common

Documentation

Index

• Constants
• Variables
• func EnvFilePath(root string, appName types.ACName) string
• func EvaluateSymlinksInsideApp(appRootfs, path string) (string, error)
• func GenerateMounts(ra *schema.RuntimeApp, volumes map[types.ACName]types.Volume, ...) []mountWrapper
• func GetAppHashes(p *stage1commontypes.Pod) []types.Hash
• func GetFlavor(p *stage1commontypes.Pod) (flavor string, systemdVersion int, err error)
• func GetMachineID(p *stage1commontypes.Pod) string
• func InitDebug(debug bool)
• func InstantiatedPrepareAppUnitName(appName types.ACName) string
• func IsMountReadOnly(vol types.Volume, mountPoints []types.MountPoint) bool
• func PodToNspawnArgs(p *stage1commontypes.Pod, insecureOptions Stage1InsecureOptions) ([]string, error)
• func PodToSystemd(p *stage1commontypes.Pod, interactive bool, flavor string, privateUsers string, ...) error
• func PrepareMountpoints(volPath string, targetPath string, vol *types.Volume, dockerImplicit bool) error
• func RelEnvFilePath(appName types.ACName) string
• func ServiceUnitName(appName types.ACName) string
• func ServiceUnitPath(root string, appName types.ACName) string
• func ServiceWantPath(root string, appName types.ACName) string
• func SetJournalPermissions(p *stage1commontypes.Pod) error
• func SocketUnitName(appName types.ACName) string
• func SocketUnitPath(root string, appName types.ACName) string
• func SocketWantPath(root string, appName types.ACName) string
• func WriteDefaultTarget(p *stage1commontypes.Pod) error
• func WritePrepareAppTemplate(p *stage1commontypes.Pod) error
• type Stage1InsecureOptions

Constants

const (
	// FlavorFile names the file storing the pod's flavor
	FlavorFile    = "flavor"
	SharedVolPerm = os.FileMode(0755)
)

const (
	// UnitsDir is the default path to systemd systemd unit directory
	UnitsDir = "/usr/lib/systemd/system"
)

Variables

var (
	// DockerDefaultSeccompWhitelist contains a default whitelist of syscalls,
	// used by docker for seccomp filtering.
	// See https://github.com/docker/docker/blob/master/profiles/seccomp/default.json
	DockerDefaultSeccompWhitelist = []string{}/* 309 elements not displayed */

	// DockerDefaultSeccompBlacklist contains a default blacklist of syscalls,
	// used by docker for seccomp filtering.
	// See https://github.com/docker/docker/blob/master/docs/security/seccomp.md
	DockerDefaultSeccompBlacklist = []string{
		"acct",
		"add_key",
		"adjtimex",
		"bpf",
		"clock_adjtime",
		"clock_settime",

		"create_module",
		"delete_module",
		"finit_module",
		"get_kernel_syms",
		"get_mempolicy",
		"init_module",
		"ioperm",
		"iopl",
		"kcmp",
		"kexec_file_load",
		"kexec_load",
		"keyctl",
		"lookup_dcookie",
		"mbind",
		"mount",
		"move_pages",
		"name_to_handle_at",
		"nfsservctl",
		"open_by_handle_at",
		"perf_event_open",

		"pivot_root",
		"process_vm_readv",
		"process_vm_writev",
		"ptrace",
		"query_module",
		"quotactl",
		"reboot",
		"request_key",
		"set_mempolicy",
		"setns",
		"settimeofday",
		"stime",
		"swapon",
		"swapoff",
		"sysfs",
		"_sysctl",
		"umount",
		"umount2",
		"unshare",
		"uselib",
		"userfaultfd",
		"ustat",
		"vm86",
		"vm86old",
	}

	// RktDefaultSeccompBlacklist contains a default blacklist of syscalls,
	// used by rkt for seccomp filtering.
	RktDefaultSeccompBlacklist = DockerDefaultSeccompBlacklist
	// RktDefaultSeccompWhitelist contains a default whitelist of syscalls,
	// used by rkt for seccomp filtering.
	RktDefaultSeccompWhitelist = DockerDefaultSeccompWhitelist
)

var (
	ErrTooManySeccompIsolators = errors.New("too many seccomp isolators specified")
)

Functions

func EnvFilePath

func EnvFilePath(root string, appName types.ACName) string

EnvFilePath returns the path to the environment file for the given app name.

func EvaluateSymlinksInsideApp

func EvaluateSymlinksInsideApp(appRootfs, path string) (string, error)

EvaluateSymlinksInsideApp tries to resolve symlinks within the path. It returns the actual path relative to the app rootfs for the given path.

func GenerateMounts

func GenerateMounts(ra *schema.RuntimeApp, volumes map[types.ACName]types.Volume, imageManifest *schema.ImageManifest) []mountWrapper

GenerateMounts maps MountPoint paths to volumes, returning a list of mounts, each with a parameter indicating if it's an implicit empty volume from a Docker image.

func GetAppHashes

func GetAppHashes(p *stage1commontypes.Pod) []types.Hash

GetAppHashes returns a list of hashes of the apps in this pod

func GetFlavor

func GetFlavor(p *stage1commontypes.Pod) (flavor string, systemdVersion int, err error)

GetFlavor populates a flavor string based on the flavor itself and respectively the systemd version If the systemd version couldn't be guessed, it will be set to 0.

func GetMachineID

func GetMachineID(p *stage1commontypes.Pod) string

GetMachineID returns the machine id string of the pod to be passed to systemd-nspawn

func InitDebug

func InitDebug(debug bool)

func InstantiatedPrepareAppUnitName

func InstantiatedPrepareAppUnitName(appName types.ACName) string

InstantiatedPrepareAppUnitName returns the systemd service unit name for prepare-app instantiated for the given root.

func IsMountReadOnly

func IsMountReadOnly(vol types.Volume, mountPoints []types.MountPoint) bool

IsMountReadOnly returns if a mount should be readOnly. If the readOnly flag in the pod manifest is not nil, it overrides the readOnly flag in the image manifest.

func PodToNspawnArgs

func PodToNspawnArgs(p *stage1commontypes.Pod, insecureOptions Stage1InsecureOptions) ([]string, error)

PodToNspawnArgs renders a prepared Pod as a systemd-nspawn argument list ready to be executed

func PodToSystemd

func PodToSystemd(p *stage1commontypes.Pod, interactive bool, flavor string, privateUsers string, insecureOptions Stage1InsecureOptions) error

PodToSystemd creates the appropriate systemd service unit files for all the constituent apps of the Pod

func PrepareMountpoints

func PrepareMountpoints(volPath string, targetPath string, vol *types.Volume, dockerImplicit bool) error

PrepareMountpoints creates and sets permissions for empty volumes. If the mountpoint comes from a Docker image and it is an implicit empty volume, we copy files from the image to the volume, see https://docs.docker.com/engine/userguide/containers/dockervolumes/#data-volumes

func RelEnvFilePath

func RelEnvFilePath(appName types.ACName) string

RelEnvFilePath returns the path to the environment file for the given app name relative to the pod's root.

func ServiceUnitName

func ServiceUnitName(appName types.ACName) string

ServiceUnitName returns a systemd service unit name for the given app name.

func ServiceUnitPath

func ServiceUnitPath(root string, appName types.ACName) string

ServiceUnitPath returns the path to the systemd service file for the given app name.

func ServiceWantPath

func ServiceWantPath(root string, appName types.ACName) string

ServiceWantPath returns the systemd default.target want symlink path for the given app name.

func SetJournalPermissions

func SetJournalPermissions(p *stage1commontypes.Pod) error

SetJournalPermissions sets ACLs and permissions so the rkt group can access the pod's logs

func SocketUnitName

func SocketUnitName(appName types.ACName) string

SocketUnitName returns a systemd socket unit name for the given app name.

func SocketUnitPath

func SocketUnitPath(root string, appName types.ACName) string

SocketUnitPath returns the path to the systemd socket file for the given app name.

func SocketWantPath

func SocketWantPath(root string, appName types.ACName) string

SocketWantPath returns the systemd sockets.target.wants symlink path for the given app name.

func WriteDefaultTarget

func WriteDefaultTarget(p *stage1commontypes.Pod) error

WriteDefaultTarget writes the default.target unit file which is responsible for bringing up the applications

func WritePrepareAppTemplate

func WritePrepareAppTemplate(p *stage1commontypes.Pod) error

WritePrepareAppTemplate writes service unit files for preparing the pod's applications

Types

type Stage1InsecureOptions

type Stage1InsecureOptions struct {
	DisablePaths        bool
	DisableCapabilities bool
	DisableSeccomp      bool
}