Remove dependency on github.com/opencontainers/runtime-tools
#316
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -25,7 +25,6 @@ import ( | |
| "strings" | ||
|
|
||
| oci "github.com/opencontainers/runtime-spec/specs-go" | ||
| cdi "tags.cncf.io/container-device-interface/specs-go" | ||
| ) | ||
|
|
||
|
|
@@ -80,9 +79,11 @@ func (e *ContainerEdits) Apply(spec *oci.Spec) error { | |
| return nil | ||
| } | ||
|
|
||
| if len(e.Env) > 0 { | ||
| if spec.Process == nil { | ||
| spec.Process = &oci.Process{} | ||
| } | ||
| addMultipleProcessEnv(spec.Process, e.Env) | ||
| } | ||
|
|
||
| for _, d := range e.DeviceNodes { | ||
|
|
@@ -104,8 +105,11 @@ func (e *ContainerEdits) Apply(spec *oci.Spec) error { | |
| } | ||
| } | ||
|
|
||
| if spec.Linux == nil { | ||
| spec.Linux = &oci.Linux{} | ||
| } | ||
| removeDevice(spec, dev.Path) | ||
| spec.Linux.Devices = append(spec.Linux.Devices, dev) | ||
|
Contributor
There was a problem hiding this comment. Another inconsistency is that
Author
There was a problem hiding this comment. Is that something you'd like me to update the PR for/with, or just something you want to note? 🙇
Contributor
There was a problem hiding this comment. It was initially just a note from my side, but what about adding an
Contributor
There was a problem hiding this comment. (similarly for |
||
|
|
||
| if dev.Type == "b" || dev.Type == "c" { | ||
| access := d.Permissions | ||
|
|
@@ -115,80 +119,131 @@ func (e *ContainerEdits) Apply(spec *oci.Spec) error { | |
| case NoPermissions: | ||
| access = "" | ||
| } | ||
| if spec.Linux.Resources == nil { | ||
| spec.Linux.Resources = &oci.LinuxResources{} | ||
| } | ||
| spec.Linux.Resources.Devices = append(spec.Linux.Resources.Devices, oci.LinuxDeviceCgroup{ | ||
| Allow: true, | ||
| Type: dev.Type, | ||
| Major: &dev.Major, | ||
| Minor: &dev.Minor, | ||
| Access: access, | ||
| }) | ||
| } | ||
| } | ||
|
|
||
| for _, dev := range e.NetDevices { | ||
| ensureLinuxNetDevices(spec) | ||
|
Contributor
There was a problem hiding this comment. If we kept the length check it would be more consistent and we could call |
||
| spec.Linux.NetDevices[dev.HostInterfaceName] = *(&LinuxNetDevice{dev}).toOCI() | ||
| } | ||
|
|
||
| if len(e.Mounts) > 0 { | ||
| for _, m := range e.Mounts { | ||
| mnt := &Mount{m} | ||
|
|
||
| removeMount(spec, m.ContainerPath) | ||
|
|
||
| if !specHasUserNamespace(spec) { | ||
| spec.Mounts = append(spec.Mounts, mnt.toOCI()) | ||
| } else { | ||
| spec.Mounts = append(spec.Mounts, mnt.toOCI(withIDMapForBindMount())) | ||
| } | ||
| } | ||
| sort.Stable(orderedMounts(spec.Mounts)) | ||
| } | ||
|
|
||
| for _, h := range e.Hooks { | ||
| ociHook := (&Hook{h}).toOCI() | ||
| ensureOCIHooks(spec) | ||
| switch h.HookName { | ||
| case PrestartHook: | ||
| spec.Hooks.Prestart = append(spec.Hooks.Prestart, ociHook) //nolint:staticcheck | ||
| case PoststartHook: | ||
| spec.Hooks.Poststart = append(spec.Hooks.Poststart, ociHook) | ||
| case PoststopHook: | ||
| spec.Hooks.Poststop = append(spec.Hooks.Poststop, ociHook) | ||
| case CreateRuntimeHook: | ||
| spec.Hooks.CreateRuntime = append(spec.Hooks.CreateRuntime, ociHook) | ||
| case CreateContainerHook: | ||
| spec.Hooks.CreateContainer = append(spec.Hooks.CreateContainer, ociHook) | ||
| case StartContainerHook: | ||
| spec.Hooks.StartContainer = append(spec.Hooks.StartContainer, ociHook) | ||
| default: | ||
| return fmt.Errorf("unknown hook name %q", h.HookName) | ||
| } | ||
| } | ||
|
|
||
| if e.IntelRdt != nil { | ||
| if spec.Linux == nil { | ||
| spec.Linux = &oci.Linux{} | ||
| } | ||
| spec.Linux.IntelRdt = (&IntelRdt{e.IntelRdt}).toOCI() | ||
| } | ||
|
|
||
| for _, additionalGID := range e.AdditionalGIDs { | ||
| if additionalGID == 0 { | ||
| continue | ||
| } | ||
| if spec.Process == nil { | ||
| spec.Process = &oci.Process{} | ||
| } | ||
| addProcessAdditionalGid(spec, additionalGID) | ||
| } | ||
|
|
||
| return nil | ||
| } | ||
|
|
||
| // addMultipleProcessEnv adds or replaces environment variables on the process, | ||
| // deduplicating by key. | ||
| func addMultipleProcessEnv(process *oci.Process, envs []string) { | ||
|
Contributor
There was a problem hiding this comment. One thing that I want to call out (thanks Codex). There is a subtle difference between the new code and the original Note that there is also a slight mismatch to the wording of the CDI specification which states that envvars are appended to the environment. I do, however, think that the new behaviour is correct and should also remove ambiguity around dealing with multiple envvars. We may want to update the wording around evvars for the spec though. |
||
| EnvLoop: | ||
| for _, env := range envs { | ||
| parts := strings.SplitN(env, "=", 2) | ||
| if len(parts) < 2 { | ||
| continue | ||
| } | ||
| prefix := parts[0] + "=" | ||
| for i, e := range process.Env { | ||
|
Contributor
There was a problem hiding this comment. Implementing a simplified generator type locally will allow us to cache the envvars to improve performance for containers with many envvars. (Using envvars in CDI is not common, so it may not be worth it though). |
||
| if strings.HasPrefix(e, prefix) { | ||
| process.Env[i] = env | ||
| continue EnvLoop | ||
| } | ||
| } | ||
| process.Env = append(process.Env, env) | ||
| } | ||
| } | ||
|
|
||
| // removeDevice removes the device at path from spec.Linux.Devices. | ||
| func removeDevice(spec *oci.Spec, path string) { | ||
| if spec.Linux == nil { | ||
| return | ||
| } | ||
| for i, d := range spec.Linux.Devices { | ||
| if d.Path == path { | ||
| spec.Linux.Devices = append(spec.Linux.Devices[:i], spec.Linux.Devices[i+1:]...) | ||
| return | ||
| } | ||
| } | ||
| } | ||
|
|
||
| // removeMount removes the mount with the given destination from spec.Mounts. | ||
| func removeMount(spec *oci.Spec, dest string) { | ||
| for i, m := range spec.Mounts { | ||
| if m.Destination == dest { | ||
| spec.Mounts = append(spec.Mounts[:i], spec.Mounts[i+1:]...) | ||
| return | ||
| } | ||
| } | ||
| } | ||
|
|
||
| // addProcessAdditionalGid appends gid to spec.Process.User.AdditionalGids if not already present. | ||
| func addProcessAdditionalGid(spec *oci.Spec, gid uint32) { | ||
| for _, g := range spec.Process.User.AdditionalGids { | ||
| if g == gid { | ||
| return | ||
| } | ||
| } | ||
| spec.Process.User.AdditionalGids = append(spec.Process.User.AdditionalGids, gid) | ||
| } | ||
|
|
||
| // Ensure OCI Spec Linux NetDevices map is not nil. | ||
|
|
@@ -444,14 +499,6 @@ func ensureOCIHooks(spec *oci.Spec) { | |
| } | ||
| } | ||
|
|
||
| // orderedMounts defines how to sort an OCI Spec Mount slice. | ||
| // This is the almost the same implementation sa used by CRI-O and Docker, | ||
| // with a minor tweak for stable sorting order (easier to test): | ||
|
|
||
Uh oh!
There was an error while loading. Please reload this page.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Maybe this could be an
ensureProcess()for consistency.