github/containerd
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases 2 Wiki Activity

Merge pull request #518 from Random-Liu/fix-privileged-caps

Browse Source 
Fix privileged caps
This commit is contained in:
Lantao Liu 2018-01-03 12:00:33 -08:00 committed by GitHub
commit 5b82e3a934
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
5 changed files with 13 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
pkg/server/container_create.go
View File

@ -279,7 +279,7 @@ func (c *criContainerdService) generateContainerSpec(id string, sandboxPid uint3
if err != nil { if err != nil {
return nil, err return nil, err
} }
g := generate.NewFromSpec(spec) g := newSpecGenerator(spec)
// Set the relative path to the rootfs of the container from containerd's // Set the relative path to the rootfs of the container from containerd's
// pre-defined directory. // pre-defined directory.

3
pkg/server/container_execsync.go
View File

@ -26,7 +26,6 @@ import (
containerdio "github.com/containerd/containerd/cio" containerdio "github.com/containerd/containerd/cio"
"github.com/containerd/containerd/errdefs" "github.com/containerd/containerd/errdefs"
"github.com/golang/glog" "github.com/golang/glog"
"github.com/opencontainers/runtime-tools/generate"
"golang.org/x/net/context" "golang.org/x/net/context"
"golang.org/x/sys/unix" "golang.org/x/sys/unix"
"k8s.io/client-go/tools/remotecommand" "k8s.io/client-go/tools/remotecommand"
@ -100,7 +99,7 @@ func (c *criContainerdService) execInContainer(ctx context.Context, id string, o
return nil, fmt.Errorf("failed to load task: %v", err) return nil, fmt.Errorf("failed to load task: %v", err)
} }
if opts.tty { if opts.tty {
g := generate.NewFromSpec(spec) g := newSpecGenerator(spec)
g.AddProcessEnv("TERM", "xterm") g.AddProcessEnv("TERM", "xterm")
spec = g.Spec() spec = g.Spec()
} }

3
pkg/server/container_update_resources.go
View File

@ -26,7 +26,6 @@ import (
"github.com/containerd/typeurl" "github.com/containerd/typeurl"
"github.com/golang/glog" "github.com/golang/glog"
runtimespec "github.com/opencontainers/runtime-spec/specs-go" runtimespec "github.com/opencontainers/runtime-spec/specs-go"
"github.com/opencontainers/runtime-tools/generate"
"golang.org/x/net/context" "golang.org/x/net/context"
"k8s.io/kubernetes/pkg/kubelet/apis/cri/v1alpha1/runtime" "k8s.io/kubernetes/pkg/kubelet/apis/cri/v1alpha1/runtime"
@ -133,7 +132,7 @@ func updateOCILinuxResource(spec *runtimespec.Spec, new *runtime.LinuxContainerR
if err := util.DeepCopy(&cloned, spec); err != nil { if err := util.DeepCopy(&cloned, spec); err != nil {
return nil, fmt.Errorf("failed to deep copy: %v", err) return nil, fmt.Errorf("failed to deep copy: %v", err)
} }
g := generate.NewFromSpec(&cloned) g := newSpecGenerator(&cloned)
if new.GetCpuPeriod() != 0 { if new.GetCpuPeriod() != 0 {
g.SetLinuxResourcesCPUPeriod(uint64(new.GetCpuPeriod())) g.SetLinuxResourcesCPUPeriod(uint64(new.GetCpuPeriod()))

9
pkg/server/helpers.go
View File

@ -32,7 +32,9 @@ import (
imagedigest "github.com/opencontainers/go-digest" imagedigest "github.com/opencontainers/go-digest"
"github.com/opencontainers/image-spec/identity" "github.com/opencontainers/image-spec/identity"
imagespec "github.com/opencontainers/image-spec/specs-go/v1" imagespec "github.com/opencontainers/image-spec/specs-go/v1"
runtimespec "github.com/opencontainers/runtime-spec/specs-go"
specs "github.com/opencontainers/runtime-spec/specs-go" specs "github.com/opencontainers/runtime-spec/specs-go"
"github.com/opencontainers/runtime-tools/generate"
"github.com/opencontainers/selinux/go-selinux" "github.com/opencontainers/selinux/go-selinux"
"github.com/opencontainers/selinux/go-selinux/label" "github.com/opencontainers/selinux/go-selinux/label"
"golang.org/x/net/context" "golang.org/x/net/context"
@ -397,3 +399,10 @@ func buildLabels(configLabels map[string]string, containerType string) map[strin
labels[containerKindLabel] = containerType labels[containerKindLabel] = containerType
return labels return labels
} }
// newSpecGenerator creates a new spec generator for the runtime spec.
func newSpecGenerator(spec *runtimespec.Spec) generate.Generator {
g := generate.NewFromSpec(spec)
g.HostSpecific = true
return g
}

3
pkg/server/sandbox_run.go
View File

@ -30,7 +30,6 @@ import (
"github.com/golang/glog" "github.com/golang/glog"
imagespec "github.com/opencontainers/image-spec/specs-go/v1" imagespec "github.com/opencontainers/image-spec/specs-go/v1"
runtimespec "github.com/opencontainers/runtime-spec/specs-go" runtimespec "github.com/opencontainers/runtime-spec/specs-go"
"github.com/opencontainers/runtime-tools/generate"
"golang.org/x/net/context" "golang.org/x/net/context"
"golang.org/x/sys/unix" "golang.org/x/sys/unix"
"k8s.io/kubernetes/pkg/kubelet/apis/cri/v1alpha1/runtime" "k8s.io/kubernetes/pkg/kubelet/apis/cri/v1alpha1/runtime"
@ -240,7 +239,7 @@ func (c *criContainerdService) generateSandboxContainerSpec(id string, config *r
if err != nil { if err != nil {
return nil, err return nil, err
} }
g := generate.NewFromSpec(spec) g := newSpecGenerator(spec)
// Apply default config from image config. // Apply default config from image config.
if err := addImageEnvs(&g, imageConfig.Env); err != nil { if err := addImageEnvs(&g, imageConfig.Env); err != nil {