github/containerd
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases 2 Wiki Activity
1,340 Commits 3 Branches 2 Tags 112 MiB
f58105a71c
Commit Graph

461 Commits

Author SHA1 Message Date
Lantao Liu
de967051d4 Fix kill when shared pid namespace. 
Signed-off-by: Lantao Liu <lantaol@google.com>
 2018-12-04 01:53:09 -08:00
Mike Brown
f8e89f71a9 adds cni results to verbose pod info 
Signed-off-by: Mike Brown <brownwm@us.ibm.com>
 2018-11-26 15:57:00 -06:00
Lantao Liu
80554f4a85
Merge pull request #973 from Random-Liu/use-event-id 
Use the `ID` field of `TaskExit` event.
 2018-11-12 17:02:34 -08:00
Lantao Liu
7f1f4e7a14 Remove invalid TODO comment. 
Signed-off-by: Lantao Liu <lantaol@google.com>
 2018-11-12 14:34:36 -08:00
Lantao Liu
d4c825f905 Use the ID field of TaskExit event. 
Signed-off-by: Lantao Liu <lantaol@google.com>
 2018-11-12 14:30:27 -08:00
Lantao Liu
459e481808 Update code for golang 1.11 gofmt. 
Signed-off-by: Lantao Liu <lantaol@google.com>
 2018-11-07 16:08:58 -08:00
Mike Brown
1b3ff7462e removes authconfit from info log 
Signed-off-by: Mike Brown <brownwm@us.ibm.com>
 2018-10-29 21:17:15 -05:00
Lantao Liu
c1740d8291 Manage mount lifecycle and remove cached state 
Signed-off-by: Lantao Liu <lantaol@google.com>
 2018-10-24 11:00:25 -07:00
Starnop
22a8777a9e refactor: setup network after get Sandbox runtime 
Signed-off-by: Starnop <starnop@163.com>
 2018-10-17 16:35:45 +08:00
Lantao Liu
84775d2c10 Add integration test. 
Signed-off-by: Lantao Liu <lantaol@google.com>
 2018-10-11 10:32:19 -07:00
Lantao Liu
c39f63eaf4 Teardown pod network even if the network namespace is closed 
Signed-off-by: Lantao Liu <lantaol@google.com>
 2018-10-10 13:10:18 -07:00
Lantao Liu
70da14e4b3
Merge pull request #943 from Random-Liu/support-per-runtime-config 
Support runtime specific configurations.
 2018-10-09 08:09:12 -07:00
Lantao Liu
1442425f92 Support runtime specific configurations. 
Signed-off-by: Lantao Liu <lantaol@google.com>
 2018-10-08 17:17:29 -07:00
Lantao Liu
3e4cf68a3f Use Authorizer. 
Signed-off-by: Lantao Liu <lantaol@google.com>
 2018-10-08 15:16:15 -07:00
JulienBalestra
27f33cd4d6
cni result: add a debug message 
Signed-off-by: JulienBalestra <julien.balestra@datadoghq.com>
 2018-10-03 17:19:51 +02:00
Lantao Liu
db68300a5a Manage unmanaged images in k8s.io namespace 
Signed-off-by: Lantao Liu <lantaol@google.com>
 2018-09-27 11:19:11 -07:00
Lantao Liu
963a01735b Add timeout for container/sandbox recover and event monitor. 
Signed-off-by: Lantao Liu <lantaol@google.com>
 2018-09-26 15:23:15 -07:00
Lantao Liu
4b45e16a4b Show runtime handler in sandbox debug info. 
Signed-off-by: Lantao Liu <lantaol@google.com>
 2018-09-16 21:27:51 -07:00
Lantao Liu
ca3b806b5c Fix addition group ids. 
Signed-off-by: Lantao Liu <lantaol@google.com>
 2018-09-13 16:31:32 -07:00
Lantao Liu
f540c2a74d Skip sctp protocol hostport mapping. 
Signed-off-by: Lantao Liu <lantaol@google.com>
 2018-09-11 16:32:15 -07:00
Lantao Liu
fe0cd3672b
Merge pull request #865 from Random-Liu/cache-image-reference 
Cache image reference
 2018-09-10 16:21:57 -07:00
Lantao Liu
953d67d250 Create image reference cache. 
Signed-off-by: Lantao Liu <lantaol@google.com>
 2018-09-10 11:30:52 -07:00
Lantao Liu
f08a90ff64 Fix hostname env. 
Signed-off-by: Lantao Liu <lantaol@google.com>
 2018-09-10 10:58:17 -07:00
Lantao Liu
cfdf872493
Merge pull request #891 from tallclair/runtimehandler 
Add RuntimeHandler support
 2018-09-10 10:09:57 -07:00
Lantao Liu
eb3d3cfc5e Revert "Add HOSTNAME to env by default for pod containers" 
This reverts commit 4c3e195db3.

Signed-off-by: Lantao Liu <lantaol@google.com>
 2018-09-06 15:30:53 -07:00
Lantao Liu
db8500d10c
Merge pull request #892 from Random-Liu/fix-volume-mount-order 
Sort volume mount.
 2018-09-06 14:44:45 -07:00
Tim Allclair
e7189a25c3
Add RuntimeHandler support 
Signed-off-by: Tim Allclair <tallclair@google.com>
 2018-09-05 17:27:35 -07:00
Lantao Liu
67c0b3e5e2
Merge pull request #894 from Random-Liu/support-masked-readonly-paths 
Support masked readonly paths
 2018-09-05 10:32:40 -07:00
Phil Estes
4c3e195db3
Add HOSTNAME to env by default for pod containers 
To match expectations of users coming from Docker engine runtime, add
the HOSTNAME to the environment of new containers in a pod.

Signed-off-by: Phil Estes <estesp@linux.vnet.ibm.com>
 2018-09-05 12:04:40 -04:00
Lantao Liu
3e4cec8739 Add MaskedPaths and ReadonlyPaths support. 
Signed-off-by: Lantao Liu <lantaol@google.com>
 2018-09-04 23:49:16 -07:00
Lantao Liu
063f8158f8 Sort volume mount. 
Signed-off-by: Lantao Liu <lantaol@google.com>
 2018-09-04 22:43:37 -07:00
Lantao Liu
49877571e9
Merge pull request #886 from DataDog/JulienBalestra/tls-stream 
stream: can use user certificates
 2018-09-03 23:35:18 -07:00
JulienBalestra
dffd0dfa0e
streaming: tls conf validation to func with tests 
Signed-off-by: JulienBalestra <julien.balestra@datadoghq.com>
 2018-08-30 15:10:48 +02:00
JulienBalestra
859003a940
stream: struct for x509 key pair, update the docs, error management 
Signed-off-by: JulienBalestra <julien.balestra@datadoghq.com>
 2018-08-28 17:22:11 +02:00
JulienBalestra
b82b524260
stream: can use user certificates 
Signed-off-by: JulienBalestra <julien.balestra@datadoghq.com>
 2018-08-27 19:26:14 +02:00
Lantao Liu
bca304ff3e Fix an issue that container/sandbox can't be stopped. 
Signed-off-by: Lantao Liu <lantaol@google.com>
 2018-08-24 18:54:08 -07:00
Yanqiang Miao
a87bda08c0 update selinux to b6fa367 
Signed-off-by: Yanqiang Miao <miao.yanqiang@zte.com.cn>
 2018-08-14 08:33:43 +08:00
Yanqiang Miao
415727cd9f verify selinux level format 
Signed-off-by: Yanqiang Miao <miao.yanqiang@zte.com.cn>
 2018-08-14 08:33:34 +08:00
Lantao Liu
e1a37e8797 Unpack image during import. 
Signed-off-by: Lantao Liu <lantaol@google.com>
 2018-07-26 07:48:41 +00:00
Eric Ernst
9a01272dc2 sandbox: separate host accessing workload and privileged 
VM isolated runtimes can support privileged workloads. In this
scenario, access to the guest VM is provided instead of the host.
Based on this, allow untrusted runtimes to run privileged workloads.

If the workload is specifically asking for node PID/IPC/network, etc.,
then continue to require the trusted runtime.

This commit repurposes the hostPrivilegedSandbox utility function to
only check for node namespace checking.

Fixes: #855

Signed-off-by: Eric Ernst <eric.ernst@intel.com>
 2018-07-22 16:51:22 -07:00
yanxuean
7065dd81f9 support no_pivot option for runc 
Signed-off-by: yanxuean <yan.xuean@zte.com.cn>
 2018-07-20 08:46:50 +08:00
Lantao Liu
952e53bf58 Add registry auth config, and use docker resolver in containerd. 
Signed-off-by: Lantao Liu <lantaol@google.com>
 2018-07-09 19:08:48 -07:00
Lantao Liu
4eb4a29577
Merge pull request #825 from abhi/cni_config 
Change to keep in sync with latest cni config
 2018-06-21 16:14:31 -07:00
Abhinandan Prativadi
263b0b99d0 Change to keep in sync with latest cni config 
This commit contains change to pick the latest cni config
from the configured CNIConfDir.
With this change any changes made to the cni config file will
be picked up on the kubelet's runtime status check call.
Ofcourse this would lead to undefined behavior when the cni config
change is made in parallel during pod creation. However its
reasonable to assume that the operator is aware of the need to
drain the nodes of pods before making cni configuration change.
The behavior is currently not defined in kubernetes. However
I see that similar approach being adopted in the upstream kubernetes
with dockershim. Keeping the behavior consistent for now.

Signed-off-by: Abhinandan Prativadi <abhi@docker.com>
 2018-06-21 20:43:38 +00:00
Filipe Brandenburger
01d77d44f5 Update github.com/opencontainers/runtime-tools to v0.6.0 
Also add new dependencies on github.com/xeipuuv/gojson* (brought up by
new runtime-tools) and adapt the containerd/cri code to replace the APIs
that were removed by runtime-tools.

In particular, add new helpers to handle the capabilities, since
runtime-tools now split them into separate sets of functions for each
capability set.

Replace g.Spec() with g.Config since g.Spec() has been deprecated in the
runtime-tools API.

Signed-off-by: Filipe Brandenburger <filbranden@google.com>
 2018-06-20 13:52:50 -07:00
Lantao Liu
b60e456bd9 Fix snapshotter nil panic. 
Signed-off-by: Lantao Liu <lantaol@google.com>
 2018-06-20 00:43:44 +00:00
Lantao Liu
e3d57d240f
Merge pull request #761 from Random-Liu/add-log-max-size 
Add log max size
 2018-06-15 15:56:04 -07:00
Lantao Liu
53f1ab4145 Fix double /dev/shm mount. 
Signed-off-by: Lantao Liu <lantaol@google.com>
 2018-06-14 19:03:19 -07:00
Lantao Liu
405f57f8e0 Add max_container_log_size 
Signed-off-by: Lantao Liu <lantaol@google.com>
 2018-06-14 14:24:17 -07:00
Lantao Liu
46d621e4ac Support Cmd for sandbox container. 
Signed-off-by: Lantao Liu <lantaol@google.com>
 2018-06-12 14:38:55 -07:00