Documentation
¶
Index ¶
- Constants
- Variables
- func CheckSystem() error
- func Delete(ctx context.Context, c *Container, force bool) error
- func Kill(ctx context.Context, c *Container, signum unix.Signal) error
- func ReadSpecProcessJSON(src string) (*specs.Process, error)
- func Start(ctx context.Context, c *Container) error
- type Container
- func (c *Container) ContainerState() (specs.ContainerState, error)
- func (c *Container) Exec(args []string, proc *specs.Process) (exitStatus int, err error)
- func (c *Container) ExecDetached(args []string, proc *specs.Process) (pid int, err error)
- func (c *Container) GetConfigItem(key string) string
- func (c *Container) Release() error
- func (c *Container) SetConfigItem(key, value string) error
- func (c *Container) State() (*specs.State, error)
- func (c *Container) SupportsConfigItem(keys ...string) bool
- type ContainerConfig
- type Hooks
- type Namespace
- type Runtime
- func (rt *Runtime) CheckSystem() error
- func (rt *Runtime) Create(ctx context.Context, cfg *ContainerConfig) (*Container, error)
- func (rt *Runtime) Delete(ctx context.Context, c *Container, force bool) error
- func (rt *Runtime) Kill(ctx context.Context, c *Container, signum unix.Signal) error
- func (rt *Runtime) Load(cfg *ContainerConfig) (*Container, error)
- func (rt *Runtime) Start(ctx context.Context, c *Container) error
- type RuntimeFeatures
- type RuntimeHook
Constants ¶
const ( // ExecStart starts the liblxc monitor process, similar to lxc-start ExecStart = "lxcri-start" // ExecHook is run as liblxc hook and creates additional devices and remounts masked paths. ExecHook = "lxcri-hook" // ExecInit is the container init process that execs the container process. ExecInit = "lxcri-init" )
Required runtime executables loaded from Runtime.LibexecDir
Variables ¶
var ( CgroupNamespace = Namespace{"cgroup", unix.CLONE_NEWCGROUP} IPCNamespace = Namespace{"ipc", unix.CLONE_NEWIPC} MountNamespace = Namespace{"mnt", unix.CLONE_NEWNS} NetworkNamespace = Namespace{"net", unix.CLONE_NEWNET} PIDNamespace = Namespace{"pid", unix.CLONE_NEWPID} TimeNamespace = Namespace{"time", unix.CLONE_NEWTIME} UserNamespace = Namespace{"user", unix.CLONE_NEWUSER} UTSNamespace = Namespace{"uts", unix.CLONE_NEWUTS} )
var ( ErrNotExist = fmt.Errorf("container does not exist") ErrExist = fmt.Errorf("container already exists") )
var DefaultRuntime = &Runtime{ Log: log.ConsoleLogger(true), Root: "/var/run/lxcri", SystemdCgroup: true, LibexecDir: "/usr/libexec/lxcri", Features: RuntimeFeatures{ Seccomp: true, Capabilities: true, Apparmor: true, CgroupDevices: true, }, }
Functions ¶
func CheckSystem ¶ added in v0.9.8
func CheckSystem() error
CheckSystem is a wrapper around DefaultRuntime.CheckSystem
func ReadSpecProcessJSON ¶
Types ¶
type Container ¶
type Container struct { LinuxContainer *lxc.Container `json:"-"` *ContainerConfig CreatedAt time.Time Pid int }
Container is the runtime state of a container instance.
func Create ¶ added in v0.9.8
func Create(ctx context.Context, cfg *ContainerConfig) (*Container, error)
Create is a wrapper around DefaultRuntime.Create
func Load ¶ added in v0.9.8
func Load(cfg *ContainerConfig) (*Container, error)
Load is a wrapper around DefaultRuntime.Load
func (*Container) ContainerState ¶
func (*Container) ExecDetached ¶
func (*Container) GetConfigItem ¶
func (*Container) SetConfigItem ¶
func (*Container) SupportsConfigItem ¶
type ContainerConfig ¶
type ContainerConfig struct { *specs.Spec RuntimeDir string ContainerID string BundlePath string ConsoleSocket string `json:",omitempty"` // PidFile is the absolute PID file path // for the container monitor process (ExecStart) MonitorCgroupDir string CgroupDir string // LogFile is the liblxc log file path LogFile string // LogLevel is the liblxc log level LogLevel string // Log is the container Logger Log zerolog.Logger `json:"-"` Hooks `json:"-"` }
ContainerConfig is the configuration for a single Container instance.
func (ContainerConfig) ConfigFilePath ¶
func (cfg ContainerConfig) ConfigFilePath() string
func (*ContainerConfig) LoadSpecJson ¶
func (c *ContainerConfig) LoadSpecJson(p string) error
func (ContainerConfig) RuntimePath ¶
func (cfg ContainerConfig) RuntimePath(subPath ...string) string
RuntimePath returns the absolute path within the container root.
type Hooks ¶ added in v0.9.8
type Hooks struct { // OnCreate is called right after creation of container runtime directory // and descriptor, but before the liblxc 'config' file is written. // At this point it's possible to add files to the container runtime directory // and modify the ContainerConfig. OnCreate RuntimeHook }
RuntimeHooks are callback functions executed within the container lifecycle.
type Runtime ¶
type Runtime struct { // Log is the logger used by the runtime. Log zerolog.Logger `json:"-"` // Root is the file path to the runtime directory. // Directories for containers created by the runtime // are created within this directory. Root string // Use systemd encoded cgroup path (from crio-o/conmon) // is true if /etc/crio/crio.conf#cgroup_manager = "systemd" SystemdCgroup bool // Path for lxc monitor cgroup (lxc specific feature) // similar to /etc/crio/crio.conf#conmon_cgroup MonitorCgroup string // LibexecDir is the the directory that contains the runtime executables. LibexecDir string // Features RuntimeFeatures Hooks `json:"-"` }
func (*Runtime) CheckSystem ¶
CheckSystem checks the hosts system configuration. Unsupported runtime features are disabled and a warning message is logged. CheckSystem should be called (once) before using the Runtime.
func (*Runtime) Create ¶
Create creates a single container instance from the given ContainerConfig. Create is the first runtime method to call within the lifecycle of a container. You may have to call Runtime.Delete to cleanup container runtime state, if Create returns with an error.
type RuntimeFeatures ¶ added in v0.9.8
RuntimeFeatures are (security) features supported by the Runtime. The supported features are enabled on any Container instance created by Runtime.Create.