Example #1
0
func (s *IntegrationTestSuite) unitState(id containers.Identifier) (string, string) {
	props, err := s.sdconn.GetUnitProperties(id.UnitNameFor())
	if props == nil || err != nil {
		return "", ""
	}
	return props["ActiveState"].(string), props["SubState"].(string)
}
Example #2
0
func (s *IntegrationTestSuite) assertContainerRestarts(c *chk.C, id containers.Identifier) {
	isStarted := func() bool {
		active, sub := s.unitState(id)
		if active == "active" {
			return true
		}
		if active == "deactivating" || active == "activating" {
			return false
		}
		c.Errorf("Unit %s restart failed (%s) in unexpected state %s", id, active, sub)
		c.FailNow()
		return false
	}

	if !until(CONTAINER_STATE_CHANGE_TIMEOUT, CONTAINER_CHECK_INTERVAL, isStarted) {
		active, sub := s.unitState(id)
		c.Errorf("Timeout during restart of %s, never got back to 'active' state (%s/%s)", id, active, sub)
		c.FailNow()
	}

	container, err := s.dockerClient.GetContainer(id.ContainerFor(), false)
	if err != nil {
		c.Error("Can't check container "+id, err)
		c.FailNow()
	}
	if !container.State.Running {
		c.Logf("Container %s exists, but is not running - race condition %+v", id, container.State)
	}
}
Example #3
0
func (s *IntegrationTestSuite) getContainerPid(id containers.Identifier) int {
	container, err := s.dockerClient.InspectContainer(id.ContainerFor())
	if err != nil {
		return 0
	}
	return container.State.Pid
}
Example #4
0
func switchnsExec(args []string) {
	var err error

	client, err := docker.GetConnection("unix:///var/run/docker.sock")
	if err != nil {
		fmt.Printf("Unable to connect to server\n")
		os.Exit(3)
	}

	uid := os.Getuid()

	if uid == 0 {
		runCommandInContainer(client, containerName, args, envs)
	} else {
		var u *user.User
		var containerId containers.Identifier

		if u, err = user.LookupId(strconv.Itoa(uid)); err != nil {
			fmt.Printf("Couldn't lookup uid %s\n", uid)
			os.Exit(2)
		}

		if containerId, err = containers.NewIdentifierFromUser(u); err != nil {
			fmt.Printf("Couldn't get identifier from user: %v\n", u)
			os.Exit(2)
		}
		runCommandInContainer(client, containerId.ContainerFor(), []string{"/bin/sh", "-l"}, []string{})
	}
}
Example #5
0
func GetSocketActivation(id containers.Identifier) (bool, string, error) {
	var err error
	var existing *os.File
	if existing, err = os.Open(id.UnitPathFor()); err != nil {
		return false, "disabled", err
	}

	defer existing.Close()
	return readSocketActivationFromUnitFile(existing)
}
Example #6
0
func (s *IntegrationTestSuite) unitTimes(id containers.Identifier) (inactiveStart time.Time, inactiveEnd time.Time, activeStart time.Time, activeEnd time.Time) {
	props, err := s.sdconn.GetUnitProperties(id.UnitNameFor())
	if props == nil || err != nil {
		return
	}
	inactiveStart = time.Unix(int64(props["InactiveEnterTimestampMonotonic"].(uint64)), 0)
	inactiveEnd = time.Unix(int64(props["InactiveExitTimestampMonotonic"].(uint64)), 0)
	activeStart = time.Unix(int64(props["ActiveEnterTimestampMonotonic"].(uint64)), 0)
	activeEnd = time.Unix(int64(props["ActiveExitTimestampMonotonic"].(uint64)), 0)
	return
}
Example #7
0
func SetUnitStartOnBoot(i containers.Identifier, active bool) error {
	if active {
		if err := os.Symlink(i.UnitPathFor(), activeUnitPathFor(i)); err != nil && !os.IsExist(err) {
			return err
		}
	} else {
		if err := os.Remove(activeUnitPathFor(i)); err != nil && !os.IsNotExist(err) {
			return err
		}
	}
	return nil
}
Example #8
0
func (s *IntegrationTestSuite) assertContainerStarts(c *chk.C, id containers.Identifier) {
	active, _ := s.unitState(id)
	switch active {
	case "active":
		return
	case "activating":
		break
	default:
		c.Errorf("Container %s failed to start - %s", id, active)
		c.FailNow()
		return
	}

	isRunning := func() bool {
		active, sub := s.unitState(id)
		if active == "active" {
			return true
		}
		if active == "activating" {
			return false
		}
		c.Errorf("Unit %s start failed with state %s", id, sub)
		c.FailNow()
		return false
	}

	if !until(TimeoutContainerStateChange, time.Second/20, isRunning) {
		c.Errorf("Timeout during start of %s, never got to 'active' state", id)
		c.FailNow()
	}

	// Docker does not immediately return container status - possibly due to races inside of the
	// daemon
	failed := false
	isContainerUp := func() bool {
		done, err := isContainerAvailable(s.dockerClient, id.ContainerFor())
		if err != nil {
			failed = true
			c.Error("Docker couldn't return container info", err)
			c.FailNow()
		}
		return done
	}

	if !until(TimeoutDockerWait, IntervalHttpCheck, isContainerUp) {
		if !failed {
			c.Errorf("Docker never reported the container running %s", id)
		}
		c.FailNow()
	}
}
Example #9
0
func (s *IntegrationTestSuite) assertContainerStarts(c *chk.C, id containers.Identifier) {
	active, _ := s.unitState(id)
	switch active {
	case "active":
		return
	case "activating":
		break
	default:
		c.Errorf("Container %s failed to start - %s", id, active)
		c.FailNow()
		return
	}

	isRunning := func() bool {
		active, sub := s.unitState(id)
		if active == "active" {
			return true
		}
		if active == "activating" {
			return false
		}
		c.Errorf("Unit %s start failed with state %s", id, sub)
		c.FailNow()
		return false
	}

	if !until(CONTAINER_STATE_CHANGE_TIMEOUT, time.Second/20, isRunning) {
		c.Errorf("Timeout during start of %s, never got to 'active' state", id)
		c.FailNow()
	}

	container, err := s.dockerClient.GetContainer(id.ContainerFor(), false)
	if err != nil {
		c.Error("Can't check container "+id, err)
		c.FailNow()
	}
	if !container.State.Running {
		c.Logf("Container %s exists, but is not running - race condition %+v", id, container.State)
		//c.Errorf("Container %s is not running %+v", id, container)
		//c.FailNow()
	}
}
Example #10
0
func switchnsExec(cmd *cobra.Command, args []string) {
	var err error

	uid := os.Getuid()

	if uid == 0 {
		runCommand(containerName, args, envs)
	} else {
		var u *user.User
		var containerId containers.Identifier

		if u, err = user.LookupId(strconv.Itoa(uid)); err != nil {
			os.Exit(2)
		}

		if containerId, err = containers.NewIdentifierFromUser(u); err != nil {
			os.Exit(2)
		}
		runCommand(containerId.ContainerFor(), []string{"/bin/bash", "-l"}, []string{"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"})
	}
}
Example #11
0
func (s *IntegrationTestSuite) assertContainerRestarts(c *chk.C, id containers.Identifier) {
	isStarted := func() bool {
		active, sub := s.unitState(id)
		if active == "active" {
			return true
		}
		if active == "deactivating" || active == "activating" {
			return false
		}
		c.Errorf("Unit %s restart failed (%s) in unexpected state %s", id, active, sub)
		c.FailNow()
		return false
	}

	if !until(TimeoutContainerStateChange, IntervalContainerCheck, isStarted) {
		active, sub := s.unitState(id)
		c.Errorf("Timeout during restart of %s, never got back to 'active' state (%s/%s)", id, active, sub)
		c.FailNow()
	}

	// Docker does not immediately return container status - possibly due to races inside of the
	// daemon
	failed := false
	isContainerUp := func() bool {
		done, err := isContainerAvailable(s.dockerClient, id.ContainerFor())
		if err != nil {
			failed = true
			c.Error("Docker couldn't return container info", err)
			c.FailNow()
		}
		return done
	}

	if !until(TimeoutDockerWait, IntervalHttpCheck, isContainerUp) {
		if !failed {
			c.Errorf("Docker never reported the container running %s", id)
		}
		c.FailNow()
	}
}
Example #12
0
func switchnsExec(args []string) {
	var err error

	uid := os.Getuid()

	if uid == 0 {
		runCommandInContainer(containerName, args, envs)
	} else {
		var u *user.User
		var containerId containers.Identifier

		if u, err = user.LookupId(strconv.Itoa(uid)); err != nil {
			fmt.Printf("Couldn't lookup uid %s\n", uid)
			os.Exit(2)
		}

		if containerId, err = containers.NewIdentifierFromUser(u); err != nil {
			fmt.Printf("Couldn't get identifier from user: %v\n", u)
			os.Exit(2)
		}
		runCommandInContainer(containerId.ContainerFor(), []string{"/bin/bash", "-l"}, []string{"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"})
	}
}
Example #13
0
func createUser(id containers.Identifier) error {
	cmd := exec.Command("/usr/sbin/useradd", id.LoginFor(), "-m", "-d", id.HomePath(), "-c", "Container user")
	if out, err := cmd.CombinedOutput(); err != nil {
		log.Println(out)
		return err
	}
	selinux.RestoreCon(id.HomePath(), true)
	return nil
}
Example #14
0
func (s *IntegrationTestSuite) assertContainerStops(c *chk.C, id containers.Identifier, allowFail bool) {
	active, _ := s.unitState(id)
	switch active {
	case "active", "activating":
		c.Errorf("Container %s stop not properly queued, service is still active - %s", id, active)
		c.FailNow()
		return
	}

	isStopped := func() bool {
		active, sub := s.unitState(id)
		if active == "inactive" {
			return true
		}
		if allowFail && active == "failed" {
			return true
		}
		if active == "deactivating" {
			return false
		}
		c.Errorf("Unit %s stop failed (%s) with state %s", id, active, sub)
		c.FailNow()
		return false
	}

	if !until(TimeoutContainerStateChange, IntervalContainerCheck, isStopped) {
		c.Errorf("Timeout during start of %s, never got to 'inactive' state", id)
		c.FailNow()
	}

	_, err := s.dockerClient.InspectContainer(id.ContainerFor())
	if err == nil {
		c.Errorf("Container %s is still active in docker, should be stopped and removed", id.ContainerFor())
		c.FailNow()
	}
}
Example #15
0
func InitPostStart(dockerSocket string, id containers.Identifier) error {
	var (
		u         *user.User
		container *dc.Container
		err       error
		d         *docker.DockerClient
	)

	if u, err = user.Lookup(id.LoginFor()); err == nil {
		if err := ssh.GenerateAuthorizedKeysFor(u, true, false); err != nil {
			log.Print(err.Error())
		}
	} else {
		log.Print(err.Error())
	}

	if d, err = docker.GetConnection(dockerSocket); err != nil {
		return err
	}

	if file, err := os.Open(id.NetworkLinksPathFor()); err == nil {
		defer file.Close()

		const ContainerInterval = time.Second / 3
		const ContainerWait = time.Second * 12
		for i := 0; i < int(ContainerWait/ContainerInterval); i++ {
			if container, err = d.GetContainer(id.ContainerFor(), true); err != nil {
				return err
			}
			if container.State.Running {
				break
			} else {
				log.Printf("Waiting for container to run.")
				time.Sleep(ContainerInterval)
			}
		}

		pid, err := d.ChildProcessForContainer(container)
		if err != nil {
			return err
		}
		if pid < 2 {
			return errors.New("support: child PID is not correct")
		}
		log.Printf("Updating network namespaces for %d", pid)
		if err := updateNamespaceNetworkLinks(pid, file); err != nil {
			return err
		}
	}

	return nil
}
Example #16
0
func (idler *Idler) idleContainer(id containers.Identifier) bool {
	portPairs, err := containers.GetExistingPorts(id)
	if err != nil {
		fmt.Printf("idler.idleContainer: Error retrieving ports for container: %v\n", id)
		return false
	}

	iptablePorts, err := iptables.GetIdlerRules(id, false)
	if err != nil {
		fmt.Printf("idler.idleContainer: Error retrieving ports from iptables: %v\n", id)
		return false
	}

	shouldRecreateRules := false
	for _, portPair := range portPairs {
		extPort := strconv.Itoa(int(portPair.External))
		shouldRecreateRules = shouldRecreateRules || !iptablePorts[extPort]
	}

	if !shouldRecreateRules {
		return false
	}

	//TODO: Ask geard to idle container
	f, err := os.Create(id.IdleUnitPathFor())
	if err != nil {
		fmt.Printf("idler.idleContainer: Could not create idle marker for %s: %v", id.UnitNameFor(), err)
		return false
	}
	f.Close()
	if err := systemd.Connection().StopUnitJob(id.UnitNameFor(), "fail"); err != nil {
		fmt.Printf("idler.idleContainer: Could not stop container %s: %v", id.UnitNameFor(), err)
		return false
	}

	iptables.IdleContainer(id, idler.hostIp)
	return true
}
Example #17
0
func (idler *Idler) unidleContainer(id containers.Identifier, p netfilter.NFPacket) {
	newChanId, wasAlreadyAssigned := idler.getAvailableWaiter(id)

	if newChanId == 0 {
		fmt.Println("unidle: Error while finding wait channel")
		return
	}

	if !wasAlreadyAssigned {
		//TODO: Ask geard to unidle container
		if err := os.Remove(id.IdleUnitPathFor()); err != nil {
			fmt.Printf("unidle: Could not remove idle marker for %s: %v", id.UnitNameFor(), err)
			p.SetVerdict(netfilter.NF_ACCEPT)
			return
		}
		if err := systemd.Connection().StartUnitJob(id.UnitNameFor(), "fail"); err != nil {
			fmt.Printf("unidle: Could not start container %s: %v", id.UnitNameFor(), err)
			p.SetVerdict(netfilter.NF_ACCEPT)
			return
		}
	}

	p.SetRequeueVerdict(newChanId)
}
Example #18
0
func (s *IntegrationTestSuite) assertContainerState(c *chk.C, id containers.Identifier, expectedState ContainerState) {
	var (
		curState   ContainerState
		didStop    bool
		didRestart bool
		ticker     *time.Ticker
	)

	ticker = time.NewTicker(time.Second / 10)
	defer ticker.Stop()

	cInfo, err := s.sdconn.GetUnitProperties(id.UnitNameFor())
	c.Assert(err, chk.IsNil)
	switch cInfo["SubState"] {
	case "running":
		curState = CONTAINER_STARTED
	case "dead", "failed", "stop-sigterm", "stop":
		didStop = true
		curState = CONTAINER_STOPPED
	}
	c.Logf("Current state: %v, interpreted as %v", cInfo["SubState"], curState)

	if curState != expectedState {
		for true {
			select {
			case <-ticker.C:
				cInfo, err := s.sdconn.GetUnitProperties(id.UnitNameFor())
				c.Assert(err, chk.IsNil)
				switch cInfo["SubState"] {
				case "running":
					curState = CONTAINER_STARTED
					if didStop {
						didRestart = true
					}
				case "dead", "failed", "stop-sigterm", "stop":
					didStop = true
					curState = CONTAINER_STOPPED
				}
				c.Logf("Current state: %v, interpreted as %v", cInfo["SubState"], curState)
			case <-time.After(CONTAINER_STATE_CHANGE_TIMEOUT):
				c.Logf("%v %v", didStop, didRestart)
				c.Log("Timed out during state change")
				c.Assert(1, chk.Equals, 2)
			}
			if (curState == expectedState) || (expectedState == CONTAINER_RESTARTED && didRestart == true) {
				break
			}
		}
	}

	switch {
	case expectedState == CONTAINER_STOPPED:
		for true {
			select {
			case <-ticker.C:
				_, err := s.dockerClient.GetContainer(id.ContainerFor(), false)
				if err != nil {
					return
				}
			case <-time.After(DOCKER_STATE_CHANGE_TIMEOUT):
				c.Log("Timed out waiting for docker container to stop")
				c.FailNow()
			}
		}
	case expectedState == CONTAINER_STARTED || expectedState == CONTAINER_RESTARTED:
		for true {
			select {
			case <-ticker.C:
				container, err := s.dockerClient.GetContainer(id.ContainerFor(), true)
				if err != nil {
					continue
				}
				c.Logf("Container state: %v. Info: %v", container.State.Running, container.State)
				if container.State.Running {
					return
				}
			case <-time.After(DOCKER_STATE_CHANGE_TIMEOUT):
				c.Log("Timed out waiting for docker container to start")
				c.FailNow()
			}
		}
	}
}
Example #19
0
func InitPreStart(dockerSocket string, id containers.Identifier, imageName string) error {
	var (
		err     error
		imgInfo *dc.Image
		d       *docker.DockerClient
	)

	_, socketActivationType, err := containers.GetSocketActivation(id)
	if err != nil {
		fmt.Printf("init_pre_start: Error while parsing unit file: %v\n", err)
		return err
	}

	if _, err = user.Lookup(id.LoginFor()); err != nil {
		if _, ok := err.(user.UnknownUserError); !ok {
			return err
		}
		if err = createUser(id); err != nil {
			return err
		}
	}

	if d, err = docker.GetConnection(dockerSocket); err != nil {
		return err
	}

	if imgInfo, err = d.GetImage(imageName); err != nil {
		return err
	}

	if err := os.MkdirAll(id.HomePath(), 0700); err != nil {
		return err
	}

	u, _ := user.Lookup(id.LoginFor())
	volumes := make([]string, 0, 10)
	for volPath := range imgInfo.Config.Volumes {
		volumes = append(volumes, volPath)
	}

	user := imgInfo.Config.User
	if user == "" {
		user = "******"
	}

	ports, err := containers.GetExistingPorts(id)
	if err != nil {
		fmt.Printf("container init pre-start: Unable to retrieve port mapping\n")
		return err
	}

	containerData := containers.ContainerInitScript{
		imgInfo.Config.User == "",
		user,
		u.Uid,
		u.Gid,
		strings.Join(imgInfo.Config.Cmd, " "),
		len(volumes) > 0,
		strings.Join(volumes, " "),
		ports,
		socketActivationType == "proxied",
	}

	file, _, err := utils.OpenFileExclusive(path.Join(id.RunPathFor(), "container-init.sh"), 0700)
	if err != nil {
		fmt.Printf("container init pre-start: Unable to open script file: %v\n", err)
		return err
	}
	defer file.Close()

	if erre := containers.ContainerInitTemplate.Execute(file, containerData); erre != nil {
		fmt.Printf("container init pre-start: Unable to output template: ", erre)
		return erre
	}
	if err := file.Close(); err != nil {
		return err
	}

	file, _, err = utils.OpenFileExclusive(path.Join(id.RunPathFor(), "container-cmd.sh"), 0705)
	if err != nil {
		fmt.Printf("container init pre-start: Unable to open cmd script file: %v\n", err)
		return err
	}
	defer file.Close()

	if erre := containers.ContainerCmdTemplate.Execute(file, containerData); erre != nil {
		fmt.Printf("container init pre-start: Unable to output cmd template: ", erre)
		return erre
	}
	if err := file.Close(); err != nil {
		return err
	}

	return nil
}
Example #20
0
func activeUnitPathFor(i containers.Identifier) string {
	return filepath.Join("/etc/systemd/system/container-active.target.wants", i.UnitNameFor())
}
// FIXME: Refactor into separate responsibilities for file creation, templating, and disk access
func generateAuthorizedKeys(id containers.Identifier, u *user.User, forceCreate, printToStdOut bool) error {
	var (
		err      error
		sshKeys  []string
		destFile *os.File
		srcFile  *os.File
		w        *bufio.Writer
	)

	var authorizedKeysPortSpec string
	ports, err := containers.GetExistingPorts(id)
	if err != nil {
		fmt.Errorf("container init pre-start: Unable to retrieve port mapping")
		return err
	}

	for _, port := range ports {
		authorizedKeysPortSpec += fmt.Sprintf("permitopen=\"127.0.0.1:%v\",", port.External)
	}

	sshKeys, err = filepath.Glob(path.Join(SshAccessBasePath(id), "*"))

	if !printToStdOut {
		os.MkdirAll(id.HomePath(), 0700)
		os.Mkdir(path.Join(id.HomePath(), ".ssh"), 0700)
		authKeysPath := id.AuthKeysPathFor()
		if _, err = os.Stat(authKeysPath); err != nil {
			if !os.IsNotExist(err) {
				return err
			}
		} else {
			if forceCreate {
				os.Remove(authKeysPath)
			} else {
				return nil
			}
		}

		if destFile, err = os.Create(authKeysPath); err != nil {
			return err
		}
		defer destFile.Close()
		w = bufio.NewWriter(destFile)
	} else {
		w = bufio.NewWriter(os.Stdout)
	}

	for _, keyFile := range sshKeys {
		s, err := os.Stat(keyFile)
		if err != nil {
			continue
		}
		if s.IsDir() {
			continue
		}

		srcFile, err = os.Open(keyFile)
		defer srcFile.Close()
		w.WriteString(fmt.Sprintf("command=\"/usr/bin/switchns\",%vno-agent-forwarding,no-X11-forwarding ", authorizedKeysPortSpec))
		io.Copy(w, srcFile)
		w.WriteString("\n")
	}
	w.Flush()

	if !printToStdOut {
		uid, _ := strconv.Atoi(u.Uid)
		gid, _ := strconv.Atoi(u.Gid)

		for _, path := range []string{
			id.HomePath(),
			filepath.Join(id.HomePath(), ".ssh"),
			filepath.Join(id.HomePath(), ".ssh", "authorized_keys"),
		} {
			if err := os.Chown(path, uid, gid); err != nil {
				return err
			}
		}

		if err := selinux.RestoreCon(id.BaseHomePath(), true); err != nil {
			return err
		}
	}
	return nil
}
Example #22
0
func InitPostStart(dockerSocket string, id containers.Identifier) error {
	var (
		u         *user.User
		container *dc.Container
		err       error
		d         *docker.DockerClient
	)

	if u, err = user.Lookup(id.LoginFor()); err == nil {
		if err := ssh.GenerateAuthorizedKeysFor(u, true, false); err != nil {
			log.Print(err.Error())
		}
	} else {
		log.Print(err.Error())
	}

	if d, err = docker.GetConnection(dockerSocket); err != nil {
		return err
	}

	if file, err := os.Open(id.NetworkLinksPathFor()); err == nil {
		defer file.Close()

		const ContainerInterval = time.Second / 10
		const ContainerWait = time.Second * 15
		for i := 0; i < int(ContainerWait/ContainerInterval); i++ {
			if container, err = d.InspectContainer(id.ContainerFor()); err != nil {
				if err == docker.ErrNoSuchContainer {
					//log.Printf("Waiting for container to be available.")
					time.Sleep(ContainerInterval)
					continue
				}
				return err
			}
			if container.State.Running && container.State.Pid != 0 {
				break
			} else {
				//log.Printf("Waiting for container to report available.")
				time.Sleep(ContainerInterval)
			}
		}

		if container == nil {
			return fmt.Errorf("container %s was not visible through Docker before timeout", id.ContainerFor())
		}

		pid, err := d.ChildProcessForContainer(container)
		if err != nil {
			return err
		}
		if pid <= 1 {
			return errors.New("child PID is not correct")
		}
		log.Printf("Updating network namespaces for %d", pid)
		if err := updateNamespaceNetworkLinks(pid, file); err != nil {
			return err
		}
	}

	return nil
}
Example #23
0
func (s *IntegrationTestSuite) getContainerPid(id containers.Identifier) int {
	container, _ := s.dockerClient.GetContainer(id.ContainerFor(), true)
	return container.State.Pid
}