mirror of
https://github.com/containers/podman
synced 2024-10-20 17:23:30 +00:00
dd81a44ccf
the compilation demands of having libpod in main is a burden for the remote client compilations. to combat this, we should move the use of libpod structs, vars, constants, and functions into the adapter code where it will only be compiled by the local client. this should result in cleaner code organization and smaller binaries. it should also help if we ever need to compile the remote client on non-Linux operating systems natively (not cross-compiled). Signed-off-by: baude <bbaude@redhat.com>
125 lines
3.6 KiB
Go
125 lines
3.6 KiB
Go
// +build linux
|
|
|
|
package libpod
|
|
|
|
import (
|
|
"context"
|
|
"strings"
|
|
|
|
"github.com/containers/libpod/libpod/define"
|
|
"github.com/containers/libpod/libpod/image"
|
|
"github.com/containers/libpod/pkg/rootless"
|
|
"github.com/opencontainers/image-spec/specs-go/v1"
|
|
spec "github.com/opencontainers/runtime-spec/specs-go"
|
|
"github.com/opencontainers/runtime-tools/generate"
|
|
"github.com/pkg/errors"
|
|
"github.com/sirupsen/logrus"
|
|
)
|
|
|
|
const (
|
|
// IDTruncLength is the length of the pod's id that will be used to make the
|
|
// infra container name
|
|
IDTruncLength = 12
|
|
)
|
|
|
|
func (r *Runtime) makeInfraContainer(ctx context.Context, p *Pod, imgName, imgID string, config *v1.ImageConfig) (*Container, error) {
|
|
|
|
// Set up generator for infra container defaults
|
|
g, err := generate.New("linux")
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
isRootless := rootless.IsRootless()
|
|
|
|
entryCmd := []string{r.config.InfraCommand}
|
|
// I've seen circumstances where config is being passed as nil.
|
|
// Let's err on the side of safety and make sure it's safe to use.
|
|
if config != nil {
|
|
setEntrypoint := false
|
|
// default to entrypoint in image if there is one
|
|
if len(config.Entrypoint) > 0 {
|
|
entryCmd = config.Entrypoint
|
|
setEntrypoint = true
|
|
}
|
|
if len(config.Cmd) > 0 {
|
|
// We can't use the default pause command, since we're
|
|
// sourcing from the image. If we didn't already set an
|
|
// entrypoint, set one now.
|
|
if !setEntrypoint {
|
|
// Use the Docker default "/bin/sh -c"
|
|
// entrypoint, as we're overriding command.
|
|
// If an image doesn't want this, it can
|
|
// override entrypoint too.
|
|
entryCmd = []string{"/bin/sh", "-c"}
|
|
}
|
|
entryCmd = append(entryCmd, config.Cmd...)
|
|
}
|
|
if len(config.Env) > 0 {
|
|
for _, nameValPair := range config.Env {
|
|
nameValSlice := strings.Split(nameValPair, "=")
|
|
if len(nameValSlice) < 2 {
|
|
return nil, errors.Errorf("Invalid environment variable structure in pause image")
|
|
}
|
|
g.AddProcessEnv(nameValSlice[0], nameValSlice[1])
|
|
}
|
|
}
|
|
}
|
|
|
|
g.SetRootReadonly(true)
|
|
g.SetProcessArgs(entryCmd)
|
|
|
|
logrus.Debugf("Using %q as infra container entrypoint", entryCmd)
|
|
|
|
if isRootless {
|
|
g.RemoveMount("/dev/pts")
|
|
devPts := spec.Mount{
|
|
Destination: "/dev/pts",
|
|
Type: "devpts",
|
|
Source: "devpts",
|
|
Options: []string{"private", "nosuid", "noexec", "newinstance", "ptmxmode=0666", "mode=0620"},
|
|
}
|
|
g.AddMount(devPts)
|
|
}
|
|
|
|
containerName := p.ID()[:IDTruncLength] + "-infra"
|
|
var options []CtrCreateOption
|
|
options = append(options, r.WithPod(p))
|
|
options = append(options, WithRootFSFromImage(imgID, imgName, false))
|
|
options = append(options, WithName(containerName))
|
|
options = append(options, withIsInfra())
|
|
|
|
// Since user namespace sharing is not implemented, we only need to check if it's rootless
|
|
networks := make([]string, 0)
|
|
netmode := "bridge"
|
|
if isRootless {
|
|
netmode = "slirp4netns"
|
|
}
|
|
options = append(options, WithNetNS(p.config.InfraContainer.PortBindings, isRootless, netmode, networks))
|
|
|
|
return r.newContainer(ctx, g.Config, options...)
|
|
}
|
|
|
|
// createInfraContainer wrap creates an infra container for a pod.
|
|
// An infra container becomes the basis for kernel namespace sharing between
|
|
// containers in the pod.
|
|
func (r *Runtime) createInfraContainer(ctx context.Context, p *Pod) (*Container, error) {
|
|
if !r.valid {
|
|
return nil, define.ErrRuntimeStopped
|
|
}
|
|
|
|
newImage, err := r.ImageRuntime().New(ctx, r.config.InfraImage, "", "", nil, nil, image.SigningOptions{}, false, nil)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
data, err := newImage.Inspect(ctx)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
imageName := newImage.Names()[0]
|
|
imageID := data.ID
|
|
|
|
return r.makeInfraContainer(ctx, p, imageName, imageID, data.Config)
|
|
}
|