func createUser(id containers.Identifier) error { cmd := exec.Command("/usr/sbin/useradd", id.LoginFor(), "-m", "-d", id.HomePath(), "-c", "Container user") if out, err := cmd.CombinedOutput(); err != nil { log.Println(out) return err } selinux.RestoreCon(id.HomePath(), true) return nil }
func InitPostStart(dockerSocket string, id containers.Identifier) error { var ( u *user.User container *dc.Container err error d *docker.DockerClient ) if u, err = user.Lookup(id.LoginFor()); err == nil { if err := ssh.GenerateAuthorizedKeysFor(u, true, false); err != nil { log.Print(err.Error()) } } else { log.Print(err.Error()) } if d, err = docker.GetConnection(dockerSocket); err != nil { return err } if file, err := os.Open(id.NetworkLinksPathFor()); err == nil { defer file.Close() const ContainerInterval = time.Second / 3 const ContainerWait = time.Second * 12 for i := 0; i < int(ContainerWait/ContainerInterval); i++ { if container, err = d.GetContainer(id.ContainerFor(), true); err != nil { return err } if container.State.Running { break } else { log.Printf("Waiting for container to run.") time.Sleep(ContainerInterval) } } pid, err := d.ChildProcessForContainer(container) if err != nil { return err } if pid < 2 { return errors.New("support: child PID is not correct") } log.Printf("Updating network namespaces for %d", pid) if err := updateNamespaceNetworkLinks(pid, file); err != nil { return err } } return nil }
func InitPreStart(dockerSocket string, id containers.Identifier, imageName string) error { var ( err error imgInfo *dc.Image d *docker.DockerClient ) _, socketActivationType, err := containers.GetSocketActivation(id) if err != nil { fmt.Printf("init_pre_start: Error while parsing unit file: %v\n", err) return err } if _, err = user.Lookup(id.LoginFor()); err != nil { if _, ok := err.(user.UnknownUserError); !ok { return err } if err = createUser(id); err != nil { return err } } if d, err = docker.GetConnection(dockerSocket); err != nil { return err } if imgInfo, err = d.GetImage(imageName); err != nil { return err } if err := os.MkdirAll(id.HomePath(), 0700); err != nil { return err } u, _ := user.Lookup(id.LoginFor()) volumes := make([]string, 0, 10) for volPath := range imgInfo.Config.Volumes { volumes = append(volumes, volPath) } user := imgInfo.Config.User if user == "" { user = "******" } ports, err := containers.GetExistingPorts(id) if err != nil { fmt.Printf("container init pre-start: Unable to retrieve port mapping\n") return err } containerData := containers.ContainerInitScript{ imgInfo.Config.User == "", user, u.Uid, u.Gid, strings.Join(imgInfo.Config.Cmd, " "), len(volumes) > 0, strings.Join(volumes, " "), ports, socketActivationType == "proxied", } file, _, err := utils.OpenFileExclusive(path.Join(id.RunPathFor(), "container-init.sh"), 0700) if err != nil { fmt.Printf("container init pre-start: Unable to open script file: %v\n", err) return err } defer file.Close() if erre := containers.ContainerInitTemplate.Execute(file, containerData); erre != nil { fmt.Printf("container init pre-start: Unable to output template: ", erre) return erre } if err := file.Close(); err != nil { return err } file, _, err = utils.OpenFileExclusive(path.Join(id.RunPathFor(), "container-cmd.sh"), 0705) if err != nil { fmt.Printf("container init pre-start: Unable to open cmd script file: %v\n", err) return err } defer file.Close() if erre := containers.ContainerCmdTemplate.Execute(file, containerData); erre != nil { fmt.Printf("container init pre-start: Unable to output cmd template: ", erre) return erre } if err := file.Close(); err != nil { return err } return nil }
func InitPostStart(dockerSocket string, id containers.Identifier) error { var ( u *user.User container *dc.Container err error d *docker.DockerClient ) if u, err = user.Lookup(id.LoginFor()); err == nil { if err := ssh.GenerateAuthorizedKeysFor(u, true, false); err != nil { log.Print(err.Error()) } } else { log.Print(err.Error()) } if d, err = docker.GetConnection(dockerSocket); err != nil { return err } if file, err := os.Open(id.NetworkLinksPathFor()); err == nil { defer file.Close() const ContainerInterval = time.Second / 10 const ContainerWait = time.Second * 15 for i := 0; i < int(ContainerWait/ContainerInterval); i++ { if container, err = d.InspectContainer(id.ContainerFor()); err != nil { if err == docker.ErrNoSuchContainer { //log.Printf("Waiting for container to be available.") time.Sleep(ContainerInterval) continue } return err } if container.State.Running && container.State.Pid != 0 { break } else { //log.Printf("Waiting for container to report available.") time.Sleep(ContainerInterval) } } if container == nil { return fmt.Errorf("container %s was not visible through Docker before timeout", id.ContainerFor()) } pid, err := d.ChildProcessForContainer(container) if err != nil { return err } if pid <= 1 { return errors.New("child PID is not correct") } log.Printf("Updating network namespaces for %d", pid) if err := updateNamespaceNetworkLinks(pid, file); err != nil { return err } } return nil }