// TODO(vishh): This is part of the libcontainer API and it does much more than just namespaces related work. // Move this to libcontainer package. // Exec performs setup outside of a namespace so that a container can be // executed. Exec is a high level function for working with container namespaces. func Exec(container *libcontainer.Config, stdin io.Reader, stdout, stderr io.Writer, console string, rootfs, dataPath string, args []string, createCommand CreateCommand, startCallback func()) (int, error) { var ( err error ) // create a pipe so that we can syncronize with the namespaced process and // pass the veth name to the child syncPipe, err := syncpipe.NewSyncPipe() if err != nil { return -1, err } defer syncPipe.Close() command := createCommand(container, console, rootfs, dataPath, os.Args[0], syncPipe.Child(), args) // Note: these are only used in non-tty mode // if there is a tty for the container it will be opened within the namespace and the // fds will be duped to stdin, stdiout, and stderr command.Stdin = stdin command.Stdout = stdout command.Stderr = stderr if err := command.Start(); err != nil { return -1, err } // Now we passed the pipe to the child, close our side syncPipe.CloseChild() started, err := system.GetProcessStartTime(command.Process.Pid) if err != nil { return -1, err } // Do this before syncing with child so that no children // can escape the cgroup cgroupRef, err := SetupCgroups(container, command.Process.Pid) if err != nil { command.Process.Kill() command.Wait() return -1, err } defer cgroupRef.Cleanup() cgroupPaths, err := cgroupRef.Paths() if err != nil { command.Process.Kill() command.Wait() return -1, err } var networkState network.NetworkState if err := InitializeNetworking(container, command.Process.Pid, syncPipe, &networkState); err != nil { command.Process.Kill() command.Wait() return -1, err } state := &libcontainer.State{ InitPid: command.Process.Pid, InitStartTime: started, NetworkState: networkState, CgroupPaths: cgroupPaths, } if err := libcontainer.SaveState(dataPath, state); err != nil { command.Process.Kill() command.Wait() return -1, err } defer libcontainer.DeleteState(dataPath) // Sync with child if err := syncPipe.ReadFromChild(); err != nil { command.Process.Kill() command.Wait() return -1, err } if startCallback != nil { startCallback() } if err := command.Wait(); err != nil { if _, ok := err.(*exec.ExitError); !ok { return -1, err } } return command.ProcessState.Sys().(syscall.WaitStatus).ExitStatus(), nil }
// ExecIn reexec's the initPath with the argv 0 rewrite to "nsenter" so that it is able to run the // setns code in a single threaded environment joining the existing containers' namespaces. func ExecIn(container *libcontainer.Config, state *libcontainer.State, userArgs []string, initPath, action string, stdin io.Reader, stdout, stderr io.Writer, console string, startCallback func(*exec.Cmd)) (int, error) { args := []string{fmt.Sprintf("nsenter-%s", action), "--nspid", strconv.Itoa(state.InitPid)} if console != "" { args = append(args, "--console", console) } cmd := &exec.Cmd{ Path: initPath, Args: append(args, append([]string{"--"}, userArgs...)...), } if filepath.Base(initPath) == initPath { if lp, err := exec.LookPath(initPath); err == nil { cmd.Path = lp } } pipe, err := syncpipe.NewSyncPipe() if err != nil { return -1, err } defer pipe.Close() // Note: these are only used in non-tty mode // if there is a tty for the container it will be opened within the namespace and the // fds will be duped to stdin, stdiout, and stderr cmd.Stdin = stdin cmd.Stdout = stdout cmd.Stderr = stderr cmd.ExtraFiles = []*os.File{pipe.Child()} if err := cmd.Start(); err != nil { return -1, err } pipe.CloseChild() // Enter cgroups. if err := EnterCgroups(state, cmd.Process.Pid); err != nil { return -1, err } if err := pipe.SendToChild(container); err != nil { cmd.Process.Kill() cmd.Wait() return -1, err } if startCallback != nil { startCallback(cmd) } if err := cmd.Wait(); err != nil { if _, ok := err.(*exec.ExitError); !ok { return -1, err } } return cmd.ProcessState.Sys().(syscall.WaitStatus).ExitStatus(), nil }