Add support for devices

api/api.pb.txt

@@ -5810,6 +5810,14 @@ file {
       type: TYPE_INT64
       json_name: "oomScoreAdj"
     }
+    field {
+      name: "Devices"
+      number: 31
+      label: LABEL_REPEATED
+      type: TYPE_MESSAGE
+      type_name: ".docker.swarmkit.v1.ContainerSpec.DeviceMapping"
+      json_name: "Devices"
+    }
     nested_type {
       name: "LabelsEntry"
       field {
@@ -5908,6 +5916,30 @@ file {
         json_name: "hard"
       }
     }
+    nested_type {
+      name: "DeviceMapping"
+      field {
+        name: "pathOnHost"
+        number: 1
+        label: LABEL_OPTIONAL
+        type: TYPE_STRING
+        json_name: "pathOnHost"
+      }
+      field {
+        name: "pathInContainer"
+        number: 2
+        label: LABEL_OPTIONAL
+        type: TYPE_STRING
+        json_name: "pathInContainer"
+      }
+      field {
+        name: "cgroupPermissions"
+        number: 3
+        label: LABEL_OPTIONAL
+        type: TYPE_STRING
+        json_name: "cgroupPermissions"
+      }
+    }
     enum_type {
       name: "Isolation"
       value {

api/specs.proto

@@ -375,6 +375,13 @@ message ContainerSpec {
 	// OOmScoreAdj defines the relative value used for destroying a container during an OOM
 	// Values are between -1000 and 1000
 	int64 oom_score_adj = 30;
+
+	message DeviceMapping {
+		string pathOnHost = 1;
+		string pathInContainer = 2;
+		string cgroupPermissions = 3;
+	}
+	repeated DeviceMapping Devices = 31;
 }
 
 // EndpointSpec defines the properties that can be configured to

swarmd/cmd/swarmctl/service/flagparser/device.go

@@ -0,0 +1,49 @@
+package flagparser
+
+import (
+	"strings"
+
+	"github.com/moby/swarmkit/v2/api"
+	"github.com/pkg/errors"
+	"github.com/spf13/pflag"
+)
+
+func parseDevice(flags *pflag.FlagSet, spec *api.ServiceSpec) error {
+	if flags.Changed("device") {
+		container := spec.Task.GetContainer()
+		if container == nil {
+			return nil
+		}
+
+		devices, err := flags.GetStringSlice("device")
+		if err != nil {
+			return err
+		}
+
+		container.Devices = make([]*api.ContainerSpec_DeviceMapping, len(devices))
+
+		for i, device := range devices {
+			parts := strings.Split(device, ":")
+			if len(parts) < 1 || len(parts) > 3 {
+				return errors.Wrap(err, "failed to parse device")
+			}
+
+			mapping := &api.ContainerSpec_DeviceMapping{
+				PathOnHost:      parts[0],
+				PathInContainer: parts[0],
+			}
+
+			if len(parts) > 1 {
+				mapping.PathInContainer = parts[1]
+			}
+
+			if len(parts) == 3 {
+				mapping.CgroupPermissions = parts[2]
+			}
+
+			container.Devices[i] = mapping
+		}
+	}
+
+	return nil
+}

swarmd/cmd/swarmctl/service/flagparser/flags.go

@@ -59,6 +59,7 @@ func AddServiceFlags(flags *pflag.FlagSet) {
 	flags.StringSlice("volume", nil, "define a volume mount")
 	flags.StringSlice("tmpfs", nil, "define a tmpfs mount")
 	flags.StringSlice("npipe", nil, "define a npipe mount")
+	flags.StringSlice("device", nil, "device options")
 
 	flags.String("log-driver", "", "specify a log driver")
 	flags.StringSlice("log-opt", nil, "log driver options, as key value pairs")
@@ -151,6 +152,10 @@ func Merge(cmd *cobra.Command, spec *api.ServiceSpec, c api.ControlClient) error
 		return err
 	}
 
+	if err := parseDevice(flags, spec); err != nil {
+		return err
+	}
+
 	driver, err := common.ParseLogDriverFlags(flags)
 	if err != nil {
 		return err

swarmd/dockerexec/container.go

@@ -467,6 +467,15 @@ func (c *containerConfig) resources() enginecontainer.Resources {
 		}
 	}
 
+	resources.Devices = make([]enginecontainer.DeviceMapping, len(c.spec().Devices))
+	for i, device := range c.spec().Devices {
+		resources.Devices[i] = enginecontainer.DeviceMapping{
+			PathOnHost:        device.PathOnHost,
+			PathInContainer:   device.PathInContainer,
+			CgroupPermissions: device.CgroupPermissions,
+		}
+	}
+
 	// If no limits are specified let the engine use its defaults.
 	//
 	// TODO(aluzzardi): We might want to set some limits anyway otherwise

swarmd/dockerexec/container_test.go

@@ -332,3 +332,35 @@ func TestUlimits(t *testing.T) {
 		t.Fatalf("expected %v, got %v", expected, actual)
 	}
 }
+
+func TestDevices(t *testing.T) {
+	c := containerConfig{
+		task: &api.Task{
+			Spec: api.TaskSpec{
+				Runtime: &api.TaskSpec_Container{
+					Container: &api.ContainerSpec{
+						Devices: []*api.ContainerSpec_DeviceMapping{
+							{
+								PathOnHost:        "/dev/dri/card0",
+								PathInContainer:   "/dev/card0",
+								CgroupPermissions: "ro",
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+
+	expected := []enginecontainer.DeviceMapping{
+		{
+			PathOnHost:        "/dev/dri/card0",
+			PathInContainer:   "/dev/card0",
+			CgroupPermissions: "ro",
+		},
+	}
+	actual := c.resources().Devices
+	if !reflect.DeepEqual(actual, expected) {
+		t.Fatalf("expected %v, got %v", expected, actual)
+	}
+}