b670ee9b69
These settings need to be in the HostConfig so that they are not committed to an image and cannot introduce a security issue. We can safely move this field from the Config to the HostConfig without any regressions because these settings are consumed at container created and used to populate fields on the Container struct. Because of this, existing settings will be honored for containers already created on a daemon with custom security settings and prevent values being consumed via an Image. Signed-off-by: Michael Crosby <crosbymichael@gmail.com> Upstream-commit: c9379eb3fbbc484c056f5a5e49d8d0b755a29c45 Component: engine
122 lines
3.0 KiB
Go
122 lines
3.0 KiB
Go
package runconfig
|
|
|
|
import (
|
|
"strings"
|
|
|
|
"github.com/docker/docker/engine"
|
|
"github.com/docker/docker/nat"
|
|
"github.com/docker/docker/utils"
|
|
)
|
|
|
|
type NetworkMode string
|
|
|
|
// IsPrivate indicates whether container use it's private network stack
|
|
func (n NetworkMode) IsPrivate() bool {
|
|
return !(n.IsHost() || n.IsContainer() || n.IsNone())
|
|
}
|
|
|
|
func (n NetworkMode) IsHost() bool {
|
|
return n == "host"
|
|
}
|
|
|
|
func (n NetworkMode) IsContainer() bool {
|
|
parts := strings.SplitN(string(n), ":", 2)
|
|
return len(parts) > 1 && parts[0] == "container"
|
|
}
|
|
|
|
func (n NetworkMode) IsNone() bool {
|
|
return n == "none"
|
|
}
|
|
|
|
type DeviceMapping struct {
|
|
PathOnHost string
|
|
PathInContainer string
|
|
CgroupPermissions string
|
|
}
|
|
|
|
type RestartPolicy struct {
|
|
Name string
|
|
MaximumRetryCount int
|
|
}
|
|
|
|
type HostConfig struct {
|
|
Binds []string
|
|
ContainerIDFile string
|
|
LxcConf []utils.KeyValuePair
|
|
Privileged bool
|
|
PortBindings nat.PortMap
|
|
Links []string
|
|
PublishAllPorts bool
|
|
Dns []string
|
|
DnsSearch []string
|
|
ExtraHosts []string
|
|
VolumesFrom []string
|
|
Devices []DeviceMapping
|
|
NetworkMode NetworkMode
|
|
CapAdd []string
|
|
CapDrop []string
|
|
RestartPolicy RestartPolicy
|
|
SecurityOpt []string
|
|
}
|
|
|
|
// This is used by the create command when you want to set both the
|
|
// Config and the HostConfig in the same call
|
|
type ConfigAndHostConfig struct {
|
|
Config
|
|
HostConfig HostConfig
|
|
}
|
|
|
|
func MergeConfigs(config *Config, hostConfig *HostConfig) *ConfigAndHostConfig {
|
|
return &ConfigAndHostConfig{
|
|
*config,
|
|
*hostConfig,
|
|
}
|
|
}
|
|
|
|
func ContainerHostConfigFromJob(job *engine.Job) *HostConfig {
|
|
if job.EnvExists("HostConfig") {
|
|
hostConfig := HostConfig{}
|
|
job.GetenvJson("HostConfig", &hostConfig)
|
|
return &hostConfig
|
|
}
|
|
|
|
hostConfig := &HostConfig{
|
|
ContainerIDFile: job.Getenv("ContainerIDFile"),
|
|
Privileged: job.GetenvBool("Privileged"),
|
|
PublishAllPorts: job.GetenvBool("PublishAllPorts"),
|
|
NetworkMode: NetworkMode(job.Getenv("NetworkMode")),
|
|
}
|
|
|
|
job.GetenvJson("LxcConf", &hostConfig.LxcConf)
|
|
job.GetenvJson("PortBindings", &hostConfig.PortBindings)
|
|
job.GetenvJson("Devices", &hostConfig.Devices)
|
|
job.GetenvJson("RestartPolicy", &hostConfig.RestartPolicy)
|
|
hostConfig.SecurityOpt = job.GetenvList("SecurityOpt")
|
|
if Binds := job.GetenvList("Binds"); Binds != nil {
|
|
hostConfig.Binds = Binds
|
|
}
|
|
if Links := job.GetenvList("Links"); Links != nil {
|
|
hostConfig.Links = Links
|
|
}
|
|
if Dns := job.GetenvList("Dns"); Dns != nil {
|
|
hostConfig.Dns = Dns
|
|
}
|
|
if DnsSearch := job.GetenvList("DnsSearch"); DnsSearch != nil {
|
|
hostConfig.DnsSearch = DnsSearch
|
|
}
|
|
if ExtraHosts := job.GetenvList("ExtraHosts"); ExtraHosts != nil {
|
|
hostConfig.ExtraHosts = ExtraHosts
|
|
}
|
|
if VolumesFrom := job.GetenvList("VolumesFrom"); VolumesFrom != nil {
|
|
hostConfig.VolumesFrom = VolumesFrom
|
|
}
|
|
if CapAdd := job.GetenvList("CapAdd"); CapAdd != nil {
|
|
hostConfig.CapAdd = CapAdd
|
|
}
|
|
if CapDrop := job.GetenvList("CapDrop"); CapDrop != nil {
|
|
hostConfig.CapDrop = CapDrop
|
|
}
|
|
|
|
return hostConfig
|
|
}
|