mirror of
https://github.com/opencontainers/runc.git
synced 2026-07-11 06:03:57 +08:00
Michael Crosby
549f508d5b
This changes the namespace configuration on the config to include the name of the namespace along with an optional path. This path is used to point to a file of another namespace for the namespace so that it can be joined in place of the empty, initialized namespace. Signed-off-by: Michael Crosby <crosbymichael@gmail.com>
107 lines
4.3 KiB
Go
107 lines
4.3 KiB
Go
package libcontainer
|
|
|
|
import (
|
|
"github.com/docker/libcontainer/cgroups"
|
|
"github.com/docker/libcontainer/mount"
|
|
"github.com/docker/libcontainer/network"
|
|
)
|
|
|
|
type MountConfig mount.MountConfig
|
|
|
|
type Network network.Network
|
|
|
|
// Namespace defines configuration for each namespace. It specifies an
|
|
// alternate path that is able to be joined via setns.
|
|
type Namespace struct {
|
|
Name string `json:"name"`
|
|
Path string `json:"path,omitempty"`
|
|
}
|
|
|
|
// Config defines configuration options for executing a process inside a contained environment.
|
|
type Config struct {
|
|
// Mount specific options.
|
|
MountConfig *MountConfig `json:"mount_config,omitempty"`
|
|
|
|
// Pathname to container's root filesystem
|
|
RootFs string `json:"root_fs,omitempty"`
|
|
|
|
// Hostname optionally sets the container's hostname if provided
|
|
Hostname string `json:"hostname,omitempty"`
|
|
|
|
// User will set the uid and gid of the executing process running inside the container
|
|
User string `json:"user,omitempty"`
|
|
|
|
// WorkingDir will change the processes current working directory inside the container's rootfs
|
|
WorkingDir string `json:"working_dir,omitempty"`
|
|
|
|
// Env will populate the processes environment with the provided values
|
|
// Any values from the parent processes will be cleared before the values
|
|
// provided in Env are provided to the process
|
|
Env []string `json:"environment,omitempty"`
|
|
|
|
// Tty when true will allocate a pty slave on the host for access by the container's process
|
|
// and ensure that it is mounted inside the container's rootfs
|
|
Tty bool `json:"tty,omitempty"`
|
|
|
|
// Namespaces specifies the container's namespaces that it should setup when cloning the init process
|
|
// If a namespace is not provided that namespace is shared from the container's parent process
|
|
Namespaces []Namespace `json:"namespaces,omitempty"`
|
|
|
|
// Capabilities specify the capabilities to keep when executing the process inside the container
|
|
// All capbilities not specified will be dropped from the processes capability mask
|
|
Capabilities []string `json:"capabilities,omitempty"`
|
|
|
|
// Networks specifies the container's network setup to be created
|
|
Networks []*Network `json:"networks,omitempty"`
|
|
|
|
// Routes can be specified to create entries in the route table as the container is started
|
|
Routes []*Route `json:"routes,omitempty"`
|
|
|
|
// Cgroups specifies specific cgroup settings for the various subsystems that the container is
|
|
// placed into to limit the resources the container has available
|
|
Cgroups *cgroups.Cgroup `json:"cgroups,omitempty"`
|
|
|
|
// AppArmorProfile specifies the profile to apply to the process running in the container and is
|
|
// change at the time the process is execed
|
|
AppArmorProfile string `json:"apparmor_profile,omitempty"`
|
|
|
|
// ProcessLabel specifies the label to apply to the process running in the container. It is
|
|
// commonly used by selinux
|
|
ProcessLabel string `json:"process_label,omitempty"`
|
|
|
|
// RestrictSys will remount /proc/sys, /sys, and mask over sysrq-trigger as well as /proc/irq and
|
|
// /proc/bus
|
|
RestrictSys bool `json:"restrict_sys,omitempty"`
|
|
|
|
// Rlimits specifies the resource limits, such as max open files, to set in the container
|
|
// If Rlimits are not set, the container will inherit rlimits from the parent process
|
|
Rlimits []Rlimit `json:"rlimits,omitempty"`
|
|
}
|
|
|
|
// Routes can be specified to create entries in the route table as the container is started
|
|
//
|
|
// All of destination, source, and gateway should be either IPv4 or IPv6.
|
|
// One of the three options must be present, and ommitted entries will use their
|
|
// IP family default for the route table. For IPv4 for example, setting the
|
|
// gateway to 1.2.3.4 and the interface to eth0 will set up a standard
|
|
// destination of 0.0.0.0(or *) when viewed in the route table.
|
|
type Route struct {
|
|
// Sets the destination and mask, should be a CIDR. Accepts IPv4 and IPv6
|
|
Destination string `json:"destination,omitempty"`
|
|
|
|
// Sets the source and mask, should be a CIDR. Accepts IPv4 and IPv6
|
|
Source string `json:"source,omitempty"`
|
|
|
|
// Sets the gateway. Accepts IPv4 and IPv6
|
|
Gateway string `json:"gateway,omitempty"`
|
|
|
|
// The device to set this route up for, for example: eth0
|
|
InterfaceName string `json:"interface_name,omitempty"`
|
|
}
|
|
|
|
type Rlimit struct {
|
|
Type int `json:"type,omitempty"`
|
|
Hard uint64 `json:"hard,omitempty"`
|
|
Soft uint64 `json:"soft,omitempty"`
|
|
}
|