DockerCLI/cli/compose/convert
Sebastiaan van Stijn 190c64b415
Service cap-add/cap-drop: improve handling of combinations and special "ALL" value
When creating and updating services, we need to avoid unneeded service churn.

The interaction of separate lists to "add" and "drop" capabilities, a special
("ALL") capability, as well as a "relaxed" format for accepted capabilities
(case-insensitive, `CAP_` prefix optional) make this rather involved.

This patch updates how we handle `--cap-add` / `--cap-drop` when  _creating_ as
well as _updating_, with the following rules/assumptions applied:

- both existing (service spec) and new (values passed through flags or in
  the compose-file) are normalized and de-duplicated before use.
- the special "ALL" capability is equivalent to "all capabilities" and taken
  into account when normalizing capabilities. Combining "ALL" capabilities
  and other capabilities is therefore equivalent to just specifying "ALL".
- adding capabilities takes precedence over dropping, which means that if
  a capability is both set to be "dropped" and to be "added", it is removed
  from the list to "drop".
- the final lists should be sorted and normalized to reduce service churn
- no validation of capabilities is handled by the client. Validation is
  delegated to the daemon/server.

When deploying a service using a docker-compose file, the docker-compose file
is *mostly* handled as being "declarative". However, many of the issues outlined
above also apply to compose-files, so similar handling is applied to compose
files as well to prevent service churn.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-09-08 14:38:35 +02:00
..
compose.go cli/compose/convert: driverObjectConfig - result 1 (error) is always nil (unparam) 2019-10-31 19:22:26 +01:00
compose_test.go bump gotest.tools v3.0.1 for compatibility with Go 1.14 2020-02-23 00:28:55 +01:00
service.go Service cap-add/cap-drop: improve handling of combinations and special "ALL" value 2020-09-08 14:38:35 +02:00
service_test.go Service cap-add/cap-drop: improve handling of combinations and special "ALL" value 2020-09-08 14:38:35 +02:00
volume.go Allow npipe volume type on stack file 2018-09-27 18:47:20 +03:00
volume_test.go bump gotest.tools v3.0.1 for compatibility with Go 1.14 2020-02-23 00:28:55 +01:00