mirror of
https://github.com/containers/podman
synced 2024-10-20 01:03:51 +00:00
7fc1a329bd
When we run containers in detach mode, nothing cleans up the network stack or the mount points. This patch will tell conmon to execute the cleanup code when the container exits. It can also be called to attempt to cleanup previously running containers. Signed-off-by: Daniel J Walsh <dwalsh@redhat.com> Closes: #942 Approved by: mheon
1009 lines
25 KiB
Go
1009 lines
25 KiB
Go
package libpod
|
|
|
|
import (
|
|
"net"
|
|
"os"
|
|
"path/filepath"
|
|
"regexp"
|
|
"syscall"
|
|
|
|
"github.com/containers/storage"
|
|
"github.com/containers/storage/pkg/idtools"
|
|
"github.com/cri-o/ocicni/pkg/ocicni"
|
|
"github.com/pkg/errors"
|
|
)
|
|
|
|
var (
|
|
nameRegex = regexp.MustCompile("[a-zA-Z0-9_-]+")
|
|
)
|
|
|
|
// Runtime Creation Options
|
|
|
|
// WithStorageConfig uses the given configuration to set up container storage.
|
|
// If this is not specified, the system default configuration will be used
|
|
// instead.
|
|
func WithStorageConfig(config storage.StoreOptions) RuntimeOption {
|
|
return func(rt *Runtime) error {
|
|
if rt.valid {
|
|
return ErrRuntimeFinalized
|
|
}
|
|
|
|
rt.config.StorageConfig.RunRoot = config.RunRoot
|
|
rt.config.StorageConfig.GraphRoot = config.GraphRoot
|
|
rt.config.StorageConfig.GraphDriverName = config.GraphDriverName
|
|
rt.config.StaticDir = filepath.Join(config.GraphRoot, "libpod")
|
|
|
|
rt.config.StorageConfig.GraphDriverOptions = make([]string, len(config.GraphDriverOptions))
|
|
copy(rt.config.StorageConfig.GraphDriverOptions, config.GraphDriverOptions)
|
|
|
|
rt.config.StorageConfig.UIDMap = make([]idtools.IDMap, len(config.UIDMap))
|
|
copy(rt.config.StorageConfig.UIDMap, config.UIDMap)
|
|
|
|
rt.config.StorageConfig.GIDMap = make([]idtools.IDMap, len(config.GIDMap))
|
|
copy(rt.config.StorageConfig.GIDMap, config.GIDMap)
|
|
|
|
return nil
|
|
}
|
|
}
|
|
|
|
// WithDefaultTransport sets the default transport for retrieving images.
|
|
func WithDefaultTransport(defaultTransport string) RuntimeOption {
|
|
return func(rt *Runtime) error {
|
|
if rt.valid {
|
|
return ErrRuntimeFinalized
|
|
}
|
|
|
|
rt.config.ImageDefaultTransport = defaultTransport
|
|
|
|
return nil
|
|
}
|
|
}
|
|
|
|
// WithSignaturePolicy specifies the path of a file which decides how trust is
|
|
// managed for images we've pulled.
|
|
// If this is not specified, the system default configuration will be used
|
|
// instead.
|
|
func WithSignaturePolicy(path string) RuntimeOption {
|
|
return func(rt *Runtime) error {
|
|
if rt.valid {
|
|
return ErrRuntimeFinalized
|
|
}
|
|
|
|
rt.config.SignaturePolicyPath = path
|
|
|
|
return nil
|
|
}
|
|
}
|
|
|
|
// WithStateType sets the backing state implementation for libpod.
|
|
// Please note that information is not portable between backing states.
|
|
// As such, if this differs between two libpods running on the same system,
|
|
// they will not share containers, and unspecified behavior may occur.
|
|
func WithStateType(storeType RuntimeStateStore) RuntimeOption {
|
|
return func(rt *Runtime) error {
|
|
if rt.valid {
|
|
return ErrRuntimeFinalized
|
|
}
|
|
|
|
if storeType == InvalidStateStore {
|
|
return errors.Wrapf(ErrInvalidArg, "must provide a valid state store type")
|
|
}
|
|
|
|
rt.config.StateType = storeType
|
|
|
|
return nil
|
|
}
|
|
}
|
|
|
|
// WithOCIRuntime specifies an OCI runtime to use for running containers.
|
|
func WithOCIRuntime(runtimePath string) RuntimeOption {
|
|
return func(rt *Runtime) error {
|
|
if rt.valid {
|
|
return ErrRuntimeFinalized
|
|
}
|
|
|
|
if runtimePath == "" {
|
|
return errors.Wrapf(ErrInvalidArg, "must provide a valid path")
|
|
}
|
|
|
|
rt.config.RuntimePath = []string{runtimePath}
|
|
|
|
return nil
|
|
}
|
|
}
|
|
|
|
// WithConmonPath specifies the path to the conmon binary which manages the
|
|
// runtime.
|
|
func WithConmonPath(path string) RuntimeOption {
|
|
return func(rt *Runtime) error {
|
|
if rt.valid {
|
|
return ErrRuntimeFinalized
|
|
}
|
|
|
|
if path == "" {
|
|
return errors.Wrapf(ErrInvalidArg, "must provide a valid path")
|
|
}
|
|
|
|
rt.config.ConmonPath = []string{path}
|
|
|
|
return nil
|
|
}
|
|
}
|
|
|
|
// WithConmonEnv specifies the environment variable list for the conmon process.
|
|
func WithConmonEnv(environment []string) RuntimeOption {
|
|
return func(rt *Runtime) error {
|
|
if rt.valid {
|
|
return ErrRuntimeFinalized
|
|
}
|
|
|
|
rt.config.ConmonEnvVars = make([]string, len(environment))
|
|
copy(rt.config.ConmonEnvVars, environment)
|
|
|
|
return nil
|
|
}
|
|
}
|
|
|
|
// WithCgroupManager specifies the manager implementation name which is used to
|
|
// handle cgroups for containers.
|
|
// Current valid values are "cgroupfs" and "systemd".
|
|
func WithCgroupManager(manager string) RuntimeOption {
|
|
return func(rt *Runtime) error {
|
|
if rt.valid {
|
|
return ErrRuntimeFinalized
|
|
}
|
|
|
|
if manager != CgroupfsCgroupsManager && manager != SystemdCgroupsManager {
|
|
return errors.Wrapf(ErrInvalidArg, "CGroup manager must be one of %s and %s",
|
|
CgroupfsCgroupsManager, SystemdCgroupsManager)
|
|
}
|
|
|
|
rt.config.CgroupManager = manager
|
|
|
|
return nil
|
|
}
|
|
}
|
|
|
|
// WithStaticDir sets the directory that static runtime files which persist
|
|
// across reboots will be stored.
|
|
func WithStaticDir(dir string) RuntimeOption {
|
|
return func(rt *Runtime) error {
|
|
if rt.valid {
|
|
return ErrRuntimeFinalized
|
|
}
|
|
|
|
rt.config.StaticDir = dir
|
|
|
|
return nil
|
|
}
|
|
}
|
|
|
|
// WithHooksDir sets the directory to look for OCI runtime hooks config.
|
|
// Note we are not saving this in database, since this is really just for used
|
|
// for testing.
|
|
func WithHooksDir(hooksDir string, dirNotExistFatal bool) RuntimeOption {
|
|
return func(rt *Runtime) error {
|
|
if rt.valid {
|
|
return ErrRuntimeFinalized
|
|
}
|
|
|
|
if hooksDir == "" {
|
|
return errors.Wrap(ErrInvalidArg, "empty-string hook directories are not supported")
|
|
}
|
|
|
|
rt.config.HooksDir = hooksDir
|
|
rt.config.HooksDirNotExistFatal = dirNotExistFatal
|
|
return nil
|
|
}
|
|
}
|
|
|
|
// WithDefaultMountsFile sets the file to look at for default mounts (mainly
|
|
// secrets).
|
|
// Note we are not saving this in the database as it is for testing purposes
|
|
// only.
|
|
func WithDefaultMountsFile(mountsFile string) RuntimeOption {
|
|
return func(rt *Runtime) error {
|
|
if rt.valid {
|
|
return ErrRuntimeFinalized
|
|
}
|
|
|
|
if mountsFile == "" {
|
|
return ErrInvalidArg
|
|
}
|
|
rt.config.DefaultMountsFile = mountsFile
|
|
return nil
|
|
}
|
|
}
|
|
|
|
// WithTmpDir sets the directory that temporary runtime files which are not
|
|
// expected to survive across reboots will be stored.
|
|
// This should be located on a tmpfs mount (/tmp or /var/run for example).
|
|
func WithTmpDir(dir string) RuntimeOption {
|
|
return func(rt *Runtime) error {
|
|
if rt.valid {
|
|
return ErrRuntimeFinalized
|
|
}
|
|
|
|
rt.config.TmpDir = dir
|
|
|
|
return nil
|
|
}
|
|
}
|
|
|
|
// WithMaxLogSize sets the maximum size of container logs.
|
|
// Positive sizes are limits in bytes, -1 is unlimited.
|
|
func WithMaxLogSize(limit int64) RuntimeOption {
|
|
return func(rt *Runtime) error {
|
|
if rt.valid {
|
|
return ErrRuntimeFinalized
|
|
}
|
|
|
|
rt.config.MaxLogSize = limit
|
|
|
|
return nil
|
|
}
|
|
}
|
|
|
|
// WithNoPivotRoot sets the runtime to use MS_MOVE instead of PIVOT_ROOT when
|
|
// starting containers.
|
|
func WithNoPivotRoot(noPivot bool) RuntimeOption {
|
|
return func(rt *Runtime) error {
|
|
if rt.valid {
|
|
return ErrRuntimeFinalized
|
|
}
|
|
|
|
rt.config.NoPivotRoot = true
|
|
|
|
return nil
|
|
}
|
|
}
|
|
|
|
// WithCNIConfigDir sets the CNI configuration directory.
|
|
func WithCNIConfigDir(dir string) RuntimeOption {
|
|
return func(rt *Runtime) error {
|
|
if rt.valid {
|
|
return ErrRuntimeFinalized
|
|
}
|
|
|
|
rt.config.CNIConfigDir = dir
|
|
|
|
return nil
|
|
}
|
|
}
|
|
|
|
// WithCNIPluginDir sets the CNI plugins directory.
|
|
func WithCNIPluginDir(dir string) RuntimeOption {
|
|
return func(rt *Runtime) error {
|
|
if rt.valid {
|
|
return ErrRuntimeFinalized
|
|
}
|
|
|
|
rt.config.CNIPluginDir = []string{dir}
|
|
|
|
return nil
|
|
}
|
|
}
|
|
|
|
// Container Creation Options
|
|
|
|
// WithShmDir sets the directory that should be mounted on /dev/shm.
|
|
func WithShmDir(dir string) CtrCreateOption {
|
|
return func(ctr *Container) error {
|
|
if ctr.valid {
|
|
return ErrCtrFinalized
|
|
}
|
|
|
|
ctr.config.ShmDir = dir
|
|
return nil
|
|
}
|
|
}
|
|
|
|
// WithShmSize sets the size of /dev/shm tmpfs mount.
|
|
func WithShmSize(size int64) CtrCreateOption {
|
|
return func(ctr *Container) error {
|
|
if ctr.valid {
|
|
return ErrCtrFinalized
|
|
}
|
|
|
|
ctr.config.ShmSize = size
|
|
return nil
|
|
}
|
|
}
|
|
|
|
// WithPrivileged sets the privileged flag in the container runtime.
|
|
func WithPrivileged(privileged bool) CtrCreateOption {
|
|
return func(ctr *Container) error {
|
|
if ctr.valid {
|
|
return ErrCtrFinalized
|
|
}
|
|
|
|
ctr.config.Privileged = privileged
|
|
return nil
|
|
}
|
|
}
|
|
|
|
// WithSELinuxLabels sets the mount label for SELinux.
|
|
func WithSELinuxLabels(processLabel, mountLabel string) CtrCreateOption {
|
|
return func(ctr *Container) error {
|
|
if ctr.valid {
|
|
return ErrCtrFinalized
|
|
}
|
|
|
|
ctr.config.ProcessLabel = processLabel
|
|
ctr.config.MountLabel = mountLabel
|
|
return nil
|
|
}
|
|
}
|
|
|
|
// WithUser sets the user identity field in configutation.
|
|
// Valid uses [user | user:group | uid | uid:gid | user:gid | uid:group ].
|
|
func WithUser(user string) CtrCreateOption {
|
|
return func(ctr *Container) error {
|
|
if ctr.valid {
|
|
return ErrCtrFinalized
|
|
}
|
|
|
|
ctr.config.User = user
|
|
return nil
|
|
}
|
|
}
|
|
|
|
// WithRootFSFromImage sets up a fresh root filesystem using the given image.
|
|
// If useImageConfig is specified, image volumes, environment variables, and
|
|
// other configuration from the image will be added to the config.
|
|
// TODO: Replace image name and ID with a libpod.Image struct when that is
|
|
// finished.
|
|
func WithRootFSFromImage(imageID string, imageName string, useImageVolumes bool) CtrCreateOption {
|
|
return func(ctr *Container) error {
|
|
if ctr.valid {
|
|
return ErrCtrFinalized
|
|
}
|
|
|
|
if ctr.config.RootfsImageID != "" || ctr.config.RootfsImageName != "" {
|
|
return errors.Wrapf(ErrInvalidArg, "container already configured with root filesystem")
|
|
}
|
|
if ctr.config.Rootfs != "" {
|
|
return errors.Wrapf(ErrInvalidArg, "cannot set both an image ID and a rootfs for a container")
|
|
}
|
|
|
|
ctr.config.RootfsImageID = imageID
|
|
ctr.config.RootfsImageName = imageName
|
|
ctr.config.ImageVolumes = useImageVolumes
|
|
|
|
return nil
|
|
}
|
|
}
|
|
|
|
// WithStdin keeps stdin on the container open to allow interaction.
|
|
func WithStdin() CtrCreateOption {
|
|
return func(ctr *Container) error {
|
|
if ctr.valid {
|
|
return ErrCtrFinalized
|
|
}
|
|
|
|
ctr.config.Stdin = true
|
|
|
|
return nil
|
|
}
|
|
}
|
|
|
|
// WithPod adds the container to a pod.
|
|
// Containers which join a pod can only join the namespaces of other containers
|
|
// in the same pod.
|
|
func (r *Runtime) WithPod(pod *Pod) CtrCreateOption {
|
|
return func(ctr *Container) error {
|
|
if ctr.valid {
|
|
return ErrCtrFinalized
|
|
}
|
|
|
|
if pod == nil {
|
|
return ErrInvalidArg
|
|
}
|
|
|
|
ctr.config.Pod = pod.ID()
|
|
|
|
return nil
|
|
}
|
|
}
|
|
|
|
// WithLabels adds labels to the container.
|
|
func WithLabels(labels map[string]string) CtrCreateOption {
|
|
return func(ctr *Container) error {
|
|
if ctr.valid {
|
|
return ErrCtrFinalized
|
|
}
|
|
|
|
ctr.config.Labels = make(map[string]string)
|
|
for key, value := range labels {
|
|
ctr.config.Labels[key] = value
|
|
}
|
|
|
|
return nil
|
|
}
|
|
}
|
|
|
|
// WithName sets the container's name.
|
|
func WithName(name string) CtrCreateOption {
|
|
return func(ctr *Container) error {
|
|
if ctr.valid {
|
|
return ErrCtrFinalized
|
|
}
|
|
|
|
// Check the name against a regex
|
|
if !nameRegex.MatchString(name) {
|
|
return errors.Wrapf(ErrInvalidArg, "name must match regex [a-zA-Z0-9_-]+")
|
|
}
|
|
|
|
ctr.config.Name = name
|
|
|
|
return nil
|
|
}
|
|
}
|
|
|
|
// WithStopSignal sets the signal that will be sent to stop the container.
|
|
func WithStopSignal(signal syscall.Signal) CtrCreateOption {
|
|
return func(ctr *Container) error {
|
|
if ctr.valid {
|
|
return ErrCtrFinalized
|
|
}
|
|
|
|
if signal == 0 {
|
|
return errors.Wrapf(ErrInvalidArg, "stop signal cannot be 0")
|
|
} else if signal > 64 {
|
|
return errors.Wrapf(ErrInvalidArg, "stop signal cannot be greater than 64 (SIGRTMAX)")
|
|
}
|
|
|
|
ctr.config.StopSignal = uint(signal)
|
|
|
|
return nil
|
|
}
|
|
}
|
|
|
|
// WithStopTimeout sets the time to after initial stop signal is sent to the
|
|
// container, before sending the kill signal.
|
|
func WithStopTimeout(timeout uint) CtrCreateOption {
|
|
return func(ctr *Container) error {
|
|
if ctr.valid {
|
|
return ErrCtrFinalized
|
|
}
|
|
|
|
ctr.config.StopTimeout = timeout
|
|
|
|
return nil
|
|
}
|
|
}
|
|
|
|
// WithIDMappings sets the idmappsings for the container
|
|
func WithIDMappings(idmappings storage.IDMappingOptions) CtrCreateOption {
|
|
return func(ctr *Container) error {
|
|
if ctr.valid {
|
|
return ErrCtrFinalized
|
|
}
|
|
|
|
ctr.config.IDMappings = idmappings
|
|
return nil
|
|
}
|
|
}
|
|
|
|
// WithExitCommand sets the ExitCommand for the container, appending on the ctr.ID() to the end
|
|
func WithExitCommand(exitCommand []string) CtrCreateOption {
|
|
return func(ctr *Container) error {
|
|
if ctr.valid {
|
|
return ErrCtrFinalized
|
|
}
|
|
|
|
ctr.config.ExitCommand = append(exitCommand, ctr.ID())
|
|
return nil
|
|
}
|
|
}
|
|
|
|
// WithIPCNSFrom indicates the the container should join the IPC namespace of
|
|
// the given container.
|
|
// If the container has joined a pod, it can only join the namespaces of
|
|
// containers in the same pod.
|
|
func WithIPCNSFrom(nsCtr *Container) CtrCreateOption {
|
|
return func(ctr *Container) error {
|
|
if ctr.valid {
|
|
return ErrCtrFinalized
|
|
}
|
|
|
|
if !nsCtr.valid {
|
|
return ErrCtrRemoved
|
|
}
|
|
|
|
if nsCtr.ID() == ctr.ID() {
|
|
return errors.Wrapf(ErrInvalidArg, "must specify another container")
|
|
}
|
|
|
|
if ctr.config.Pod != "" && nsCtr.config.Pod != ctr.config.Pod {
|
|
return errors.Wrapf(ErrInvalidArg, "container has joined pod %s and dependency container %s is not a member of the pod", ctr.config.Pod, nsCtr.ID())
|
|
}
|
|
|
|
ctr.config.IPCNsCtr = nsCtr.ID()
|
|
|
|
return nil
|
|
}
|
|
}
|
|
|
|
// WithMountNSFrom indicates the the container should join the mount namespace
|
|
// of the given container.
|
|
// If the container has joined a pod, it can only join the namespaces of
|
|
// containers in the same pod.
|
|
func WithMountNSFrom(nsCtr *Container) CtrCreateOption {
|
|
return func(ctr *Container) error {
|
|
if ctr.valid {
|
|
return ErrCtrFinalized
|
|
}
|
|
|
|
if !nsCtr.valid {
|
|
return ErrCtrRemoved
|
|
}
|
|
|
|
if nsCtr.ID() == ctr.ID() {
|
|
return errors.Wrapf(ErrInvalidArg, "must specify another container")
|
|
}
|
|
|
|
if ctr.config.Pod != "" && nsCtr.config.Pod != ctr.config.Pod {
|
|
return errors.Wrapf(ErrInvalidArg, "container has joined pod %s and dependency container %s is not a member of the pod", ctr.config.Pod, nsCtr.ID())
|
|
}
|
|
|
|
ctr.config.MountNsCtr = nsCtr.ID()
|
|
|
|
return nil
|
|
}
|
|
}
|
|
|
|
// WithNetNSFrom indicates the the container should join the network namespace
|
|
// of the given container.
|
|
// If the container has joined a pod, it can only join the namespaces of
|
|
// containers in the same pod.
|
|
func WithNetNSFrom(nsCtr *Container) CtrCreateOption {
|
|
return func(ctr *Container) error {
|
|
if ctr.valid {
|
|
return ErrCtrFinalized
|
|
}
|
|
|
|
if !nsCtr.valid {
|
|
return ErrCtrRemoved
|
|
}
|
|
|
|
if nsCtr.ID() == ctr.ID() {
|
|
return errors.Wrapf(ErrInvalidArg, "must specify another container")
|
|
}
|
|
|
|
if ctr.config.CreateNetNS {
|
|
return errors.Wrapf(ErrInvalidArg, "cannot join another container's net ns as we are making a new net ns")
|
|
}
|
|
|
|
if ctr.config.Pod != "" && nsCtr.config.Pod != ctr.config.Pod {
|
|
return errors.Wrapf(ErrInvalidArg, "container has joined pod %s and dependency container %s is not a member of the pod", ctr.config.Pod, nsCtr.ID())
|
|
}
|
|
|
|
ctr.config.NetNsCtr = nsCtr.ID()
|
|
|
|
return nil
|
|
}
|
|
}
|
|
|
|
// WithPIDNSFrom indicates the the container should join the PID namespace of
|
|
// the given container.
|
|
// If the container has joined a pod, it can only join the namespaces of
|
|
// containers in the same pod.
|
|
func WithPIDNSFrom(nsCtr *Container) CtrCreateOption {
|
|
return func(ctr *Container) error {
|
|
if ctr.valid {
|
|
return ErrCtrFinalized
|
|
}
|
|
|
|
if !nsCtr.valid {
|
|
return ErrCtrRemoved
|
|
}
|
|
|
|
if nsCtr.ID() == ctr.ID() {
|
|
return errors.Wrapf(ErrInvalidArg, "must specify another container")
|
|
}
|
|
|
|
if ctr.config.Pod != "" && nsCtr.config.Pod != ctr.config.Pod {
|
|
return errors.Wrapf(ErrInvalidArg, "container has joined pod %s and dependency container %s is not a member of the pod", ctr.config.Pod, nsCtr.ID())
|
|
}
|
|
|
|
ctr.config.PIDNsCtr = nsCtr.ID()
|
|
|
|
return nil
|
|
}
|
|
}
|
|
|
|
// WithUserNSFrom indicates the the container should join the user namespace of
|
|
// the given container.
|
|
// If the container has joined a pod, it can only join the namespaces of
|
|
// containers in the same pod.
|
|
func WithUserNSFrom(nsCtr *Container) CtrCreateOption {
|
|
return func(ctr *Container) error {
|
|
if ctr.valid {
|
|
return ErrCtrFinalized
|
|
}
|
|
|
|
if !nsCtr.valid {
|
|
return ErrCtrRemoved
|
|
}
|
|
|
|
if nsCtr.ID() == ctr.ID() {
|
|
return errors.Wrapf(ErrInvalidArg, "must specify another container")
|
|
}
|
|
|
|
if ctr.config.Pod != "" && nsCtr.config.Pod != ctr.config.Pod {
|
|
return errors.Wrapf(ErrInvalidArg, "container has joined pod %s and dependency container %s is not a member of the pod", ctr.config.Pod, nsCtr.ID())
|
|
}
|
|
|
|
ctr.config.UserNsCtr = nsCtr.ID()
|
|
|
|
return nil
|
|
}
|
|
}
|
|
|
|
// WithUTSNSFrom indicates the the container should join the UTS namespace of
|
|
// the given container.
|
|
// If the container has joined a pod, it can only join the namespaces of
|
|
// containers in the same pod.
|
|
func WithUTSNSFrom(nsCtr *Container) CtrCreateOption {
|
|
return func(ctr *Container) error {
|
|
if ctr.valid {
|
|
return ErrCtrFinalized
|
|
}
|
|
|
|
if !nsCtr.valid {
|
|
return ErrCtrRemoved
|
|
}
|
|
|
|
if nsCtr.ID() == ctr.ID() {
|
|
return errors.Wrapf(ErrInvalidArg, "must specify another container")
|
|
}
|
|
|
|
if ctr.config.Pod != "" && nsCtr.config.Pod != ctr.config.Pod {
|
|
return errors.Wrapf(ErrInvalidArg, "container has joined pod %s and dependency container %s is not a member of the pod", ctr.config.Pod, nsCtr.ID())
|
|
}
|
|
|
|
ctr.config.UTSNsCtr = nsCtr.ID()
|
|
|
|
return nil
|
|
}
|
|
}
|
|
|
|
// WithCgroupNSFrom indicates the the container should join the CGroup namespace
|
|
// of the given container.
|
|
// If the container has joined a pod, it can only join the namespaces of
|
|
// containers in the same pod.
|
|
func WithCgroupNSFrom(nsCtr *Container) CtrCreateOption {
|
|
return func(ctr *Container) error {
|
|
if ctr.valid {
|
|
return ErrCtrFinalized
|
|
}
|
|
|
|
if !nsCtr.valid {
|
|
return ErrCtrRemoved
|
|
}
|
|
|
|
if nsCtr.ID() == ctr.ID() {
|
|
return errors.Wrapf(ErrInvalidArg, "must specify another container")
|
|
}
|
|
|
|
if ctr.config.Pod != "" && nsCtr.config.Pod != ctr.config.Pod {
|
|
return errors.Wrapf(ErrInvalidArg, "container has joined pod %s and dependency container %s is not a member of the pod", ctr.config.Pod, nsCtr.ID())
|
|
}
|
|
|
|
ctr.config.CgroupNsCtr = nsCtr.ID()
|
|
|
|
return nil
|
|
}
|
|
}
|
|
|
|
// WithDependencyCtrs sets dependency containers of the given container.
|
|
// Dependency containers must be running before this container is started.
|
|
func WithDependencyCtrs(ctrs []*Container) CtrCreateOption {
|
|
return func(ctr *Container) error {
|
|
if ctr.valid {
|
|
return ErrCtrFinalized
|
|
}
|
|
|
|
deps := make([]string, 0, len(ctrs))
|
|
|
|
for _, dep := range ctrs {
|
|
if !dep.valid {
|
|
return errors.Wrapf(ErrCtrRemoved, "container %s is not valid", dep.ID())
|
|
}
|
|
|
|
if dep.ID() == ctr.ID() {
|
|
return errors.Wrapf(ErrInvalidArg, "must specify another container")
|
|
}
|
|
|
|
if ctr.config.Pod != "" && dep.config.Pod != ctr.config.Pod {
|
|
return errors.Wrapf(ErrInvalidArg, "container has joined pod %s and dependency container %s is not a member of the pod", ctr.config.Pod, dep.ID())
|
|
}
|
|
|
|
deps = append(deps, dep.ID())
|
|
}
|
|
|
|
ctr.config.Dependencies = deps
|
|
|
|
return nil
|
|
}
|
|
}
|
|
|
|
// WithNetNS indicates that the container should be given a new network
|
|
// namespace with a minimal configuration.
|
|
// An optional array of port mappings can be provided.
|
|
// Conflicts with WithNetNSFrom().
|
|
func WithNetNS(portMappings []ocicni.PortMapping, postConfigureNetNS bool) CtrCreateOption {
|
|
return func(ctr *Container) error {
|
|
if ctr.valid {
|
|
return ErrCtrFinalized
|
|
}
|
|
|
|
if ctr.config.NetNsCtr != "" {
|
|
return errors.Wrapf(ErrInvalidArg, "container is already set to join another container's net ns, cannot create a new net ns")
|
|
}
|
|
|
|
ctr.config.PostConfigureNetNS = postConfigureNetNS
|
|
ctr.config.CreateNetNS = true
|
|
ctr.config.PortMappings = portMappings
|
|
|
|
return nil
|
|
}
|
|
}
|
|
|
|
// WithLogPath sets the path to the log file.
|
|
func WithLogPath(path string) CtrCreateOption {
|
|
return func(ctr *Container) error {
|
|
if ctr.valid {
|
|
return ErrCtrFinalized
|
|
}
|
|
if path == "" {
|
|
return errors.Wrapf(ErrInvalidArg, "log path must be set")
|
|
}
|
|
|
|
ctr.config.LogPath = path
|
|
|
|
return nil
|
|
}
|
|
}
|
|
|
|
// WithCgroupParent sets the Cgroup Parent of the new container.
|
|
func WithCgroupParent(parent string) CtrCreateOption {
|
|
return func(ctr *Container) error {
|
|
if ctr.valid {
|
|
return ErrCtrFinalized
|
|
}
|
|
|
|
if parent == "" {
|
|
return errors.Wrapf(ErrInvalidArg, "cgroup parent cannot be empty")
|
|
}
|
|
|
|
ctr.config.CgroupParent = parent
|
|
|
|
return nil
|
|
}
|
|
}
|
|
|
|
// WithDNSSearch sets the additional search domains of a container.
|
|
func WithDNSSearch(searchDomains []string) CtrCreateOption {
|
|
return func(ctr *Container) error {
|
|
if ctr.valid {
|
|
return ErrCtrFinalized
|
|
}
|
|
ctr.config.DNSSearch = searchDomains
|
|
return nil
|
|
}
|
|
}
|
|
|
|
// WithDNS sets additional name servers for the container.
|
|
func WithDNS(dnsServers []string) CtrCreateOption {
|
|
return func(ctr *Container) error {
|
|
if ctr.valid {
|
|
return ErrCtrFinalized
|
|
}
|
|
var dns []net.IP
|
|
for _, i := range dnsServers {
|
|
result := net.ParseIP(i)
|
|
if result == nil {
|
|
return errors.Wrapf(ErrInvalidArg, "invalid IP address %s", i)
|
|
}
|
|
dns = append(dns, result)
|
|
}
|
|
ctr.config.DNSServer = dns
|
|
return nil
|
|
}
|
|
}
|
|
|
|
// WithDNSOption sets addition dns options for the container.
|
|
func WithDNSOption(dnsOptions []string) CtrCreateOption {
|
|
return func(ctr *Container) error {
|
|
if ctr.valid {
|
|
return ErrCtrFinalized
|
|
}
|
|
ctr.config.DNSOption = dnsOptions
|
|
return nil
|
|
}
|
|
}
|
|
|
|
// WithHosts sets additional host:IP for the hosts file.
|
|
func WithHosts(hosts []string) CtrCreateOption {
|
|
return func(ctr *Container) error {
|
|
if ctr.valid {
|
|
return ErrCtrFinalized
|
|
}
|
|
ctr.config.HostAdd = hosts
|
|
return nil
|
|
}
|
|
}
|
|
|
|
// WithConmonPidFile specifies the path to the file that receives the pid of
|
|
// conmon.
|
|
func WithConmonPidFile(path string) CtrCreateOption {
|
|
return func(ctr *Container) error {
|
|
if ctr.valid {
|
|
return ErrCtrFinalized
|
|
}
|
|
ctr.config.ConmonPidFile = path
|
|
return nil
|
|
}
|
|
}
|
|
|
|
// WithGroups sets additional groups for the container, which are defined by
|
|
// the user.
|
|
func WithGroups(groups []string) CtrCreateOption {
|
|
return func(ctr *Container) error {
|
|
if ctr.valid {
|
|
return ErrCtrFinalized
|
|
}
|
|
ctr.config.Groups = groups
|
|
return nil
|
|
}
|
|
}
|
|
|
|
// WithUserVolumes sets the user-added volumes of the container.
|
|
// These are not added to the container's spec, but will instead be used during
|
|
// commit to populate the volumes of the new image, and to trigger some OCI
|
|
// hooks that are only added if volume mounts are present.
|
|
// Unless explicitly set, committed images will have no volumes.
|
|
// The given volumes slice must not be nil.
|
|
func WithUserVolumes(volumes []string) CtrCreateOption {
|
|
return func(ctr *Container) error {
|
|
if ctr.valid {
|
|
return ErrCtrFinalized
|
|
}
|
|
|
|
if volumes == nil {
|
|
return ErrInvalidArg
|
|
}
|
|
|
|
ctr.config.UserVolumes = make([]string, 0, len(volumes))
|
|
for _, vol := range volumes {
|
|
ctr.config.UserVolumes = append(ctr.config.UserVolumes, vol)
|
|
}
|
|
|
|
return nil
|
|
}
|
|
}
|
|
|
|
// WithEntrypoint sets the entrypoint of the container.
|
|
// This is not used to change the container's spec, but will instead be used
|
|
// during commit to populate the entrypoint of the new image.
|
|
// If not explicitly set it will default to the image's entrypoint.
|
|
// A nil entrypoint is allowed, and will clear entrypoint on the created image.
|
|
func WithEntrypoint(entrypoint []string) CtrCreateOption {
|
|
return func(ctr *Container) error {
|
|
if ctr.valid {
|
|
return ErrCtrFinalized
|
|
}
|
|
|
|
ctr.config.Entrypoint = make([]string, 0, len(entrypoint))
|
|
for _, str := range entrypoint {
|
|
ctr.config.Entrypoint = append(ctr.config.Entrypoint, str)
|
|
}
|
|
|
|
return nil
|
|
}
|
|
}
|
|
|
|
// WithCommand sets the command of the container.
|
|
// This is not used to change the container's spec, but will instead be used
|
|
// during commit to populate the command of the new image.
|
|
// If not explicitly set it will default to the image's command.
|
|
// A nil command is allowed, and will clear command on the created image.
|
|
func WithCommand(command []string) CtrCreateOption {
|
|
return func(ctr *Container) error {
|
|
if ctr.valid {
|
|
return ErrCtrFinalized
|
|
}
|
|
|
|
ctr.config.Command = make([]string, 0, len(command))
|
|
for _, str := range command {
|
|
ctr.config.Command = append(ctr.config.Command, str)
|
|
}
|
|
|
|
return nil
|
|
}
|
|
}
|
|
|
|
// WithRootFS sets the rootfs for the container
|
|
func WithRootFS(rootfs string) CtrCreateOption {
|
|
return func(ctr *Container) error {
|
|
if ctr.valid {
|
|
return ErrCtrFinalized
|
|
}
|
|
if _, err := os.Stat(rootfs); err != nil {
|
|
return errors.Wrapf(err, "error checking path %q", rootfs)
|
|
}
|
|
if ctr.config.RootfsImageID != "" {
|
|
return errors.Wrapf(ErrInvalidArg, "cannot set both an image ID and a rootfs for a container")
|
|
}
|
|
ctr.config.Rootfs = rootfs
|
|
return nil
|
|
}
|
|
}
|
|
|
|
// Pod Creation Options
|
|
|
|
// WithPodName sets the name of the pod.
|
|
func WithPodName(name string) PodCreateOption {
|
|
return func(pod *Pod) error {
|
|
if pod.valid {
|
|
return ErrPodFinalized
|
|
}
|
|
|
|
// Check the name against a regex
|
|
if !nameRegex.MatchString(name) {
|
|
return errors.Wrapf(ErrInvalidArg, "name must match regex [a-zA-Z0-9_-]+")
|
|
}
|
|
|
|
pod.config.Name = name
|
|
|
|
return nil
|
|
}
|
|
}
|
|
|
|
// WithPodLabels sets the labels of a pod.
|
|
func WithPodLabels(labels map[string]string) PodCreateOption {
|
|
return func(pod *Pod) error {
|
|
if pod.valid {
|
|
return ErrPodFinalized
|
|
}
|
|
|
|
pod.config.Labels = make(map[string]string)
|
|
for key, value := range labels {
|
|
pod.config.Labels[key] = value
|
|
}
|
|
|
|
return nil
|
|
}
|
|
}
|
|
|
|
// WithPodCgroupParent sets the Cgroup Parent of the pod.
|
|
func WithPodCgroupParent(path string) PodCreateOption {
|
|
return func(pod *Pod) error {
|
|
if pod.valid {
|
|
return ErrPodFinalized
|
|
}
|
|
|
|
pod.config.CgroupParent = path
|
|
|
|
return nil
|
|
}
|
|
}
|
|
|
|
// WithPodCgroups tells containers in this pod to use the cgroup created for
|
|
// this pod.
|
|
// This can still be overridden at the container level by explicitly specifying
|
|
// a CGroup parent.
|
|
func WithPodCgroups() PodCreateOption {
|
|
return func(pod *Pod) error {
|
|
if pod.valid {
|
|
return ErrPodFinalized
|
|
}
|
|
|
|
pod.config.UsePodCgroup = true
|
|
|
|
return nil
|
|
}
|
|
}
|