From 19099e065da7c810f93e83d68c0776c2336e5e03 Mon Sep 17 00:00:00 2001 From: "Daniel, Dao Quang Minh" Date: Thu, 11 Dec 2014 03:15:42 -0500 Subject: [PATCH 1/3] add spec for exec a new process inside a container document desired execin process behavior for v1 container specification Docker-DCO-1.1-Signed-off-by: Daniel, Dao Quang Minh (github: dqminh) --- SPEC.md | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) diff --git a/SPEC.md b/SPEC.md index f5afaadc5..2097c7e1c 100644 --- a/SPEC.md +++ b/SPEC.md @@ -318,4 +318,27 @@ a container. | Resume | Resume all processes inside the container if paused | | Exec | Execute a new process inside of the container ( requires setns ) | +### Execute a new process inside of a running container. +User can execute a new process inside of a running container. Any binaries to be +executed must be contained within the container's rootfs. + +The started process is jailed inside the current container's rootfs. Any changes +made by the process to the container's filesystem will be persisted after the +process finished executing. + +The started process will join the container's existing namespaces. When the +container is paused, the process will also be paused and will resume when +the container is unpaused. The started process will only run when the container's +primary process (PID 1) is running, and will not be restarted when the container +is restarted. + +The started process will have its own cgroups nested inside the container's +cgroups. This is used for process tracking and optionally resource allocation +handling for the new process. Freezer cgroup is required, the rest of the cgroups +are optional. The process executor must place its pid inside the correct +cgroups before starting the process. This is done so that no child processes or +threads can escape the cgroups. + +When the process stopped, all child processes spawned by the process will be +stopped and the process's cgroups will be removed. From e9c1b0144ae784df9d26f59bfadd8cb2fc3a1d69 Mon Sep 17 00:00:00 2001 From: "Daniel, Dao Quang Minh" Date: Thu, 11 Dec 2014 13:45:07 -0500 Subject: [PATCH 2/3] fix some grammar errors Docker-DCO-1.1-Signed-off-by: Daniel, Dao Quang Minh (github: dqminh) --- SPEC.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/SPEC.md b/SPEC.md index 2097c7e1c..85b575023 100644 --- a/SPEC.md +++ b/SPEC.md @@ -321,13 +321,13 @@ a container. ### Execute a new process inside of a running container. User can execute a new process inside of a running container. Any binaries to be -executed must be contained within the container's rootfs. +executed must be accessible within the container's rootfs. -The started process is jailed inside the current container's rootfs. Any changes -made by the process to the container's filesystem will be persisted after the +The started process will run inside the container's rootfs. Any changes +made by the process to the container's filesystem will persist after the process finished executing. -The started process will join the container's existing namespaces. When the +The started process will join all the container's existing namespaces. When the container is paused, the process will also be paused and will resume when the container is unpaused. The started process will only run when the container's primary process (PID 1) is running, and will not be restarted when the container From eb2ae34c80f6b8ffb1bdfc55287d967c6e18cd81 Mon Sep 17 00:00:00 2001 From: "Daniel, Dao Quang Minh" Date: Thu, 11 Dec 2014 13:59:10 -0500 Subject: [PATCH 3/3] move cgroup requirements to planned additions also document that the executor will only try to remove all the children in a best-effort way. Docker-DCO-1.1-Signed-off-by: Daniel, Dao Quang Minh (github: dqminh) --- SPEC.md | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/SPEC.md b/SPEC.md index 85b575023..d83d758dd 100644 --- a/SPEC.md +++ b/SPEC.md @@ -333,6 +333,8 @@ the container is unpaused. The started process will only run when the container primary process (PID 1) is running, and will not be restarted when the container is restarted. +#### Planned additions + The started process will have its own cgroups nested inside the container's cgroups. This is used for process tracking and optionally resource allocation handling for the new process. Freezer cgroup is required, the rest of the cgroups @@ -340,5 +342,5 @@ are optional. The process executor must place its pid inside the correct cgroups before starting the process. This is done so that no child processes or threads can escape the cgroups. -When the process stopped, all child processes spawned by the process will be -stopped and the process's cgroups will be removed. +When the process is stopped, the process executor will try (in a best-effort way) +to stop all its children and remove the sub-cgroups.