github.com/olljanat/moby@v1.13.1/daemon/cluster/executor/container/container.go (about) 1 package container 2 3 import ( 4 "errors" 5 "fmt" 6 "net" 7 "strconv" 8 "strings" 9 "time" 10 11 "github.com/Sirupsen/logrus" 12 13 "github.com/docker/docker/api/types" 14 enginecontainer "github.com/docker/docker/api/types/container" 15 "github.com/docker/docker/api/types/events" 16 "github.com/docker/docker/api/types/filters" 17 enginemount "github.com/docker/docker/api/types/mount" 18 "github.com/docker/docker/api/types/network" 19 volumetypes "github.com/docker/docker/api/types/volume" 20 clustertypes "github.com/docker/docker/daemon/cluster/provider" 21 "github.com/docker/docker/reference" 22 "github.com/docker/go-connections/nat" 23 "github.com/docker/swarmkit/agent/exec" 24 "github.com/docker/swarmkit/api" 25 "github.com/docker/swarmkit/protobuf/ptypes" 26 "github.com/docker/swarmkit/template" 27 ) 28 29 const ( 30 // Explicitly use the kernel's default setting for CPU quota of 100ms. 31 // https://www.kernel.org/doc/Documentation/scheduler/sched-bwc.txt 32 cpuQuotaPeriod = 100 * time.Millisecond 33 34 // systemLabelPrefix represents the reserved namespace for system labels. 35 systemLabelPrefix = "com.docker.swarm" 36 ) 37 38 // containerConfig converts task properties into docker container compatible 39 // components. 40 type containerConfig struct { 41 task *api.Task 42 networksAttachments map[string]*api.NetworkAttachment 43 } 44 45 // newContainerConfig returns a validated container config. No methods should 46 // return an error if this function returns without error. 47 func newContainerConfig(t *api.Task) (*containerConfig, error) { 48 var c containerConfig 49 return &c, c.setTask(t) 50 } 51 52 func (c *containerConfig) setTask(t *api.Task) error { 53 if t.Spec.GetContainer() == nil && t.Spec.GetAttachment() == nil { 54 return exec.ErrRuntimeUnsupported 55 } 56 57 container := t.Spec.GetContainer() 58 if container != nil { 59 if container.Image == "" { 60 return ErrImageRequired 61 } 62 63 if err := validateMounts(container.Mounts); err != nil { 64 return err 65 } 66 } 67 68 // index the networks by name 69 c.networksAttachments = make(map[string]*api.NetworkAttachment, len(t.Networks)) 70 for _, attachment := range t.Networks { 71 c.networksAttachments[attachment.Network.Spec.Annotations.Name] = attachment 72 } 73 74 c.task = t 75 76 if t.Spec.GetContainer() != nil { 77 preparedSpec, err := template.ExpandContainerSpec(t) 78 if err != nil { 79 return err 80 } 81 c.task.Spec.Runtime = &api.TaskSpec_Container{ 82 Container: preparedSpec, 83 } 84 } 85 86 return nil 87 } 88 89 func (c *containerConfig) id() string { 90 attachment := c.task.Spec.GetAttachment() 91 if attachment == nil { 92 return "" 93 } 94 95 return attachment.ContainerID 96 } 97 98 func (c *containerConfig) taskID() string { 99 return c.task.ID 100 } 101 102 func (c *containerConfig) endpoint() *api.Endpoint { 103 return c.task.Endpoint 104 } 105 106 func (c *containerConfig) spec() *api.ContainerSpec { 107 return c.task.Spec.GetContainer() 108 } 109 110 func (c *containerConfig) nameOrID() string { 111 if c.task.Spec.GetContainer() != nil { 112 return c.name() 113 } 114 115 return c.id() 116 } 117 118 func (c *containerConfig) name() string { 119 if c.task.Annotations.Name != "" { 120 // if set, use the container Annotations.Name field, set in the orchestrator. 121 return c.task.Annotations.Name 122 } 123 124 slot := fmt.Sprint(c.task.Slot) 125 if slot == "" || c.task.Slot == 0 { 126 slot = c.task.NodeID 127 } 128 129 // fallback to service.slot.id. 130 return fmt.Sprintf("%s.%s.%s", c.task.ServiceAnnotations.Name, slot, c.task.ID) 131 } 132 133 func (c *containerConfig) image() string { 134 raw := c.spec().Image 135 ref, err := reference.ParseNamed(raw) 136 if err != nil { 137 return raw 138 } 139 return reference.WithDefaultTag(ref).String() 140 } 141 142 func (c *containerConfig) portBindings() nat.PortMap { 143 portBindings := nat.PortMap{} 144 if c.task.Endpoint == nil { 145 return portBindings 146 } 147 148 for _, portConfig := range c.task.Endpoint.Ports { 149 if portConfig.PublishMode != api.PublishModeHost { 150 continue 151 } 152 153 port := nat.Port(fmt.Sprintf("%d/%s", portConfig.TargetPort, strings.ToLower(portConfig.Protocol.String()))) 154 binding := []nat.PortBinding{ 155 {}, 156 } 157 158 if portConfig.PublishedPort != 0 { 159 binding[0].HostPort = strconv.Itoa(int(portConfig.PublishedPort)) 160 } 161 portBindings[port] = binding 162 } 163 164 return portBindings 165 } 166 167 func (c *containerConfig) exposedPorts() map[nat.Port]struct{} { 168 exposedPorts := make(map[nat.Port]struct{}) 169 if c.task.Endpoint == nil { 170 return exposedPorts 171 } 172 173 for _, portConfig := range c.task.Endpoint.Ports { 174 if portConfig.PublishMode != api.PublishModeHost { 175 continue 176 } 177 178 port := nat.Port(fmt.Sprintf("%d/%s", portConfig.TargetPort, strings.ToLower(portConfig.Protocol.String()))) 179 exposedPorts[port] = struct{}{} 180 } 181 182 return exposedPorts 183 } 184 185 func (c *containerConfig) config() *enginecontainer.Config { 186 config := &enginecontainer.Config{ 187 Labels: c.labels(), 188 Tty: c.spec().TTY, 189 OpenStdin: c.spec().OpenStdin, 190 User: c.spec().User, 191 Env: c.spec().Env, 192 Hostname: c.spec().Hostname, 193 WorkingDir: c.spec().Dir, 194 Image: c.image(), 195 ExposedPorts: c.exposedPorts(), 196 Healthcheck: c.healthcheck(), 197 } 198 199 if len(c.spec().Command) > 0 { 200 // If Command is provided, we replace the whole invocation with Command 201 // by replacing Entrypoint and specifying Cmd. Args is ignored in this 202 // case. 203 config.Entrypoint = append(config.Entrypoint, c.spec().Command...) 204 config.Cmd = append(config.Cmd, c.spec().Args...) 205 } else if len(c.spec().Args) > 0 { 206 // In this case, we assume the image has an Entrypoint and Args 207 // specifies the arguments for that entrypoint. 208 config.Cmd = c.spec().Args 209 } 210 211 return config 212 } 213 214 func (c *containerConfig) labels() map[string]string { 215 var ( 216 system = map[string]string{ 217 "task": "", // mark as cluster task 218 "task.id": c.task.ID, 219 "task.name": c.name(), 220 "node.id": c.task.NodeID, 221 "service.id": c.task.ServiceID, 222 "service.name": c.task.ServiceAnnotations.Name, 223 } 224 labels = make(map[string]string) 225 ) 226 227 // base labels are those defined in the spec. 228 for k, v := range c.spec().Labels { 229 labels[k] = v 230 } 231 232 // we then apply the overrides from the task, which may be set via the 233 // orchestrator. 234 for k, v := range c.task.Annotations.Labels { 235 labels[k] = v 236 } 237 238 // finally, we apply the system labels, which override all labels. 239 for k, v := range system { 240 labels[strings.Join([]string{systemLabelPrefix, k}, ".")] = v 241 } 242 243 return labels 244 } 245 246 func (c *containerConfig) mounts() []enginemount.Mount { 247 var r []enginemount.Mount 248 for _, mount := range c.spec().Mounts { 249 r = append(r, convertMount(mount)) 250 } 251 return r 252 } 253 254 func convertMount(m api.Mount) enginemount.Mount { 255 mount := enginemount.Mount{ 256 Source: m.Source, 257 Target: m.Target, 258 ReadOnly: m.ReadOnly, 259 } 260 261 switch m.Type { 262 case api.MountTypeBind: 263 mount.Type = enginemount.TypeBind 264 case api.MountTypeVolume: 265 mount.Type = enginemount.TypeVolume 266 case api.MountTypeTmpfs: 267 mount.Type = enginemount.TypeTmpfs 268 } 269 270 if m.BindOptions != nil { 271 mount.BindOptions = &enginemount.BindOptions{} 272 switch m.BindOptions.Propagation { 273 case api.MountPropagationRPrivate: 274 mount.BindOptions.Propagation = enginemount.PropagationRPrivate 275 case api.MountPropagationPrivate: 276 mount.BindOptions.Propagation = enginemount.PropagationPrivate 277 case api.MountPropagationRSlave: 278 mount.BindOptions.Propagation = enginemount.PropagationRSlave 279 case api.MountPropagationSlave: 280 mount.BindOptions.Propagation = enginemount.PropagationSlave 281 case api.MountPropagationRShared: 282 mount.BindOptions.Propagation = enginemount.PropagationRShared 283 case api.MountPropagationShared: 284 mount.BindOptions.Propagation = enginemount.PropagationShared 285 } 286 } 287 288 if m.VolumeOptions != nil { 289 mount.VolumeOptions = &enginemount.VolumeOptions{ 290 NoCopy: m.VolumeOptions.NoCopy, 291 } 292 if m.VolumeOptions.Labels != nil { 293 mount.VolumeOptions.Labels = make(map[string]string, len(m.VolumeOptions.Labels)) 294 for k, v := range m.VolumeOptions.Labels { 295 mount.VolumeOptions.Labels[k] = v 296 } 297 } 298 if m.VolumeOptions.DriverConfig != nil { 299 mount.VolumeOptions.DriverConfig = &enginemount.Driver{ 300 Name: m.VolumeOptions.DriverConfig.Name, 301 } 302 if m.VolumeOptions.DriverConfig.Options != nil { 303 mount.VolumeOptions.DriverConfig.Options = make(map[string]string, len(m.VolumeOptions.DriverConfig.Options)) 304 for k, v := range m.VolumeOptions.DriverConfig.Options { 305 mount.VolumeOptions.DriverConfig.Options[k] = v 306 } 307 } 308 } 309 } 310 311 if m.TmpfsOptions != nil { 312 mount.TmpfsOptions = &enginemount.TmpfsOptions{ 313 SizeBytes: m.TmpfsOptions.SizeBytes, 314 Mode: m.TmpfsOptions.Mode, 315 } 316 } 317 318 return mount 319 } 320 321 func (c *containerConfig) healthcheck() *enginecontainer.HealthConfig { 322 hcSpec := c.spec().Healthcheck 323 if hcSpec == nil { 324 return nil 325 } 326 interval, _ := ptypes.Duration(hcSpec.Interval) 327 timeout, _ := ptypes.Duration(hcSpec.Timeout) 328 return &enginecontainer.HealthConfig{ 329 Test: hcSpec.Test, 330 Interval: interval, 331 Timeout: timeout, 332 Retries: int(hcSpec.Retries), 333 } 334 } 335 336 func (c *containerConfig) hostConfig() *enginecontainer.HostConfig { 337 hc := &enginecontainer.HostConfig{ 338 Resources: c.resources(), 339 GroupAdd: c.spec().Groups, 340 PortBindings: c.portBindings(), 341 Mounts: c.mounts(), 342 } 343 344 if c.spec().DNSConfig != nil { 345 hc.DNS = c.spec().DNSConfig.Nameservers 346 hc.DNSSearch = c.spec().DNSConfig.Search 347 hc.DNSOptions = c.spec().DNSConfig.Options 348 } 349 350 // The format of extra hosts on swarmkit is specified in: 351 // http://man7.org/linux/man-pages/man5/hosts.5.html 352 // IP_address canonical_hostname [aliases...] 353 // However, the format of ExtraHosts in HostConfig is 354 // <host>:<ip> 355 // We need to do the conversion here 356 // (Alias is ignored for now) 357 for _, entry := range c.spec().Hosts { 358 parts := strings.Fields(entry) 359 if len(parts) > 1 { 360 hc.ExtraHosts = append(hc.ExtraHosts, fmt.Sprintf("%s:%s", parts[1], parts[0])) 361 } 362 } 363 364 if c.task.LogDriver != nil { 365 hc.LogConfig = enginecontainer.LogConfig{ 366 Type: c.task.LogDriver.Name, 367 Config: c.task.LogDriver.Options, 368 } 369 } 370 371 return hc 372 } 373 374 // This handles the case of volumes that are defined inside a service Mount 375 func (c *containerConfig) volumeCreateRequest(mount *api.Mount) *volumetypes.VolumesCreateBody { 376 var ( 377 driverName string 378 driverOpts map[string]string 379 labels map[string]string 380 ) 381 382 if mount.VolumeOptions != nil && mount.VolumeOptions.DriverConfig != nil { 383 driverName = mount.VolumeOptions.DriverConfig.Name 384 driverOpts = mount.VolumeOptions.DriverConfig.Options 385 labels = mount.VolumeOptions.Labels 386 } 387 388 if mount.VolumeOptions != nil { 389 return &volumetypes.VolumesCreateBody{ 390 Name: mount.Source, 391 Driver: driverName, 392 DriverOpts: driverOpts, 393 Labels: labels, 394 } 395 } 396 return nil 397 } 398 399 func (c *containerConfig) resources() enginecontainer.Resources { 400 resources := enginecontainer.Resources{} 401 402 // If no limits are specified let the engine use its defaults. 403 // 404 // TODO(aluzzardi): We might want to set some limits anyway otherwise 405 // "unlimited" tasks will step over the reservation of other tasks. 406 r := c.task.Spec.Resources 407 if r == nil || r.Limits == nil { 408 return resources 409 } 410 411 if r.Limits.MemoryBytes > 0 { 412 resources.Memory = r.Limits.MemoryBytes 413 } 414 415 if r.Limits.NanoCPUs > 0 { 416 // CPU Period must be set in microseconds. 417 resources.CPUPeriod = int64(cpuQuotaPeriod / time.Microsecond) 418 resources.CPUQuota = r.Limits.NanoCPUs * resources.CPUPeriod / 1e9 419 } 420 421 return resources 422 } 423 424 // Docker daemon supports just 1 network during container create. 425 func (c *containerConfig) createNetworkingConfig() *network.NetworkingConfig { 426 var networks []*api.NetworkAttachment 427 if c.task.Spec.GetContainer() != nil || c.task.Spec.GetAttachment() != nil { 428 networks = c.task.Networks 429 } 430 431 epConfig := make(map[string]*network.EndpointSettings) 432 if len(networks) > 0 { 433 epConfig[networks[0].Network.Spec.Annotations.Name] = getEndpointConfig(networks[0]) 434 } 435 436 return &network.NetworkingConfig{EndpointsConfig: epConfig} 437 } 438 439 // TODO: Merge this function with createNetworkingConfig after daemon supports multiple networks in container create 440 func (c *containerConfig) connectNetworkingConfig() *network.NetworkingConfig { 441 var networks []*api.NetworkAttachment 442 if c.task.Spec.GetContainer() != nil { 443 networks = c.task.Networks 444 } 445 446 // First network is used during container create. Other networks are used in "docker network connect" 447 if len(networks) < 2 { 448 return nil 449 } 450 451 epConfig := make(map[string]*network.EndpointSettings) 452 for _, na := range networks[1:] { 453 epConfig[na.Network.Spec.Annotations.Name] = getEndpointConfig(na) 454 } 455 return &network.NetworkingConfig{EndpointsConfig: epConfig} 456 } 457 458 func getEndpointConfig(na *api.NetworkAttachment) *network.EndpointSettings { 459 var ipv4, ipv6 string 460 for _, addr := range na.Addresses { 461 ip, _, err := net.ParseCIDR(addr) 462 if err != nil { 463 continue 464 } 465 466 if ip.To4() != nil { 467 ipv4 = ip.String() 468 continue 469 } 470 471 if ip.To16() != nil { 472 ipv6 = ip.String() 473 } 474 } 475 476 return &network.EndpointSettings{ 477 NetworkID: na.Network.ID, 478 IPAMConfig: &network.EndpointIPAMConfig{ 479 IPv4Address: ipv4, 480 IPv6Address: ipv6, 481 }, 482 } 483 } 484 485 func (c *containerConfig) virtualIP(networkID string) string { 486 if c.task.Endpoint == nil { 487 return "" 488 } 489 490 for _, eVip := range c.task.Endpoint.VirtualIPs { 491 // We only support IPv4 VIPs for now. 492 if eVip.NetworkID == networkID { 493 vip, _, err := net.ParseCIDR(eVip.Addr) 494 if err != nil { 495 return "" 496 } 497 498 return vip.String() 499 } 500 } 501 502 return "" 503 } 504 505 func (c *containerConfig) serviceConfig() *clustertypes.ServiceConfig { 506 if len(c.task.Networks) == 0 { 507 return nil 508 } 509 510 logrus.Debugf("Creating service config in agent for t = %+v", c.task) 511 svcCfg := &clustertypes.ServiceConfig{ 512 Name: c.task.ServiceAnnotations.Name, 513 Aliases: make(map[string][]string), 514 ID: c.task.ServiceID, 515 VirtualAddresses: make(map[string]*clustertypes.VirtualAddress), 516 } 517 518 for _, na := range c.task.Networks { 519 svcCfg.VirtualAddresses[na.Network.ID] = &clustertypes.VirtualAddress{ 520 // We support only IPv4 virtual IP for now. 521 IPv4: c.virtualIP(na.Network.ID), 522 } 523 if len(na.Aliases) > 0 { 524 svcCfg.Aliases[na.Network.ID] = na.Aliases 525 } 526 } 527 528 if c.task.Endpoint != nil { 529 for _, ePort := range c.task.Endpoint.Ports { 530 if ePort.PublishMode != api.PublishModeIngress { 531 continue 532 } 533 534 svcCfg.ExposedPorts = append(svcCfg.ExposedPorts, &clustertypes.PortConfig{ 535 Name: ePort.Name, 536 Protocol: int32(ePort.Protocol), 537 TargetPort: ePort.TargetPort, 538 PublishedPort: ePort.PublishedPort, 539 }) 540 } 541 } 542 543 return svcCfg 544 } 545 546 // networks returns a list of network names attached to the container. The 547 // returned name can be used to lookup the corresponding network create 548 // options. 549 func (c *containerConfig) networks() []string { 550 var networks []string 551 552 for name := range c.networksAttachments { 553 networks = append(networks, name) 554 } 555 556 return networks 557 } 558 559 func (c *containerConfig) networkCreateRequest(name string) (clustertypes.NetworkCreateRequest, error) { 560 na, ok := c.networksAttachments[name] 561 if !ok { 562 return clustertypes.NetworkCreateRequest{}, errors.New("container: unknown network referenced") 563 } 564 565 options := types.NetworkCreate{ 566 // ID: na.Network.ID, 567 Driver: na.Network.DriverState.Name, 568 IPAM: &network.IPAM{ 569 Driver: na.Network.IPAM.Driver.Name, 570 Options: na.Network.IPAM.Driver.Options, 571 }, 572 Options: na.Network.DriverState.Options, 573 Labels: na.Network.Spec.Annotations.Labels, 574 Internal: na.Network.Spec.Internal, 575 Attachable: na.Network.Spec.Attachable, 576 EnableIPv6: na.Network.Spec.Ipv6Enabled, 577 CheckDuplicate: true, 578 } 579 580 for _, ic := range na.Network.IPAM.Configs { 581 c := network.IPAMConfig{ 582 Subnet: ic.Subnet, 583 IPRange: ic.Range, 584 Gateway: ic.Gateway, 585 } 586 options.IPAM.Config = append(options.IPAM.Config, c) 587 } 588 589 return clustertypes.NetworkCreateRequest{na.Network.ID, types.NetworkCreateRequest{Name: name, NetworkCreate: options}}, nil 590 } 591 592 func (c containerConfig) eventFilter() filters.Args { 593 filter := filters.NewArgs() 594 filter.Add("type", events.ContainerEventType) 595 filter.Add("name", c.name()) 596 filter.Add("label", fmt.Sprintf("%v.task.id=%v", systemLabelPrefix, c.task.ID)) 597 return filter 598 }