github.com/containers/podman/v2@v2.2.2-0.20210501105131-c1e07d070c4c/pkg/varlinkapi/create.go (about)

     1  package varlinkapi
     2  
     3  import (
     4  	"context"
     5  	"encoding/json"
     6  	"fmt"
     7  	"io"
     8  	"os"
     9  	"path/filepath"
    10  	goruntime "runtime"
    11  	"strconv"
    12  	"strings"
    13  	"syscall"
    14  	"time"
    15  
    16  	"github.com/containers/common/pkg/sysinfo"
    17  	"github.com/containers/image/v5/manifest"
    18  	"github.com/containers/podman/v2/cmd/podman/parse"
    19  	"github.com/containers/podman/v2/libpod"
    20  	"github.com/containers/podman/v2/libpod/define"
    21  	"github.com/containers/podman/v2/libpod/image"
    22  	ann "github.com/containers/podman/v2/pkg/annotations"
    23  	"github.com/containers/podman/v2/pkg/autoupdate"
    24  	"github.com/containers/podman/v2/pkg/cgroups"
    25  	envLib "github.com/containers/podman/v2/pkg/env"
    26  	"github.com/containers/podman/v2/pkg/errorhandling"
    27  	"github.com/containers/podman/v2/pkg/inspect"
    28  	ns "github.com/containers/podman/v2/pkg/namespaces"
    29  	"github.com/containers/podman/v2/pkg/rootless"
    30  	"github.com/containers/podman/v2/pkg/seccomp"
    31  	cc "github.com/containers/podman/v2/pkg/spec"
    32  	systemdGen "github.com/containers/podman/v2/pkg/systemd/generate"
    33  	"github.com/containers/podman/v2/pkg/util"
    34  	"github.com/docker/go-connections/nat"
    35  	"github.com/docker/go-units"
    36  	"github.com/opentracing/opentracing-go"
    37  	"github.com/pkg/errors"
    38  	"github.com/sirupsen/logrus"
    39  )
    40  
    41  var DefaultKernelNamespaces = "cgroup,ipc,net,uts"
    42  
    43  func CreateContainer(ctx context.Context, c *GenericCLIResults, runtime *libpod.Runtime) (*libpod.Container, *cc.CreateConfig, error) {
    44  	var (
    45  		healthCheck *manifest.Schema2HealthConfig
    46  		err         error
    47  		cidFile     *os.File
    48  	)
    49  	if c.Bool("trace") {
    50  		span, _ := opentracing.StartSpanFromContext(ctx, "createContainer")
    51  		defer span.Finish()
    52  	}
    53  	if c.Bool("rm") && c.String("restart") != "" && c.String("restart") != "no" {
    54  		return nil, nil, errors.Errorf("the --rm option conflicts with --restart")
    55  	}
    56  
    57  	rtc, err := runtime.GetConfig()
    58  	if err != nil {
    59  		return nil, nil, err
    60  	}
    61  	rootfs := ""
    62  	if c.Bool("rootfs") {
    63  		rootfs = c.InputArgs[0]
    64  	}
    65  
    66  	if c.IsSet("cidfile") {
    67  		cidFile, err = util.OpenExclusiveFile(c.String("cidfile"))
    68  		if err != nil && os.IsExist(err) {
    69  			return nil, nil, errors.Errorf("container id file exists. Ensure another container is not using it or delete %s", c.String("cidfile"))
    70  		}
    71  		if err != nil {
    72  			return nil, nil, errors.Errorf("error opening cidfile %s", c.String("cidfile"))
    73  		}
    74  		defer errorhandling.CloseQuiet(cidFile)
    75  		defer errorhandling.SyncQuiet(cidFile)
    76  	}
    77  
    78  	imageName := ""
    79  	rawImageName := ""
    80  	var imageData *inspect.ImageData = nil
    81  
    82  	// Set the storage if there is no rootfs specified
    83  	if rootfs == "" {
    84  		var writer io.Writer
    85  		if !c.Bool("quiet") {
    86  			writer = os.Stderr
    87  		}
    88  
    89  		if len(c.InputArgs) != 0 {
    90  			rawImageName = c.InputArgs[0]
    91  		} else {
    92  			return nil, nil, errors.Errorf("error, image name not provided")
    93  		}
    94  
    95  		pullType, err := util.ValidatePullType(c.String("pull"))
    96  		if err != nil {
    97  			return nil, nil, err
    98  		}
    99  
   100  		overrideOS := c.String("override-os")
   101  		overrideArch := c.String("override-arch")
   102  		dockerRegistryOptions := image.DockerRegistryOptions{
   103  			OSChoice:           overrideOS,
   104  			ArchitectureChoice: overrideArch,
   105  		}
   106  
   107  		newImage, err := runtime.ImageRuntime().New(ctx, rawImageName, rtc.Engine.SignaturePolicyPath, c.String("authfile"), writer, &dockerRegistryOptions, image.SigningOptions{}, nil, pullType)
   108  		if err != nil {
   109  			return nil, nil, err
   110  		}
   111  		imageData, err = newImage.InspectNoSize(ctx)
   112  		if err != nil {
   113  			return nil, nil, err
   114  		}
   115  
   116  		if overrideOS == "" && imageData.Os != goruntime.GOOS {
   117  			logrus.Infof("Using %q (OS) image on %q host", imageData.Os, goruntime.GOOS)
   118  		}
   119  
   120  		if overrideArch == "" && imageData.Architecture != goruntime.GOARCH {
   121  			logrus.Infof("Using %q (architecture) on %q host", imageData.Architecture, goruntime.GOARCH)
   122  		}
   123  
   124  		names := newImage.Names()
   125  		if len(names) > 0 {
   126  			imageName = names[0]
   127  		} else {
   128  			imageName = newImage.ID()
   129  		}
   130  
   131  		// if the user disabled the healthcheck with "none" or the no-healthcheck
   132  		// options is provided, we skip adding it
   133  		healthCheckCommandInput := c.String("healthcheck-command")
   134  
   135  		// the user didn't disable the healthcheck but did pass in a healthcheck command
   136  		// now we need to make a healthcheck from the commandline input
   137  		if healthCheckCommandInput != "none" && !c.Bool("no-healthcheck") {
   138  			if len(healthCheckCommandInput) > 0 {
   139  				healthCheck, err = makeHealthCheckFromCli(c)
   140  				if err != nil {
   141  					return nil, nil, errors.Wrapf(err, "unable to create healthcheck")
   142  				}
   143  			} else {
   144  				// the user did not disable the health check and did not pass in a healthcheck
   145  				// command as input.  so now we add healthcheck if it exists AND is correct mediatype
   146  				_, mediaType, err := newImage.Manifest(ctx)
   147  				if err != nil {
   148  					return nil, nil, errors.Wrapf(err, "unable to determine mediatype of image %s", newImage.ID())
   149  				}
   150  				if mediaType == manifest.DockerV2Schema2MediaType {
   151  					healthCheck, err = newImage.GetHealthCheck(ctx)
   152  					if err != nil {
   153  						return nil, nil, errors.Wrapf(err, "unable to get healthcheck for %s", c.InputArgs[0])
   154  					}
   155  
   156  					if healthCheck != nil {
   157  						hcCommand := healthCheck.Test
   158  						if len(hcCommand) < 1 || hcCommand[0] == "" || hcCommand[0] == "NONE" {
   159  							// disable health check
   160  							healthCheck = nil
   161  						} else {
   162  							// apply defaults if image doesn't override them
   163  							if healthCheck.Interval == 0 {
   164  								healthCheck.Interval = 30 * time.Second
   165  							}
   166  							if healthCheck.Timeout == 0 {
   167  								healthCheck.Timeout = 30 * time.Second
   168  							}
   169  							/* Docker default is 0s, so the following would be a no-op
   170  							if healthCheck.StartPeriod == 0 {
   171  								healthCheck.StartPeriod = 0 * time.Second
   172  							}
   173  							*/
   174  							if healthCheck.Retries == 0 {
   175  								healthCheck.Retries = 3
   176  							}
   177  						}
   178  					}
   179  				}
   180  			}
   181  		}
   182  	}
   183  
   184  	createConfig, err := ParseCreateOpts(ctx, c, runtime, imageName, rawImageName, imageData)
   185  	if err != nil {
   186  		return nil, nil, err
   187  	}
   188  
   189  	// (VR): Ideally we perform the checks _before_ pulling the image but that
   190  	// would require some bigger code refactoring of `ParseCreateOpts` and the
   191  	// logic here.  But as the creation code will be consolidated in the future
   192  	// and given auto updates are experimental, we can live with that for now.
   193  	// In the end, the user may only need to correct the policy or the raw image
   194  	// name.
   195  	autoUpdatePolicy, autoUpdatePolicySpecified := createConfig.Labels[autoupdate.Label]
   196  	if autoUpdatePolicySpecified {
   197  		if _, err := autoupdate.LookupPolicy(autoUpdatePolicy); err != nil {
   198  			return nil, nil, err
   199  		}
   200  		// Now we need to make sure we're having a fully-qualified image reference.
   201  		if rootfs != "" {
   202  			return nil, nil, errors.Errorf("auto updates do not work with --rootfs")
   203  		}
   204  		// Make sure the input image is a docker.
   205  		if err := autoupdate.ValidateImageReference(rawImageName); err != nil {
   206  			return nil, nil, err
   207  		}
   208  	}
   209  
   210  	// Because parseCreateOpts does derive anything from the image, we add health check
   211  	// at this point. The rest is done by WithOptions.
   212  	createConfig.HealthCheck = healthCheck
   213  
   214  	// TODO: Should be able to return this from ParseCreateOpts
   215  	var pod *libpod.Pod
   216  	if createConfig.Pod != "" {
   217  		pod, err = runtime.LookupPod(createConfig.Pod)
   218  		if err != nil {
   219  			return nil, nil, errors.Wrapf(err, "error looking up pod to join")
   220  		}
   221  	}
   222  
   223  	ctr, err := CreateContainerFromCreateConfig(ctx, runtime, createConfig, pod)
   224  	if err != nil {
   225  		return nil, nil, err
   226  	}
   227  	if cidFile != nil {
   228  		_, err = cidFile.WriteString(ctr.ID())
   229  		if err != nil {
   230  			logrus.Error(err)
   231  		}
   232  
   233  	}
   234  
   235  	logrus.Debugf("New container created %q", ctr.ID())
   236  	return ctr, createConfig, nil
   237  }
   238  
   239  func configureEntrypoint(c *GenericCLIResults, data *inspect.ImageData) []string {
   240  	entrypoint := []string{}
   241  	if c.IsSet("entrypoint") {
   242  		// Force entrypoint to ""
   243  		if c.String("entrypoint") == "" {
   244  			return entrypoint
   245  		}
   246  		// Check if entrypoint specified is json
   247  		if err := json.Unmarshal([]byte(c.String("entrypoint")), &entrypoint); err == nil {
   248  			return entrypoint
   249  		}
   250  		// Return entrypoint as a single command
   251  		return []string{c.String("entrypoint")}
   252  	}
   253  	if data != nil {
   254  		return data.Config.Entrypoint
   255  	}
   256  	return entrypoint
   257  }
   258  
   259  func configurePod(c *GenericCLIResults, runtime *libpod.Runtime, namespaces map[string]string, podName string) (map[string]string, string, error) {
   260  	pod, err := runtime.LookupPod(podName)
   261  	if err != nil {
   262  		return namespaces, "", err
   263  	}
   264  	podInfraID, err := pod.InfraContainerID()
   265  	if err != nil {
   266  		return namespaces, "", err
   267  	}
   268  	hasUserns := false
   269  	if podInfraID != "" {
   270  		podCtr, err := runtime.GetContainer(podInfraID)
   271  		if err != nil {
   272  			return namespaces, "", err
   273  		}
   274  		mappings, err := podCtr.IDMappings()
   275  		if err != nil {
   276  			return namespaces, "", err
   277  		}
   278  		hasUserns = len(mappings.UIDMap) > 0
   279  	}
   280  
   281  	if (namespaces["pid"] == cc.Pod) || (!c.IsSet("pid") && pod.SharesPID()) {
   282  		namespaces["pid"] = fmt.Sprintf("container:%s", podInfraID)
   283  	}
   284  	if (namespaces["net"] == cc.Pod) || (!c.IsSet("net") && !c.IsSet("network") && pod.SharesNet()) {
   285  		namespaces["net"] = fmt.Sprintf("container:%s", podInfraID)
   286  	}
   287  	if hasUserns && (namespaces["user"] == cc.Pod) || (!c.IsSet("user") && pod.SharesUser()) {
   288  		namespaces["user"] = fmt.Sprintf("container:%s", podInfraID)
   289  	}
   290  	if (namespaces["ipc"] == cc.Pod) || (!c.IsSet("ipc") && pod.SharesIPC()) {
   291  		namespaces["ipc"] = fmt.Sprintf("container:%s", podInfraID)
   292  	}
   293  	if (namespaces["uts"] == cc.Pod) || (!c.IsSet("uts") && pod.SharesUTS()) {
   294  		namespaces["uts"] = fmt.Sprintf("container:%s", podInfraID)
   295  	}
   296  	return namespaces, podInfraID, nil
   297  }
   298  
   299  // Parses CLI options related to container creation into a config which can be
   300  // parsed into an OCI runtime spec
   301  func ParseCreateOpts(ctx context.Context, c *GenericCLIResults, runtime *libpod.Runtime, imageName string, rawImageName string, data *inspect.ImageData) (*cc.CreateConfig, error) {
   302  	var (
   303  		inputCommand, command                                    []string
   304  		memoryLimit, memoryReservation, memorySwap, memoryKernel int64
   305  		blkioWeight                                              uint16
   306  		namespaces                                               map[string]string
   307  	)
   308  
   309  	idmappings, err := util.ParseIDMapping(ns.UsernsMode(c.String("userns")), c.StringSlice("uidmap"), c.StringSlice("gidmap"), c.String("subuidname"), c.String("subgidname"))
   310  	if err != nil {
   311  		return nil, err
   312  	}
   313  
   314  	imageID := ""
   315  
   316  	inputCommand = c.InputArgs[1:]
   317  	if data != nil {
   318  		imageID = data.ID
   319  	}
   320  
   321  	rootfs := ""
   322  	if c.Bool("rootfs") {
   323  		rootfs = c.InputArgs[0]
   324  	}
   325  
   326  	if c.String("memory") != "" {
   327  		memoryLimit, err = units.RAMInBytes(c.String("memory"))
   328  		if err != nil {
   329  			return nil, errors.Wrapf(err, "invalid value for memory")
   330  		}
   331  	}
   332  	if c.String("memory-reservation") != "" {
   333  		memoryReservation, err = units.RAMInBytes(c.String("memory-reservation"))
   334  		if err != nil {
   335  			return nil, errors.Wrapf(err, "invalid value for memory-reservation")
   336  		}
   337  	}
   338  	if c.String("memory-swap") != "" {
   339  		if c.String("memory-swap") == "-1" {
   340  			memorySwap = -1
   341  		} else {
   342  			memorySwap, err = units.RAMInBytes(c.String("memory-swap"))
   343  			if err != nil {
   344  				return nil, errors.Wrapf(err, "invalid value for memory-swap")
   345  			}
   346  		}
   347  	}
   348  	if c.String("kernel-memory") != "" {
   349  		memoryKernel, err = units.RAMInBytes(c.String("kernel-memory"))
   350  		if err != nil {
   351  			return nil, errors.Wrapf(err, "invalid value for kernel-memory")
   352  		}
   353  	}
   354  	if c.String("blkio-weight") != "" {
   355  		u, err := strconv.ParseUint(c.String("blkio-weight"), 10, 16)
   356  		if err != nil {
   357  			return nil, errors.Wrapf(err, "invalid value for blkio-weight")
   358  		}
   359  		blkioWeight = uint16(u)
   360  	}
   361  
   362  	tty := c.Bool("tty")
   363  
   364  	if c.Changed("cpu-period") && c.Changed("cpus") {
   365  		return nil, errors.Errorf("--cpu-period and --cpus cannot be set together")
   366  	}
   367  	if c.Changed("cpu-quota") && c.Changed("cpus") {
   368  		return nil, errors.Errorf("--cpu-quota and --cpus cannot be set together")
   369  	}
   370  
   371  	if c.Bool("no-hosts") && c.Changed("add-host") {
   372  		return nil, errors.Errorf("--no-hosts and --add-host cannot be set together")
   373  	}
   374  
   375  	// EXPOSED PORTS
   376  	var portBindings map[nat.Port][]nat.PortBinding
   377  	if data != nil {
   378  		portBindings, err = cc.ExposedPorts(c.StringSlice("expose"), c.StringSlice("publish"), c.Bool("publish-all"), data.Config.ExposedPorts)
   379  		if err != nil {
   380  			return nil, err
   381  		}
   382  	}
   383  
   384  	// Kernel Namespaces
   385  	// TODO Fix handling of namespace from pod
   386  	// Instead of integrating here, should be done in libpod
   387  	// However, that also involves setting up security opts
   388  	// when the pod's namespace is integrated
   389  	namespaces = map[string]string{
   390  		"cgroup": c.String("cgroupns"),
   391  		"pid":    c.String("pid"),
   392  		"net":    c.String("network"),
   393  		"ipc":    c.String("ipc"),
   394  		"user":   c.String("userns"),
   395  		"uts":    c.String("uts"),
   396  	}
   397  
   398  	originalPodName := c.String("pod")
   399  	podName := strings.Replace(originalPodName, "new:", "", 1)
   400  	// after we strip out :new, make sure there is something left for a pod name
   401  	if len(podName) < 1 && c.IsSet("pod") {
   402  		return nil, errors.Errorf("new pod name must be at least one character")
   403  	}
   404  
   405  	// If we are adding a container to a pod, we would like to add an annotation for the infra ID
   406  	// so kata containers can share VMs inside the pod
   407  	var podInfraID string
   408  	if c.IsSet("pod") {
   409  		if strings.HasPrefix(originalPodName, "new:") {
   410  			// pod does not exist; lets make it
   411  			var podOptions []libpod.PodCreateOption
   412  			podOptions = append(podOptions, libpod.WithPodName(podName), libpod.WithInfraContainer(), libpod.WithPodCgroups())
   413  			if len(portBindings) > 0 {
   414  				ociPortBindings, err := cc.NatToOCIPortBindings(portBindings)
   415  				if err != nil {
   416  					return nil, err
   417  				}
   418  				podOptions = append(podOptions, libpod.WithInfraContainerPorts(ociPortBindings))
   419  			}
   420  
   421  			podNsOptions, err := GetNamespaceOptions(strings.Split(DefaultKernelNamespaces, ","))
   422  			if err != nil {
   423  				return nil, err
   424  			}
   425  			podOptions = append(podOptions, podNsOptions...)
   426  			// make pod
   427  			pod, err := runtime.NewPod(ctx, podOptions...)
   428  			if err != nil {
   429  				return nil, err
   430  			}
   431  			logrus.Debugf("pod %s created by new container request", pod.ID())
   432  
   433  			// The container now cannot have port bindings; so we reset the map
   434  			portBindings = make(map[nat.Port][]nat.PortBinding)
   435  		}
   436  		namespaces, podInfraID, err = configurePod(c, runtime, namespaces, podName)
   437  		if err != nil {
   438  			return nil, err
   439  		}
   440  	}
   441  
   442  	pidMode := ns.PidMode(namespaces["pid"])
   443  	if !cc.Valid(string(pidMode), pidMode) {
   444  		return nil, errors.Errorf("--pid %q is not valid", c.String("pid"))
   445  	}
   446  
   447  	usernsMode := ns.UsernsMode(namespaces["user"])
   448  	if !cc.Valid(string(usernsMode), usernsMode) {
   449  		return nil, errors.Errorf("--userns %q is not valid", namespaces["user"])
   450  	}
   451  
   452  	utsMode := ns.UTSMode(namespaces["uts"])
   453  	if !cc.Valid(string(utsMode), utsMode) {
   454  		return nil, errors.Errorf("--uts %q is not valid", namespaces["uts"])
   455  	}
   456  
   457  	cgroupMode := ns.CgroupMode(namespaces["cgroup"])
   458  	if !cgroupMode.Valid() {
   459  		return nil, errors.Errorf("--cgroup %q is not valid", namespaces["cgroup"])
   460  	}
   461  
   462  	ipcMode := ns.IpcMode(namespaces["ipc"])
   463  	if !cc.Valid(string(ipcMode), ipcMode) {
   464  		return nil, errors.Errorf("--ipc %q is not valid", ipcMode)
   465  	}
   466  
   467  	// Make sure if network is set to container namespace, port binding is not also being asked for
   468  	netMode := ns.NetworkMode(namespaces["net"])
   469  	if netMode.IsContainer() {
   470  		if len(portBindings) > 0 {
   471  			return nil, errors.Errorf("cannot set port bindings on an existing container network namespace")
   472  		}
   473  	}
   474  
   475  	// USER
   476  	user := c.String("user")
   477  	if user == "" {
   478  		switch {
   479  		case usernsMode.IsKeepID():
   480  			user = fmt.Sprintf("%d:%d", rootless.GetRootlessUID(), rootless.GetRootlessGID())
   481  		case data == nil:
   482  			user = "0"
   483  		default:
   484  			user = data.Config.User
   485  		}
   486  	}
   487  
   488  	// STOP SIGNAL
   489  	stopSignal := syscall.SIGTERM
   490  	signalString := ""
   491  	if data != nil {
   492  		signalString = data.Config.StopSignal
   493  	}
   494  	if c.IsSet("stop-signal") {
   495  		signalString = c.String("stop-signal")
   496  	}
   497  	if signalString != "" {
   498  		stopSignal, err = util.ParseSignal(signalString)
   499  		if err != nil {
   500  			return nil, err
   501  		}
   502  	}
   503  
   504  	// ENVIRONMENT VARIABLES
   505  	//
   506  	// Precedence order (higher index wins):
   507  	//  1) env-host, 2) image data, 3) env-file, 4) env
   508  	env := map[string]string{
   509  		"container": "podman",
   510  	}
   511  
   512  	// First transform the os env into a map. We need it for the labels later in
   513  	// any case.
   514  	osEnv, err := envLib.ParseSlice(os.Environ())
   515  	if err != nil {
   516  		return nil, errors.Wrap(err, "error parsing host environment variables")
   517  	}
   518  
   519  	// Start with env-host
   520  
   521  	if c.Bool("env-host") {
   522  		env = envLib.Join(env, osEnv)
   523  	}
   524  
   525  	// Image data overrides any previous variables
   526  	if data != nil {
   527  		configEnv, err := envLib.ParseSlice(data.Config.Env)
   528  		if err != nil {
   529  			return nil, errors.Wrap(err, "error passing image environment variables")
   530  		}
   531  		env = envLib.Join(env, configEnv)
   532  	}
   533  
   534  	// env-file overrides any previous variables
   535  	if c.IsSet("env-file") {
   536  		for _, f := range c.StringSlice("env-file") {
   537  			fileEnv, err := envLib.ParseFile(f)
   538  			if err != nil {
   539  				return nil, err
   540  			}
   541  			// File env is overridden by env.
   542  			env = envLib.Join(env, fileEnv)
   543  		}
   544  	}
   545  
   546  	if c.IsSet("env") {
   547  		// env overrides any previous variables
   548  		cmdlineEnv := c.StringSlice("env")
   549  		if len(cmdlineEnv) > 0 {
   550  			parsedEnv, err := envLib.ParseSlice(cmdlineEnv)
   551  			if err != nil {
   552  				return nil, err
   553  			}
   554  			env = envLib.Join(env, parsedEnv)
   555  		}
   556  	}
   557  
   558  	// LABEL VARIABLES
   559  	labels, err := parse.GetAllLabels(c.StringSlice("label-file"), c.StringArray("label"))
   560  	if err != nil {
   561  		return nil, errors.Wrapf(err, "unable to process labels")
   562  	}
   563  	if data != nil {
   564  		for key, val := range data.Config.Labels {
   565  			if _, ok := labels[key]; !ok {
   566  				labels[key] = val
   567  			}
   568  		}
   569  	}
   570  
   571  	if systemdUnit, exists := osEnv[systemdGen.EnvVariable]; exists {
   572  		labels[systemdGen.EnvVariable] = systemdUnit
   573  	}
   574  
   575  	// ANNOTATIONS
   576  	annotations := make(map[string]string)
   577  
   578  	// First, add our default annotations
   579  	annotations[ann.TTY] = "false"
   580  	if tty {
   581  		annotations[ann.TTY] = "true"
   582  	}
   583  
   584  	// in the event this container is in a pod, and the pod has an infra container
   585  	// we will want to configure it as a type "container" instead defaulting to
   586  	// the behavior of a "sandbox" container
   587  	// In Kata containers:
   588  	// - "sandbox" is the annotation that denotes the container should use its own
   589  	//   VM, which is the default behavior
   590  	// - "container" denotes the container should join the VM of the SandboxID
   591  	//   (the infra container)
   592  	if podInfraID != "" {
   593  		annotations[ann.SandboxID] = podInfraID
   594  		annotations[ann.ContainerType] = ann.ContainerTypeContainer
   595  	}
   596  
   597  	if data != nil {
   598  		// Next, add annotations from the image
   599  		for key, value := range data.Annotations {
   600  			annotations[key] = value
   601  		}
   602  	}
   603  	// Last, add user annotations
   604  	for _, annotation := range c.StringSlice("annotation") {
   605  		splitAnnotation := strings.SplitN(annotation, "=", 2)
   606  		if len(splitAnnotation) < 2 {
   607  			return nil, errors.Errorf("Annotations must be formatted KEY=VALUE")
   608  		}
   609  		annotations[splitAnnotation[0]] = splitAnnotation[1]
   610  	}
   611  
   612  	// WORKING DIRECTORY
   613  	workDir := "/"
   614  	if c.IsSet("workdir") {
   615  		workDir = c.String("workdir")
   616  	} else if data != nil && data.Config.WorkingDir != "" {
   617  		workDir = data.Config.WorkingDir
   618  	}
   619  
   620  	userCommand := []string{}
   621  	entrypoint := configureEntrypoint(c, data)
   622  	// Build the command
   623  	// If we have an entry point, it goes first
   624  	if len(entrypoint) > 0 {
   625  		command = entrypoint
   626  	}
   627  	if len(inputCommand) > 0 {
   628  		// User command overrides data CMD
   629  		command = append(command, inputCommand...)
   630  		userCommand = append(userCommand, inputCommand...)
   631  	} else if data != nil && len(data.Config.Cmd) > 0 && !c.IsSet("entrypoint") {
   632  		// If not user command, add CMD
   633  		command = append(command, data.Config.Cmd...)
   634  		userCommand = append(userCommand, data.Config.Cmd...)
   635  	}
   636  
   637  	if data != nil && len(command) == 0 {
   638  		return nil, errors.Errorf("No command specified on command line or as CMD or ENTRYPOINT in this image")
   639  	}
   640  
   641  	// SHM Size
   642  	shmSize, err := units.FromHumanSize(c.String("shm-size"))
   643  	if err != nil {
   644  		return nil, errors.Wrapf(err, "unable to translate --shm-size")
   645  	}
   646  
   647  	if c.IsSet("add-host") {
   648  		// Verify the additional hosts are in correct format
   649  		for _, host := range c.StringSlice("add-host") {
   650  			if _, err := parse.ValidateExtraHost(host); err != nil {
   651  				return nil, err
   652  			}
   653  		}
   654  	}
   655  
   656  	var (
   657  		dnsSearches []string
   658  		dnsServers  []string
   659  		dnsOptions  []string
   660  	)
   661  	if c.Changed("dns-search") {
   662  		dnsSearches = c.StringSlice("dns-search")
   663  		// Check for explicit dns-search domain of ''
   664  		if len(dnsSearches) == 0 {
   665  			return nil, errors.Errorf("'' is not a valid domain")
   666  		}
   667  		// Validate domains are good
   668  		for _, dom := range dnsSearches {
   669  			if dom == "." {
   670  				if len(dnsSearches) > 1 {
   671  					return nil, errors.Errorf("cannot pass additional search domains when also specifying '.'")
   672  				}
   673  				continue
   674  			}
   675  			if _, err := parse.ValidateDomain(dom); err != nil {
   676  				return nil, err
   677  			}
   678  		}
   679  	}
   680  	if c.IsSet("dns") {
   681  		dnsServers = append(dnsServers, c.StringSlice("dns")...)
   682  	}
   683  	if c.IsSet("dns-opt") {
   684  		dnsOptions = c.StringSlice("dns-opt")
   685  	}
   686  
   687  	var ImageVolumes map[string]struct{}
   688  	if data != nil && c.String("image-volume") != "ignore" {
   689  		ImageVolumes = data.Config.Volumes
   690  	}
   691  
   692  	var imageVolType = map[string]string{
   693  		"bind":   "",
   694  		"tmpfs":  "",
   695  		"ignore": "",
   696  	}
   697  	if _, ok := imageVolType[c.String("image-volume")]; !ok {
   698  		return nil, errors.Errorf("invalid image-volume type %q. Pick one of bind, tmpfs, or ignore", c.String("image-volume"))
   699  	}
   700  
   701  	systemd := c.String("systemd") == "always"
   702  	if !systemd && command != nil {
   703  		x, err := strconv.ParseBool(c.String("systemd"))
   704  		if err != nil {
   705  			return nil, errors.Wrapf(err, "cannot parse bool %s", c.String("systemd"))
   706  		}
   707  		useSystemdCommands := map[string]bool{
   708  			"/sbin/init":           true,
   709  			"/usr/sbin/init":       true,
   710  			"/usr/local/sbin/init": true,
   711  		}
   712  		if x && (useSystemdCommands[command[0]] || (filepath.Base(command[0]) == "systemd")) {
   713  			systemd = true
   714  		}
   715  	}
   716  	if systemd {
   717  		if signalString == "" {
   718  			stopSignal, err = util.ParseSignal("RTMIN+3")
   719  			if err != nil {
   720  				return nil, errors.Wrapf(err, "error parsing systemd signal")
   721  			}
   722  		}
   723  	}
   724  	// This is done because cobra cannot have two aliased flags. So we have to check
   725  	// both
   726  	memorySwappiness := c.Int64("memory-swappiness")
   727  
   728  	logDriver := define.KubernetesLogging
   729  	if c.Changed("log-driver") {
   730  		logDriver = c.String("log-driver")
   731  	}
   732  
   733  	pidsLimit := c.Int64("pids-limit")
   734  	if c.String("cgroups") == "disabled" && !c.Changed("pids-limit") {
   735  		pidsLimit = -1
   736  	}
   737  
   738  	pid := &cc.PidConfig{
   739  		PidMode: pidMode,
   740  	}
   741  	ipc := &cc.IpcConfig{
   742  		IpcMode: ipcMode,
   743  	}
   744  
   745  	cgroup := &cc.CgroupConfig{
   746  		Cgroups:      c.String("cgroups"),
   747  		Cgroupns:     c.String("cgroupns"),
   748  		CgroupParent: c.String("cgroup-parent"),
   749  		CgroupMode:   cgroupMode,
   750  	}
   751  
   752  	userns := &cc.UserConfig{
   753  		GroupAdd:   c.StringSlice("group-add"),
   754  		IDMappings: idmappings,
   755  		UsernsMode: usernsMode,
   756  		User:       user,
   757  	}
   758  
   759  	uts := &cc.UtsConfig{
   760  		UtsMode:  utsMode,
   761  		NoHosts:  c.Bool("no-hosts"),
   762  		HostAdd:  c.StringSlice("add-host"),
   763  		Hostname: c.String("hostname"),
   764  	}
   765  	net := &cc.NetworkConfig{
   766  		DNSOpt:       dnsOptions,
   767  		DNSSearch:    dnsSearches,
   768  		DNSServers:   dnsServers,
   769  		HTTPProxy:    c.Bool("http-proxy"),
   770  		MacAddress:   c.String("mac-address"),
   771  		Network:      c.String("network"),
   772  		NetMode:      netMode,
   773  		IPAddress:    c.String("ip"),
   774  		Publish:      c.StringSlice("publish"),
   775  		PublishAll:   c.Bool("publish-all"),
   776  		PortBindings: portBindings,
   777  	}
   778  
   779  	sysctl := map[string]string{}
   780  	if c.Changed("sysctl") {
   781  		sysctl, err = util.ValidateSysctls(c.StringSlice("sysctl"))
   782  		if err != nil {
   783  			return nil, errors.Wrapf(err, "invalid value for sysctl")
   784  		}
   785  	}
   786  
   787  	secConfig := &cc.SecurityConfig{
   788  		CapAdd:         c.StringSlice("cap-add"),
   789  		CapDrop:        c.StringSlice("cap-drop"),
   790  		Privileged:     c.Bool("privileged"),
   791  		ReadOnlyRootfs: c.Bool("read-only"),
   792  		ReadOnlyTmpfs:  c.Bool("read-only-tmpfs"),
   793  		Sysctl:         sysctl,
   794  	}
   795  
   796  	var securityOpt []string
   797  	if c.Changed("security-opt") {
   798  		securityOpt = c.StringArray("security-opt")
   799  	}
   800  	if err := secConfig.SetSecurityOpts(runtime, securityOpt); err != nil {
   801  		return nil, err
   802  	}
   803  
   804  	// SECCOMP
   805  	if data != nil {
   806  		if value, exists := labels[seccomp.ContainerImageLabel]; exists {
   807  			secConfig.SeccompProfileFromImage = value
   808  		}
   809  	}
   810  	if policy, err := seccomp.LookupPolicy(c.String("seccomp-policy")); err != nil {
   811  		return nil, err
   812  	} else {
   813  		secConfig.SeccompPolicy = policy
   814  	}
   815  	rtc, err := runtime.GetConfig()
   816  	if err != nil {
   817  		return nil, err
   818  	}
   819  	volumes := rtc.Containers.Volumes
   820  	if c.Changed("volume") {
   821  		volumes = append(volumes, c.StringSlice("volume")...)
   822  	}
   823  
   824  	devices := rtc.Containers.Devices
   825  	if c.Changed("device") {
   826  		devices = append(devices, c.StringSlice("device")...)
   827  	}
   828  
   829  	config := &cc.CreateConfig{
   830  		Annotations:       annotations,
   831  		BuiltinImgVolumes: ImageVolumes,
   832  		ConmonPidFile:     c.String("conmon-pidfile"),
   833  		ImageVolumeType:   c.String("image-volume"),
   834  		CidFile:           c.String("cidfile"),
   835  		Command:           command,
   836  		UserCommand:       userCommand,
   837  		Detach:            c.Bool("detach"),
   838  		Devices:           devices,
   839  		Entrypoint:        entrypoint,
   840  		Env:               env,
   841  		// ExposedPorts:   ports,
   842  		Init:         c.Bool("init"),
   843  		InitPath:     c.String("init-path"),
   844  		Image:        imageName,
   845  		RawImageName: rawImageName,
   846  		ImageID:      imageID,
   847  		Interactive:  c.Bool("interactive"),
   848  		// IP6Address:     c.String("ipv6"), // Not implemented yet - needs CNI support for static v6
   849  		Labels: labels,
   850  		// LinkLocalIP:    c.StringSlice("link-local-ip"), // Not implemented yet
   851  		LogDriver:    logDriver,
   852  		LogDriverOpt: c.StringSlice("log-opt"),
   853  		Name:         c.String("name"),
   854  		// NetworkAlias:   c.StringSlice("network-alias"), // Not implemented - does this make sense in Podman?
   855  		Pod:   podName,
   856  		Quiet: c.Bool("quiet"),
   857  		Resources: cc.CreateResourceConfig{
   858  			BlkioWeight:       blkioWeight,
   859  			BlkioWeightDevice: c.StringSlice("blkio-weight-device"),
   860  			CPUShares:         c.Uint64("cpu-shares"),
   861  			CPUPeriod:         c.Uint64("cpu-period"),
   862  			CPUsetCPUs:        c.String("cpuset-cpus"),
   863  			CPUsetMems:        c.String("cpuset-mems"),
   864  			CPUQuota:          c.Int64("cpu-quota"),
   865  			CPURtPeriod:       c.Uint64("cpu-rt-period"),
   866  			CPURtRuntime:      c.Int64("cpu-rt-runtime"),
   867  			CPUs:              c.Float64("cpus"),
   868  			DeviceCgroupRules: c.StringSlice("device-cgroup-rule"),
   869  			DeviceReadBps:     c.StringSlice("device-read-bps"),
   870  			DeviceReadIOps:    c.StringSlice("device-read-iops"),
   871  			DeviceWriteBps:    c.StringSlice("device-write-bps"),
   872  			DeviceWriteIOps:   c.StringSlice("device-write-iops"),
   873  			DisableOomKiller:  c.Bool("oom-kill-disable"),
   874  			ShmSize:           shmSize,
   875  			Memory:            memoryLimit,
   876  			MemoryReservation: memoryReservation,
   877  			MemorySwap:        memorySwap,
   878  			MemorySwappiness:  int(memorySwappiness),
   879  			KernelMemory:      memoryKernel,
   880  			OomScoreAdj:       c.Int("oom-score-adj"),
   881  			PidsLimit:         pidsLimit,
   882  			Ulimit:            c.StringSlice("ulimit"),
   883  		},
   884  		RestartPolicy: c.String("restart"),
   885  		Rm:            c.Bool("rm"),
   886  		Security:      *secConfig,
   887  		StopSignal:    stopSignal,
   888  		StopTimeout:   c.Uint("stop-timeout"),
   889  		Systemd:       systemd,
   890  		Tmpfs:         c.StringArray("tmpfs"),
   891  		Tty:           tty,
   892  		MountsFlag:    c.StringArray("mount"),
   893  		Volumes:       volumes,
   894  		WorkDir:       workDir,
   895  		Rootfs:        rootfs,
   896  		VolumesFrom:   c.StringSlice("volumes-from"),
   897  		Syslog:        c.Bool("syslog"),
   898  
   899  		Pid:     *pid,
   900  		Ipc:     *ipc,
   901  		Cgroup:  *cgroup,
   902  		User:    *userns,
   903  		Uts:     *uts,
   904  		Network: *net,
   905  	}
   906  
   907  	warnings, err := verifyContainerResources(config, false)
   908  	if err != nil {
   909  		return nil, err
   910  	}
   911  	for _, warning := range warnings {
   912  		fmt.Fprintln(os.Stderr, warning)
   913  	}
   914  	return config, nil
   915  }
   916  
   917  func CreateContainerFromCreateConfig(ctx context.Context, r *libpod.Runtime, createConfig *cc.CreateConfig, pod *libpod.Pod) (*libpod.Container, error) {
   918  	runtimeSpec, options, err := createConfig.MakeContainerConfig(r, pod)
   919  	if err != nil {
   920  		return nil, err
   921  	}
   922  
   923  	ctr, err := r.NewContainer(ctx, runtimeSpec, options...)
   924  	if err != nil {
   925  		return nil, err
   926  	}
   927  	return ctr, nil
   928  }
   929  
   930  func makeHealthCheckFromCli(c *GenericCLIResults) (*manifest.Schema2HealthConfig, error) {
   931  	inCommand := c.String("healthcheck-command")
   932  	inInterval := c.String("healthcheck-interval")
   933  	inRetries := c.Uint("healthcheck-retries")
   934  	inTimeout := c.String("healthcheck-timeout")
   935  	inStartPeriod := c.String("healthcheck-start-period")
   936  
   937  	// Every healthcheck requires a command
   938  	if len(inCommand) == 0 {
   939  		return nil, errors.New("Must define a healthcheck command for all healthchecks")
   940  	}
   941  
   942  	// first try to parse option value as JSON array of strings...
   943  	cmd := []string{}
   944  	err := json.Unmarshal([]byte(inCommand), &cmd)
   945  	if err != nil {
   946  		// ...otherwise pass it to "/bin/sh -c" inside the container
   947  		cmd = []string{"CMD-SHELL", inCommand}
   948  	}
   949  	hc := manifest.Schema2HealthConfig{
   950  		Test: cmd,
   951  	}
   952  
   953  	if inInterval == "disable" {
   954  		inInterval = "0"
   955  	}
   956  	intervalDuration, err := time.ParseDuration(inInterval)
   957  	if err != nil {
   958  		return nil, errors.Wrapf(err, "invalid healthcheck-interval %s ", inInterval)
   959  	}
   960  
   961  	hc.Interval = intervalDuration
   962  
   963  	if inRetries < 1 {
   964  		return nil, errors.New("healthcheck-retries must be greater than 0.")
   965  	}
   966  	hc.Retries = int(inRetries)
   967  	timeoutDuration, err := time.ParseDuration(inTimeout)
   968  	if err != nil {
   969  		return nil, errors.Wrapf(err, "invalid healthcheck-timeout %s", inTimeout)
   970  	}
   971  	if timeoutDuration < time.Duration(1) {
   972  		return nil, errors.New("healthcheck-timeout must be at least 1 second")
   973  	}
   974  	hc.Timeout = timeoutDuration
   975  
   976  	startPeriodDuration, err := time.ParseDuration(inStartPeriod)
   977  	if err != nil {
   978  		return nil, errors.Wrapf(err, "invalid healthcheck-start-period %s", inStartPeriod)
   979  	}
   980  	if startPeriodDuration < time.Duration(0) {
   981  		return nil, errors.New("healthcheck-start-period must be 0 seconds or greater")
   982  	}
   983  	hc.StartPeriod = startPeriodDuration
   984  
   985  	return &hc, nil
   986  }
   987  
   988  // GetNamespaceOptions transforms a slice of kernel namespaces
   989  // into a slice of pod create options. Currently, not all
   990  // kernel namespaces are supported, and they will be returned in an error
   991  func GetNamespaceOptions(ns []string) ([]libpod.PodCreateOption, error) {
   992  	var options []libpod.PodCreateOption
   993  	var erroredOptions []libpod.PodCreateOption
   994  	for _, toShare := range ns {
   995  		switch toShare {
   996  		case "cgroup":
   997  			options = append(options, libpod.WithPodCgroups())
   998  		case "net":
   999  			options = append(options, libpod.WithPodNet())
  1000  		case "mnt":
  1001  			return erroredOptions, errors.Errorf("Mount sharing functionality not supported on pod level")
  1002  		case "pid":
  1003  			options = append(options, libpod.WithPodPID())
  1004  		case "user":
  1005  			return erroredOptions, errors.Errorf("User sharing functionality not supported on pod level")
  1006  		case "ipc":
  1007  			options = append(options, libpod.WithPodIPC())
  1008  		case "uts":
  1009  			options = append(options, libpod.WithPodUTS())
  1010  		case "":
  1011  		case "none":
  1012  			return erroredOptions, nil
  1013  		default:
  1014  			return erroredOptions, errors.Errorf("Invalid kernel namespace to share: %s. Options are: net, pid, ipc, uts or none", toShare)
  1015  		}
  1016  	}
  1017  	return options, nil
  1018  }
  1019  
  1020  func addWarning(warnings []string, msg string) []string {
  1021  	logrus.Warn(msg)
  1022  	return append(warnings, msg)
  1023  }
  1024  
  1025  func verifyContainerResources(config *cc.CreateConfig, update bool) ([]string, error) {
  1026  	warnings := []string{}
  1027  
  1028  	cgroup2, err := cgroups.IsCgroup2UnifiedMode()
  1029  	if err != nil || cgroup2 {
  1030  		return warnings, err
  1031  	}
  1032  
  1033  	sysInfo := sysinfo.New(true)
  1034  
  1035  	// memory subsystem checks and adjustments
  1036  	if config.Resources.Memory > 0 && !sysInfo.MemoryLimit {
  1037  		warnings = addWarning(warnings, "Your kernel does not support memory limit capabilities or the cgroup is not mounted. Limitation discarded.")
  1038  		config.Resources.Memory = 0
  1039  		config.Resources.MemorySwap = -1
  1040  	}
  1041  	if config.Resources.Memory > 0 && config.Resources.MemorySwap != -1 && !sysInfo.SwapLimit {
  1042  		warnings = addWarning(warnings, "Your kernel does not support swap limit capabilities,or the cgroup is not mounted. Memory limited without swap.")
  1043  		config.Resources.MemorySwap = -1
  1044  	}
  1045  	if config.Resources.Memory > 0 && config.Resources.MemorySwap > 0 && config.Resources.MemorySwap < config.Resources.Memory {
  1046  		return warnings, fmt.Errorf("minimum memoryswap limit should be larger than memory limit, see usage")
  1047  	}
  1048  	if config.Resources.Memory == 0 && config.Resources.MemorySwap > 0 && !update {
  1049  		return warnings, fmt.Errorf("you should always set the memory limit when using memoryswap limit, see usage")
  1050  	}
  1051  	if config.Resources.MemorySwappiness != -1 {
  1052  		if !sysInfo.MemorySwappiness {
  1053  			msg := "Your kernel does not support memory swappiness capabilities, or the cgroup is not mounted. Memory swappiness discarded."
  1054  			warnings = addWarning(warnings, msg)
  1055  			config.Resources.MemorySwappiness = -1
  1056  		} else {
  1057  			swappiness := config.Resources.MemorySwappiness
  1058  			if swappiness < -1 || swappiness > 100 {
  1059  				return warnings, fmt.Errorf("invalid value: %v, valid memory swappiness range is 0-100", swappiness)
  1060  			}
  1061  		}
  1062  	}
  1063  	if config.Resources.MemoryReservation > 0 && !sysInfo.MemoryReservation {
  1064  		warnings = addWarning(warnings, "Your kernel does not support memory soft limit capabilities or the cgroup is not mounted. Limitation discarded.")
  1065  		config.Resources.MemoryReservation = 0
  1066  	}
  1067  	if config.Resources.Memory > 0 && config.Resources.MemoryReservation > 0 && config.Resources.Memory < config.Resources.MemoryReservation {
  1068  		return warnings, fmt.Errorf("minimum memory limit cannot be less than memory reservation limit, see usage")
  1069  	}
  1070  	if config.Resources.KernelMemory > 0 && !sysInfo.KernelMemory {
  1071  		warnings = addWarning(warnings, "Your kernel does not support kernel memory limit capabilities or the cgroup is not mounted. Limitation discarded.")
  1072  		config.Resources.KernelMemory = 0
  1073  	}
  1074  	if config.Resources.DisableOomKiller && !sysInfo.OomKillDisable {
  1075  		// only produce warnings if the setting wasn't to *disable* the OOM Kill; no point
  1076  		// warning the caller if they already wanted the feature to be off
  1077  		warnings = addWarning(warnings, "Your kernel does not support OomKillDisable. OomKillDisable discarded.")
  1078  		config.Resources.DisableOomKiller = false
  1079  	}
  1080  
  1081  	if config.Resources.PidsLimit != 0 && !sysInfo.PidsLimit {
  1082  		warnings = addWarning(warnings, "Your kernel does not support pids limit capabilities or the cgroup is not mounted. PIDs limit discarded.")
  1083  		config.Resources.PidsLimit = 0
  1084  	}
  1085  
  1086  	if config.Resources.CPUShares > 0 && !sysInfo.CPUShares {
  1087  		warnings = addWarning(warnings, "Your kernel does not support CPU shares or the cgroup is not mounted. Shares discarded.")
  1088  		config.Resources.CPUShares = 0
  1089  	}
  1090  	if config.Resources.CPUPeriod > 0 && !sysInfo.CPUCfsPeriod {
  1091  		warnings = addWarning(warnings, "Your kernel does not support CPU cfs period or the cgroup is not mounted. Period discarded.")
  1092  		config.Resources.CPUPeriod = 0
  1093  	}
  1094  	if config.Resources.CPUPeriod != 0 && (config.Resources.CPUPeriod < 1000 || config.Resources.CPUPeriod > 1000000) {
  1095  		return warnings, fmt.Errorf("CPU cfs period cannot be less than 1ms (i.e. 1000) or larger than 1s (i.e. 1000000)")
  1096  	}
  1097  	if config.Resources.CPUQuota > 0 && !sysInfo.CPUCfsQuota {
  1098  		warnings = addWarning(warnings, "Your kernel does not support CPU cfs quota or the cgroup is not mounted. Quota discarded.")
  1099  		config.Resources.CPUQuota = 0
  1100  	}
  1101  	if config.Resources.CPUQuota > 0 && config.Resources.CPUQuota < 1000 {
  1102  		return warnings, fmt.Errorf("CPU cfs quota cannot be less than 1ms (i.e. 1000)")
  1103  	}
  1104  	// cpuset subsystem checks and adjustments
  1105  	if (config.Resources.CPUsetCPUs != "" || config.Resources.CPUsetMems != "") && !sysInfo.Cpuset {
  1106  		warnings = addWarning(warnings, "Your kernel does not support cpuset or the cgroup is not mounted. CPUset discarded.")
  1107  		config.Resources.CPUsetCPUs = ""
  1108  		config.Resources.CPUsetMems = ""
  1109  	}
  1110  	cpusAvailable, err := sysInfo.IsCpusetCpusAvailable(config.Resources.CPUsetCPUs)
  1111  	if err != nil {
  1112  		return warnings, fmt.Errorf("invalid value %s for cpuset cpus", config.Resources.CPUsetCPUs)
  1113  	}
  1114  	if !cpusAvailable {
  1115  		return warnings, fmt.Errorf("requested CPUs are not available - requested %s, available: %s", config.Resources.CPUsetCPUs, sysInfo.Cpus)
  1116  	}
  1117  	memsAvailable, err := sysInfo.IsCpusetMemsAvailable(config.Resources.CPUsetMems)
  1118  	if err != nil {
  1119  		return warnings, fmt.Errorf("invalid value %s for cpuset mems", config.Resources.CPUsetMems)
  1120  	}
  1121  	if !memsAvailable {
  1122  		return warnings, fmt.Errorf("requested memory nodes are not available - requested %s, available: %s", config.Resources.CPUsetMems, sysInfo.Mems)
  1123  	}
  1124  
  1125  	// blkio subsystem checks and adjustments
  1126  	if config.Resources.BlkioWeight > 0 && !sysInfo.BlkioWeight {
  1127  		warnings = addWarning(warnings, "Your kernel does not support Block I/O weight or the cgroup is not mounted. Weight discarded.")
  1128  		config.Resources.BlkioWeight = 0
  1129  	}
  1130  	if config.Resources.BlkioWeight > 0 && (config.Resources.BlkioWeight < 10 || config.Resources.BlkioWeight > 1000) {
  1131  		return warnings, fmt.Errorf("range of blkio weight is from 10 to 1000")
  1132  	}
  1133  	if len(config.Resources.BlkioWeightDevice) > 0 && !sysInfo.BlkioWeightDevice {
  1134  		warnings = addWarning(warnings, "Your kernel does not support Block I/O weight_device or the cgroup is not mounted. Weight-device discarded.")
  1135  		config.Resources.BlkioWeightDevice = []string{}
  1136  	}
  1137  	if len(config.Resources.DeviceReadBps) > 0 && !sysInfo.BlkioReadBpsDevice {
  1138  		warnings = addWarning(warnings, "Your kernel does not support BPS Block I/O read limit or the cgroup is not mounted. Block I/O BPS read limit discarded")
  1139  		config.Resources.DeviceReadBps = []string{}
  1140  	}
  1141  	if len(config.Resources.DeviceWriteBps) > 0 && !sysInfo.BlkioWriteBpsDevice {
  1142  		warnings = addWarning(warnings, "Your kernel does not support BPS Block I/O write limit or the cgroup is not mounted. Block I/O BPS write limit discarded.")
  1143  		config.Resources.DeviceWriteBps = []string{}
  1144  	}
  1145  	if len(config.Resources.DeviceReadIOps) > 0 && !sysInfo.BlkioReadIOpsDevice {
  1146  		warnings = addWarning(warnings, "Your kernel does not support IOPS Block read limit or the cgroup is not mounted. Block I/O IOPS read limit discarded.")
  1147  		config.Resources.DeviceReadIOps = []string{}
  1148  	}
  1149  	if len(config.Resources.DeviceWriteIOps) > 0 && !sysInfo.BlkioWriteIOpsDevice {
  1150  		warnings = addWarning(warnings, "Your kernel does not support IOPS Block I/O write limit or the cgroup is not mounted. Block I/O IOPS write limit discarded.")
  1151  		config.Resources.DeviceWriteIOps = []string{}
  1152  	}
  1153  
  1154  	return warnings, nil
  1155  }