github.com/opencontainers/runtime-tools@v0.9.0/specerror/config-linux.go (about)

     1  package specerror
     2  
     3  import (
     4  	"fmt"
     5  
     6  	rfc2119 "github.com/opencontainers/runtime-tools/error"
     7  )
     8  
     9  // define error codes
    10  const (
    11  	// DefaultFilesystems represents "The following filesystems SHOULD be made available in each container's filesystem:"
    12  	DefaultFilesystems Code = 0xc001 + iota
    13  	// NSPathAbs represents "This value MUST be an absolute path in the runtime mount namespace."
    14  	NSPathAbs
    15  	// NSProcInPath represents "The runtime MUST place the container process in the namespace associated with that `path`."
    16  	NSProcInPath
    17  	// NSPathMatchTypeError represents "The runtime MUST generate an error if `path` is not associated with a namespace of type `type`."
    18  	NSPathMatchTypeError
    19  	// NSNewNSWithoutPath represents "If `path` is not specified, the runtime MUST create a new container namespace of type `type`."
    20  	NSNewNSWithoutPath
    21  	// NSInheritWithoutType represents "If a namespace type is not specified in the `namespaces` array, the container MUST inherit the runtime namespace of that type."
    22  	NSInheritWithoutType
    23  	// NSErrorOnDup represents "If a `namespaces` field contains duplicated namespaces with same `type`, the runtime MUST generate an error."
    24  	NSErrorOnDup
    25  	// UserNSMapOwnershipRO represents "The runtime SHOULD NOT modify the ownership of referenced filesystems to realize the mapping."
    26  	UserNSMapOwnershipRO
    27  	// DevicesAvailable represents "devices (array of objects, OPTIONAL) lists devices that MUST be available in the container."
    28  	DevicesAvailable
    29  	// DevicesFileNotMatch represents "If a file already exists at `path` that does not match the requested device, the runtime MUST generate an error."
    30  	DevicesFileNotMatch
    31  	// DevicesMajMinRequired represents "`major, minor` (int64, REQUIRED unless `type` is `p`) - major, minor numbers for the device."
    32  	DevicesMajMinRequired
    33  	// DevicesErrorOnDup represents "The same `type`, `major` and `minor` SHOULD NOT be used for multiple devices."
    34  	DevicesErrorOnDup
    35  	// DefaultDevices represents "In addition to any devices configured with this setting, the runtime MUST also supply default devices."
    36  	DefaultDevices
    37  	// CgroupsPathAbsOrRel represents "The value of `cgroupsPath` MUST be either an absolute path or a relative path."
    38  	CgroupsPathAbsOrRel
    39  	// CgroupsAbsPathRelToMount represents "In the case of an absolute path (starting with `/`), the runtime MUST take the path to be relative to the cgroups mount point."
    40  	CgroupsAbsPathRelToMount
    41  	// CgroupsPathAttach represents "If the value is specified, the runtime MUST consistently attach to the same place in the cgroups hierarchy given the same value of `cgroupsPath`."
    42  	CgroupsPathAttach
    43  	// CgroupsPathError represents "Runtimes MAY consider certain `cgroupsPath` values to be invalid, and MUST generate an error if this is the case."
    44  	CgroupsPathError
    45  	// DevicesApplyInOrder represents "The runtime MUST apply entries in the listed order."
    46  	DevicesApplyInOrder
    47  	// BlkIOWeightOrLeafWeightExist represents "You MUST specify at least one of `weight` or `leafWeight` in a given entry, and MAY specify both."
    48  	BlkIOWeightOrLeafWeightExist
    49  	// IntelRdtPIDWrite represents "If `intelRdt` is set, the runtime MUST write the container process ID to the `<container-id>/tasks` file in a mounted `resctrl` pseudo-filesystem, using the container ID from `start` and creating the `container-id` directory if necessary."
    50  	IntelRdtPIDWrite
    51  	// IntelRdtNoMountedResctrlError represents "If no mounted `resctrl` pseudo-filesystem is available in the runtime mount namespace, the runtime MUST generate an error."
    52  	IntelRdtNoMountedResctrlError
    53  	// NotManipResctrlWithoutIntelRdt represents "If `intelRdt` is not set, the runtime MUST NOT manipulate any `resctrl` pseudo-filesystems."
    54  	NotManipResctrlWithoutIntelRdt
    55  	// IntelRdtL3CacheSchemaWrite represents "If `l3CacheSchema` is set, runtimes MUST write the value to the `schemata` file in the `<container-id>` directory discussed in `intelRdt`."
    56  	IntelRdtL3CacheSchemaWrite
    57  	// IntelRdtL3CacheSchemaNotWrite represents "If `l3CacheSchema` is not set, runtimes MUST NOT write to `schemata` files in any `resctrl` pseudo-filesystems."
    58  	IntelRdtL3CacheSchemaNotWrite
    59  	// SeccSyscallsNamesRequired represents "`names` MUST contain at least one entry."
    60  	SeccSyscallsNamesRequired
    61  	// MaskedPathsAbs represents "maskedPaths (array of strings, OPTIONAL) will mask over the provided paths inside the container so that they cannot be read. The values MUST be absolute paths in the container namespace."
    62  	MaskedPathsAbs
    63  	// ReadonlyPathsAbs represents "readonlyPaths (array of strings, OPTIONAL) will set the provided paths as readonly inside the container. The values MUST be absolute paths in the container namespace."
    64  	ReadonlyPathsAbs
    65  )
    66  
    67  var (
    68  	defaultFilesystemsRef = func(version string) (reference string, err error) {
    69  		return fmt.Sprintf(referenceTemplate, version, "config-linux.md#default-filesystems"), nil
    70  	}
    71  	namespacesRef = func(version string) (reference string, err error) {
    72  		return fmt.Sprintf(referenceTemplate, version, "config-linux.md#namespaces"), nil
    73  	}
    74  	userNamespaceMappingsRef = func(version string) (reference string, err error) {
    75  		return fmt.Sprintf(referenceTemplate, version, "config-linux.md#user-namespace-mappings"), nil
    76  	}
    77  	devicesRef = func(version string) (reference string, err error) {
    78  		return fmt.Sprintf(referenceTemplate, version, "config-linux.md#devices"), nil
    79  	}
    80  	defaultDevicesRef = func(version string) (reference string, err error) {
    81  		return fmt.Sprintf(referenceTemplate, version, "config-linux.md#default-devices"), nil
    82  	}
    83  	cgroupsPathRef = func(version string) (reference string, err error) {
    84  		return fmt.Sprintf(referenceTemplate, version, "config-linux.md#cgroups-path"), nil
    85  	}
    86  	deviceWhitelistRef = func(version string) (reference string, err error) {
    87  		return fmt.Sprintf(referenceTemplate, version, "config-linux.md#device-whitelist"), nil
    88  	}
    89  	blockIoRef = func(version string) (reference string, err error) {
    90  		return fmt.Sprintf(referenceTemplate, version, "config-linux.md#block-io"), nil
    91  	}
    92  	intelrdtRef = func(version string) (reference string, err error) {
    93  		return fmt.Sprintf(referenceTemplate, version, "config-linux.md#intelrdt"), nil
    94  	}
    95  	seccompRef = func(version string) (reference string, err error) {
    96  		return fmt.Sprintf(referenceTemplate, version, "config-linux.md#seccomp"), nil
    97  	}
    98  	maskedPathsRef = func(version string) (reference string, err error) {
    99  		return fmt.Sprintf(referenceTemplate, version, "config-linux.md#masked-paths"), nil
   100  	}
   101  	readonlyPathsRef = func(version string) (reference string, err error) {
   102  		return fmt.Sprintf(referenceTemplate, version, "config-linux.md#readonly-paths"), nil
   103  	}
   104  )
   105  
   106  func init() {
   107  	register(DefaultFilesystems, rfc2119.Should, defaultFilesystemsRef)
   108  	register(NSPathAbs, rfc2119.Must, namespacesRef)
   109  	register(NSProcInPath, rfc2119.Must, namespacesRef)
   110  	register(NSPathMatchTypeError, rfc2119.Must, namespacesRef)
   111  	register(NSNewNSWithoutPath, rfc2119.Must, namespacesRef)
   112  	register(NSInheritWithoutType, rfc2119.Must, namespacesRef)
   113  	register(NSErrorOnDup, rfc2119.Must, namespacesRef)
   114  	register(UserNSMapOwnershipRO, rfc2119.Should, userNamespaceMappingsRef)
   115  	register(DevicesAvailable, rfc2119.Must, devicesRef)
   116  	register(DevicesFileNotMatch, rfc2119.Must, devicesRef)
   117  	register(DevicesMajMinRequired, rfc2119.Required, devicesRef)
   118  	register(DevicesErrorOnDup, rfc2119.Should, devicesRef)
   119  	register(DefaultDevices, rfc2119.Must, defaultDevicesRef)
   120  	register(CgroupsPathAbsOrRel, rfc2119.Must, cgroupsPathRef)
   121  	register(CgroupsAbsPathRelToMount, rfc2119.Must, cgroupsPathRef)
   122  	register(CgroupsPathAttach, rfc2119.Must, cgroupsPathRef)
   123  	register(CgroupsPathError, rfc2119.Must, cgroupsPathRef)
   124  	register(DevicesApplyInOrder, rfc2119.Must, deviceWhitelistRef)
   125  	register(BlkIOWeightOrLeafWeightExist, rfc2119.Must, blockIoRef)
   126  	register(IntelRdtPIDWrite, rfc2119.Must, intelrdtRef)
   127  	register(IntelRdtNoMountedResctrlError, rfc2119.Must, intelrdtRef)
   128  	register(NotManipResctrlWithoutIntelRdt, rfc2119.Must, intelrdtRef)
   129  	register(IntelRdtL3CacheSchemaWrite, rfc2119.Must, intelrdtRef)
   130  	register(IntelRdtL3CacheSchemaNotWrite, rfc2119.Must, intelrdtRef)
   131  	register(SeccSyscallsNamesRequired, rfc2119.Must, seccompRef)
   132  	register(MaskedPathsAbs, rfc2119.Must, maskedPathsRef)
   133  	register(ReadonlyPathsAbs, rfc2119.Must, readonlyPathsRef)
   134  }