github.com/SagerNet/gvisor@v0.0.0-20210707092255-7731c139d75c/runsc/cmd/create.go (about)

     1  // Copyright 2018 The gVisor Authors.
     2  //
     3  // Licensed under the Apache License, Version 2.0 (the "License");
     4  // you may not use this file except in compliance with the License.
     5  // You may obtain a copy of the License at
     6  //
     7  //     http://www.apache.org/licenses/LICENSE-2.0
     8  //
     9  // Unless required by applicable law or agreed to in writing, software
    10  // distributed under the License is distributed on an "AS IS" BASIS,
    11  // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
    12  // See the License for the specific language governing permissions and
    13  // limitations under the License.
    14  
    15  package cmd
    16  
    17  import (
    18  	"context"
    19  
    20  	"github.com/google/subcommands"
    21  	"github.com/SagerNet/gvisor/runsc/config"
    22  	"github.com/SagerNet/gvisor/runsc/container"
    23  	"github.com/SagerNet/gvisor/runsc/flag"
    24  	"github.com/SagerNet/gvisor/runsc/specutils"
    25  )
    26  
    27  // Create implements subcommands.Command for the "create" command.
    28  type Create struct {
    29  	// bundleDir is the path to the bundle directory (defaults to the
    30  	// current working directory).
    31  	bundleDir string
    32  
    33  	// pidFile is the filename that the sandbox pid will be written to.
    34  	// This file should only be created once the container process inside
    35  	// the sandbox is ready to use.
    36  	pidFile string
    37  
    38  	// consoleSocket is the path to an AF_UNIX socket which will receive a
    39  	// file descriptor referencing the master end of the console's
    40  	// pseudoterminal.  This is ignored unless spec.Process.Terminal is
    41  	// true.
    42  	consoleSocket string
    43  
    44  	// userLog is the path to send user-visible logs to. This log is different
    45  	// from debug logs. The former is meant to be consumed by the users and should
    46  	// contain only information that is relevant to the person running the
    47  	// container, e.g. unsuported syscalls, while the later is more verbose and
    48  	// consumed by developers.
    49  	userLog string
    50  }
    51  
    52  // Name implements subcommands.Command.Name.
    53  func (*Create) Name() string {
    54  	return "create"
    55  }
    56  
    57  // Synopsis implements subcommands.Command.Synopsis.
    58  func (*Create) Synopsis() string {
    59  	return "create a secure container"
    60  }
    61  
    62  // Usage implements subcommands.Command.Usage.
    63  func (*Create) Usage() string {
    64  	return `create [flags] <container id> - create a secure container
    65  `
    66  }
    67  
    68  // SetFlags implements subcommands.Command.SetFlags.
    69  func (c *Create) SetFlags(f *flag.FlagSet) {
    70  	f.StringVar(&c.bundleDir, "bundle", "", "path to the root of the bundle directory, defaults to the current directory")
    71  	f.StringVar(&c.consoleSocket, "console-socket", "", "path to an AF_UNIX socket which will receive a file descriptor referencing the master end of the console's pseudoterminal")
    72  	f.StringVar(&c.pidFile, "pid-file", "", "filename that the container pid will be written to")
    73  	f.StringVar(&c.userLog, "user-log", "", "filename to send user-visible logs to. Empty means no logging.")
    74  }
    75  
    76  // Execute implements subcommands.Command.Execute.
    77  func (c *Create) Execute(_ context.Context, f *flag.FlagSet, args ...interface{}) subcommands.ExitStatus {
    78  	if f.NArg() != 1 {
    79  		f.Usage()
    80  		return subcommands.ExitUsageError
    81  	}
    82  
    83  	id := f.Arg(0)
    84  	conf := args[0].(*config.Config)
    85  
    86  	if conf.Rootless {
    87  		return Errorf("Rootless mode not supported with %q", c.Name())
    88  	}
    89  
    90  	bundleDir := c.bundleDir
    91  	if bundleDir == "" {
    92  		bundleDir = getwdOrDie()
    93  	}
    94  	spec, err := specutils.ReadSpec(bundleDir, conf)
    95  	if err != nil {
    96  		return Errorf("reading spec: %v", err)
    97  	}
    98  	specutils.LogSpec(spec)
    99  
   100  	// Create the container. A new sandbox will be created for the
   101  	// container unless the metadata specifies that it should be run in an
   102  	// existing container.
   103  	contArgs := container.Args{
   104  		ID:            id,
   105  		Spec:          spec,
   106  		BundleDir:     bundleDir,
   107  		ConsoleSocket: c.consoleSocket,
   108  		PIDFile:       c.pidFile,
   109  		UserLog:       c.userLog,
   110  	}
   111  	if _, err := container.New(conf, contArgs); err != nil {
   112  		return Errorf("creating container: %v", err)
   113  	}
   114  	return subcommands.ExitSuccess
   115  }