func createUser(id containers.Identifier) error {
cmd := exec.Command("/usr/sbin/useradd", id.LoginFor(), "-m", "-d", id.HomePath(), "-c", "Container user")
if out, err := cmd.CombinedOutput(); err != nil {
log.Println(out)
return err
}
selinux.RestoreCon(id.HomePath(), true)
return nil
}
func InitPostStart(dockerSocket string, id containers.Identifier) error {
var (
u *user.User
container *dc.Container
err error
d *docker.DockerClient
)
if u, err = user.Lookup(id.LoginFor()); err == nil {
if err := ssh.GenerateAuthorizedKeysFor(u, true, false); err != nil {
log.Print(err.Error())
}
} else {
log.Print(err.Error())
}
if d, err = docker.GetConnection(dockerSocket); err != nil {
return err
}
if file, err := os.Open(id.NetworkLinksPathFor()); err == nil {
defer file.Close()
const ContainerInterval = time.Second / 3
const ContainerWait = time.Second * 12
for i := 0; i < int(ContainerWait/ContainerInterval); i++ {
if container, err = d.GetContainer(id.ContainerFor(), true); err != nil {
return err
}
if container.State.Running {
break
} else {
log.Printf("Waiting for container to run.")
time.Sleep(ContainerInterval)
}
}
pid, err := d.ChildProcessForContainer(container)
if err != nil {
return err
}
if pid < 2 {
return errors.New("support: child PID is not correct")
}
log.Printf("Updating network namespaces for %d", pid)
if err := updateNamespaceNetworkLinks(pid, file); err != nil {
return err
}
}
return nil
}
func InitPreStart(dockerSocket string, id containers.Identifier, imageName string) error {
var (
err error
imgInfo *dc.Image
d *docker.DockerClient
)
_, socketActivationType, err := containers.GetSocketActivation(id)
if err != nil {
fmt.Printf("init_pre_start: Error while parsing unit file: %v\n", err)
return err
}
if _, err = user.Lookup(id.LoginFor()); err != nil {
if _, ok := err.(user.UnknownUserError); !ok {
return err
}
if err = createUser(id); err != nil {
return err
}
}
if d, err = docker.GetConnection(dockerSocket); err != nil {
return err
}
if imgInfo, err = d.GetImage(imageName); err != nil {
return err
}
if err := os.MkdirAll(id.HomePath(), 0700); err != nil {
return err
}
u, _ := user.Lookup(id.LoginFor())
volumes := make([]string, 0, 10)
for volPath := range imgInfo.Config.Volumes {
volumes = append(volumes, volPath)
}
user := imgInfo.Config.User
if user == "" {
user = "******"
}
ports, err := containers.GetExistingPorts(id)
if err != nil {
fmt.Printf("container init pre-start: Unable to retrieve port mapping\n")
return err
}
containerData := containers.ContainerInitScript{
imgInfo.Config.User == "",
user,
u.Uid,
u.Gid,
strings.Join(imgInfo.Config.Cmd, " "),
len(volumes) > 0,
strings.Join(volumes, " "),
ports,
socketActivationType == "proxied",
}
file, _, err := utils.OpenFileExclusive(path.Join(id.RunPathFor(), "container-init.sh"), 0700)
if err != nil {
fmt.Printf("container init pre-start: Unable to open script file: %v\n", err)
return err
}
defer file.Close()
if erre := containers.ContainerInitTemplate.Execute(file, containerData); erre != nil {
fmt.Printf("container init pre-start: Unable to output template: ", erre)
return erre
}
if err := file.Close(); err != nil {
return err
}
file, _, err = utils.OpenFileExclusive(path.Join(id.RunPathFor(), "container-cmd.sh"), 0705)
if err != nil {
fmt.Printf("container init pre-start: Unable to open cmd script file: %v\n", err)
return err
}
defer file.Close()
if erre := containers.ContainerCmdTemplate.Execute(file, containerData); erre != nil {
fmt.Printf("container init pre-start: Unable to output cmd template: ", erre)
return erre
}
if err := file.Close(); err != nil {
return err
}
return nil
}
func InitPostStart(dockerSocket string, id containers.Identifier) error {
var (
u *user.User
container *dc.Container
err error
d *docker.DockerClient
)
if u, err = user.Lookup(id.LoginFor()); err == nil {
if err := ssh.GenerateAuthorizedKeysFor(u, true, false); err != nil {
log.Print(err.Error())
}
} else {
log.Print(err.Error())
}
if d, err = docker.GetConnection(dockerSocket); err != nil {
return err
}
if file, err := os.Open(id.NetworkLinksPathFor()); err == nil {
defer file.Close()
const ContainerInterval = time.Second / 10
const ContainerWait = time.Second * 15
for i := 0; i < int(ContainerWait/ContainerInterval); i++ {
if container, err = d.InspectContainer(id.ContainerFor()); err != nil {
if err == docker.ErrNoSuchContainer {
//log.Printf("Waiting for container to be available.")
time.Sleep(ContainerInterval)
continue
}
return err
}
if container.State.Running && container.State.Pid != 0 {
break
} else {
//log.Printf("Waiting for container to report available.")
time.Sleep(ContainerInterval)
}
}
if container == nil {
return fmt.Errorf("container %s was not visible through Docker before timeout", id.ContainerFor())
}
pid, err := d.ChildProcessForContainer(container)
if err != nil {
return err
}
if pid <= 1 {
return errors.New("child PID is not correct")
}
log.Printf("Updating network namespaces for %d", pid)
if err := updateNamespaceNetworkLinks(pid, file); err != nil {
return err
}
}
return nil
}
