mirror of
https://github.com/opencontainers/runc.git
synced 2026-07-10 21:53:57 +08:00
Wei Fu
94505a046a
The container manager like containerd-shim can't use cgroup.kill feature or freeze all the processes in cgroup to terminate the exec init process. It's unsafe to call kill(2) since the pid can be recycled. It's good to provide the pidfd of init process through the pidfd-socket. It's similar to the console-socket. With the pidfd, the container manager like containerd-shim can send the signal to target process safely. And for the standard init process, we can have polling support to get exit event instead of blocking on wait4. Signed-off-by: Wei Fu <fuweid89@gmail.com>
76 lines
2.6 KiB
Go
76 lines
2.6 KiB
Go
package main
|
|
|
|
import (
|
|
"fmt"
|
|
"os"
|
|
|
|
"github.com/urfave/cli"
|
|
)
|
|
|
|
var createCommand = cli.Command{
|
|
Name: "create",
|
|
Usage: "create a container",
|
|
ArgsUsage: `<container-id>
|
|
|
|
Where "<container-id>" is your name for the instance of the container that you
|
|
are starting. The name you provide for the container instance must be unique on
|
|
your host.`,
|
|
Description: `The create command creates an instance of a container for a bundle. The bundle
|
|
is a directory with a specification file named "` + specConfig + `" and a root
|
|
filesystem.
|
|
|
|
The specification file includes an args parameter. The args parameter is used
|
|
to specify command(s) that get run when the container is started. To change the
|
|
command(s) that get executed on start, edit the args parameter of the spec. See
|
|
"runc spec --help" for more explanation.`,
|
|
Flags: []cli.Flag{
|
|
cli.StringFlag{
|
|
Name: "bundle, b",
|
|
Value: "",
|
|
Usage: `path to the root of the bundle directory, defaults to the current directory`,
|
|
},
|
|
cli.StringFlag{
|
|
Name: "console-socket",
|
|
Value: "",
|
|
Usage: "path to an AF_UNIX socket which will receive a file descriptor referencing the master end of the console's pseudoterminal",
|
|
},
|
|
cli.StringFlag{
|
|
Name: "pidfd-socket",
|
|
Usage: "path to an AF_UNIX socket which will receive a file descriptor referencing the init process",
|
|
},
|
|
cli.StringFlag{
|
|
Name: "pid-file",
|
|
Value: "",
|
|
Usage: "specify the file to write the process id to",
|
|
},
|
|
cli.BoolFlag{
|
|
Name: "no-pivot",
|
|
Usage: "do not use pivot root to jail process inside rootfs. This should be used whenever the rootfs is on top of a ramdisk",
|
|
},
|
|
cli.BoolFlag{
|
|
Name: "no-new-keyring",
|
|
Usage: "do not create a new session keyring for the container. This will cause the container to inherit the calling processes session key",
|
|
},
|
|
cli.IntFlag{
|
|
Name: "preserve-fds",
|
|
Usage: "Pass N additional file descriptors to the container (stdio + $LISTEN_FDS + N in total)",
|
|
},
|
|
cli.BoolFlag{
|
|
Name: "no-mount-fallback",
|
|
Usage: "Do not fallback when the specific configuration is not applicable (e.g., do not try to remount a bind mount again after the first attempt failed on source filesystems that have nodev, noexec, nosuid, noatime, relatime, strictatime, nodiratime set)",
|
|
},
|
|
},
|
|
Action: func(context *cli.Context) error {
|
|
if err := checkArgs(context, 1, exactArgs); err != nil {
|
|
return err
|
|
}
|
|
status, err := startContainer(context, CT_ACT_CREATE, nil)
|
|
if err == nil {
|
|
// exit with the container's exit status so any external supervisor
|
|
// is notified of the exit with the correct exit status.
|
|
os.Exit(status)
|
|
}
|
|
return fmt.Errorf("runc create failed: %w", err)
|
|
},
|
|
}
|