Port ctr to use client
Signed-off-by: Michael Crosby <crosbymichael@gmail.com>
This commit is contained in:
Michael Crosby
@@ -3,343 +3,29 @@
|
||||
package main
|
||||
|
||||
import (
|
||||
"context"
|
||||
"encoding/json"
|
||||
"fmt"
|
||||
"io/ioutil"
|
||||
gocontext "context"
|
||||
"os"
|
||||
"os/signal"
|
||||
"path/filepath"
|
||||
"runtime"
|
||||
"strconv"
|
||||
"strings"
|
||||
|
||||
"golang.org/x/sys/unix"
|
||||
|
||||
"github.com/Sirupsen/logrus"
|
||||
"github.com/containerd/console"
|
||||
containersapi "github.com/containerd/containerd/api/services/containers"
|
||||
"github.com/containerd/containerd/api/services/execution"
|
||||
"github.com/containerd/containerd/api/types/descriptor"
|
||||
"github.com/containerd/containerd/api/types/mount"
|
||||
mountt "github.com/containerd/containerd/mount"
|
||||
protobuf "github.com/gogo/protobuf/types"
|
||||
ocispec "github.com/opencontainers/image-spec/specs-go/v1"
|
||||
"github.com/containerd/containerd"
|
||||
digest "github.com/opencontainers/go-digest"
|
||||
"github.com/opencontainers/image-spec/specs-go/v1"
|
||||
specs "github.com/opencontainers/runtime-spec/specs-go"
|
||||
"github.com/urfave/cli"
|
||||
)
|
||||
|
||||
const (
|
||||
rwm = "rwm"
|
||||
defaultRootfsPath = "rootfs"
|
||||
)
|
||||
|
||||
var capabilities = []string{
|
||||
"CAP_CHOWN",
|
||||
"CAP_DAC_OVERRIDE",
|
||||
"CAP_FSETID",
|
||||
"CAP_FOWNER",
|
||||
"CAP_MKNOD",
|
||||
"CAP_NET_RAW",
|
||||
"CAP_SETGID",
|
||||
"CAP_SETUID",
|
||||
"CAP_SETFCAP",
|
||||
"CAP_SETPCAP",
|
||||
"CAP_NET_BIND_SERVICE",
|
||||
"CAP_SYS_CHROOT",
|
||||
"CAP_KILL",
|
||||
"CAP_AUDIT_WRITE",
|
||||
}
|
||||
|
||||
func spec(id string, config *ocispec.ImageConfig, context *cli.Context, rootfs string) (*specs.Spec, error) {
|
||||
defaultEnv := []string{
|
||||
"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
|
||||
}
|
||||
defaultEnv = append(defaultEnv, config.Env...)
|
||||
cmd := config.Cmd
|
||||
if v := context.Args().Tail(); len(v) > 0 {
|
||||
cmd = v
|
||||
}
|
||||
var (
|
||||
// TODO: support overriding entrypoint
|
||||
args = append(config.Entrypoint, cmd...)
|
||||
tty = context.Bool("tty")
|
||||
uid, gid uint32
|
||||
)
|
||||
if config.User != "" {
|
||||
parts := strings.Split(config.User, ":")
|
||||
switch len(parts) {
|
||||
case 1:
|
||||
v, err := strconv.ParseUint(parts[0], 0, 10)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
uid, gid = uint32(v), uint32(v)
|
||||
case 2:
|
||||
v, err := strconv.ParseUint(parts[0], 0, 10)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
uid = uint32(v)
|
||||
if v, err = strconv.ParseUint(parts[1], 0, 10); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
gid = uint32(v)
|
||||
default:
|
||||
return nil, fmt.Errorf("invalid USER value %s", config.User)
|
||||
}
|
||||
}
|
||||
if tty {
|
||||
defaultEnv = append(defaultEnv, "TERM=xterm")
|
||||
}
|
||||
|
||||
// additional environment vars
|
||||
env := replaceOrAppendEnvValues(defaultEnv, context.StringSlice("env"))
|
||||
|
||||
cwd := config.WorkingDir
|
||||
if cwd == "" {
|
||||
cwd = "/"
|
||||
}
|
||||
if rootfs == "" {
|
||||
rootfs = defaultRootfsPath
|
||||
}
|
||||
s := &specs.Spec{
|
||||
Version: specs.Version,
|
||||
Platform: specs.Platform{
|
||||
OS: runtime.GOOS,
|
||||
Arch: runtime.GOARCH,
|
||||
},
|
||||
Root: specs.Root{
|
||||
Path: rootfs,
|
||||
Readonly: context.Bool("readonly"),
|
||||
},
|
||||
Process: specs.Process{
|
||||
Args: args,
|
||||
Env: env,
|
||||
Terminal: tty,
|
||||
Cwd: cwd,
|
||||
NoNewPrivileges: true,
|
||||
User: specs.User{
|
||||
UID: uid,
|
||||
GID: gid,
|
||||
},
|
||||
Capabilities: &specs.LinuxCapabilities{
|
||||
Bounding: capabilities,
|
||||
Permitted: capabilities,
|
||||
Inheritable: capabilities,
|
||||
Effective: capabilities,
|
||||
Ambient: capabilities,
|
||||
},
|
||||
Rlimits: []specs.LinuxRlimit{
|
||||
{
|
||||
Type: "RLIMIT_NOFILE",
|
||||
Hard: uint64(1024),
|
||||
Soft: uint64(1024),
|
||||
},
|
||||
},
|
||||
},
|
||||
Mounts: []specs.Mount{
|
||||
{
|
||||
Destination: "/proc",
|
||||
Type: "proc",
|
||||
Source: "proc",
|
||||
},
|
||||
{
|
||||
Destination: "/dev",
|
||||
Type: "tmpfs",
|
||||
Source: "tmpfs",
|
||||
Options: []string{"nosuid", "strictatime", "mode=755", "size=65536k"},
|
||||
},
|
||||
{
|
||||
Destination: "/dev/pts",
|
||||
Type: "devpts",
|
||||
Source: "devpts",
|
||||
Options: []string{"nosuid", "noexec", "newinstance", "ptmxmode=0666", "mode=0620", "gid=5"},
|
||||
},
|
||||
{
|
||||
Destination: "/dev/shm",
|
||||
Type: "tmpfs",
|
||||
Source: "shm",
|
||||
Options: []string{"nosuid", "noexec", "nodev", "mode=1777", "size=65536k"},
|
||||
},
|
||||
{
|
||||
Destination: "/dev/mqueue",
|
||||
Type: "mqueue",
|
||||
Source: "mqueue",
|
||||
Options: []string{"nosuid", "noexec", "nodev"},
|
||||
},
|
||||
{
|
||||
Destination: "/sys",
|
||||
Type: "sysfs",
|
||||
Source: "sysfs",
|
||||
Options: []string{"nosuid", "noexec", "nodev", "ro"},
|
||||
},
|
||||
{
|
||||
Destination: "/run",
|
||||
Type: "tmpfs",
|
||||
Source: "tmpfs",
|
||||
Options: []string{"nosuid", "strictatime", "mode=755", "size=65536k"},
|
||||
},
|
||||
{
|
||||
Destination: "/etc/resolv.conf",
|
||||
Type: "bind",
|
||||
Source: "/etc/resolv.conf",
|
||||
Options: []string{"rbind", "ro"},
|
||||
},
|
||||
{
|
||||
Destination: "/etc/hosts",
|
||||
Type: "bind",
|
||||
Source: "/etc/hosts",
|
||||
Options: []string{"rbind", "ro"},
|
||||
},
|
||||
{
|
||||
Destination: "/etc/localtime",
|
||||
Type: "bind",
|
||||
Source: "/etc/localtime",
|
||||
Options: []string{"rbind", "ro"},
|
||||
},
|
||||
},
|
||||
Hostname: id,
|
||||
Linux: &specs.Linux{
|
||||
Resources: &specs.LinuxResources{
|
||||
Devices: []specs.LinuxDeviceCgroup{
|
||||
{
|
||||
Allow: false,
|
||||
Access: rwm,
|
||||
},
|
||||
},
|
||||
},
|
||||
Namespaces: []specs.LinuxNamespace{
|
||||
{
|
||||
Type: "pid",
|
||||
},
|
||||
{
|
||||
Type: "ipc",
|
||||
},
|
||||
{
|
||||
Type: "uts",
|
||||
},
|
||||
{
|
||||
Type: "mount",
|
||||
},
|
||||
},
|
||||
},
|
||||
}
|
||||
if !context.Bool("net-host") {
|
||||
s.Linux.Namespaces = append(s.Linux.Namespaces, specs.LinuxNamespace{
|
||||
Type: "network",
|
||||
})
|
||||
}
|
||||
for _, mount := range context.StringSlice("mount") {
|
||||
m, err := parseMountFlag(mount)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
s.Mounts = append(s.Mounts, m)
|
||||
}
|
||||
return s, nil
|
||||
}
|
||||
|
||||
func customSpec(configPath string, rootfs string) (*specs.Spec, error) {
|
||||
b, err := ioutil.ReadFile(configPath)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
var s specs.Spec
|
||||
if err := json.Unmarshal(b, &s); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
if rootfs == "" {
|
||||
if s.Root.Path != defaultRootfsPath {
|
||||
logrus.Warnf("ignoring Root.Path %q, setting %q forcibly", s.Root.Path, defaultRootfsPath)
|
||||
s.Root.Path = defaultRootfsPath
|
||||
}
|
||||
} else {
|
||||
s.Root.Path = rootfs
|
||||
}
|
||||
return &s, nil
|
||||
}
|
||||
|
||||
func getConfig(context *cli.Context, imageConfig *ocispec.ImageConfig, rootfs string) (*specs.Spec, error) {
|
||||
config := context.String("runtime-config")
|
||||
if config == "" {
|
||||
return spec(context.String("id"), imageConfig, context, rootfs)
|
||||
}
|
||||
|
||||
return customSpec(config, rootfs)
|
||||
}
|
||||
|
||||
func newContainerSpec(context *cli.Context, config *ocispec.ImageConfig, imageRef string) ([]byte, error) {
|
||||
s, err := getConfig(context, config, context.String("rootfs"))
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
if s.Annotations == nil {
|
||||
s.Annotations = make(map[string]string)
|
||||
}
|
||||
s.Annotations["image"] = imageRef
|
||||
return json.Marshal(s)
|
||||
}
|
||||
|
||||
func newCreateContainerRequest(context *cli.Context, id, snapshot, image string, spec []byte) (*containersapi.CreateContainerRequest, error) {
|
||||
create := &containersapi.CreateContainerRequest{
|
||||
Container: containersapi.Container{
|
||||
ID: id,
|
||||
Image: image,
|
||||
Spec: &protobuf.Any{
|
||||
TypeUrl: specs.Version,
|
||||
Value: spec,
|
||||
},
|
||||
Runtime: context.String("runtime"),
|
||||
RootFS: snapshot,
|
||||
},
|
||||
}
|
||||
|
||||
return create, nil
|
||||
}
|
||||
|
||||
func newCreateTaskRequest(context *cli.Context, id, tmpDir string, checkpoint *ocispec.Descriptor, mounts []mountt.Mount) (*execution.CreateRequest, error) {
|
||||
create := &execution.CreateRequest{
|
||||
ContainerID: id,
|
||||
Terminal: context.Bool("tty"),
|
||||
Stdin: filepath.Join(tmpDir, "stdin"),
|
||||
Stdout: filepath.Join(tmpDir, "stdout"),
|
||||
Stderr: filepath.Join(tmpDir, "stderr"),
|
||||
}
|
||||
|
||||
for _, m := range mounts {
|
||||
create.Rootfs = append(create.Rootfs, &mount.Mount{
|
||||
Type: m.Type,
|
||||
Source: m.Source,
|
||||
Options: m.Options,
|
||||
})
|
||||
}
|
||||
|
||||
if checkpoint != nil {
|
||||
create.Checkpoint = &descriptor.Descriptor{
|
||||
MediaType: checkpoint.MediaType,
|
||||
Size_: checkpoint.Size,
|
||||
Digest: checkpoint.Digest,
|
||||
}
|
||||
}
|
||||
|
||||
return create, nil
|
||||
}
|
||||
|
||||
func handleConsoleResize(ctx context.Context, service execution.TasksClient, id string, pid uint32, con console.Console) error {
|
||||
func handleConsoleResize(ctx gocontext.Context, task resizer, con console.Console) error {
|
||||
// do an initial resize of the console
|
||||
size, err := con.Size()
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if _, err := service.Pty(ctx, &execution.PtyRequest{
|
||||
ContainerID: id,
|
||||
Pid: pid,
|
||||
Width: uint32(size.Width),
|
||||
Height: uint32(size.Height),
|
||||
}); err != nil {
|
||||
return err
|
||||
if err := task.Resize(ctx, uint32(size.Width), uint32(size.Height)); err != nil {
|
||||
logrus.WithError(err).Error("resize pty")
|
||||
}
|
||||
s := make(chan os.Signal, 16)
|
||||
signal.Notify(s, unix.SIGWINCH)
|
||||
@@ -350,15 +36,86 @@ func handleConsoleResize(ctx context.Context, service execution.TasksClient, id
|
||||
logrus.WithError(err).Error("get pty size")
|
||||
continue
|
||||
}
|
||||
if _, err := service.Pty(ctx, &execution.PtyRequest{
|
||||
ContainerID: id,
|
||||
Pid: pid,
|
||||
Width: uint32(size.Width),
|
||||
Height: uint32(size.Height),
|
||||
}); err != nil {
|
||||
if err := task.Resize(ctx, uint32(size.Width), uint32(size.Height)); err != nil {
|
||||
logrus.WithError(err).Error("resize pty")
|
||||
}
|
||||
}
|
||||
}()
|
||||
return nil
|
||||
}
|
||||
|
||||
func withTTY() containerd.SpecOpts {
|
||||
return containerd.WithTTY
|
||||
}
|
||||
|
||||
func setHostNetworking() containerd.SpecOpts {
|
||||
return containerd.WithHostNamespace(specs.NetworkNamespace)
|
||||
}
|
||||
|
||||
func newContainer(ctx gocontext.Context, client *containerd.Client, context *cli.Context) (containerd.Container, error) {
|
||||
var (
|
||||
err error
|
||||
checkpointIndex digest.Digest
|
||||
|
||||
ref = context.Args().First()
|
||||
id = context.Args().Get(1)
|
||||
args = context.Args()[2:]
|
||||
tty = context.Bool("tty")
|
||||
)
|
||||
if raw := context.String("checkpoint"); raw != "" {
|
||||
if checkpointIndex, err = digest.Parse(raw); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
}
|
||||
image, err := client.GetImage(ctx, ref)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
if checkpointIndex == "" {
|
||||
opts := []containerd.SpecOpts{
|
||||
containerd.WithImageConfig(ctx, image),
|
||||
withEnv(context),
|
||||
withMounts(context),
|
||||
}
|
||||
if len(args) > 0 {
|
||||
opts = append(opts, containerd.WithProcessArgs(args...))
|
||||
}
|
||||
if tty {
|
||||
opts = append(opts, withTTY())
|
||||
}
|
||||
if context.Bool("net-host") {
|
||||
opts = append(opts, setHostNetworking())
|
||||
}
|
||||
spec, err := containerd.GenerateSpec(opts...)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
var rootfs containerd.NewContainerOpts
|
||||
if context.Bool("readonly") {
|
||||
rootfs = containerd.WithNewReadonlyRootFS(id, image)
|
||||
} else {
|
||||
rootfs = containerd.WithNewRootFS(id, image)
|
||||
}
|
||||
return client.NewContainer(ctx, id,
|
||||
containerd.WithSpec(spec),
|
||||
containerd.WithImage(image),
|
||||
rootfs,
|
||||
)
|
||||
}
|
||||
return client.NewContainer(ctx, id, containerd.WithCheckpoint(v1.Descriptor{
|
||||
Digest: checkpointIndex,
|
||||
}, id))
|
||||
}
|
||||
|
||||
func newTask(ctx gocontext.Context, container containerd.Container, checkpoint digest.Digest, tty bool) (containerd.Task, error) {
|
||||
if checkpoint == "" {
|
||||
io := containerd.Stdio
|
||||
if tty {
|
||||
io = containerd.StdioTerminal
|
||||
}
|
||||
return container.NewTask(ctx, io)
|
||||
}
|
||||
return container.NewTask(ctx, containerd.Stdio, containerd.WithTaskCheckpoint(v1.Descriptor{
|
||||
Digest: checkpoint,
|
||||
}))
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user