github.com/jiasir/docker@v1.3.3-0.20170609024000-252e610103e7/plugin/manager.go (about) 1 package plugin 2 3 import ( 4 "encoding/json" 5 "io" 6 "io/ioutil" 7 "os" 8 "path/filepath" 9 "reflect" 10 "regexp" 11 "sort" 12 "strings" 13 "sync" 14 15 "github.com/Sirupsen/logrus" 16 "github.com/docker/distribution/reference" 17 "github.com/docker/docker/api/types" 18 "github.com/docker/docker/image" 19 "github.com/docker/docker/layer" 20 "github.com/docker/docker/libcontainerd" 21 "github.com/docker/docker/pkg/authorization" 22 "github.com/docker/docker/pkg/ioutils" 23 "github.com/docker/docker/pkg/mount" 24 "github.com/docker/docker/plugin/v2" 25 "github.com/docker/docker/registry" 26 "github.com/opencontainers/go-digest" 27 "github.com/pkg/errors" 28 ) 29 30 const configFileName = "config.json" 31 const rootFSFileName = "rootfs" 32 33 var validFullID = regexp.MustCompile(`^([a-f0-9]{64})$`) 34 35 func (pm *Manager) restorePlugin(p *v2.Plugin) error { 36 if p.IsEnabled() { 37 return pm.restore(p) 38 } 39 return nil 40 } 41 42 type eventLogger func(id, name, action string) 43 44 // ManagerConfig defines configuration needed to start new manager. 45 type ManagerConfig struct { 46 Store *Store // remove 47 Executor libcontainerd.Remote 48 RegistryService registry.Service 49 LiveRestoreEnabled bool // TODO: remove 50 LogPluginEvent eventLogger 51 Root string 52 ExecRoot string 53 AuthzMiddleware *authorization.Middleware 54 } 55 56 // Manager controls the plugin subsystem. 57 type Manager struct { 58 config ManagerConfig 59 mu sync.RWMutex // protects cMap 60 muGC sync.RWMutex // protects blobstore deletions 61 cMap map[*v2.Plugin]*controller 62 containerdClient libcontainerd.Client 63 blobStore *basicBlobStore 64 } 65 66 // controller represents the manager's control on a plugin. 67 type controller struct { 68 restart bool 69 exitChan chan bool 70 timeoutInSecs int 71 } 72 73 // pluginRegistryService ensures that all resolved repositories 74 // are of the plugin class. 75 type pluginRegistryService struct { 76 registry.Service 77 } 78 79 func (s pluginRegistryService) ResolveRepository(name reference.Named) (repoInfo *registry.RepositoryInfo, err error) { 80 repoInfo, err = s.Service.ResolveRepository(name) 81 if repoInfo != nil { 82 repoInfo.Class = "plugin" 83 } 84 return 85 } 86 87 // NewManager returns a new plugin manager. 88 func NewManager(config ManagerConfig) (*Manager, error) { 89 if config.RegistryService != nil { 90 config.RegistryService = pluginRegistryService{config.RegistryService} 91 } 92 manager := &Manager{ 93 config: config, 94 } 95 if err := os.MkdirAll(manager.config.Root, 0700); err != nil { 96 return nil, errors.Wrapf(err, "failed to mkdir %v", manager.config.Root) 97 } 98 if err := os.MkdirAll(manager.config.ExecRoot, 0700); err != nil { 99 return nil, errors.Wrapf(err, "failed to mkdir %v", manager.config.ExecRoot) 100 } 101 if err := os.MkdirAll(manager.tmpDir(), 0700); err != nil { 102 return nil, errors.Wrapf(err, "failed to mkdir %v", manager.tmpDir()) 103 } 104 var err error 105 manager.containerdClient, err = config.Executor.Client(manager) // todo: move to another struct 106 if err != nil { 107 return nil, errors.Wrap(err, "failed to create containerd client") 108 } 109 manager.blobStore, err = newBasicBlobStore(filepath.Join(manager.config.Root, "storage/blobs")) 110 if err != nil { 111 return nil, err 112 } 113 114 manager.cMap = make(map[*v2.Plugin]*controller) 115 if err := manager.reload(); err != nil { 116 return nil, errors.Wrap(err, "failed to restore plugins") 117 } 118 return manager, nil 119 } 120 121 func (pm *Manager) tmpDir() string { 122 return filepath.Join(pm.config.Root, "tmp") 123 } 124 125 // StateChanged updates plugin internals using libcontainerd events. 126 func (pm *Manager) StateChanged(id string, e libcontainerd.StateInfo) error { 127 logrus.Debugf("plugin state changed %s %#v", id, e) 128 129 switch e.State { 130 case libcontainerd.StateExit: 131 p, err := pm.config.Store.GetV2Plugin(id) 132 if err != nil { 133 return err 134 } 135 136 os.RemoveAll(filepath.Join(pm.config.ExecRoot, id)) 137 138 if p.PropagatedMount != "" { 139 if err := mount.Unmount(p.PropagatedMount); err != nil { 140 logrus.Warnf("Could not unmount %s: %v", p.PropagatedMount, err) 141 } 142 propRoot := filepath.Join(filepath.Dir(p.Rootfs), "propagated-mount") 143 if err := mount.Unmount(propRoot); err != nil { 144 logrus.Warn("Could not unmount %s: %v", propRoot, err) 145 } 146 } 147 148 pm.mu.RLock() 149 c := pm.cMap[p] 150 if c.exitChan != nil { 151 close(c.exitChan) 152 } 153 restart := c.restart 154 pm.mu.RUnlock() 155 156 if restart { 157 pm.enable(p, c, true) 158 } 159 } 160 161 return nil 162 } 163 164 func (pm *Manager) reload() error { // todo: restore 165 dir, err := ioutil.ReadDir(pm.config.Root) 166 if err != nil { 167 return errors.Wrapf(err, "failed to read %v", pm.config.Root) 168 } 169 plugins := make(map[string]*v2.Plugin) 170 for _, v := range dir { 171 if validFullID.MatchString(v.Name()) { 172 p, err := pm.loadPlugin(v.Name()) 173 if err != nil { 174 return err 175 } 176 plugins[p.GetID()] = p 177 } 178 } 179 180 pm.config.Store.SetAll(plugins) 181 182 var wg sync.WaitGroup 183 wg.Add(len(plugins)) 184 for _, p := range plugins { 185 c := &controller{} // todo: remove this 186 pm.cMap[p] = c 187 go func(p *v2.Plugin) { 188 defer wg.Done() 189 if err := pm.restorePlugin(p); err != nil { 190 logrus.Errorf("failed to restore plugin '%s': %s", p.Name(), err) 191 return 192 } 193 194 if p.Rootfs != "" { 195 p.Rootfs = filepath.Join(pm.config.Root, p.PluginObj.ID, "rootfs") 196 } 197 198 // We should only enable rootfs propagation for certain plugin types that need it. 199 for _, typ := range p.PluginObj.Config.Interface.Types { 200 if (typ.Capability == "volumedriver" || typ.Capability == "graphdriver") && typ.Prefix == "docker" && strings.HasPrefix(typ.Version, "1.") { 201 if p.PluginObj.Config.PropagatedMount != "" { 202 propRoot := filepath.Join(filepath.Dir(p.Rootfs), "propagated-mount") 203 204 // check if we need to migrate an older propagated mount from before 205 // these mounts were stored outside the plugin rootfs 206 if _, err := os.Stat(propRoot); os.IsNotExist(err) { 207 if _, err := os.Stat(p.PropagatedMount); err == nil { 208 // make sure nothing is mounted here 209 // don't care about errors 210 mount.Unmount(p.PropagatedMount) 211 if err := os.Rename(p.PropagatedMount, propRoot); err != nil { 212 logrus.WithError(err).WithField("dir", propRoot).Error("error migrating propagated mount storage") 213 } 214 if err := os.MkdirAll(p.PropagatedMount, 0755); err != nil { 215 logrus.WithError(err).WithField("dir", p.PropagatedMount).Error("error migrating propagated mount storage") 216 } 217 } 218 } 219 220 if err := os.MkdirAll(propRoot, 0755); err != nil { 221 logrus.Errorf("failed to create PropagatedMount directory at %s: %v", propRoot, err) 222 } 223 // TODO: sanitize PropagatedMount and prevent breakout 224 p.PropagatedMount = filepath.Join(p.Rootfs, p.PluginObj.Config.PropagatedMount) 225 if err := os.MkdirAll(p.PropagatedMount, 0755); err != nil { 226 logrus.Errorf("failed to create PropagatedMount directory at %s: %v", p.PropagatedMount, err) 227 return 228 } 229 } 230 } 231 } 232 233 pm.save(p) 234 requiresManualRestore := !pm.config.LiveRestoreEnabled && p.IsEnabled() 235 236 if requiresManualRestore { 237 // if liveRestore is not enabled, the plugin will be stopped now so we should enable it 238 if err := pm.enable(p, c, true); err != nil { 239 logrus.Errorf("failed to enable plugin '%s': %s", p.Name(), err) 240 } 241 } 242 }(p) 243 } 244 wg.Wait() 245 return nil 246 } 247 248 func (pm *Manager) loadPlugin(id string) (*v2.Plugin, error) { 249 p := filepath.Join(pm.config.Root, id, configFileName) 250 dt, err := ioutil.ReadFile(p) 251 if err != nil { 252 return nil, errors.Wrapf(err, "error reading %v", p) 253 } 254 var plugin v2.Plugin 255 if err := json.Unmarshal(dt, &plugin); err != nil { 256 return nil, errors.Wrapf(err, "error decoding %v", p) 257 } 258 return &plugin, nil 259 } 260 261 func (pm *Manager) save(p *v2.Plugin) error { 262 pluginJSON, err := json.Marshal(p) 263 if err != nil { 264 return errors.Wrap(err, "failed to marshal plugin json") 265 } 266 if err := ioutils.AtomicWriteFile(filepath.Join(pm.config.Root, p.GetID(), configFileName), pluginJSON, 0600); err != nil { 267 return errors.Wrap(err, "failed to write atomically plugin json") 268 } 269 return nil 270 } 271 272 // GC cleans up unrefrenced blobs. This is recommended to run in a goroutine 273 func (pm *Manager) GC() { 274 pm.muGC.Lock() 275 defer pm.muGC.Unlock() 276 277 whitelist := make(map[digest.Digest]struct{}) 278 for _, p := range pm.config.Store.GetAll() { 279 whitelist[p.Config] = struct{}{} 280 for _, b := range p.Blobsums { 281 whitelist[b] = struct{}{} 282 } 283 } 284 285 pm.blobStore.gc(whitelist) 286 } 287 288 type logHook struct{ id string } 289 290 func (logHook) Levels() []logrus.Level { 291 return logrus.AllLevels 292 } 293 294 func (l logHook) Fire(entry *logrus.Entry) error { 295 entry.Data = logrus.Fields{"plugin": l.id} 296 return nil 297 } 298 299 func attachToLog(id string) func(libcontainerd.IOPipe) error { 300 return func(iop libcontainerd.IOPipe) error { 301 iop.Stdin.Close() 302 303 logger := logrus.New() 304 logger.Hooks.Add(logHook{id}) 305 // TODO: cache writer per id 306 w := logger.Writer() 307 go func() { 308 io.Copy(w, iop.Stdout) 309 }() 310 go func() { 311 // TODO: update logrus and use logger.WriterLevel 312 io.Copy(w, iop.Stderr) 313 }() 314 return nil 315 } 316 } 317 318 func validatePrivileges(requiredPrivileges, privileges types.PluginPrivileges) error { 319 if !isEqual(requiredPrivileges, privileges, isEqualPrivilege) { 320 return errors.New("incorrect privileges") 321 } 322 323 return nil 324 } 325 326 func isEqual(arrOne, arrOther types.PluginPrivileges, compare func(x, y types.PluginPrivilege) bool) bool { 327 if len(arrOne) != len(arrOther) { 328 return false 329 } 330 331 sort.Sort(arrOne) 332 sort.Sort(arrOther) 333 334 for i := 1; i < arrOne.Len(); i++ { 335 if !compare(arrOne[i], arrOther[i]) { 336 return false 337 } 338 } 339 340 return true 341 } 342 343 func isEqualPrivilege(a, b types.PluginPrivilege) bool { 344 if a.Name != b.Name { 345 return false 346 } 347 348 return reflect.DeepEqual(a.Value, b.Value) 349 } 350 351 func configToRootFS(c []byte) (*image.RootFS, error) { 352 var pluginConfig types.PluginConfig 353 if err := json.Unmarshal(c, &pluginConfig); err != nil { 354 return nil, err 355 } 356 // validation for empty rootfs is in distribution code 357 if pluginConfig.Rootfs == nil { 358 return nil, nil 359 } 360 361 return rootFSFromPlugin(pluginConfig.Rootfs), nil 362 } 363 364 func rootFSFromPlugin(pluginfs *types.PluginConfigRootfs) *image.RootFS { 365 rootFS := image.RootFS{ 366 Type: pluginfs.Type, 367 DiffIDs: make([]layer.DiffID, len(pluginfs.DiffIds)), 368 } 369 for i := range pluginfs.DiffIds { 370 rootFS.DiffIDs[i] = layer.DiffID(pluginfs.DiffIds[i]) 371 } 372 373 return &rootFS 374 }