Skip to content

Commit 444ef06

Browse files
author
John Howard
committed
Windows: config refactoring
Signed-off-by: John Howard <jhoward@microsoft.com>
1 parent db21ac7 commit 444ef06

File tree

5 files changed

+172
-154
lines changed

5 files changed

+172
-154
lines changed

‎libcontainer/configs/config.go‎

Lines changed: 3 additions & 154 deletions
Original file line numberDiff line numberDiff line change
@@ -6,170 +6,19 @@ import (
66
"os/exec"
77
)
88

9-
type Rlimit struct {
10-
Type int `json:"type"`
11-
Hard uint64 `json:"hard"`
12-
Soft uint64 `json:"soft"`
13-
}
14-
15-
// IDMap represents UID/GID Mappings for User Namespaces.
16-
type IDMap struct {
17-
ContainerID int `json:"container_id"`
18-
HostID int `json:"host_id"`
19-
Size int `json:"size"`
20-
}
21-
22-
// Seccomp represents syscall restrictions
23-
// By default, only the native architecture of the kernel is allowed to be used
24-
// for syscalls. Additional architectures can be added by specifying them in
25-
// Architectures.
26-
type Seccomp struct {
27-
DefaultAction Action `json:"default_action"`
28-
Architectures []string `json:"architectures"`
29-
Syscalls []*Syscall `json:"syscalls"`
30-
}
31-
32-
// An action to be taken upon rule match in Seccomp
33-
type Action int
34-
35-
const (
36-
Kill Action = iota - 4
37-
Errno
38-
Trap
39-
Allow
40-
)
41-
42-
// A comparison operator to be used when matching syscall arguments in Seccomp
43-
type Operator int
44-
45-
const (
46-
EqualTo Operator = iota
47-
NotEqualTo
48-
GreaterThan
49-
GreaterThanOrEqualTo
50-
LessThan
51-
LessThanOrEqualTo
52-
MaskEqualTo
53-
)
54-
55-
// A rule to match a specific syscall argument in Seccomp
56-
type Arg struct {
57-
Index uint `json:"index"`
58-
Value uint64 `json:"value"`
59-
ValueTwo uint64 `json:"value_two"`
60-
Op Operator `json:"op"`
61-
}
62-
63-
// An rule to match a syscall in Seccomp
64-
type Syscall struct {
65-
Name string `json:"name"`
66-
Action Action `json:"action"`
67-
Args []*Arg `json:"args"`
68-
}
69-
70-
// TODO Windows. Many of these fields should be factored out into those parts
71-
// which are common across platforms, and those which are platform specific.
72-
73-
// Config defines configuration options for executing a process inside a contained environment.
74-
type Config struct {
75-
// NoPivotRoot will use MS_MOVE and a chroot to jail the process into the container's rootfs
76-
// This is a common option when the container is running in ramdisk
77-
NoPivotRoot bool `json:"no_pivot_root"`
78-
79-
// ParentDeathSignal specifies the signal that is sent to the container's process in the case
80-
// that the parent process dies.
81-
ParentDeathSignal int `json:"parent_death_signal"`
82-
83-
// PivotDir allows a custom directory inside the container's root filesystem to be used as pivot, when NoPivotRoot is not set.
84-
// When a custom PivotDir not set, a temporary dir inside the root filesystem will be used. The pivot dir needs to be writeable.
85-
// This is required when using read only root filesystems. In these cases, a read/writeable path can be (bind) mounted somewhere inside the root filesystem to act as pivot.
86-
PivotDir string `json:"pivot_dir"`
87-
9+
// BaseConfig defines the platform agnostic configuration options for executing
10+
// a process inside a contained environment.
11+
type BaseConfig struct {
8812
// Path to a directory containing the container's root filesystem.
8913
Rootfs string `json:"rootfs"`
9014

91-
// Readonlyfs will remount the container's rootfs as readonly where only externally mounted
92-
// bind mounts are writtable.
93-
Readonlyfs bool `json:"readonlyfs"`
94-
95-
// Specifies the mount propagation flags to be applied to /.
96-
RootPropagation int `json:"rootPropagation"`
97-
9815
// Mounts specify additional source and destination paths that will be mounted inside the container's
9916
// rootfs and mount namespace if specified
10017
Mounts []*Mount `json:"mounts"`
10118

102-
// The device nodes that should be automatically created within the container upon container start. Note, make sure that the node is marked as allowed in the cgroup as well!
103-
Devices []*Device `json:"devices"`
104-
105-
MountLabel string `json:"mount_label"`
106-
10719
// Hostname optionally sets the container's hostname if provided
10820
Hostname string `json:"hostname"`
10921

110-
// Namespaces specifies the container's namespaces that it should setup when cloning the init process
111-
// If a namespace is not provided that namespace is shared from the container's parent process
112-
Namespaces Namespaces `json:"namespaces"`
113-
114-
// Capabilities specify the capabilities to keep when executing the process inside the container
115-
// All capbilities not specified will be dropped from the processes capability mask
116-
Capabilities []string `json:"capabilities"`
117-
118-
// Networks specifies the container's network setup to be created
119-
Networks []*Network `json:"networks"`
120-
121-
// Routes can be specified to create entries in the route table as the container is started
122-
Routes []*Route `json:"routes"`
123-
124-
// Cgroups specifies specific cgroup settings for the various subsystems that the container is
125-
// placed into to limit the resources the container has available
126-
Cgroups *Cgroup `json:"cgroups"`
127-
128-
// AppArmorProfile specifies the profile to apply to the process running in the container and is
129-
// change at the time the process is execed
130-
AppArmorProfile string `json:"apparmor_profile"`
131-
132-
// ProcessLabel specifies the label to apply to the process running in the container. It is
133-
// commonly used by selinux
134-
ProcessLabel string `json:"process_label"`
135-
136-
// Rlimits specifies the resource limits, such as max open files, to set in the container
137-
// If Rlimits are not set, the container will inherit rlimits from the parent process
138-
Rlimits []Rlimit `json:"rlimits"`
139-
140-
// OomScoreAdj specifies the adjustment to be made by the kernel when calculating oom scores
141-
// for a process. Valid values are between the range [-1000, '1000'], where processes with
142-
// higher scores are preferred for being killed.
143-
// More information about kernel oom score calculation here: https://lwn.net/Articles/317814/
144-
OomScoreAdj int `json:"oom_score_adj"`
145-
146-
// AdditionalGroups specifies the gids that should be added to supplementary groups
147-
// in addition to those that the user belongs to.
148-
AdditionalGroups []string `json:"additional_groups"`
149-
150-
// UidMappings is an array of User ID mappings for User Namespaces
151-
UidMappings []IDMap `json:"uid_mappings"`
152-
153-
// GidMappings is an array of Group ID mappings for User Namespaces
154-
GidMappings []IDMap `json:"gid_mappings"`
155-
156-
// MaskPaths specifies paths within the container's rootfs to mask over with a bind
157-
// mount pointing to /dev/null as to prevent reads of the file.
158-
MaskPaths []string `json:"mask_paths"`
159-
160-
// ReadonlyPaths specifies paths within the container's rootfs to remount as read-only
161-
// so that these files prevent any writes.
162-
ReadonlyPaths []string `json:"readonly_paths"`
163-
164-
// Sysctl is a map of properties and their values. It is the equivalent of using
165-
// sysctl -w my.property.name value in Linux.
166-
Sysctl map[string]string `json:"sysctl"`
167-
168-
// Seccomp allows actions to be taken whenever a syscall is made within the container.
169-
// A number of rules are given, each having an action to be taken if a syscall matches it.
170-
// A default action to be taken if no rules match is also given.
171-
Seccomp *Seccomp `json:"seccomp"`
172-
17322
// Hooks are a collection of actions to perform at various container lifecycle events.
17423
// Hooks are not able to be marshaled to json but they are also not needed to.
17524
Hooks *Hooks `json:"-"`

libcontainer/configs/config_test.go renamed to libcontainer/configs/config_test_unix.go

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
1+
// +build linux freebsd
2+
13
package configs
24

35
import (

‎libcontainer/configs/config_test_windows.go‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
package configs
2+
3+
// All current tests are for Unix specific functionality

‎libcontainer/configs/config_unix.go‎

Lines changed: 156 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,162 @@ package configs
44

55
import "fmt"
66

7+
type Rlimit struct {
8+
Type int `json:"type"`
9+
Hard uint64 `json:"hard"`
10+
Soft uint64 `json:"soft"`
11+
}
12+
13+
// IDMap represents UID/GID Mappings for User Namespaces.
14+
type IDMap struct {
15+
ContainerID int `json:"container_id"`
16+
HostID int `json:"host_id"`
17+
Size int `json:"size"`
18+
}
19+
20+
// Seccomp represents syscall restrictions
21+
// By default, only the native architecture of the kernel is allowed to be used
22+
// for syscalls. Additional architectures can be added by specifying them in
23+
// Architectures.
24+
type Seccomp struct {
25+
DefaultAction Action `json:"default_action"`
26+
Architectures []string `json:"architectures"`
27+
Syscalls []*Syscall `json:"syscalls"`
28+
}
29+
30+
// An action to be taken upon rule match in Seccomp
31+
type Action int
32+
33+
const (
34+
Kill Action = iota - 4
35+
Errno
36+
Trap
37+
Allow
38+
)
39+
40+
// A comparison operator to be used when matching syscall arguments in Seccomp
41+
type Operator int
42+
43+
const (
44+
EqualTo Operator = iota
45+
NotEqualTo
46+
GreaterThan
47+
GreaterThanOrEqualTo
48+
LessThan
49+
LessThanOrEqualTo
50+
MaskEqualTo
51+
)
52+
53+
// A rule to match a specific syscall argument in Seccomp
54+
type Arg struct {
55+
Index uint `json:"index"`
56+
Value uint64 `json:"value"`
57+
ValueTwo uint64 `json:"value_two"`
58+
Op Operator `json:"op"`
59+
}
60+
61+
// An rule to match a syscall in Seccomp
62+
type Syscall struct {
63+
Name string `json:"name"`
64+
Action Action `json:"action"`
65+
Args []*Arg `json:"args"`
66+
}
67+
68+
// Config defines configuration options for executing a process inside a contained environment.
69+
type Config struct {
70+
BaseConfig
71+
72+
// Fields below here are platform specific
73+
74+
// NoPivotRoot will use MS_MOVE and a chroot to jail the process into the container's rootfs
75+
// This is a common option when the container is running in ramdisk
76+
NoPivotRoot bool `json:"no_pivot_root"`
77+
78+
// ParentDeathSignal specifies the signal that is sent to the container's process in the case
79+
// that the parent process dies.
80+
ParentDeathSignal int `json:"parent_death_signal"`
81+
82+
// PivotDir allows a custom directory inside the container's root filesystem to be used as pivot, when NoPivotRoot is not set.
83+
// When a custom PivotDir not set, a temporary dir inside the root filesystem will be used. The pivot dir needs to be writeable.
84+
// This is required when using read only root filesystems. In these cases, a read/writeable path can be (bind) mounted somewhere inside the root filesystem to act as pivot.
85+
PivotDir string `json:"pivot_dir"`
86+
87+
// Readonlyfs will remount the container's rootfs as readonly where only externally mounted
88+
// bind mounts are writtable.
89+
Readonlyfs bool `json:"readonlyfs"`
90+
91+
// Specifies the mount propagation flags to be applied to /.
92+
RootPropagation int `json:"rootPropagation"`
93+
94+
// The device nodes that should be automatically created within the container upon container start. Note, make sure that the node is marked as allowed in the cgroup as well!
95+
Devices []*Device `json:"devices"`
96+
97+
MountLabel string `json:"mount_label"`
98+
99+
// Namespaces specifies the container's namespaces that it should setup when cloning the init process
100+
// If a namespace is not provided that namespace is shared from the container's parent process
101+
Namespaces Namespaces `json:"namespaces"`
102+
103+
// Capabilities specify the capabilities to keep when executing the process inside the container
104+
// All capbilities not specified will be dropped from the processes capability mask
105+
Capabilities []string `json:"capabilities"`
106+
107+
// Networks specifies the container's network setup to be created
108+
Networks []*Network `json:"networks"`
109+
110+
// Routes can be specified to create entries in the route table as the container is started
111+
Routes []*Route `json:"routes"`
112+
113+
// Cgroups specifies specific cgroup settings for the various subsystems that the container is
114+
// placed into to limit the resources the container has available
115+
Cgroups *Cgroup `json:"cgroups"`
116+
117+
// AppArmorProfile specifies the profile to apply to the process running in the container and is
118+
// change at the time the process is execed
119+
AppArmorProfile string `json:"apparmor_profile"`
120+
121+
// ProcessLabel specifies the label to apply to the process running in the container. It is
122+
// commonly used by selinux
123+
ProcessLabel string `json:"process_label"`
124+
125+
// Rlimits specifies the resource limits, such as max open files, to set in the container
126+
// If Rlimits are not set, the container will inherit rlimits from the parent process
127+
Rlimits []Rlimit `json:"rlimits"`
128+
129+
// OomScoreAdj specifies the adjustment to be made by the kernel when calculating oom scores
130+
// for a process. Valid values are between the range [-1000, '1000'], where processes with
131+
// higher scores are preferred for being killed.
132+
// More information about kernel oom score calculation here: https://lwn.net/Articles/317814/
133+
OomScoreAdj int `json:"oom_score_adj"`
134+
135+
// AdditionalGroups specifies the gids that should be added to supplementary groups
136+
// in addition to those that the user belongs to.
137+
AdditionalGroups []string `json:"additional_groups"`
138+
139+
// UidMappings is an array of User ID mappings for User Namespaces
140+
UidMappings []IDMap `json:"uid_mappings"`
141+
142+
// GidMappings is an array of Group ID mappings for User Namespaces
143+
GidMappings []IDMap `json:"gid_mappings"`
144+
145+
// MaskPaths specifies paths within the container's rootfs to mask over with a bind
146+
// mount pointing to /dev/null as to prevent reads of the file.
147+
MaskPaths []string `json:"mask_paths"`
148+
149+
// ReadonlyPaths specifies paths within the container's rootfs to remount as read-only
150+
// so that these files prevent any writes.
151+
ReadonlyPaths []string `json:"readonly_paths"`
152+
153+
// Sysctl is a map of properties and their values. It is the equivalent of using
154+
// sysctl -w my.property.name value in Linux.
155+
Sysctl map[string]string `json:"sysctl"`
156+
157+
// Seccomp allows actions to be taken whenever a syscall is made within the container.
158+
// A number of rules are given, each having an action to be taken if a syscall matches it.
159+
// A default action to be taken if no rules match is also given.
160+
Seccomp *Seccomp `json:"seccomp"`
161+
}
162+
7163
// Gets the root uid for the process on host which could be non-zero
8164
// when user namespaces are enabled.
9165
func (c Config) HostUID() (int, error) {

‎libcontainer/configs/config_windows.go‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
package configs
2+
3+
// Config defines configuration options for executing a process inside a contained environment.
4+
type Config struct {
5+
BaseConfig
6+
7+
// Fields below here are platform specific
8+
}

0 commit comments

Comments
 (0)