mirror of
https://github.com/opencontainers/runc.git
synced 2026-07-10 21:53:57 +08:00
06f789cf26
This PR decomposes `libcontainer/configs.Config.Rootless bool` into `RootlessEUID bool` and `RootlessCgroups bool`, so as to make "runc-in-userns" to be more compatible with "rootful" runc. `RootlessEUID` denotes that runc is being executed as a non-root user (euid != 0) in the current user namespace. `RootlessEUID` is almost identical to the former `Rootless` except cgroups stuff. `RootlessCgroups` denotes that runc is unlikely to have the full access to cgroups. `RootlessCgroups` is set to false if runc is executed as the root (euid == 0) in the initial namespace. Otherwise `RootlessCgroups` is set to true. (Hint: if `RootlessEUID` is true, `RootlessCgroups` becomes true as well) When runc is executed as the root (euid == 0) in an user namespace (e.g. by Docker-in-LXD, Podman, Usernetes), `RootlessEUID` is set to false but `RootlessCgroups` is set to true. So, "runc-in-userns" behaves almost same as "rootful" runc except that cgroups errors are ignored. This PR does not have any impact on CLI flags and `state.json`. Note about CLI: * Now `runc --rootless=(auto|true|false)` CLI flag is only used for setting `RootlessCgroups`. * Now `runc spec --rootless` is only required when `RootlessEUID` is set to true. For runc-in-userns, `runc spec` without `--rootless` should work, when sufficient numbers of UID/GID are mapped. Note about `$XDG_RUNTIME_DIR` (e.g. `/run/user/1000`): * `$XDG_RUNTIME_DIR` is ignored if runc is being executed as the root (euid == 0) in the initial namespace, for backward compatibility. (`/run/runc` is used) * If runc is executed as the root (euid == 0) in an user namespace, `$XDG_RUNTIME_DIR` is honored if `$USER != "" && $USER != "root"`. This allows unprivileged users to allow execute runc as the root in userns, without mounting writable `/run/runc`. Note about `state.json`: * `rootless` is set to true when `RootlessEUID == true && RootlessCgroups == true`. Signed-off-by: Akihiro Suda <suda.akihiro@lab.ntt.co.jp>
173 lines
4.6 KiB
Go
173 lines
4.6 KiB
Go
package main
|
|
|
|
import (
|
|
"fmt"
|
|
"io"
|
|
"os"
|
|
"strings"
|
|
|
|
"github.com/opencontainers/runtime-spec/specs-go"
|
|
|
|
"github.com/sirupsen/logrus"
|
|
"github.com/urfave/cli"
|
|
)
|
|
|
|
// version will be populated by the Makefile, read from
|
|
// VERSION file of the source code.
|
|
var version = ""
|
|
|
|
// gitCommit will be the hash that the binary was built from
|
|
// and will be populated by the Makefile
|
|
var gitCommit = ""
|
|
|
|
const (
|
|
specConfig = "config.json"
|
|
usage = `Open Container Initiative runtime
|
|
|
|
runc is a command line client for running applications packaged according to
|
|
the Open Container Initiative (OCI) format and is a compliant implementation of the
|
|
Open Container Initiative specification.
|
|
|
|
runc integrates well with existing process supervisors to provide a production
|
|
container runtime environment for applications. It can be used with your
|
|
existing process monitoring tools and the container will be spawned as a
|
|
direct child of the process supervisor.
|
|
|
|
Containers are configured using bundles. A bundle for a container is a directory
|
|
that includes a specification file named "` + specConfig + `" and a root filesystem.
|
|
The root filesystem contains the contents of the container.
|
|
|
|
To start a new instance of a container:
|
|
|
|
# runc run [ -b bundle ] <container-id>
|
|
|
|
Where "<container-id>" is your name for the instance of the container that you
|
|
are starting. The name you provide for the container instance must be unique on
|
|
your host. Providing the bundle directory using "-b" is optional. The default
|
|
value for "bundle" is the current directory.`
|
|
)
|
|
|
|
func main() {
|
|
app := cli.NewApp()
|
|
app.Name = "runc"
|
|
app.Usage = usage
|
|
|
|
var v []string
|
|
if version != "" {
|
|
v = append(v, version)
|
|
}
|
|
if gitCommit != "" {
|
|
v = append(v, fmt.Sprintf("commit: %s", gitCommit))
|
|
}
|
|
v = append(v, fmt.Sprintf("spec: %s", specs.Version))
|
|
app.Version = strings.Join(v, "\n")
|
|
|
|
root := "/run/runc"
|
|
if shouldHonorXDGRuntimeDir() {
|
|
if runtimeDir := os.Getenv("XDG_RUNTIME_DIR"); runtimeDir != "" {
|
|
root = runtimeDir + "/runc"
|
|
// According to the XDG specification, we need to set anything in
|
|
// XDG_RUNTIME_DIR to have a sticky bit if we don't want it to get
|
|
// auto-pruned.
|
|
if err := os.MkdirAll(root, 0700); err != nil {
|
|
fatal(err)
|
|
}
|
|
if err := os.Chmod(root, 0700|os.ModeSticky); err != nil {
|
|
fatal(err)
|
|
}
|
|
}
|
|
}
|
|
|
|
app.Flags = []cli.Flag{
|
|
cli.BoolFlag{
|
|
Name: "debug",
|
|
Usage: "enable debug output for logging",
|
|
},
|
|
cli.StringFlag{
|
|
Name: "log",
|
|
Value: "/dev/null",
|
|
Usage: "set the log file path where internal debug information is written",
|
|
},
|
|
cli.StringFlag{
|
|
Name: "log-format",
|
|
Value: "text",
|
|
Usage: "set the format used by logs ('text' (default), or 'json')",
|
|
},
|
|
cli.StringFlag{
|
|
Name: "root",
|
|
Value: root,
|
|
Usage: "root directory for storage of container state (this should be located in tmpfs)",
|
|
},
|
|
cli.StringFlag{
|
|
Name: "criu",
|
|
Value: "criu",
|
|
Usage: "path to the criu binary used for checkpoint and restore",
|
|
},
|
|
cli.BoolFlag{
|
|
Name: "systemd-cgroup",
|
|
Usage: "enable systemd cgroup support, expects cgroupsPath to be of form \"slice:prefix:name\" for e.g. \"system.slice:runc:434234\"",
|
|
},
|
|
cli.StringFlag{
|
|
Name: "rootless",
|
|
Value: "auto",
|
|
Usage: "ignore cgroup permission errors ('true', 'false', or 'auto')",
|
|
},
|
|
}
|
|
app.Commands = []cli.Command{
|
|
checkpointCommand,
|
|
createCommand,
|
|
deleteCommand,
|
|
eventsCommand,
|
|
execCommand,
|
|
initCommand,
|
|
killCommand,
|
|
listCommand,
|
|
pauseCommand,
|
|
psCommand,
|
|
restoreCommand,
|
|
resumeCommand,
|
|
runCommand,
|
|
specCommand,
|
|
startCommand,
|
|
stateCommand,
|
|
updateCommand,
|
|
}
|
|
app.Before = func(context *cli.Context) error {
|
|
if context.GlobalBool("debug") {
|
|
logrus.SetLevel(logrus.DebugLevel)
|
|
}
|
|
if path := context.GlobalString("log"); path != "" {
|
|
f, err := os.OpenFile(path, os.O_CREATE|os.O_WRONLY|os.O_APPEND|os.O_SYNC, 0666)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
logrus.SetOutput(f)
|
|
}
|
|
switch context.GlobalString("log-format") {
|
|
case "text":
|
|
// retain logrus's default.
|
|
case "json":
|
|
logrus.SetFormatter(new(logrus.JSONFormatter))
|
|
default:
|
|
return fmt.Errorf("unknown log-format %q", context.GlobalString("log-format"))
|
|
}
|
|
return nil
|
|
}
|
|
// If the command returns an error, cli takes upon itself to print
|
|
// the error on cli.ErrWriter and exit.
|
|
// Use our own writer here to ensure the log gets sent to the right location.
|
|
cli.ErrWriter = &FatalWriter{cli.ErrWriter}
|
|
if err := app.Run(os.Args); err != nil {
|
|
fatal(err)
|
|
}
|
|
}
|
|
|
|
type FatalWriter struct {
|
|
cliErrWriter io.Writer
|
|
}
|
|
|
|
func (f *FatalWriter) Write(p []byte) (n int, err error) {
|
|
logrus.Error(string(p))
|
|
return f.cliErrWriter.Write(p)
|
|
}
|