@charmes.net > (github: creack)
Upstream-commit: 62bfef59f7ae6f9128bfc3e7ef2e6ed5e4441d2e
Component: engine
2014-05-11 06:23:53 -07:00
Solomon Hykes
b701571f37
beam/data: Message.GetOne() returns the last value set at a key
...
This is a convenience for callers which are only interested in one value
per key. Similar to how HTTP headers allow multiple keys per value, but
are often used to store and retrieve only one value.
Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com > (github: shykes)
Upstream-commit: 2af030ab57d1d84ac9a1d22552dc9d83b16951c4
Component: engine
2014-05-09 17:01:27 -07:00
Solomon Hykes
c3352a3b6c
Fix stdin handling in engine.Sender and engine.Receiver
...
This introduces a superficial change to the Beam API:
* `beam.SendPipe` is renamed to the more accurate `beam.SendRPipe`
* `beam.SendWPipe` is introduced as a mirror to `SendRPipe`
There is no other change in the beam API.
Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com > (github: shykes)
Upstream-commit: 0aeff69e5900a15e3872494ac0009600f6c1c372
Component: engine
2014-05-09 15:39:55 -07:00
Michael Crosby
0e12d2d077
Merge pull request #5673 from tianon/kcore-error
...
Update restrict.Restrict to both show the error message when failing to mount /dev/null over /proc/kcore, and to ignore "not exists" errors while doing so (for when CONFIG_PROC_KCORE=n in the kernel)
Upstream-commit: 7673e3c58938aa4179f3ec84ed4960b4b6267c14
Component: engine
2014-05-08 10:20:19 -07:00
Michael Crosby
891da1c12d
Merge pull request #5535 from vmarmol/add-maintainers-cgroup
...
Adding Rohit Jnagal and Victor Marmol to pkg/cgroups maintainers.
Upstream-commit: 718154b3b6db33a77fb05829d29abcebb77beb86
Component: engine
2014-05-08 09:48:31 -07:00
Tianon Gravi
71620ac1c0
Update restrict.Restrict to both show the error message when failing to mount /dev/null over /proc/kcore, and to ignore "not exists" errors while doing so (for when CONFIG_PROC_KCORE=n in the kernel)
...
Docker-DCO-1.1-Signed-off-by: Andrew Page <admwiggin@gmail.com > (github: tianon)
Upstream-commit: d60301edb88a4e182a10cd2becb3795b2dd13fab
Component: engine
2014-05-08 01:03:45 -06:00
Victor Vieux
29bfaa0d20
use tabwriter to display usage in mflag
...
Docker-DCO-1.1-Signed-off-by: Victor Vieux <vieux@docker.com > (github: vieux)
Upstream-commit: 77098d5b5bf8840a1179380b34aedb26139b9d65
Component: engine
2014-05-06 21:31:21 +00:00
Michael Crosby
36de1a047f
Merge pull request #5631 from vmarmol/cpuacct-usage
...
Export cpuacct CPU usage in total cores over the sampled period.
Upstream-commit: 5c12a27838b88580aaa6fd967a9f0b60d3e838af
Component: engine
2014-05-06 11:47:55 -07:00
Victor Marmol
7ab4226907
Export cpuacct CPU usage in total cores over the sampled period.
...
Docker-DCO-1.1-Signed-off-by: Victor Marmol <vmarmol@google.com > (github: vmarmol)
Upstream-commit: 543e60eb60fed2734c10953216003325beddd536
Component: engine
2014-05-06 16:56:39 +00:00
Michael Crosby
8376ec5af9
Merge pull request #5630 from rjnagal/libcontainer-fixes
...
Check supplied hostname before using it.
Upstream-commit: 818648ff9f9e506e2d296fb73ef55dc8f87648fb
Component: engine
2014-05-06 09:49:52 -07:00
Michael Crosby
23cfbb7add
Merge pull request #5629 from vmarmol/fix-systemd-softlimit
...
Remove support for MemoryReservation in systemd systems.
Upstream-commit: 7e3a1b652193abd8379905cb4dac2df53dc634fb
Component: engine
2014-05-06 09:48:33 -07:00
Victor Marmol
7754f52438
Remove support for MemoryReservation in systemd systems. This has been
...
deperecated since systemd 208.
Docker-DCO-1.1-Signed-off-by: Victor Marmol <vmarmol@google.com > (github: vmarmol)
Upstream-commit: 69d43b2674aa8ed69c641556cae68d405505a45b
Component: engine
2014-05-06 15:53:38 +00:00
Victor Marmol
Michael Crosby
Michael Crosby
Alexandr Morozov
Victor Vieux
Sridhar Ratnakumar
Bernerd Schaefer
lalyos
Guillaume J. Charmes
Victor Vieux
Guillaume J. Charmes
Alexander Larsson
unclejack
Vishnu Kannan
Solomon Hykes
Tianon Gravi