github.com/containers/podman/v2@v2.2.2-0.20210501105131-c1e07d070c4c/pkg/varlinkapi/create.go (about) 1 package varlinkapi 2 3 import ( 4 "context" 5 "encoding/json" 6 "fmt" 7 "io" 8 "os" 9 "path/filepath" 10 goruntime "runtime" 11 "strconv" 12 "strings" 13 "syscall" 14 "time" 15 16 "github.com/containers/common/pkg/sysinfo" 17 "github.com/containers/image/v5/manifest" 18 "github.com/containers/podman/v2/cmd/podman/parse" 19 "github.com/containers/podman/v2/libpod" 20 "github.com/containers/podman/v2/libpod/define" 21 "github.com/containers/podman/v2/libpod/image" 22 ann "github.com/containers/podman/v2/pkg/annotations" 23 "github.com/containers/podman/v2/pkg/autoupdate" 24 "github.com/containers/podman/v2/pkg/cgroups" 25 envLib "github.com/containers/podman/v2/pkg/env" 26 "github.com/containers/podman/v2/pkg/errorhandling" 27 "github.com/containers/podman/v2/pkg/inspect" 28 ns "github.com/containers/podman/v2/pkg/namespaces" 29 "github.com/containers/podman/v2/pkg/rootless" 30 "github.com/containers/podman/v2/pkg/seccomp" 31 cc "github.com/containers/podman/v2/pkg/spec" 32 systemdGen "github.com/containers/podman/v2/pkg/systemd/generate" 33 "github.com/containers/podman/v2/pkg/util" 34 "github.com/docker/go-connections/nat" 35 "github.com/docker/go-units" 36 "github.com/opentracing/opentracing-go" 37 "github.com/pkg/errors" 38 "github.com/sirupsen/logrus" 39 ) 40 41 var DefaultKernelNamespaces = "cgroup,ipc,net,uts" 42 43 func CreateContainer(ctx context.Context, c *GenericCLIResults, runtime *libpod.Runtime) (*libpod.Container, *cc.CreateConfig, error) { 44 var ( 45 healthCheck *manifest.Schema2HealthConfig 46 err error 47 cidFile *os.File 48 ) 49 if c.Bool("trace") { 50 span, _ := opentracing.StartSpanFromContext(ctx, "createContainer") 51 defer span.Finish() 52 } 53 if c.Bool("rm") && c.String("restart") != "" && c.String("restart") != "no" { 54 return nil, nil, errors.Errorf("the --rm option conflicts with --restart") 55 } 56 57 rtc, err := runtime.GetConfig() 58 if err != nil { 59 return nil, nil, err 60 } 61 rootfs := "" 62 if c.Bool("rootfs") { 63 rootfs = c.InputArgs[0] 64 } 65 66 if c.IsSet("cidfile") { 67 cidFile, err = util.OpenExclusiveFile(c.String("cidfile")) 68 if err != nil && os.IsExist(err) { 69 return nil, nil, errors.Errorf("container id file exists. Ensure another container is not using it or delete %s", c.String("cidfile")) 70 } 71 if err != nil { 72 return nil, nil, errors.Errorf("error opening cidfile %s", c.String("cidfile")) 73 } 74 defer errorhandling.CloseQuiet(cidFile) 75 defer errorhandling.SyncQuiet(cidFile) 76 } 77 78 imageName := "" 79 rawImageName := "" 80 var imageData *inspect.ImageData = nil 81 82 // Set the storage if there is no rootfs specified 83 if rootfs == "" { 84 var writer io.Writer 85 if !c.Bool("quiet") { 86 writer = os.Stderr 87 } 88 89 if len(c.InputArgs) != 0 { 90 rawImageName = c.InputArgs[0] 91 } else { 92 return nil, nil, errors.Errorf("error, image name not provided") 93 } 94 95 pullType, err := util.ValidatePullType(c.String("pull")) 96 if err != nil { 97 return nil, nil, err 98 } 99 100 overrideOS := c.String("override-os") 101 overrideArch := c.String("override-arch") 102 dockerRegistryOptions := image.DockerRegistryOptions{ 103 OSChoice: overrideOS, 104 ArchitectureChoice: overrideArch, 105 } 106 107 newImage, err := runtime.ImageRuntime().New(ctx, rawImageName, rtc.Engine.SignaturePolicyPath, c.String("authfile"), writer, &dockerRegistryOptions, image.SigningOptions{}, nil, pullType) 108 if err != nil { 109 return nil, nil, err 110 } 111 imageData, err = newImage.InspectNoSize(ctx) 112 if err != nil { 113 return nil, nil, err 114 } 115 116 if overrideOS == "" && imageData.Os != goruntime.GOOS { 117 logrus.Infof("Using %q (OS) image on %q host", imageData.Os, goruntime.GOOS) 118 } 119 120 if overrideArch == "" && imageData.Architecture != goruntime.GOARCH { 121 logrus.Infof("Using %q (architecture) on %q host", imageData.Architecture, goruntime.GOARCH) 122 } 123 124 names := newImage.Names() 125 if len(names) > 0 { 126 imageName = names[0] 127 } else { 128 imageName = newImage.ID() 129 } 130 131 // if the user disabled the healthcheck with "none" or the no-healthcheck 132 // options is provided, we skip adding it 133 healthCheckCommandInput := c.String("healthcheck-command") 134 135 // the user didn't disable the healthcheck but did pass in a healthcheck command 136 // now we need to make a healthcheck from the commandline input 137 if healthCheckCommandInput != "none" && !c.Bool("no-healthcheck") { 138 if len(healthCheckCommandInput) > 0 { 139 healthCheck, err = makeHealthCheckFromCli(c) 140 if err != nil { 141 return nil, nil, errors.Wrapf(err, "unable to create healthcheck") 142 } 143 } else { 144 // the user did not disable the health check and did not pass in a healthcheck 145 // command as input. so now we add healthcheck if it exists AND is correct mediatype 146 _, mediaType, err := newImage.Manifest(ctx) 147 if err != nil { 148 return nil, nil, errors.Wrapf(err, "unable to determine mediatype of image %s", newImage.ID()) 149 } 150 if mediaType == manifest.DockerV2Schema2MediaType { 151 healthCheck, err = newImage.GetHealthCheck(ctx) 152 if err != nil { 153 return nil, nil, errors.Wrapf(err, "unable to get healthcheck for %s", c.InputArgs[0]) 154 } 155 156 if healthCheck != nil { 157 hcCommand := healthCheck.Test 158 if len(hcCommand) < 1 || hcCommand[0] == "" || hcCommand[0] == "NONE" { 159 // disable health check 160 healthCheck = nil 161 } else { 162 // apply defaults if image doesn't override them 163 if healthCheck.Interval == 0 { 164 healthCheck.Interval = 30 * time.Second 165 } 166 if healthCheck.Timeout == 0 { 167 healthCheck.Timeout = 30 * time.Second 168 } 169 /* Docker default is 0s, so the following would be a no-op 170 if healthCheck.StartPeriod == 0 { 171 healthCheck.StartPeriod = 0 * time.Second 172 } 173 */ 174 if healthCheck.Retries == 0 { 175 healthCheck.Retries = 3 176 } 177 } 178 } 179 } 180 } 181 } 182 } 183 184 createConfig, err := ParseCreateOpts(ctx, c, runtime, imageName, rawImageName, imageData) 185 if err != nil { 186 return nil, nil, err 187 } 188 189 // (VR): Ideally we perform the checks _before_ pulling the image but that 190 // would require some bigger code refactoring of `ParseCreateOpts` and the 191 // logic here. But as the creation code will be consolidated in the future 192 // and given auto updates are experimental, we can live with that for now. 193 // In the end, the user may only need to correct the policy or the raw image 194 // name. 195 autoUpdatePolicy, autoUpdatePolicySpecified := createConfig.Labels[autoupdate.Label] 196 if autoUpdatePolicySpecified { 197 if _, err := autoupdate.LookupPolicy(autoUpdatePolicy); err != nil { 198 return nil, nil, err 199 } 200 // Now we need to make sure we're having a fully-qualified image reference. 201 if rootfs != "" { 202 return nil, nil, errors.Errorf("auto updates do not work with --rootfs") 203 } 204 // Make sure the input image is a docker. 205 if err := autoupdate.ValidateImageReference(rawImageName); err != nil { 206 return nil, nil, err 207 } 208 } 209 210 // Because parseCreateOpts does derive anything from the image, we add health check 211 // at this point. The rest is done by WithOptions. 212 createConfig.HealthCheck = healthCheck 213 214 // TODO: Should be able to return this from ParseCreateOpts 215 var pod *libpod.Pod 216 if createConfig.Pod != "" { 217 pod, err = runtime.LookupPod(createConfig.Pod) 218 if err != nil { 219 return nil, nil, errors.Wrapf(err, "error looking up pod to join") 220 } 221 } 222 223 ctr, err := CreateContainerFromCreateConfig(ctx, runtime, createConfig, pod) 224 if err != nil { 225 return nil, nil, err 226 } 227 if cidFile != nil { 228 _, err = cidFile.WriteString(ctr.ID()) 229 if err != nil { 230 logrus.Error(err) 231 } 232 233 } 234 235 logrus.Debugf("New container created %q", ctr.ID()) 236 return ctr, createConfig, nil 237 } 238 239 func configureEntrypoint(c *GenericCLIResults, data *inspect.ImageData) []string { 240 entrypoint := []string{} 241 if c.IsSet("entrypoint") { 242 // Force entrypoint to "" 243 if c.String("entrypoint") == "" { 244 return entrypoint 245 } 246 // Check if entrypoint specified is json 247 if err := json.Unmarshal([]byte(c.String("entrypoint")), &entrypoint); err == nil { 248 return entrypoint 249 } 250 // Return entrypoint as a single command 251 return []string{c.String("entrypoint")} 252 } 253 if data != nil { 254 return data.Config.Entrypoint 255 } 256 return entrypoint 257 } 258 259 func configurePod(c *GenericCLIResults, runtime *libpod.Runtime, namespaces map[string]string, podName string) (map[string]string, string, error) { 260 pod, err := runtime.LookupPod(podName) 261 if err != nil { 262 return namespaces, "", err 263 } 264 podInfraID, err := pod.InfraContainerID() 265 if err != nil { 266 return namespaces, "", err 267 } 268 hasUserns := false 269 if podInfraID != "" { 270 podCtr, err := runtime.GetContainer(podInfraID) 271 if err != nil { 272 return namespaces, "", err 273 } 274 mappings, err := podCtr.IDMappings() 275 if err != nil { 276 return namespaces, "", err 277 } 278 hasUserns = len(mappings.UIDMap) > 0 279 } 280 281 if (namespaces["pid"] == cc.Pod) || (!c.IsSet("pid") && pod.SharesPID()) { 282 namespaces["pid"] = fmt.Sprintf("container:%s", podInfraID) 283 } 284 if (namespaces["net"] == cc.Pod) || (!c.IsSet("net") && !c.IsSet("network") && pod.SharesNet()) { 285 namespaces["net"] = fmt.Sprintf("container:%s", podInfraID) 286 } 287 if hasUserns && (namespaces["user"] == cc.Pod) || (!c.IsSet("user") && pod.SharesUser()) { 288 namespaces["user"] = fmt.Sprintf("container:%s", podInfraID) 289 } 290 if (namespaces["ipc"] == cc.Pod) || (!c.IsSet("ipc") && pod.SharesIPC()) { 291 namespaces["ipc"] = fmt.Sprintf("container:%s", podInfraID) 292 } 293 if (namespaces["uts"] == cc.Pod) || (!c.IsSet("uts") && pod.SharesUTS()) { 294 namespaces["uts"] = fmt.Sprintf("container:%s", podInfraID) 295 } 296 return namespaces, podInfraID, nil 297 } 298 299 // Parses CLI options related to container creation into a config which can be 300 // parsed into an OCI runtime spec 301 func ParseCreateOpts(ctx context.Context, c *GenericCLIResults, runtime *libpod.Runtime, imageName string, rawImageName string, data *inspect.ImageData) (*cc.CreateConfig, error) { 302 var ( 303 inputCommand, command []string 304 memoryLimit, memoryReservation, memorySwap, memoryKernel int64 305 blkioWeight uint16 306 namespaces map[string]string 307 ) 308 309 idmappings, err := util.ParseIDMapping(ns.UsernsMode(c.String("userns")), c.StringSlice("uidmap"), c.StringSlice("gidmap"), c.String("subuidname"), c.String("subgidname")) 310 if err != nil { 311 return nil, err 312 } 313 314 imageID := "" 315 316 inputCommand = c.InputArgs[1:] 317 if data != nil { 318 imageID = data.ID 319 } 320 321 rootfs := "" 322 if c.Bool("rootfs") { 323 rootfs = c.InputArgs[0] 324 } 325 326 if c.String("memory") != "" { 327 memoryLimit, err = units.RAMInBytes(c.String("memory")) 328 if err != nil { 329 return nil, errors.Wrapf(err, "invalid value for memory") 330 } 331 } 332 if c.String("memory-reservation") != "" { 333 memoryReservation, err = units.RAMInBytes(c.String("memory-reservation")) 334 if err != nil { 335 return nil, errors.Wrapf(err, "invalid value for memory-reservation") 336 } 337 } 338 if c.String("memory-swap") != "" { 339 if c.String("memory-swap") == "-1" { 340 memorySwap = -1 341 } else { 342 memorySwap, err = units.RAMInBytes(c.String("memory-swap")) 343 if err != nil { 344 return nil, errors.Wrapf(err, "invalid value for memory-swap") 345 } 346 } 347 } 348 if c.String("kernel-memory") != "" { 349 memoryKernel, err = units.RAMInBytes(c.String("kernel-memory")) 350 if err != nil { 351 return nil, errors.Wrapf(err, "invalid value for kernel-memory") 352 } 353 } 354 if c.String("blkio-weight") != "" { 355 u, err := strconv.ParseUint(c.String("blkio-weight"), 10, 16) 356 if err != nil { 357 return nil, errors.Wrapf(err, "invalid value for blkio-weight") 358 } 359 blkioWeight = uint16(u) 360 } 361 362 tty := c.Bool("tty") 363 364 if c.Changed("cpu-period") && c.Changed("cpus") { 365 return nil, errors.Errorf("--cpu-period and --cpus cannot be set together") 366 } 367 if c.Changed("cpu-quota") && c.Changed("cpus") { 368 return nil, errors.Errorf("--cpu-quota and --cpus cannot be set together") 369 } 370 371 if c.Bool("no-hosts") && c.Changed("add-host") { 372 return nil, errors.Errorf("--no-hosts and --add-host cannot be set together") 373 } 374 375 // EXPOSED PORTS 376 var portBindings map[nat.Port][]nat.PortBinding 377 if data != nil { 378 portBindings, err = cc.ExposedPorts(c.StringSlice("expose"), c.StringSlice("publish"), c.Bool("publish-all"), data.Config.ExposedPorts) 379 if err != nil { 380 return nil, err 381 } 382 } 383 384 // Kernel Namespaces 385 // TODO Fix handling of namespace from pod 386 // Instead of integrating here, should be done in libpod 387 // However, that also involves setting up security opts 388 // when the pod's namespace is integrated 389 namespaces = map[string]string{ 390 "cgroup": c.String("cgroupns"), 391 "pid": c.String("pid"), 392 "net": c.String("network"), 393 "ipc": c.String("ipc"), 394 "user": c.String("userns"), 395 "uts": c.String("uts"), 396 } 397 398 originalPodName := c.String("pod") 399 podName := strings.Replace(originalPodName, "new:", "", 1) 400 // after we strip out :new, make sure there is something left for a pod name 401 if len(podName) < 1 && c.IsSet("pod") { 402 return nil, errors.Errorf("new pod name must be at least one character") 403 } 404 405 // If we are adding a container to a pod, we would like to add an annotation for the infra ID 406 // so kata containers can share VMs inside the pod 407 var podInfraID string 408 if c.IsSet("pod") { 409 if strings.HasPrefix(originalPodName, "new:") { 410 // pod does not exist; lets make it 411 var podOptions []libpod.PodCreateOption 412 podOptions = append(podOptions, libpod.WithPodName(podName), libpod.WithInfraContainer(), libpod.WithPodCgroups()) 413 if len(portBindings) > 0 { 414 ociPortBindings, err := cc.NatToOCIPortBindings(portBindings) 415 if err != nil { 416 return nil, err 417 } 418 podOptions = append(podOptions, libpod.WithInfraContainerPorts(ociPortBindings)) 419 } 420 421 podNsOptions, err := GetNamespaceOptions(strings.Split(DefaultKernelNamespaces, ",")) 422 if err != nil { 423 return nil, err 424 } 425 podOptions = append(podOptions, podNsOptions...) 426 // make pod 427 pod, err := runtime.NewPod(ctx, podOptions...) 428 if err != nil { 429 return nil, err 430 } 431 logrus.Debugf("pod %s created by new container request", pod.ID()) 432 433 // The container now cannot have port bindings; so we reset the map 434 portBindings = make(map[nat.Port][]nat.PortBinding) 435 } 436 namespaces, podInfraID, err = configurePod(c, runtime, namespaces, podName) 437 if err != nil { 438 return nil, err 439 } 440 } 441 442 pidMode := ns.PidMode(namespaces["pid"]) 443 if !cc.Valid(string(pidMode), pidMode) { 444 return nil, errors.Errorf("--pid %q is not valid", c.String("pid")) 445 } 446 447 usernsMode := ns.UsernsMode(namespaces["user"]) 448 if !cc.Valid(string(usernsMode), usernsMode) { 449 return nil, errors.Errorf("--userns %q is not valid", namespaces["user"]) 450 } 451 452 utsMode := ns.UTSMode(namespaces["uts"]) 453 if !cc.Valid(string(utsMode), utsMode) { 454 return nil, errors.Errorf("--uts %q is not valid", namespaces["uts"]) 455 } 456 457 cgroupMode := ns.CgroupMode(namespaces["cgroup"]) 458 if !cgroupMode.Valid() { 459 return nil, errors.Errorf("--cgroup %q is not valid", namespaces["cgroup"]) 460 } 461 462 ipcMode := ns.IpcMode(namespaces["ipc"]) 463 if !cc.Valid(string(ipcMode), ipcMode) { 464 return nil, errors.Errorf("--ipc %q is not valid", ipcMode) 465 } 466 467 // Make sure if network is set to container namespace, port binding is not also being asked for 468 netMode := ns.NetworkMode(namespaces["net"]) 469 if netMode.IsContainer() { 470 if len(portBindings) > 0 { 471 return nil, errors.Errorf("cannot set port bindings on an existing container network namespace") 472 } 473 } 474 475 // USER 476 user := c.String("user") 477 if user == "" { 478 switch { 479 case usernsMode.IsKeepID(): 480 user = fmt.Sprintf("%d:%d", rootless.GetRootlessUID(), rootless.GetRootlessGID()) 481 case data == nil: 482 user = "0" 483 default: 484 user = data.Config.User 485 } 486 } 487 488 // STOP SIGNAL 489 stopSignal := syscall.SIGTERM 490 signalString := "" 491 if data != nil { 492 signalString = data.Config.StopSignal 493 } 494 if c.IsSet("stop-signal") { 495 signalString = c.String("stop-signal") 496 } 497 if signalString != "" { 498 stopSignal, err = util.ParseSignal(signalString) 499 if err != nil { 500 return nil, err 501 } 502 } 503 504 // ENVIRONMENT VARIABLES 505 // 506 // Precedence order (higher index wins): 507 // 1) env-host, 2) image data, 3) env-file, 4) env 508 env := map[string]string{ 509 "container": "podman", 510 } 511 512 // First transform the os env into a map. We need it for the labels later in 513 // any case. 514 osEnv, err := envLib.ParseSlice(os.Environ()) 515 if err != nil { 516 return nil, errors.Wrap(err, "error parsing host environment variables") 517 } 518 519 // Start with env-host 520 521 if c.Bool("env-host") { 522 env = envLib.Join(env, osEnv) 523 } 524 525 // Image data overrides any previous variables 526 if data != nil { 527 configEnv, err := envLib.ParseSlice(data.Config.Env) 528 if err != nil { 529 return nil, errors.Wrap(err, "error passing image environment variables") 530 } 531 env = envLib.Join(env, configEnv) 532 } 533 534 // env-file overrides any previous variables 535 if c.IsSet("env-file") { 536 for _, f := range c.StringSlice("env-file") { 537 fileEnv, err := envLib.ParseFile(f) 538 if err != nil { 539 return nil, err 540 } 541 // File env is overridden by env. 542 env = envLib.Join(env, fileEnv) 543 } 544 } 545 546 if c.IsSet("env") { 547 // env overrides any previous variables 548 cmdlineEnv := c.StringSlice("env") 549 if len(cmdlineEnv) > 0 { 550 parsedEnv, err := envLib.ParseSlice(cmdlineEnv) 551 if err != nil { 552 return nil, err 553 } 554 env = envLib.Join(env, parsedEnv) 555 } 556 } 557 558 // LABEL VARIABLES 559 labels, err := parse.GetAllLabels(c.StringSlice("label-file"), c.StringArray("label")) 560 if err != nil { 561 return nil, errors.Wrapf(err, "unable to process labels") 562 } 563 if data != nil { 564 for key, val := range data.Config.Labels { 565 if _, ok := labels[key]; !ok { 566 labels[key] = val 567 } 568 } 569 } 570 571 if systemdUnit, exists := osEnv[systemdGen.EnvVariable]; exists { 572 labels[systemdGen.EnvVariable] = systemdUnit 573 } 574 575 // ANNOTATIONS 576 annotations := make(map[string]string) 577 578 // First, add our default annotations 579 annotations[ann.TTY] = "false" 580 if tty { 581 annotations[ann.TTY] = "true" 582 } 583 584 // in the event this container is in a pod, and the pod has an infra container 585 // we will want to configure it as a type "container" instead defaulting to 586 // the behavior of a "sandbox" container 587 // In Kata containers: 588 // - "sandbox" is the annotation that denotes the container should use its own 589 // VM, which is the default behavior 590 // - "container" denotes the container should join the VM of the SandboxID 591 // (the infra container) 592 if podInfraID != "" { 593 annotations[ann.SandboxID] = podInfraID 594 annotations[ann.ContainerType] = ann.ContainerTypeContainer 595 } 596 597 if data != nil { 598 // Next, add annotations from the image 599 for key, value := range data.Annotations { 600 annotations[key] = value 601 } 602 } 603 // Last, add user annotations 604 for _, annotation := range c.StringSlice("annotation") { 605 splitAnnotation := strings.SplitN(annotation, "=", 2) 606 if len(splitAnnotation) < 2 { 607 return nil, errors.Errorf("Annotations must be formatted KEY=VALUE") 608 } 609 annotations[splitAnnotation[0]] = splitAnnotation[1] 610 } 611 612 // WORKING DIRECTORY 613 workDir := "/" 614 if c.IsSet("workdir") { 615 workDir = c.String("workdir") 616 } else if data != nil && data.Config.WorkingDir != "" { 617 workDir = data.Config.WorkingDir 618 } 619 620 userCommand := []string{} 621 entrypoint := configureEntrypoint(c, data) 622 // Build the command 623 // If we have an entry point, it goes first 624 if len(entrypoint) > 0 { 625 command = entrypoint 626 } 627 if len(inputCommand) > 0 { 628 // User command overrides data CMD 629 command = append(command, inputCommand...) 630 userCommand = append(userCommand, inputCommand...) 631 } else if data != nil && len(data.Config.Cmd) > 0 && !c.IsSet("entrypoint") { 632 // If not user command, add CMD 633 command = append(command, data.Config.Cmd...) 634 userCommand = append(userCommand, data.Config.Cmd...) 635 } 636 637 if data != nil && len(command) == 0 { 638 return nil, errors.Errorf("No command specified on command line or as CMD or ENTRYPOINT in this image") 639 } 640 641 // SHM Size 642 shmSize, err := units.FromHumanSize(c.String("shm-size")) 643 if err != nil { 644 return nil, errors.Wrapf(err, "unable to translate --shm-size") 645 } 646 647 if c.IsSet("add-host") { 648 // Verify the additional hosts are in correct format 649 for _, host := range c.StringSlice("add-host") { 650 if _, err := parse.ValidateExtraHost(host); err != nil { 651 return nil, err 652 } 653 } 654 } 655 656 var ( 657 dnsSearches []string 658 dnsServers []string 659 dnsOptions []string 660 ) 661 if c.Changed("dns-search") { 662 dnsSearches = c.StringSlice("dns-search") 663 // Check for explicit dns-search domain of '' 664 if len(dnsSearches) == 0 { 665 return nil, errors.Errorf("'' is not a valid domain") 666 } 667 // Validate domains are good 668 for _, dom := range dnsSearches { 669 if dom == "." { 670 if len(dnsSearches) > 1 { 671 return nil, errors.Errorf("cannot pass additional search domains when also specifying '.'") 672 } 673 continue 674 } 675 if _, err := parse.ValidateDomain(dom); err != nil { 676 return nil, err 677 } 678 } 679 } 680 if c.IsSet("dns") { 681 dnsServers = append(dnsServers, c.StringSlice("dns")...) 682 } 683 if c.IsSet("dns-opt") { 684 dnsOptions = c.StringSlice("dns-opt") 685 } 686 687 var ImageVolumes map[string]struct{} 688 if data != nil && c.String("image-volume") != "ignore" { 689 ImageVolumes = data.Config.Volumes 690 } 691 692 var imageVolType = map[string]string{ 693 "bind": "", 694 "tmpfs": "", 695 "ignore": "", 696 } 697 if _, ok := imageVolType[c.String("image-volume")]; !ok { 698 return nil, errors.Errorf("invalid image-volume type %q. Pick one of bind, tmpfs, or ignore", c.String("image-volume")) 699 } 700 701 systemd := c.String("systemd") == "always" 702 if !systemd && command != nil { 703 x, err := strconv.ParseBool(c.String("systemd")) 704 if err != nil { 705 return nil, errors.Wrapf(err, "cannot parse bool %s", c.String("systemd")) 706 } 707 useSystemdCommands := map[string]bool{ 708 "/sbin/init": true, 709 "/usr/sbin/init": true, 710 "/usr/local/sbin/init": true, 711 } 712 if x && (useSystemdCommands[command[0]] || (filepath.Base(command[0]) == "systemd")) { 713 systemd = true 714 } 715 } 716 if systemd { 717 if signalString == "" { 718 stopSignal, err = util.ParseSignal("RTMIN+3") 719 if err != nil { 720 return nil, errors.Wrapf(err, "error parsing systemd signal") 721 } 722 } 723 } 724 // This is done because cobra cannot have two aliased flags. So we have to check 725 // both 726 memorySwappiness := c.Int64("memory-swappiness") 727 728 logDriver := define.KubernetesLogging 729 if c.Changed("log-driver") { 730 logDriver = c.String("log-driver") 731 } 732 733 pidsLimit := c.Int64("pids-limit") 734 if c.String("cgroups") == "disabled" && !c.Changed("pids-limit") { 735 pidsLimit = -1 736 } 737 738 pid := &cc.PidConfig{ 739 PidMode: pidMode, 740 } 741 ipc := &cc.IpcConfig{ 742 IpcMode: ipcMode, 743 } 744 745 cgroup := &cc.CgroupConfig{ 746 Cgroups: c.String("cgroups"), 747 Cgroupns: c.String("cgroupns"), 748 CgroupParent: c.String("cgroup-parent"), 749 CgroupMode: cgroupMode, 750 } 751 752 userns := &cc.UserConfig{ 753 GroupAdd: c.StringSlice("group-add"), 754 IDMappings: idmappings, 755 UsernsMode: usernsMode, 756 User: user, 757 } 758 759 uts := &cc.UtsConfig{ 760 UtsMode: utsMode, 761 NoHosts: c.Bool("no-hosts"), 762 HostAdd: c.StringSlice("add-host"), 763 Hostname: c.String("hostname"), 764 } 765 net := &cc.NetworkConfig{ 766 DNSOpt: dnsOptions, 767 DNSSearch: dnsSearches, 768 DNSServers: dnsServers, 769 HTTPProxy: c.Bool("http-proxy"), 770 MacAddress: c.String("mac-address"), 771 Network: c.String("network"), 772 NetMode: netMode, 773 IPAddress: c.String("ip"), 774 Publish: c.StringSlice("publish"), 775 PublishAll: c.Bool("publish-all"), 776 PortBindings: portBindings, 777 } 778 779 sysctl := map[string]string{} 780 if c.Changed("sysctl") { 781 sysctl, err = util.ValidateSysctls(c.StringSlice("sysctl")) 782 if err != nil { 783 return nil, errors.Wrapf(err, "invalid value for sysctl") 784 } 785 } 786 787 secConfig := &cc.SecurityConfig{ 788 CapAdd: c.StringSlice("cap-add"), 789 CapDrop: c.StringSlice("cap-drop"), 790 Privileged: c.Bool("privileged"), 791 ReadOnlyRootfs: c.Bool("read-only"), 792 ReadOnlyTmpfs: c.Bool("read-only-tmpfs"), 793 Sysctl: sysctl, 794 } 795 796 var securityOpt []string 797 if c.Changed("security-opt") { 798 securityOpt = c.StringArray("security-opt") 799 } 800 if err := secConfig.SetSecurityOpts(runtime, securityOpt); err != nil { 801 return nil, err 802 } 803 804 // SECCOMP 805 if data != nil { 806 if value, exists := labels[seccomp.ContainerImageLabel]; exists { 807 secConfig.SeccompProfileFromImage = value 808 } 809 } 810 if policy, err := seccomp.LookupPolicy(c.String("seccomp-policy")); err != nil { 811 return nil, err 812 } else { 813 secConfig.SeccompPolicy = policy 814 } 815 rtc, err := runtime.GetConfig() 816 if err != nil { 817 return nil, err 818 } 819 volumes := rtc.Containers.Volumes 820 if c.Changed("volume") { 821 volumes = append(volumes, c.StringSlice("volume")...) 822 } 823 824 devices := rtc.Containers.Devices 825 if c.Changed("device") { 826 devices = append(devices, c.StringSlice("device")...) 827 } 828 829 config := &cc.CreateConfig{ 830 Annotations: annotations, 831 BuiltinImgVolumes: ImageVolumes, 832 ConmonPidFile: c.String("conmon-pidfile"), 833 ImageVolumeType: c.String("image-volume"), 834 CidFile: c.String("cidfile"), 835 Command: command, 836 UserCommand: userCommand, 837 Detach: c.Bool("detach"), 838 Devices: devices, 839 Entrypoint: entrypoint, 840 Env: env, 841 // ExposedPorts: ports, 842 Init: c.Bool("init"), 843 InitPath: c.String("init-path"), 844 Image: imageName, 845 RawImageName: rawImageName, 846 ImageID: imageID, 847 Interactive: c.Bool("interactive"), 848 // IP6Address: c.String("ipv6"), // Not implemented yet - needs CNI support for static v6 849 Labels: labels, 850 // LinkLocalIP: c.StringSlice("link-local-ip"), // Not implemented yet 851 LogDriver: logDriver, 852 LogDriverOpt: c.StringSlice("log-opt"), 853 Name: c.String("name"), 854 // NetworkAlias: c.StringSlice("network-alias"), // Not implemented - does this make sense in Podman? 855 Pod: podName, 856 Quiet: c.Bool("quiet"), 857 Resources: cc.CreateResourceConfig{ 858 BlkioWeight: blkioWeight, 859 BlkioWeightDevice: c.StringSlice("blkio-weight-device"), 860 CPUShares: c.Uint64("cpu-shares"), 861 CPUPeriod: c.Uint64("cpu-period"), 862 CPUsetCPUs: c.String("cpuset-cpus"), 863 CPUsetMems: c.String("cpuset-mems"), 864 CPUQuota: c.Int64("cpu-quota"), 865 CPURtPeriod: c.Uint64("cpu-rt-period"), 866 CPURtRuntime: c.Int64("cpu-rt-runtime"), 867 CPUs: c.Float64("cpus"), 868 DeviceCgroupRules: c.StringSlice("device-cgroup-rule"), 869 DeviceReadBps: c.StringSlice("device-read-bps"), 870 DeviceReadIOps: c.StringSlice("device-read-iops"), 871 DeviceWriteBps: c.StringSlice("device-write-bps"), 872 DeviceWriteIOps: c.StringSlice("device-write-iops"), 873 DisableOomKiller: c.Bool("oom-kill-disable"), 874 ShmSize: shmSize, 875 Memory: memoryLimit, 876 MemoryReservation: memoryReservation, 877 MemorySwap: memorySwap, 878 MemorySwappiness: int(memorySwappiness), 879 KernelMemory: memoryKernel, 880 OomScoreAdj: c.Int("oom-score-adj"), 881 PidsLimit: pidsLimit, 882 Ulimit: c.StringSlice("ulimit"), 883 }, 884 RestartPolicy: c.String("restart"), 885 Rm: c.Bool("rm"), 886 Security: *secConfig, 887 StopSignal: stopSignal, 888 StopTimeout: c.Uint("stop-timeout"), 889 Systemd: systemd, 890 Tmpfs: c.StringArray("tmpfs"), 891 Tty: tty, 892 MountsFlag: c.StringArray("mount"), 893 Volumes: volumes, 894 WorkDir: workDir, 895 Rootfs: rootfs, 896 VolumesFrom: c.StringSlice("volumes-from"), 897 Syslog: c.Bool("syslog"), 898 899 Pid: *pid, 900 Ipc: *ipc, 901 Cgroup: *cgroup, 902 User: *userns, 903 Uts: *uts, 904 Network: *net, 905 } 906 907 warnings, err := verifyContainerResources(config, false) 908 if err != nil { 909 return nil, err 910 } 911 for _, warning := range warnings { 912 fmt.Fprintln(os.Stderr, warning) 913 } 914 return config, nil 915 } 916 917 func CreateContainerFromCreateConfig(ctx context.Context, r *libpod.Runtime, createConfig *cc.CreateConfig, pod *libpod.Pod) (*libpod.Container, error) { 918 runtimeSpec, options, err := createConfig.MakeContainerConfig(r, pod) 919 if err != nil { 920 return nil, err 921 } 922 923 ctr, err := r.NewContainer(ctx, runtimeSpec, options...) 924 if err != nil { 925 return nil, err 926 } 927 return ctr, nil 928 } 929 930 func makeHealthCheckFromCli(c *GenericCLIResults) (*manifest.Schema2HealthConfig, error) { 931 inCommand := c.String("healthcheck-command") 932 inInterval := c.String("healthcheck-interval") 933 inRetries := c.Uint("healthcheck-retries") 934 inTimeout := c.String("healthcheck-timeout") 935 inStartPeriod := c.String("healthcheck-start-period") 936 937 // Every healthcheck requires a command 938 if len(inCommand) == 0 { 939 return nil, errors.New("Must define a healthcheck command for all healthchecks") 940 } 941 942 // first try to parse option value as JSON array of strings... 943 cmd := []string{} 944 err := json.Unmarshal([]byte(inCommand), &cmd) 945 if err != nil { 946 // ...otherwise pass it to "/bin/sh -c" inside the container 947 cmd = []string{"CMD-SHELL", inCommand} 948 } 949 hc := manifest.Schema2HealthConfig{ 950 Test: cmd, 951 } 952 953 if inInterval == "disable" { 954 inInterval = "0" 955 } 956 intervalDuration, err := time.ParseDuration(inInterval) 957 if err != nil { 958 return nil, errors.Wrapf(err, "invalid healthcheck-interval %s ", inInterval) 959 } 960 961 hc.Interval = intervalDuration 962 963 if inRetries < 1 { 964 return nil, errors.New("healthcheck-retries must be greater than 0.") 965 } 966 hc.Retries = int(inRetries) 967 timeoutDuration, err := time.ParseDuration(inTimeout) 968 if err != nil { 969 return nil, errors.Wrapf(err, "invalid healthcheck-timeout %s", inTimeout) 970 } 971 if timeoutDuration < time.Duration(1) { 972 return nil, errors.New("healthcheck-timeout must be at least 1 second") 973 } 974 hc.Timeout = timeoutDuration 975 976 startPeriodDuration, err := time.ParseDuration(inStartPeriod) 977 if err != nil { 978 return nil, errors.Wrapf(err, "invalid healthcheck-start-period %s", inStartPeriod) 979 } 980 if startPeriodDuration < time.Duration(0) { 981 return nil, errors.New("healthcheck-start-period must be 0 seconds or greater") 982 } 983 hc.StartPeriod = startPeriodDuration 984 985 return &hc, nil 986 } 987 988 // GetNamespaceOptions transforms a slice of kernel namespaces 989 // into a slice of pod create options. Currently, not all 990 // kernel namespaces are supported, and they will be returned in an error 991 func GetNamespaceOptions(ns []string) ([]libpod.PodCreateOption, error) { 992 var options []libpod.PodCreateOption 993 var erroredOptions []libpod.PodCreateOption 994 for _, toShare := range ns { 995 switch toShare { 996 case "cgroup": 997 options = append(options, libpod.WithPodCgroups()) 998 case "net": 999 options = append(options, libpod.WithPodNet()) 1000 case "mnt": 1001 return erroredOptions, errors.Errorf("Mount sharing functionality not supported on pod level") 1002 case "pid": 1003 options = append(options, libpod.WithPodPID()) 1004 case "user": 1005 return erroredOptions, errors.Errorf("User sharing functionality not supported on pod level") 1006 case "ipc": 1007 options = append(options, libpod.WithPodIPC()) 1008 case "uts": 1009 options = append(options, libpod.WithPodUTS()) 1010 case "": 1011 case "none": 1012 return erroredOptions, nil 1013 default: 1014 return erroredOptions, errors.Errorf("Invalid kernel namespace to share: %s. Options are: net, pid, ipc, uts or none", toShare) 1015 } 1016 } 1017 return options, nil 1018 } 1019 1020 func addWarning(warnings []string, msg string) []string { 1021 logrus.Warn(msg) 1022 return append(warnings, msg) 1023 } 1024 1025 func verifyContainerResources(config *cc.CreateConfig, update bool) ([]string, error) { 1026 warnings := []string{} 1027 1028 cgroup2, err := cgroups.IsCgroup2UnifiedMode() 1029 if err != nil || cgroup2 { 1030 return warnings, err 1031 } 1032 1033 sysInfo := sysinfo.New(true) 1034 1035 // memory subsystem checks and adjustments 1036 if config.Resources.Memory > 0 && !sysInfo.MemoryLimit { 1037 warnings = addWarning(warnings, "Your kernel does not support memory limit capabilities or the cgroup is not mounted. Limitation discarded.") 1038 config.Resources.Memory = 0 1039 config.Resources.MemorySwap = -1 1040 } 1041 if config.Resources.Memory > 0 && config.Resources.MemorySwap != -1 && !sysInfo.SwapLimit { 1042 warnings = addWarning(warnings, "Your kernel does not support swap limit capabilities,or the cgroup is not mounted. Memory limited without swap.") 1043 config.Resources.MemorySwap = -1 1044 } 1045 if config.Resources.Memory > 0 && config.Resources.MemorySwap > 0 && config.Resources.MemorySwap < config.Resources.Memory { 1046 return warnings, fmt.Errorf("minimum memoryswap limit should be larger than memory limit, see usage") 1047 } 1048 if config.Resources.Memory == 0 && config.Resources.MemorySwap > 0 && !update { 1049 return warnings, fmt.Errorf("you should always set the memory limit when using memoryswap limit, see usage") 1050 } 1051 if config.Resources.MemorySwappiness != -1 { 1052 if !sysInfo.MemorySwappiness { 1053 msg := "Your kernel does not support memory swappiness capabilities, or the cgroup is not mounted. Memory swappiness discarded." 1054 warnings = addWarning(warnings, msg) 1055 config.Resources.MemorySwappiness = -1 1056 } else { 1057 swappiness := config.Resources.MemorySwappiness 1058 if swappiness < -1 || swappiness > 100 { 1059 return warnings, fmt.Errorf("invalid value: %v, valid memory swappiness range is 0-100", swappiness) 1060 } 1061 } 1062 } 1063 if config.Resources.MemoryReservation > 0 && !sysInfo.MemoryReservation { 1064 warnings = addWarning(warnings, "Your kernel does not support memory soft limit capabilities or the cgroup is not mounted. Limitation discarded.") 1065 config.Resources.MemoryReservation = 0 1066 } 1067 if config.Resources.Memory > 0 && config.Resources.MemoryReservation > 0 && config.Resources.Memory < config.Resources.MemoryReservation { 1068 return warnings, fmt.Errorf("minimum memory limit cannot be less than memory reservation limit, see usage") 1069 } 1070 if config.Resources.KernelMemory > 0 && !sysInfo.KernelMemory { 1071 warnings = addWarning(warnings, "Your kernel does not support kernel memory limit capabilities or the cgroup is not mounted. Limitation discarded.") 1072 config.Resources.KernelMemory = 0 1073 } 1074 if config.Resources.DisableOomKiller && !sysInfo.OomKillDisable { 1075 // only produce warnings if the setting wasn't to *disable* the OOM Kill; no point 1076 // warning the caller if they already wanted the feature to be off 1077 warnings = addWarning(warnings, "Your kernel does not support OomKillDisable. OomKillDisable discarded.") 1078 config.Resources.DisableOomKiller = false 1079 } 1080 1081 if config.Resources.PidsLimit != 0 && !sysInfo.PidsLimit { 1082 warnings = addWarning(warnings, "Your kernel does not support pids limit capabilities or the cgroup is not mounted. PIDs limit discarded.") 1083 config.Resources.PidsLimit = 0 1084 } 1085 1086 if config.Resources.CPUShares > 0 && !sysInfo.CPUShares { 1087 warnings = addWarning(warnings, "Your kernel does not support CPU shares or the cgroup is not mounted. Shares discarded.") 1088 config.Resources.CPUShares = 0 1089 } 1090 if config.Resources.CPUPeriod > 0 && !sysInfo.CPUCfsPeriod { 1091 warnings = addWarning(warnings, "Your kernel does not support CPU cfs period or the cgroup is not mounted. Period discarded.") 1092 config.Resources.CPUPeriod = 0 1093 } 1094 if config.Resources.CPUPeriod != 0 && (config.Resources.CPUPeriod < 1000 || config.Resources.CPUPeriod > 1000000) { 1095 return warnings, fmt.Errorf("CPU cfs period cannot be less than 1ms (i.e. 1000) or larger than 1s (i.e. 1000000)") 1096 } 1097 if config.Resources.CPUQuota > 0 && !sysInfo.CPUCfsQuota { 1098 warnings = addWarning(warnings, "Your kernel does not support CPU cfs quota or the cgroup is not mounted. Quota discarded.") 1099 config.Resources.CPUQuota = 0 1100 } 1101 if config.Resources.CPUQuota > 0 && config.Resources.CPUQuota < 1000 { 1102 return warnings, fmt.Errorf("CPU cfs quota cannot be less than 1ms (i.e. 1000)") 1103 } 1104 // cpuset subsystem checks and adjustments 1105 if (config.Resources.CPUsetCPUs != "" || config.Resources.CPUsetMems != "") && !sysInfo.Cpuset { 1106 warnings = addWarning(warnings, "Your kernel does not support cpuset or the cgroup is not mounted. CPUset discarded.") 1107 config.Resources.CPUsetCPUs = "" 1108 config.Resources.CPUsetMems = "" 1109 } 1110 cpusAvailable, err := sysInfo.IsCpusetCpusAvailable(config.Resources.CPUsetCPUs) 1111 if err != nil { 1112 return warnings, fmt.Errorf("invalid value %s for cpuset cpus", config.Resources.CPUsetCPUs) 1113 } 1114 if !cpusAvailable { 1115 return warnings, fmt.Errorf("requested CPUs are not available - requested %s, available: %s", config.Resources.CPUsetCPUs, sysInfo.Cpus) 1116 } 1117 memsAvailable, err := sysInfo.IsCpusetMemsAvailable(config.Resources.CPUsetMems) 1118 if err != nil { 1119 return warnings, fmt.Errorf("invalid value %s for cpuset mems", config.Resources.CPUsetMems) 1120 } 1121 if !memsAvailable { 1122 return warnings, fmt.Errorf("requested memory nodes are not available - requested %s, available: %s", config.Resources.CPUsetMems, sysInfo.Mems) 1123 } 1124 1125 // blkio subsystem checks and adjustments 1126 if config.Resources.BlkioWeight > 0 && !sysInfo.BlkioWeight { 1127 warnings = addWarning(warnings, "Your kernel does not support Block I/O weight or the cgroup is not mounted. Weight discarded.") 1128 config.Resources.BlkioWeight = 0 1129 } 1130 if config.Resources.BlkioWeight > 0 && (config.Resources.BlkioWeight < 10 || config.Resources.BlkioWeight > 1000) { 1131 return warnings, fmt.Errorf("range of blkio weight is from 10 to 1000") 1132 } 1133 if len(config.Resources.BlkioWeightDevice) > 0 && !sysInfo.BlkioWeightDevice { 1134 warnings = addWarning(warnings, "Your kernel does not support Block I/O weight_device or the cgroup is not mounted. Weight-device discarded.") 1135 config.Resources.BlkioWeightDevice = []string{} 1136 } 1137 if len(config.Resources.DeviceReadBps) > 0 && !sysInfo.BlkioReadBpsDevice { 1138 warnings = addWarning(warnings, "Your kernel does not support BPS Block I/O read limit or the cgroup is not mounted. Block I/O BPS read limit discarded") 1139 config.Resources.DeviceReadBps = []string{} 1140 } 1141 if len(config.Resources.DeviceWriteBps) > 0 && !sysInfo.BlkioWriteBpsDevice { 1142 warnings = addWarning(warnings, "Your kernel does not support BPS Block I/O write limit or the cgroup is not mounted. Block I/O BPS write limit discarded.") 1143 config.Resources.DeviceWriteBps = []string{} 1144 } 1145 if len(config.Resources.DeviceReadIOps) > 0 && !sysInfo.BlkioReadIOpsDevice { 1146 warnings = addWarning(warnings, "Your kernel does not support IOPS Block read limit or the cgroup is not mounted. Block I/O IOPS read limit discarded.") 1147 config.Resources.DeviceReadIOps = []string{} 1148 } 1149 if len(config.Resources.DeviceWriteIOps) > 0 && !sysInfo.BlkioWriteIOpsDevice { 1150 warnings = addWarning(warnings, "Your kernel does not support IOPS Block I/O write limit or the cgroup is not mounted. Block I/O IOPS write limit discarded.") 1151 config.Resources.DeviceWriteIOps = []string{} 1152 } 1153 1154 return warnings, nil 1155 }