github.com/demonoid81/moby@v0.0.0-20200517203328-62dd8e17c460/daemon/config/config.go (about) 1 package config // import "github.com/demonoid81/moby/daemon/config" 2 3 import ( 4 "bytes" 5 "encoding/json" 6 "fmt" 7 "io" 8 "io/ioutil" 9 "net" 10 "os" 11 "reflect" 12 "strings" 13 "sync" 14 15 daemondiscovery "github.com/demonoid81/moby/daemon/discovery" 16 "github.com/demonoid81/moby/opts" 17 "github.com/demonoid81/moby/pkg/authorization" 18 "github.com/demonoid81/moby/pkg/discovery" 19 "github.com/demonoid81/moby/registry" 20 "github.com/imdario/mergo" 21 "github.com/pkg/errors" 22 "github.com/sirupsen/logrus" 23 "github.com/spf13/pflag" 24 ) 25 26 const ( 27 // DefaultMaxConcurrentDownloads is the default value for 28 // maximum number of downloads that 29 // may take place at a time for each pull. 30 DefaultMaxConcurrentDownloads = 3 31 // DefaultMaxConcurrentUploads is the default value for 32 // maximum number of uploads that 33 // may take place at a time for each push. 34 DefaultMaxConcurrentUploads = 5 35 // DefaultDownloadAttempts is the default value for 36 // maximum number of attempts that 37 // may take place at a time for each pull when the connection is lost. 38 DefaultDownloadAttempts = 5 39 // StockRuntimeName is the reserved name/alias used to represent the 40 // OCI runtime being shipped with the docker daemon package. 41 StockRuntimeName = "runc" 42 // DefaultShmSize is the default value for container's shm size 43 DefaultShmSize = int64(67108864) 44 // DefaultNetworkMtu is the default value for network MTU 45 DefaultNetworkMtu = 1500 46 // DisableNetworkBridge is the default value of the option to disable network bridge 47 DisableNetworkBridge = "none" 48 // DefaultInitBinary is the name of the default init binary 49 DefaultInitBinary = "docker-init" 50 ) 51 52 // flatOptions contains configuration keys 53 // that MUST NOT be parsed as deep structures. 54 // Use this to differentiate these options 55 // with others like the ones in CommonTLSOptions. 56 var flatOptions = map[string]bool{ 57 "cluster-store-opts": true, 58 "log-opts": true, 59 "runtimes": true, 60 "default-ulimits": true, 61 "features": true, 62 "builder": true, 63 } 64 65 // skipValidateOptions contains configuration keys 66 // that will be skipped from findConfigurationConflicts 67 // for unknown flag validation. 68 var skipValidateOptions = map[string]bool{ 69 "features": true, 70 "builder": true, 71 // Corresponding flag has been removed because it was already unusable 72 "deprecated-key-path": true, 73 } 74 75 // skipDuplicates contains configuration keys that 76 // will be skipped when checking duplicated 77 // configuration field defined in both daemon 78 // config file and from dockerd cli flags. 79 // This allows some configurations to be merged 80 // during the parsing. 81 var skipDuplicates = map[string]bool{ 82 "runtimes": true, 83 } 84 85 // LogConfig represents the default log configuration. 86 // It includes json tags to deserialize configuration from a file 87 // using the same names that the flags in the command line use. 88 type LogConfig struct { 89 Type string `json:"log-driver,omitempty"` 90 Config map[string]string `json:"log-opts,omitempty"` 91 } 92 93 // commonBridgeConfig stores all the platform-common bridge driver specific 94 // configuration. 95 type commonBridgeConfig struct { 96 Iface string `json:"bridge,omitempty"` 97 FixedCIDR string `json:"fixed-cidr,omitempty"` 98 } 99 100 // NetworkConfig stores the daemon-wide networking configurations 101 type NetworkConfig struct { 102 // Default address pools for docker networks 103 DefaultAddressPools opts.PoolsOpt `json:"default-address-pools,omitempty"` 104 // NetworkControlPlaneMTU allows to specify the control plane MTU, this will allow to optimize the network use in some components 105 NetworkControlPlaneMTU int `json:"network-control-plane-mtu,omitempty"` 106 } 107 108 // CommonTLSOptions defines TLS configuration for the daemon server. 109 // It includes json tags to deserialize configuration from a file 110 // using the same names that the flags in the command line use. 111 type CommonTLSOptions struct { 112 CAFile string `json:"tlscacert,omitempty"` 113 CertFile string `json:"tlscert,omitempty"` 114 KeyFile string `json:"tlskey,omitempty"` 115 } 116 117 // DNSConfig defines the DNS configurations. 118 type DNSConfig struct { 119 DNS []string `json:"dns,omitempty"` 120 DNSOptions []string `json:"dns-opts,omitempty"` 121 DNSSearch []string `json:"dns-search,omitempty"` 122 HostGatewayIP net.IP `json:"host-gateway-ip,omitempty"` 123 } 124 125 // CommonConfig defines the configuration of a docker daemon which is 126 // common across platforms. 127 // It includes json tags to deserialize configuration from a file 128 // using the same names that the flags in the command line use. 129 type CommonConfig struct { 130 AuthzMiddleware *authorization.Middleware `json:"-"` 131 AuthorizationPlugins []string `json:"authorization-plugins,omitempty"` // AuthorizationPlugins holds list of authorization plugins 132 AutoRestart bool `json:"-"` 133 Context map[string][]string `json:"-"` 134 DisableBridge bool `json:"-"` 135 ExecOptions []string `json:"exec-opts,omitempty"` 136 GraphDriver string `json:"storage-driver,omitempty"` 137 GraphOptions []string `json:"storage-opts,omitempty"` 138 Labels []string `json:"labels,omitempty"` 139 Mtu int `json:"mtu,omitempty"` 140 NetworkDiagnosticPort int `json:"network-diagnostic-port,omitempty"` 141 Pidfile string `json:"pidfile,omitempty"` 142 RawLogs bool `json:"raw-logs,omitempty"` 143 RootDeprecated string `json:"graph,omitempty"` 144 Root string `json:"data-root,omitempty"` 145 ExecRoot string `json:"exec-root,omitempty"` 146 SocketGroup string `json:"group,omitempty"` 147 CorsHeaders string `json:"api-cors-header,omitempty"` 148 149 // TrustKeyPath is used to generate the daemon ID and for signing schema 1 manifests 150 // when pushing to a registry which does not support schema 2. This field is marked as 151 // deprecated because schema 1 manifests are deprecated in favor of schema 2 and the 152 // daemon ID will use a dedicated identifier not shared with exported signatures. 153 TrustKeyPath string `json:"deprecated-key-path,omitempty"` 154 155 // LiveRestoreEnabled determines whether we should keep containers 156 // alive upon daemon shutdown/start 157 LiveRestoreEnabled bool `json:"live-restore,omitempty"` 158 159 // ClusterStore is the storage backend used for the cluster information. It is used by both 160 // multihost networking (to store networks and endpoints information) and by the node discovery 161 // mechanism. 162 // Deprecated: host-discovery and overlay networks with external k/v stores are deprecated 163 ClusterStore string `json:"cluster-store,omitempty"` 164 165 // ClusterOpts is used to pass options to the discovery package for tuning libkv settings, such 166 // as TLS configuration settings. 167 // Deprecated: host-discovery and overlay networks with external k/v stores are deprecated 168 ClusterOpts map[string]string `json:"cluster-store-opts,omitempty"` 169 170 // ClusterAdvertise is the network endpoint that the Engine advertises for the purpose of node 171 // discovery. This should be a 'host:port' combination on which that daemon instance is 172 // reachable by other hosts. 173 // Deprecated: host-discovery and overlay networks with external k/v stores are deprecated 174 ClusterAdvertise string `json:"cluster-advertise,omitempty"` 175 176 // MaxConcurrentDownloads is the maximum number of downloads that 177 // may take place at a time for each pull. 178 MaxConcurrentDownloads *int `json:"max-concurrent-downloads,omitempty"` 179 180 // MaxConcurrentUploads is the maximum number of uploads that 181 // may take place at a time for each push. 182 MaxConcurrentUploads *int `json:"max-concurrent-uploads,omitempty"` 183 184 // MaxDownloadAttempts is the maximum number of attempts that 185 // may take place at a time for each push. 186 MaxDownloadAttempts *int `json:"max-download-attempts,omitempty"` 187 188 // ShutdownTimeout is the timeout value (in seconds) the daemon will wait for the container 189 // to stop when daemon is being shutdown 190 ShutdownTimeout int `json:"shutdown-timeout,omitempty"` 191 192 Debug bool `json:"debug,omitempty"` 193 Hosts []string `json:"hosts,omitempty"` 194 LogLevel string `json:"log-level,omitempty"` 195 TLS bool `json:"tls,omitempty"` 196 TLSVerify bool `json:"tlsverify,omitempty"` 197 198 // Embedded structs that allow config 199 // deserialization without the full struct. 200 CommonTLSOptions 201 202 // SwarmDefaultAdvertiseAddr is the default host/IP or network interface 203 // to use if a wildcard address is specified in the ListenAddr value 204 // given to the /swarm/init endpoint and no advertise address is 205 // specified. 206 SwarmDefaultAdvertiseAddr string `json:"swarm-default-advertise-addr"` 207 208 // SwarmRaftHeartbeatTick is the number of ticks in time for swarm mode raft quorum heartbeat 209 // Typical value is 1 210 SwarmRaftHeartbeatTick uint32 `json:"swarm-raft-heartbeat-tick"` 211 212 // SwarmRaftElectionTick is the number of ticks to elapse before followers in the quorum can propose 213 // a new round of leader election. Default, recommended value is at least 10X that of Heartbeat tick. 214 // Higher values can make the quorum less sensitive to transient faults in the environment, but this also 215 // means it takes longer for the managers to detect a down leader. 216 SwarmRaftElectionTick uint32 `json:"swarm-raft-election-tick"` 217 218 MetricsAddress string `json:"metrics-addr"` 219 220 DNSConfig 221 LogConfig 222 BridgeConfig // bridgeConfig holds bridge network specific configuration. 223 NetworkConfig 224 registry.ServiceOptions 225 226 sync.Mutex 227 // FIXME(vdemeester) This part is not that clear and is mainly dependent on cli flags 228 // It should probably be handled outside this package. 229 ValuesSet map[string]interface{} `json:"-"` 230 231 Experimental bool `json:"experimental"` // Experimental indicates whether experimental features should be exposed or not 232 233 // Exposed node Generic Resources 234 // e.g: ["orange=red", "orange=green", "orange=blue", "apple=3"] 235 NodeGenericResources []string `json:"node-generic-resources,omitempty"` 236 237 // ContainerAddr is the address used to connect to containerd if we're 238 // not starting it ourselves 239 ContainerdAddr string `json:"containerd,omitempty"` 240 241 // CriContainerd determines whether a supervised containerd instance 242 // should be configured with the CRI plugin enabled. This allows using 243 // Docker's containerd instance directly with a Kubernetes kubelet. 244 CriContainerd bool `json:"cri-containerd,omitempty"` 245 246 // Features contains a list of feature key value pairs indicating what features are enabled or disabled. 247 // If a certain feature doesn't appear in this list then it's unset (i.e. neither true nor false). 248 Features map[string]bool `json:"features,omitempty"` 249 250 Builder BuilderConfig `json:"builder,omitempty"` 251 252 ContainerdNamespace string `json:"containerd-namespace,omitempty"` 253 ContainerdPluginNamespace string `json:"containerd-plugin-namespace,omitempty"` 254 } 255 256 // IsValueSet returns true if a configuration value 257 // was explicitly set in the configuration file. 258 func (conf *Config) IsValueSet(name string) bool { 259 if conf.ValuesSet == nil { 260 return false 261 } 262 _, ok := conf.ValuesSet[name] 263 return ok 264 } 265 266 // New returns a new fully initialized Config struct 267 func New() *Config { 268 config := Config{} 269 config.LogConfig.Config = make(map[string]string) 270 config.ClusterOpts = make(map[string]string) 271 return &config 272 } 273 274 // ParseClusterAdvertiseSettings parses the specified advertise settings 275 func ParseClusterAdvertiseSettings(clusterStore, clusterAdvertise string) (string, error) { 276 if clusterAdvertise == "" { 277 return "", daemondiscovery.ErrDiscoveryDisabled 278 } 279 if clusterStore == "" { 280 return "", errors.New("invalid cluster configuration. --cluster-advertise must be accompanied by --cluster-store configuration") 281 } 282 283 advertise, err := discovery.ParseAdvertise(clusterAdvertise) 284 if err != nil { 285 return "", errors.Wrap(err, "discovery advertise parsing failed") 286 } 287 return advertise, nil 288 } 289 290 // GetConflictFreeLabels validates Labels for conflict 291 // In swarm the duplicates for labels are removed 292 // so we only take same values here, no conflict values 293 // If the key-value is the same we will only take the last label 294 func GetConflictFreeLabels(labels []string) ([]string, error) { 295 labelMap := map[string]string{} 296 for _, label := range labels { 297 stringSlice := strings.SplitN(label, "=", 2) 298 if len(stringSlice) > 1 { 299 // If there is a conflict we will return an error 300 if v, ok := labelMap[stringSlice[0]]; ok && v != stringSlice[1] { 301 return nil, fmt.Errorf("conflict labels for %s=%s and %s=%s", stringSlice[0], stringSlice[1], stringSlice[0], v) 302 } 303 labelMap[stringSlice[0]] = stringSlice[1] 304 } 305 } 306 307 newLabels := []string{} 308 for k, v := range labelMap { 309 newLabels = append(newLabels, fmt.Sprintf("%s=%s", k, v)) 310 } 311 return newLabels, nil 312 } 313 314 // Reload reads the configuration in the host and reloads the daemon and server. 315 func Reload(configFile string, flags *pflag.FlagSet, reload func(*Config)) error { 316 logrus.Infof("Got signal to reload configuration, reloading from: %s", configFile) 317 newConfig, err := getConflictFreeConfiguration(configFile, flags) 318 if err != nil { 319 if flags.Changed("config-file") || !os.IsNotExist(err) { 320 return errors.Wrapf(err, "unable to configure the Docker daemon with file %s", configFile) 321 } 322 newConfig = New() 323 } 324 325 if err := Validate(newConfig); err != nil { 326 return errors.Wrap(err, "file configuration validation failed") 327 } 328 329 // Check if duplicate label-keys with different values are found 330 newLabels, err := GetConflictFreeLabels(newConfig.Labels) 331 if err != nil { 332 return err 333 } 334 newConfig.Labels = newLabels 335 336 reload(newConfig) 337 return nil 338 } 339 340 // boolValue is an interface that boolean value flags implement 341 // to tell the command line how to make -name equivalent to -name=true. 342 type boolValue interface { 343 IsBoolFlag() bool 344 } 345 346 // MergeDaemonConfigurations reads a configuration file, 347 // loads the file configuration in an isolated structure, 348 // and merges the configuration provided from flags on top 349 // if there are no conflicts. 350 func MergeDaemonConfigurations(flagsConfig *Config, flags *pflag.FlagSet, configFile string) (*Config, error) { 351 fileConfig, err := getConflictFreeConfiguration(configFile, flags) 352 if err != nil { 353 return nil, err 354 } 355 356 if err := Validate(fileConfig); err != nil { 357 return nil, errors.Wrap(err, "configuration validation from file failed") 358 } 359 360 // merge flags configuration on top of the file configuration 361 if err := mergo.Merge(fileConfig, flagsConfig); err != nil { 362 return nil, err 363 } 364 365 // We need to validate again once both fileConfig and flagsConfig 366 // have been merged 367 if err := Validate(fileConfig); err != nil { 368 return nil, errors.Wrap(err, "merged configuration validation from file and command line flags failed") 369 } 370 371 return fileConfig, nil 372 } 373 374 // getConflictFreeConfiguration loads the configuration from a JSON file. 375 // It compares that configuration with the one provided by the flags, 376 // and returns an error if there are conflicts. 377 func getConflictFreeConfiguration(configFile string, flags *pflag.FlagSet) (*Config, error) { 378 b, err := ioutil.ReadFile(configFile) 379 if err != nil { 380 return nil, err 381 } 382 383 var config Config 384 var reader io.Reader 385 if flags != nil { 386 var jsonConfig map[string]interface{} 387 reader = bytes.NewReader(b) 388 if err := json.NewDecoder(reader).Decode(&jsonConfig); err != nil { 389 return nil, err 390 } 391 392 configSet := configValuesSet(jsonConfig) 393 394 if err := findConfigurationConflicts(configSet, flags); err != nil { 395 return nil, err 396 } 397 398 // Override flag values to make sure the values set in the config file with nullable values, like `false`, 399 // are not overridden by default truthy values from the flags that were not explicitly set. 400 // See https://github.com/demonoid81/moby/issues/20289 for an example. 401 // 402 // TODO: Rewrite configuration logic to avoid same issue with other nullable values, like numbers. 403 namedOptions := make(map[string]interface{}) 404 for key, value := range configSet { 405 f := flags.Lookup(key) 406 if f == nil { // ignore named flags that don't match 407 namedOptions[key] = value 408 continue 409 } 410 411 if _, ok := f.Value.(boolValue); ok { 412 f.Value.Set(fmt.Sprintf("%v", value)) 413 } 414 } 415 if len(namedOptions) > 0 { 416 // set also default for mergeVal flags that are boolValue at the same time. 417 flags.VisitAll(func(f *pflag.Flag) { 418 if opt, named := f.Value.(opts.NamedOption); named { 419 v, set := namedOptions[opt.Name()] 420 _, boolean := f.Value.(boolValue) 421 if set && boolean { 422 f.Value.Set(fmt.Sprintf("%v", v)) 423 } 424 } 425 }) 426 } 427 428 config.ValuesSet = configSet 429 } 430 431 reader = bytes.NewReader(b) 432 if err := json.NewDecoder(reader).Decode(&config); err != nil { 433 return nil, err 434 } 435 436 if config.RootDeprecated != "" { 437 logrus.Warn(`The "graph" config file option is deprecated. Please use "data-root" instead.`) 438 439 if config.Root != "" { 440 return nil, errors.New(`cannot specify both "graph" and "data-root" config file options`) 441 } 442 443 config.Root = config.RootDeprecated 444 } 445 446 return &config, nil 447 } 448 449 // configValuesSet returns the configuration values explicitly set in the file. 450 func configValuesSet(config map[string]interface{}) map[string]interface{} { 451 flatten := make(map[string]interface{}) 452 for k, v := range config { 453 if m, isMap := v.(map[string]interface{}); isMap && !flatOptions[k] { 454 for km, vm := range m { 455 flatten[km] = vm 456 } 457 continue 458 } 459 460 flatten[k] = v 461 } 462 return flatten 463 } 464 465 // findConfigurationConflicts iterates over the provided flags searching for 466 // duplicated configurations and unknown keys. It returns an error with all the conflicts if 467 // it finds any. 468 func findConfigurationConflicts(config map[string]interface{}, flags *pflag.FlagSet) error { 469 // 1. Search keys from the file that we don't recognize as flags. 470 unknownKeys := make(map[string]interface{}) 471 for key, value := range config { 472 if flag := flags.Lookup(key); flag == nil && !skipValidateOptions[key] { 473 unknownKeys[key] = value 474 } 475 } 476 477 // 2. Discard values that implement NamedOption. 478 // Their configuration name differs from their flag name, like `labels` and `label`. 479 if len(unknownKeys) > 0 { 480 unknownNamedConflicts := func(f *pflag.Flag) { 481 if namedOption, ok := f.Value.(opts.NamedOption); ok { 482 delete(unknownKeys, namedOption.Name()) 483 } 484 } 485 flags.VisitAll(unknownNamedConflicts) 486 } 487 488 if len(unknownKeys) > 0 { 489 var unknown []string 490 for key := range unknownKeys { 491 unknown = append(unknown, key) 492 } 493 return fmt.Errorf("the following directives don't match any configuration option: %s", strings.Join(unknown, ", ")) 494 } 495 496 var conflicts []string 497 printConflict := func(name string, flagValue, fileValue interface{}) string { 498 return fmt.Sprintf("%s: (from flag: %v, from file: %v)", name, flagValue, fileValue) 499 } 500 501 // 3. Search keys that are present as a flag and as a file option. 502 duplicatedConflicts := func(f *pflag.Flag) { 503 // search option name in the json configuration payload if the value is a named option 504 if namedOption, ok := f.Value.(opts.NamedOption); ok { 505 if optsValue, ok := config[namedOption.Name()]; ok && !skipDuplicates[namedOption.Name()] { 506 conflicts = append(conflicts, printConflict(namedOption.Name(), f.Value.String(), optsValue)) 507 } 508 } else { 509 // search flag name in the json configuration payload 510 for _, name := range []string{f.Name, f.Shorthand} { 511 if value, ok := config[name]; ok && !skipDuplicates[name] { 512 conflicts = append(conflicts, printConflict(name, f.Value.String(), value)) 513 break 514 } 515 } 516 } 517 } 518 519 flags.Visit(duplicatedConflicts) 520 521 if len(conflicts) > 0 { 522 return fmt.Errorf("the following directives are specified both as a flag and in the configuration file: %s", strings.Join(conflicts, ", ")) 523 } 524 return nil 525 } 526 527 // Validate validates some specific configs. 528 // such as config.DNS, config.Labels, config.DNSSearch, 529 // as well as config.MaxConcurrentDownloads, config.MaxConcurrentUploads and config.MaxDownloadAttempts. 530 func Validate(config *Config) error { 531 // validate DNS 532 for _, dns := range config.DNS { 533 if _, err := opts.ValidateIPAddress(dns); err != nil { 534 return err 535 } 536 } 537 538 // validate DNSSearch 539 for _, dnsSearch := range config.DNSSearch { 540 if _, err := opts.ValidateDNSSearch(dnsSearch); err != nil { 541 return err 542 } 543 } 544 545 // validate Labels 546 for _, label := range config.Labels { 547 if _, err := opts.ValidateLabel(label); err != nil { 548 return err 549 } 550 } 551 // validate MaxConcurrentDownloads 552 if config.MaxConcurrentDownloads != nil && *config.MaxConcurrentDownloads < 0 { 553 return fmt.Errorf("invalid max concurrent downloads: %d", *config.MaxConcurrentDownloads) 554 } 555 // validate MaxConcurrentUploads 556 if config.MaxConcurrentUploads != nil && *config.MaxConcurrentUploads < 0 { 557 return fmt.Errorf("invalid max concurrent uploads: %d", *config.MaxConcurrentUploads) 558 } 559 if err := ValidateMaxDownloadAttempts(config); err != nil { 560 return err 561 } 562 563 // validate that "default" runtime is not reset 564 if runtimes := config.GetAllRuntimes(); len(runtimes) > 0 { 565 if _, ok := runtimes[StockRuntimeName]; ok { 566 return fmt.Errorf("runtime name '%s' is reserved", StockRuntimeName) 567 } 568 } 569 570 if _, err := ParseGenericResources(config.NodeGenericResources); err != nil { 571 return err 572 } 573 574 if defaultRuntime := config.GetDefaultRuntimeName(); defaultRuntime != "" && defaultRuntime != StockRuntimeName { 575 runtimes := config.GetAllRuntimes() 576 if _, ok := runtimes[defaultRuntime]; !ok { 577 return fmt.Errorf("specified default runtime '%s' does not exist", defaultRuntime) 578 } 579 } 580 581 // validate platform-specific settings 582 return config.ValidatePlatformConfig() 583 } 584 585 // ValidateMaxDownloadAttempts validates if the max-download-attempts is within the valid range 586 func ValidateMaxDownloadAttempts(config *Config) error { 587 if config.MaxDownloadAttempts != nil && *config.MaxDownloadAttempts <= 0 { 588 return fmt.Errorf("invalid max download attempts: %d", *config.MaxDownloadAttempts) 589 } 590 return nil 591 } 592 593 // ModifiedDiscoverySettings returns whether the discovery configuration has been modified or not. 594 func ModifiedDiscoverySettings(config *Config, backendType, advertise string, clusterOpts map[string]string) bool { 595 if config.ClusterStore != backendType || config.ClusterAdvertise != advertise { 596 return true 597 } 598 599 if (config.ClusterOpts == nil && clusterOpts == nil) || 600 (config.ClusterOpts == nil && len(clusterOpts) == 0) || 601 (len(config.ClusterOpts) == 0 && clusterOpts == nil) { 602 return false 603 } 604 605 return !reflect.DeepEqual(config.ClusterOpts, clusterOpts) 606 }