2016-12-23 14:09:12 -05:00
package container
import (
"bytes"
"encoding/json"
"fmt"
2022-02-25 07:05:59 -05:00
"os"
2016-12-23 14:09:12 -05:00
"path"
2022-03-10 10:40:49 -05:00
"path/filepath"
2019-05-23 15:27:02 -04:00
"reflect"
2016-05-06 18:09:46 -04:00
"regexp"
2016-12-23 14:09:12 -05:00
"strconv"
"strings"
"time"
2023-07-20 09:50:14 -04:00
"github.com/docker/cli/cli/command"
2017-05-09 19:21:17 -04:00
"github.com/docker/cli/cli/compose/loader"
2017-05-15 08:45:19 -04:00
"github.com/docker/cli/opts"
2016-12-23 14:09:12 -05:00
"github.com/docker/docker/api/types/container"
2022-03-10 10:40:49 -05:00
mounttypes "github.com/docker/docker/api/types/mount"
2016-12-23 14:09:12 -05:00
networktypes "github.com/docker/docker/api/types/network"
"github.com/docker/docker/api/types/strslice"
2019-03-20 12:53:44 -04:00
"github.com/docker/docker/errdefs"
2016-12-23 14:09:12 -05:00
"github.com/docker/go-connections/nat"
2017-03-09 13:23:45 -05:00
"github.com/pkg/errors"
2016-12-23 14:09:12 -05:00
"github.com/spf13/pflag"
2023-11-03 20:18:37 -04:00
cdi "tags.cncf.io/container-device-interface/pkg/parser"
2016-12-23 14:09:12 -05:00
)
2024-01-05 05:57:19 -05:00
const (
// TODO(thaJeztah): define these in the API-types, or query available defaults
// from the daemon, or require "local" profiles to be an absolute path or
// relative paths starting with "./". The daemon-config has consts for this
// but we don't want to import that package:
// https://github.com/moby/moby/blob/v23.0.0/daemon/config/config.go#L63-L67
// seccompProfileDefault is the built-in default seccomp profile.
seccompProfileDefault = "builtin"
// seccompProfileUnconfined is a special profile name for seccomp to use an
// "unconfined" seccomp profile.
seccompProfileUnconfined = "unconfined"
)
2022-09-29 11:21:51 -04:00
var deviceCgroupRuleRegexp = regexp . MustCompile ( ` ^[acb] ([0-9]+|\*):([0-9]+|\*) [rwm] { 1,3}$ ` )
2016-05-06 18:09:46 -04:00
2016-12-23 14:09:12 -05:00
// containerOptions is a data object with all the options for creating a container
type containerOptions struct {
2023-07-06 15:05:34 -04:00
attach opts . ListOpts
volumes opts . ListOpts
tmpfs opts . ListOpts
mounts opts . MountOpt
blkioWeightDevice opts . WeightdeviceOpt
deviceReadBps opts . ThrottledeviceOpt
deviceWriteBps opts . ThrottledeviceOpt
links opts . ListOpts
aliases opts . ListOpts
linkLocalIPs opts . ListOpts
deviceReadIOps opts . ThrottledeviceOpt
deviceWriteIOps opts . ThrottledeviceOpt
env opts . ListOpts
labels opts . ListOpts
deviceCgroupRules opts . ListOpts
devices opts . ListOpts
gpus opts . GpuOpts
ulimits * opts . UlimitOpt
sysctls * opts . MapOpts
publish opts . ListOpts
expose opts . ListOpts
dns opts . ListOpts
dnsSearch opts . ListOpts
dnsOptions opts . ListOpts
extraHosts opts . ListOpts
volumesFrom opts . ListOpts
envFile opts . ListOpts
capAdd opts . ListOpts
capDrop opts . ListOpts
groupAdd opts . ListOpts
securityOpt opts . ListOpts
storageOpt opts . ListOpts
labelsFile opts . ListOpts
loggingOpts opts . ListOpts
privileged bool
pidMode string
utsMode string
usernsMode string
cgroupnsMode string
publishAll bool
stdin bool
tty bool
oomKillDisable bool
oomScoreAdj int
containerIDFile string
entrypoint string
hostname string
domainname string
memory opts . MemBytes
memoryReservation opts . MemBytes
memorySwap opts . MemSwapBytes
kernelMemory opts . MemBytes
user string
workingDir string
cpuCount int64
cpuShares int64
cpuPercent int64
cpuPeriod int64
cpuRealtimePeriod int64
cpuRealtimeRuntime int64
cpuQuota int64
cpus opts . NanoCPUs
cpusetCpus string
cpusetMems string
blkioWeight uint16
ioMaxBandwidth opts . MemBytes
ioMaxIOps uint64
swappiness int64
netMode opts . NetworkOpt
macAddress string
ipv4Address string
ipv6Address string
ipcMode string
pidsLimit int64
restartPolicy string
readonlyRootfs bool
loggingDriver string
cgroupParent string
volumeDriver string
stopSignal string
stopTimeout int
isolation string
shmSize opts . MemBytes
noHealthcheck bool
healthCmd string
healthInterval time . Duration
healthTimeout time . Duration
healthStartPeriod time . Duration
healthStartInterval time . Duration
healthRetries int
runtime string
autoRemove bool
init bool
annotations * opts . MapOpts
2016-12-23 14:09:12 -05:00
Image string
Args [ ] string
}
// addFlags adds all command line flags that will be used by parse to the FlagSet
func addFlags ( flags * pflag . FlagSet ) * containerOptions {
copts := & containerOptions {
aliases : opts . NewListOpts ( nil ) ,
attach : opts . NewListOpts ( validateAttach ) ,
blkioWeightDevice : opts . NewWeightdeviceOpt ( opts . ValidateWeightDevice ) ,
capAdd : opts . NewListOpts ( nil ) ,
capDrop : opts . NewListOpts ( nil ) ,
dns : opts . NewListOpts ( opts . ValidateIPAddress ) ,
dnsOptions : opts . NewListOpts ( nil ) ,
dnsSearch : opts . NewListOpts ( opts . ValidateDNSSearch ) ,
2016-05-06 18:09:46 -04:00
deviceCgroupRules : opts . NewListOpts ( validateDeviceCgroupRule ) ,
2016-12-23 14:09:12 -05:00
deviceReadBps : opts . NewThrottledeviceOpt ( opts . ValidateThrottleBpsDevice ) ,
deviceReadIOps : opts . NewThrottledeviceOpt ( opts . ValidateThrottleIOpsDevice ) ,
deviceWriteBps : opts . NewThrottledeviceOpt ( opts . ValidateThrottleBpsDevice ) ,
deviceWriteIOps : opts . NewThrottledeviceOpt ( opts . ValidateThrottleIOpsDevice ) ,
2019-01-07 18:34:33 -05:00
devices : opts . NewListOpts ( nil ) , // devices can only be validated after we know the server OS
2016-12-23 14:09:12 -05:00
env : opts . NewListOpts ( opts . ValidateEnv ) ,
envFile : opts . NewListOpts ( nil ) ,
expose : opts . NewListOpts ( nil ) ,
extraHosts : opts . NewListOpts ( opts . ValidateExtraHost ) ,
groupAdd : opts . NewListOpts ( nil ) ,
2019-02-13 10:48:59 -05:00
labels : opts . NewListOpts ( opts . ValidateLabel ) ,
2016-12-23 14:09:12 -05:00
labelsFile : opts . NewListOpts ( nil ) ,
linkLocalIPs : opts . NewListOpts ( nil ) ,
links : opts . NewListOpts ( opts . ValidateLink ) ,
loggingOpts : opts . NewListOpts ( nil ) ,
publish : opts . NewListOpts ( nil ) ,
securityOpt : opts . NewListOpts ( nil ) ,
storageOpt : opts . NewListOpts ( nil ) ,
sysctls : opts . NewMapOpts ( nil , opts . ValidateSysctl ) ,
tmpfs : opts . NewListOpts ( nil ) ,
ulimits : opts . NewUlimitOpt ( nil ) ,
volumes : opts . NewListOpts ( nil ) ,
volumesFrom : opts . NewListOpts ( nil ) ,
2023-04-03 04:08:36 -04:00
annotations : opts . NewMapOpts ( nil , nil ) ,
2016-12-23 14:09:12 -05:00
}
// General purpose flags
flags . VarP ( & copts . attach , "attach" , "a" , "Attach to STDIN, STDOUT or STDERR" )
2016-05-06 18:09:46 -04:00
flags . Var ( & copts . deviceCgroupRules , "device-cgroup-rule" , "Add a rule to the cgroup allowed devices list" )
2016-12-23 14:09:12 -05:00
flags . Var ( & copts . devices , "device" , "Add a host device to the container" )
2019-03-19 14:58:41 -04:00
flags . Var ( & copts . gpus , "gpus" , "GPU devices to add to the container ('all' to pass all GPUs)" )
flags . SetAnnotation ( "gpus" , "version" , [ ] string { "1.40" } )
2016-12-23 14:09:12 -05:00
flags . VarP ( & copts . env , "env" , "e" , "Set environment variables" )
flags . Var ( & copts . envFile , "env-file" , "Read in a file of environment variables" )
flags . StringVar ( & copts . entrypoint , "entrypoint" , "" , "Overwrite the default ENTRYPOINT of the image" )
flags . Var ( & copts . groupAdd , "group-add" , "Add additional groups to join" )
flags . StringVarP ( & copts . hostname , "hostname" , "h" , "" , "Container host name" )
2018-06-18 07:58:23 -04:00
flags . StringVar ( & copts . domainname , "domainname" , "" , "Container NIS domain name" )
2016-12-23 14:09:12 -05:00
flags . BoolVarP ( & copts . stdin , "interactive" , "i" , false , "Keep STDIN open even if not attached" )
flags . VarP ( & copts . labels , "label" , "l" , "Set meta data on a container" )
flags . Var ( & copts . labelsFile , "label-file" , "Read in a line delimited file of labels" )
flags . BoolVar ( & copts . readonlyRootfs , "read-only" , false , "Mount the container's root filesystem as read only" )
2023-08-28 06:06:35 -04:00
flags . StringVar ( & copts . restartPolicy , "restart" , string ( container . RestartPolicyDisabled ) , "Restart policy to apply when a container exits" )
2021-08-11 05:00:27 -04:00
flags . StringVar ( & copts . stopSignal , "stop-signal" , "" , "Signal to stop the container" )
2016-12-23 14:09:12 -05:00
flags . IntVar ( & copts . stopTimeout , "stop-timeout" , 0 , "Timeout (in seconds) to stop a container" )
flags . SetAnnotation ( "stop-timeout" , "version" , [ ] string { "1.25" } )
flags . Var ( copts . sysctls , "sysctl" , "Sysctl options" )
flags . BoolVarP ( & copts . tty , "tty" , "t" , false , "Allocate a pseudo-TTY" )
flags . Var ( copts . ulimits , "ulimit" , "Ulimit options" )
flags . StringVarP ( & copts . user , "user" , "u" , "" , "Username or UID (format: <name|uid>[:<group|gid>])" )
flags . StringVarP ( & copts . workingDir , "workdir" , "w" , "" , "Working directory inside the container" )
2024-05-21 07:50:54 -04:00
flags . BoolVar ( & copts . autoRemove , "rm" , false , "Automatically remove the container and its associated anonymous volumes when it exits" )
2016-12-23 14:09:12 -05:00
// Security
flags . Var ( & copts . capAdd , "cap-add" , "Add Linux capabilities" )
flags . Var ( & copts . capDrop , "cap-drop" , "Drop Linux capabilities" )
flags . BoolVar ( & copts . privileged , "privileged" , false , "Give extended privileges to this container" )
flags . Var ( & copts . securityOpt , "security-opt" , "Security Options" )
flags . StringVar ( & copts . usernsMode , "userns" , "" , "User namespace to use" )
2019-07-30 13:10:03 -04:00
flags . StringVar ( & copts . cgroupnsMode , "cgroupns" , "" , ` Cgroup namespace to use ( host | private )
' host ' : Run the container in the Docker host ' s cgroup namespace
' private ' : Run the container in its own private cgroup namespace
' ' : Use the cgroup namespace as configured by the
default - cgroupns - mode option on the daemon ( default ) ` )
flags . SetAnnotation ( "cgroupns" , "version" , [ ] string { "1.41" } )
2016-12-23 14:09:12 -05:00
// Network and port publishing flag
flags . Var ( & copts . extraHosts , "add-host" , "Add a custom host-to-IP mapping (host:ip)" )
flags . Var ( & copts . dns , "dns" , "Set custom DNS servers" )
// We allow for both "--dns-opt" and "--dns-option", although the latter is the recommended way.
// This is to be consistent with service create/update
flags . Var ( & copts . dnsOptions , "dns-opt" , "Set DNS options" )
flags . Var ( & copts . dnsOptions , "dns-option" , "Set DNS options" )
flags . MarkHidden ( "dns-opt" )
flags . Var ( & copts . dnsSearch , "dns-search" , "Set custom DNS search domains" )
flags . Var ( & copts . expose , "expose" , "Expose a port or a range of ports" )
2016-12-28 06:34:32 -05:00
flags . StringVar ( & copts . ipv4Address , "ip" , "" , "IPv4 address (e.g., 172.30.100.104)" )
flags . StringVar ( & copts . ipv6Address , "ip6" , "" , "IPv6 address (e.g., 2001:db8::33)" )
2016-12-23 14:09:12 -05:00
flags . Var ( & copts . links , "link" , "Add link to another container" )
flags . Var ( & copts . linkLocalIPs , "link-local-ip" , "Container IPv4/IPv6 link-local addresses" )
2016-12-28 06:34:32 -05:00
flags . StringVar ( & copts . macAddress , "mac-address" , "" , "Container MAC address (e.g., 92:d0:c6:0a:29:33)" )
2016-12-23 14:09:12 -05:00
flags . VarP ( & copts . publish , "publish" , "p" , "Publish a container's port(s) to the host" )
flags . BoolVarP ( & copts . publishAll , "publish-all" , "P" , false , "Publish all exposed ports to random ports" )
// We allow for both "--net" and "--network", although the latter is the recommended way.
2017-07-10 16:44:45 -04:00
flags . Var ( & copts . netMode , "net" , "Connect a container to a network" )
flags . Var ( & copts . netMode , "network" , "Connect a container to a network" )
2016-12-23 14:09:12 -05:00
flags . MarkHidden ( "net" )
// We allow for both "--net-alias" and "--network-alias", although the latter is the recommended way.
flags . Var ( & copts . aliases , "net-alias" , "Add network-scoped alias for the container" )
flags . Var ( & copts . aliases , "network-alias" , "Add network-scoped alias for the container" )
flags . MarkHidden ( "net-alias" )
// Logging and storage
flags . StringVar ( & copts . loggingDriver , "log-driver" , "" , "Logging driver for the container" )
flags . StringVar ( & copts . volumeDriver , "volume-driver" , "" , "Optional volume driver for the container" )
flags . Var ( & copts . loggingOpts , "log-opt" , "Log driver options" )
flags . Var ( & copts . storageOpt , "storage-opt" , "Storage driver options for the container" )
flags . Var ( & copts . tmpfs , "tmpfs" , "Mount a tmpfs directory" )
flags . Var ( & copts . volumesFrom , "volumes-from" , "Mount volumes from the specified container(s)" )
flags . VarP ( & copts . volumes , "volume" , "v" , "Bind mount a volume" )
2017-03-31 02:41:45 -04:00
flags . Var ( & copts . mounts , "mount" , "Attach a filesystem mount to the container" )
2016-12-23 14:09:12 -05:00
// Health-checking
flags . StringVar ( & copts . healthCmd , "health-cmd" , "" , "Command to run to check health" )
2017-04-10 17:12:44 -04:00
flags . DurationVar ( & copts . healthInterval , "health-interval" , 0 , "Time between running the check (ms|s|m|h) (default 0s)" )
2016-12-23 14:09:12 -05:00
flags . IntVar ( & copts . healthRetries , "health-retries" , 0 , "Consecutive failures needed to report unhealthy" )
2017-04-10 17:12:44 -04:00
flags . DurationVar ( & copts . healthTimeout , "health-timeout" , 0 , "Maximum time to allow one check to run (ms|s|m|h) (default 0s)" )
flags . DurationVar ( & copts . healthStartPeriod , "health-start-period" , 0 , "Start period for the container to initialize before starting health-retries countdown (ms|s|m|h) (default 0s)" )
2016-11-29 04:58:47 -05:00
flags . SetAnnotation ( "health-start-period" , "version" , [ ] string { "1.29" } )
2023-07-06 15:05:34 -04:00
flags . DurationVar ( & copts . healthStartInterval , "health-start-interval" , 0 , "Time between running the check during the start period (ms|s|m|h) (default 0s)" )
flags . SetAnnotation ( "health-start-interval" , "version" , [ ] string { "1.44" } )
2016-12-23 14:09:12 -05:00
flags . BoolVar ( & copts . noHealthcheck , "no-healthcheck" , false , "Disable any container-specified HEALTHCHECK" )
// Resource management
flags . Uint16Var ( & copts . blkioWeight , "blkio-weight" , 0 , "Block IO (relative weight), between 10 and 1000, or 0 to disable (default 0)" )
flags . Var ( & copts . blkioWeightDevice , "blkio-weight-device" , "Block IO weight (relative device weight)" )
flags . StringVar ( & copts . containerIDFile , "cidfile" , "" , "Write the container ID to the file" )
flags . StringVar ( & copts . cpusetCpus , "cpuset-cpus" , "" , "CPUs in which to allow execution (0-3, 0,1)" )
flags . StringVar ( & copts . cpusetMems , "cpuset-mems" , "" , "MEMs in which to allow execution (0-3, 0,1)" )
flags . Int64Var ( & copts . cpuCount , "cpu-count" , 0 , "CPU count (Windows only)" )
2017-02-07 07:52:20 -05:00
flags . SetAnnotation ( "cpu-count" , "ostype" , [ ] string { "windows" } )
2016-12-23 14:09:12 -05:00
flags . Int64Var ( & copts . cpuPercent , "cpu-percent" , 0 , "CPU percent (Windows only)" )
2017-02-07 07:52:20 -05:00
flags . SetAnnotation ( "cpu-percent" , "ostype" , [ ] string { "windows" } )
2016-12-23 14:09:12 -05:00
flags . Int64Var ( & copts . cpuPeriod , "cpu-period" , 0 , "Limit CPU CFS (Completely Fair Scheduler) period" )
flags . Int64Var ( & copts . cpuQuota , "cpu-quota" , 0 , "Limit CPU CFS (Completely Fair Scheduler) quota" )
flags . Int64Var ( & copts . cpuRealtimePeriod , "cpu-rt-period" , 0 , "Limit CPU real-time period in microseconds" )
2017-01-16 11:57:26 -05:00
flags . SetAnnotation ( "cpu-rt-period" , "version" , [ ] string { "1.25" } )
2016-12-23 14:09:12 -05:00
flags . Int64Var ( & copts . cpuRealtimeRuntime , "cpu-rt-runtime" , 0 , "Limit CPU real-time runtime in microseconds" )
2017-01-16 11:57:26 -05:00
flags . SetAnnotation ( "cpu-rt-runtime" , "version" , [ ] string { "1.25" } )
2016-12-23 14:09:12 -05:00
flags . Int64VarP ( & copts . cpuShares , "cpu-shares" , "c" , 0 , "CPU shares (relative weight)" )
flags . Var ( & copts . cpus , "cpus" , "Number of CPUs" )
2017-01-16 11:57:26 -05:00
flags . SetAnnotation ( "cpus" , "version" , [ ] string { "1.25" } )
2016-12-23 14:09:12 -05:00
flags . Var ( & copts . deviceReadBps , "device-read-bps" , "Limit read rate (bytes per second) from a device" )
flags . Var ( & copts . deviceReadIOps , "device-read-iops" , "Limit read rate (IO per second) from a device" )
flags . Var ( & copts . deviceWriteBps , "device-write-bps" , "Limit write rate (bytes per second) to a device" )
flags . Var ( & copts . deviceWriteIOps , "device-write-iops" , "Limit write rate (IO per second) to a device" )
2017-03-06 16:01:04 -05:00
flags . Var ( & copts . ioMaxBandwidth , "io-maxbandwidth" , "Maximum IO bandwidth limit for the system drive (Windows only)" )
2017-02-07 07:52:20 -05:00
flags . SetAnnotation ( "io-maxbandwidth" , "ostype" , [ ] string { "windows" } )
2016-12-23 14:09:12 -05:00
flags . Uint64Var ( & copts . ioMaxIOps , "io-maxiops" , 0 , "Maximum IOps limit for the system drive (Windows only)" )
2017-02-07 07:52:20 -05:00
flags . SetAnnotation ( "io-maxiops" , "ostype" , [ ] string { "windows" } )
2017-03-06 16:01:04 -05:00
flags . Var ( & copts . kernelMemory , "kernel-memory" , "Kernel memory limit" )
flags . VarP ( & copts . memory , "memory" , "m" , "Memory limit" )
flags . Var ( & copts . memoryReservation , "memory-reservation" , "Memory soft limit" )
flags . Var ( & copts . memorySwap , "memory-swap" , "Swap limit equal to memory plus swap: '-1' to enable unlimited swap" )
2016-12-23 14:09:12 -05:00
flags . Int64Var ( & copts . swappiness , "memory-swappiness" , - 1 , "Tune container memory swappiness (0 to 100)" )
flags . BoolVar ( & copts . oomKillDisable , "oom-kill-disable" , false , "Disable OOM Killer" )
flags . IntVar ( & copts . oomScoreAdj , "oom-score-adj" , 0 , "Tune host's OOM preferences (-1000 to 1000)" )
flags . Int64Var ( & copts . pidsLimit , "pids-limit" , 0 , "Tune container pids limit (set -1 for unlimited)" )
// Low-level execution (cgroups, namespaces, ...)
flags . StringVar ( & copts . cgroupParent , "cgroup-parent" , "" , "Optional parent cgroup for the container" )
2017-07-20 17:42:51 -04:00
flags . StringVar ( & copts . ipcMode , "ipc" , "" , "IPC mode to use" )
2016-12-23 14:09:12 -05:00
flags . StringVar ( & copts . isolation , "isolation" , "" , "Container isolation technology" )
flags . StringVar ( & copts . pidMode , "pid" , "" , "PID namespace to use" )
2016-12-28 17:44:07 -05:00
flags . Var ( & copts . shmSize , "shm-size" , "Size of /dev/shm" )
2016-12-23 14:09:12 -05:00
flags . StringVar ( & copts . utsMode , "uts" , "" , "UTS namespace to use" )
flags . StringVar ( & copts . runtime , "runtime" , "" , "Runtime to use for this container" )
flags . BoolVar ( & copts . init , "init" , false , "Run an init inside the container that forwards signals and reaps processes" )
2017-01-16 11:57:26 -05:00
flags . SetAnnotation ( "init" , "version" , [ ] string { "1.25" } )
2023-04-03 04:08:36 -04:00
flags . Var ( copts . annotations , "annotation" , "Add an annotation to the container (passed through to the OCI runtime)" )
flags . SetAnnotation ( "annotation" , "version" , [ ] string { "1.43" } )
2016-12-23 14:09:12 -05:00
return copts
}
2017-03-07 17:19:54 -05:00
type containerConfig struct {
Config * container . Config
HostConfig * container . HostConfig
NetworkingConfig * networktypes . NetworkingConfig
}
2016-12-23 14:09:12 -05:00
// parse parses the args for the specified command and generates a Config,
// a HostConfig and returns them with the specified command.
// If the specified args are not valid, it will return an error.
2022-07-13 06:29:49 -04:00
//
//nolint:gocyclo
2019-01-07 18:34:33 -05:00
func parse ( flags * pflag . FlagSet , copts * containerOptions , serverOS string ) ( * containerConfig , error ) {
2016-12-23 14:09:12 -05:00
var (
attachStdin = copts . attach . Get ( "stdin" )
attachStdout = copts . attach . Get ( "stdout" )
attachStderr = copts . attach . Get ( "stderr" )
)
// Validate the input mac address
if copts . macAddress != "" {
if _ , err := opts . ValidateMACAddress ( copts . macAddress ) ; err != nil {
2017-03-09 13:23:45 -05:00
return nil , errors . Errorf ( "%s is not a valid mac address" , copts . macAddress )
2016-12-23 14:09:12 -05:00
}
}
if copts . stdin {
attachStdin = true
}
// If -a is not set, attach to stdout and stderr
if copts . attach . Len ( ) == 0 {
attachStdout = true
attachStderr = true
}
var err error
swappiness := copts . swappiness
if swappiness != - 1 && ( swappiness < 0 || swappiness > 100 ) {
2017-03-09 13:23:45 -05:00
return nil , errors . Errorf ( "invalid value: %d. Valid memory swappiness range is 0-100" , swappiness )
2016-12-23 14:09:12 -05:00
}
var binds [ ] string
volumes := copts . volumes . GetMap ( )
// add any bind targets to the list of container volumes
for bind := range copts . volumes . GetMap ( ) {
2023-07-11 11:48:35 -04:00
parsed , err := loader . ParseVolume ( bind )
if err != nil {
return nil , err
}
2022-03-10 10:40:49 -05:00
2017-05-09 19:21:17 -04:00
if parsed . Source != "" {
2022-03-10 10:40:49 -05:00
toBind := bind
if parsed . Type == string ( mounttypes . TypeBind ) {
2022-12-27 10:26:08 -05:00
if hostPart , targetPath , ok := strings . Cut ( bind , ":" ) ; ok {
2022-03-10 10:40:49 -05:00
if strings . HasPrefix ( hostPart , "." + string ( filepath . Separator ) ) || hostPart == "." {
if absHostPart , err := filepath . Abs ( hostPart ) ; err == nil {
hostPart = absHostPart
}
}
2022-12-27 10:26:08 -05:00
toBind = hostPart + ":" + targetPath
2022-03-10 10:40:49 -05:00
}
}
2016-12-23 14:09:12 -05:00
// after creating the bind mount we want to delete it from the copts.volumes values because
// we do not want bind mounts being committed to image configs
2022-03-10 10:40:49 -05:00
binds = append ( binds , toBind )
2016-12-23 14:09:12 -05:00
// We should delete from the map (`volumes`) here, as deleting from copts.volumes will not work if
// there are duplicates entries.
delete ( volumes , bind )
}
}
// Can't evaluate options passed into --tmpfs until we actually mount
tmpfs := make ( map [ string ] string )
for _ , t := range copts . tmpfs . GetAll ( ) {
2022-12-27 10:26:08 -05:00
k , v , _ := strings . Cut ( t , ":" )
tmpfs [ k ] = v
2016-12-23 14:09:12 -05:00
}
var (
runCmd strslice . StrSlice
entrypoint strslice . StrSlice
)
if len ( copts . Args ) > 0 {
2022-12-27 09:59:57 -05:00
runCmd = copts . Args
2016-12-23 14:09:12 -05:00
}
if copts . entrypoint != "" {
entrypoint = strslice . StrSlice { copts . entrypoint }
} else if flags . Changed ( "entrypoint" ) {
// if `--entrypoint=` is parsed then Entrypoint is reset
entrypoint = [ ] string { "" }
}
2018-07-04 18:32:25 -04:00
publishOpts := copts . publish . GetAll ( )
2019-06-21 16:11:48 -04:00
var (
ports map [ nat . Port ] struct { }
portBindings map [ nat . Port ] [ ] nat . PortBinding
convertedOpts [ ] string
)
2018-07-04 18:32:25 -04:00
2019-06-21 16:11:48 -04:00
convertedOpts , err = convertToStandardNotation ( publishOpts )
2016-12-23 14:09:12 -05:00
if err != nil {
2019-06-21 16:11:48 -04:00
return nil , err
}
2018-07-04 18:32:25 -04:00
2019-06-21 16:11:48 -04:00
ports , portBindings , err = nat . ParsePortSpecs ( convertedOpts )
if err != nil {
return nil , err
2016-12-23 14:09:12 -05:00
}
// Merge in exposed ports to the map of published ports
for _ , e := range copts . expose . GetAll ( ) {
if strings . Contains ( e , ":" ) {
2017-03-09 13:23:45 -05:00
return nil , errors . Errorf ( "invalid port format for --expose: %s" , e )
2016-12-23 14:09:12 -05:00
}
2019-06-21 16:11:48 -04:00
// support two formats for expose, original format <portnum>/[<proto>]
// or <startport-endport>/[<proto>]
2016-12-23 14:09:12 -05:00
proto , port := nat . SplitProtoPort ( e )
2019-06-21 16:11:48 -04:00
// parse the start and end port and create a sequence of ports to expose
// if expose a port, the start and end port are the same
2016-12-23 14:09:12 -05:00
start , end , err := nat . ParsePortRange ( port )
if err != nil {
2017-03-09 13:23:45 -05:00
return nil , errors . Errorf ( "invalid range format for --expose: %s, error: %s" , e , err )
2016-12-23 14:09:12 -05:00
}
for i := start ; i <= end ; i ++ {
p , err := nat . NewPort ( proto , strconv . FormatUint ( i , 10 ) )
if err != nil {
2017-03-07 17:19:54 -05:00
return nil , err
2016-12-23 14:09:12 -05:00
}
if _ , exists := ports [ p ] ; ! exists {
ports [ p ] = struct { } { }
}
}
}
2019-01-07 18:34:33 -05:00
// validate and parse device mappings. Note we do late validation of the
// device path (as opposed to during flag parsing), as at the time we are
// parsing flags, we haven't yet sent a _ping to the daemon to determine
// what operating system it is.
2016-12-23 14:09:12 -05:00
deviceMappings := [ ] container . DeviceMapping { }
2023-03-10 01:29:47 -05:00
var cdiDeviceNames [ ] string
2016-12-23 14:09:12 -05:00
for _ , device := range copts . devices . GetAll ( ) {
2019-01-07 18:34:33 -05:00
var (
validated string
deviceMapping container . DeviceMapping
err error
)
2023-03-10 01:29:47 -05:00
if cdi . IsQualifiedName ( device ) {
cdiDeviceNames = append ( cdiDeviceNames , device )
continue
}
2019-01-07 18:34:33 -05:00
validated , err = validateDevice ( device , serverOS )
if err != nil {
return nil , err
}
deviceMapping , err = parseDevice ( validated , serverOS )
2016-12-23 14:09:12 -05:00
if err != nil {
2017-03-07 17:19:54 -05:00
return nil , err
2016-12-23 14:09:12 -05:00
}
deviceMappings = append ( deviceMappings , deviceMapping )
}
// collect all the environment variables for the container
2018-01-26 12:45:29 -05:00
envVariables , err := opts . ReadKVEnvStrings ( copts . envFile . GetAll ( ) , copts . env . GetAll ( ) )
2016-12-23 14:09:12 -05:00
if err != nil {
2017-03-07 17:19:54 -05:00
return nil , err
2016-12-23 14:09:12 -05:00
}
// collect all the labels for the container
2017-06-05 18:23:21 -04:00
labels , err := opts . ReadKVStrings ( copts . labelsFile . GetAll ( ) , copts . labels . GetAll ( ) )
2016-12-23 14:09:12 -05:00
if err != nil {
2017-03-07 17:19:54 -05:00
return nil , err
2016-12-23 14:09:12 -05:00
}
pidMode := container . PidMode ( copts . pidMode )
if ! pidMode . Valid ( ) {
2017-03-09 13:23:45 -05:00
return nil , errors . Errorf ( "--pid: invalid PID mode" )
2016-12-23 14:09:12 -05:00
}
utsMode := container . UTSMode ( copts . utsMode )
if ! utsMode . Valid ( ) {
2017-03-09 13:23:45 -05:00
return nil , errors . Errorf ( "--uts: invalid UTS mode" )
2016-12-23 14:09:12 -05:00
}
usernsMode := container . UsernsMode ( copts . usernsMode )
if ! usernsMode . Valid ( ) {
2017-03-09 13:23:45 -05:00
return nil , errors . Errorf ( "--userns: invalid USER mode" )
2016-12-23 14:09:12 -05:00
}
2019-07-30 13:10:03 -04:00
cgroupnsMode := container . CgroupnsMode ( copts . cgroupnsMode )
if ! cgroupnsMode . Valid ( ) {
return nil , errors . Errorf ( "--cgroupns: invalid CGROUP mode" )
}
2017-06-05 18:23:21 -04:00
restartPolicy , err := opts . ParseRestartPolicy ( copts . restartPolicy )
2016-12-23 14:09:12 -05:00
if err != nil {
2017-03-07 17:19:54 -05:00
return nil , err
2016-12-23 14:09:12 -05:00
}
loggingOpts , err := parseLoggingOpts ( copts . loggingDriver , copts . loggingOpts . GetAll ( ) )
if err != nil {
2017-03-07 17:19:54 -05:00
return nil , err
2016-12-23 14:09:12 -05:00
}
securityOpts , err := parseSecurityOpts ( copts . securityOpt . GetAll ( ) )
if err != nil {
2017-03-07 17:19:54 -05:00
return nil , err
2016-12-23 14:09:12 -05:00
}
2019-04-04 17:43:43 -04:00
securityOpts , maskedPaths , readonlyPaths := parseSystemPaths ( securityOpts )
2016-12-23 14:09:12 -05:00
storageOpts , err := parseStorageOpts ( copts . storageOpt . GetAll ( ) )
if err != nil {
2017-03-07 17:19:54 -05:00
return nil , err
2016-12-23 14:09:12 -05:00
}
// Healthcheck
var healthConfig * container . HealthConfig
haveHealthSettings := copts . healthCmd != "" ||
copts . healthInterval != 0 ||
copts . healthTimeout != 0 ||
2016-11-29 04:58:47 -05:00
copts . healthStartPeriod != 0 ||
2023-07-06 15:05:34 -04:00
copts . healthRetries != 0 ||
copts . healthStartInterval != 0
2016-12-23 14:09:12 -05:00
if copts . noHealthcheck {
if haveHealthSettings {
2017-03-09 13:23:45 -05:00
return nil , errors . Errorf ( "--no-healthcheck conflicts with --health-* options" )
2016-12-23 14:09:12 -05:00
}
2022-12-27 09:59:57 -05:00
healthConfig = & container . HealthConfig { Test : strslice . StrSlice { "NONE" } }
2016-12-23 14:09:12 -05:00
} else if haveHealthSettings {
var probe strslice . StrSlice
if copts . healthCmd != "" {
2022-12-27 09:59:57 -05:00
probe = [ ] string { "CMD-SHELL" , copts . healthCmd }
2016-12-23 14:09:12 -05:00
}
if copts . healthInterval < 0 {
2017-03-09 13:23:45 -05:00
return nil , errors . Errorf ( "--health-interval cannot be negative" )
2016-12-23 14:09:12 -05:00
}
if copts . healthTimeout < 0 {
2017-03-09 13:23:45 -05:00
return nil , errors . Errorf ( "--health-timeout cannot be negative" )
2016-12-23 14:09:12 -05:00
}
2017-01-17 02:55:45 -05:00
if copts . healthRetries < 0 {
2017-03-09 13:23:45 -05:00
return nil , errors . Errorf ( "--health-retries cannot be negative" )
2017-01-17 02:55:45 -05:00
}
2016-11-29 04:58:47 -05:00
if copts . healthStartPeriod < 0 {
linting: fmt.Errorf can be replaced with errors.New (perfsprint)
internal/test/cli.go:175:14: fmt.Errorf can be replaced with errors.New (perfsprint)
return nil, fmt.Errorf("no notary client available unless defined")
^
cli/command/cli.go:318:29: fmt.Errorf can be replaced with errors.New (perfsprint)
return docker.Endpoint{}, fmt.Errorf("no context store initialized")
^
cli/command/container/attach.go:161:11: fmt.Errorf can be replaced with errors.New (perfsprint)
return fmt.Errorf(result.Error.Message)
^
cli/command/container/opts.go:577:16: fmt.Errorf can be replaced with errors.New (perfsprint)
return nil, fmt.Errorf("--health-start-period cannot be negative")
^
cli/command/container/opts.go:580:16: fmt.Errorf can be replaced with errors.New (perfsprint)
return nil, fmt.Errorf("--health-start-interval cannot be negative")
^
cli/command/container/stats.go:221:11: fmt.Errorf can be replaced with errors.New (perfsprint)
return fmt.Errorf("filtering is not supported when specifying a list of containers")
^
cli/command/container/attach_test.go:82:17: fmt.Errorf can be replaced with errors.New (perfsprint)
expectedErr = fmt.Errorf("unexpected error")
^
cli/command/container/create_test.go:234:40: fmt.Errorf can be replaced with errors.New (perfsprint)
return container.CreateResponse{}, fmt.Errorf("shouldn't try to pull image")
^
cli/command/container/list_test.go:150:17: fmt.Errorf can be replaced with errors.New (perfsprint)
return nil, fmt.Errorf("error listing containers")
^
cli/command/container/rm_test.go:40:31: fmt.Errorf can be replaced with errors.New (perfsprint)
return errdefs.NotFound(fmt.Errorf("Error: no such container: " + container))
^
cli/command/container/run_test.go:138:40: fmt.Errorf can be replaced with errors.New (perfsprint)
return container.CreateResponse{}, fmt.Errorf("shouldn't try to pull image")
^
cli/command/image/pull_test.go:115:49: fmt.Errorf can be replaced with errors.New (perfsprint)
return io.NopCloser(strings.NewReader("")), fmt.Errorf("shouldn't try to pull image")
^
cli/command/network/connect.go:88:16: fmt.Errorf can be replaced with errors.New (perfsprint)
return nil, fmt.Errorf("invalid key/value pair format in driver options")
^
cli/command/plugin/create_test.go:96:11: fmt.Errorf can be replaced with errors.New (perfsprint)
return fmt.Errorf("Error creating plugin")
^
cli/command/plugin/disable_test.go:32:12: fmt.Errorf can be replaced with errors.New (perfsprint)
return fmt.Errorf("Error disabling plugin")
^
cli/command/plugin/enable_test.go:32:12: fmt.Errorf can be replaced with errors.New (perfsprint)
return fmt.Errorf("failed to enable plugin")
^
cli/command/plugin/inspect_test.go:55:22: fmt.Errorf can be replaced with errors.New (perfsprint)
return nil, nil, fmt.Errorf("error inspecting plugin")
^
cli/command/plugin/install_test.go:43:17: fmt.Errorf can be replaced with errors.New (perfsprint)
return nil, fmt.Errorf("Error installing plugin")
^
cli/command/plugin/install_test.go:51:17: fmt.Errorf can be replaced with errors.New (perfsprint)
return nil, fmt.Errorf("(image) when fetching")
^
cli/command/plugin/install_test.go:95:17: fmt.Errorf can be replaced with errors.New (perfsprint)
return nil, fmt.Errorf("should not try to install plugin")
^
cli/command/plugin/list_test.go:35:41: fmt.Errorf can be replaced with errors.New (perfsprint)
return types.PluginsListResponse{}, fmt.Errorf("error listing plugins")
^
cli/command/plugin/remove_test.go:27:12: fmt.Errorf can be replaced with errors.New (perfsprint)
return fmt.Errorf("Error removing plugin")
^
cli/command/registry/login_test.go:36:46: fmt.Errorf can be replaced with errors.New (perfsprint)
return registrytypes.AuthenticateOKBody{}, fmt.Errorf("Invalid Username or Password")
^
cli/command/registry/login_test.go:44:46: fmt.Errorf can be replaced with errors.New (perfsprint)
return registrytypes.AuthenticateOKBody{}, fmt.Errorf(errUnknownUser)
^
cli/command/system/info.go:190:10: fmt.Errorf can be replaced with errors.New (perfsprint)
return fmt.Errorf("errors pretty printing info")
^
cli/command/system/prune.go:77:10: fmt.Errorf can be replaced with errors.New (perfsprint)
return fmt.Errorf(`ERROR: The "until" filter is not supported with "--volumes"`)
^
cli/command/system/version_test.go:19:28: fmt.Errorf can be replaced with errors.New (perfsprint)
return types.Version{}, fmt.Errorf("no server")
^
cli/command/trust/key_load.go:112:22: fmt.Errorf can be replaced with errors.New (perfsprint)
return []byte{}, fmt.Errorf("could not decrypt key")
^
cli/command/trust/revoke.go:44:10: fmt.Errorf can be replaced with errors.New (perfsprint)
return fmt.Errorf("cannot use a digest reference for IMAGE:TAG")
^
cli/command/trust/revoke.go:105:10: fmt.Errorf can be replaced with errors.New (perfsprint)
return fmt.Errorf("no signed tags to remove")
^
cli/command/trust/signer_add.go:56:10: fmt.Errorf can be replaced with errors.New (perfsprint)
return fmt.Errorf("releases is a reserved keyword, please use a different signer name")
^
cli/command/trust/signer_add.go:60:10: fmt.Errorf can be replaced with errors.New (perfsprint)
return fmt.Errorf("path to a public key must be provided using the `--key` flag")
^
opts/config.go:71:10: fmt.Errorf can be replaced with errors.New (perfsprint)
return fmt.Errorf("source is required")
^
opts/mount.go:168:10: fmt.Errorf can be replaced with errors.New (perfsprint)
return fmt.Errorf("type is required")
^
opts/mount.go:172:10: fmt.Errorf can be replaced with errors.New (perfsprint)
return fmt.Errorf("target is required")
^
opts/network.go:90:11: fmt.Errorf can be replaced with errors.New (perfsprint)
return fmt.Errorf("network name/id is not specified")
^
opts/network.go:129:18: fmt.Errorf can be replaced with errors.New (perfsprint)
return "", "", fmt.Errorf("invalid key value pair format in driver options")
^
opts/opts.go:404:13: fmt.Errorf can be replaced with errors.New (perfsprint)
return 0, fmt.Errorf("value is too precise")
^
opts/opts.go:412:18: fmt.Errorf can be replaced with errors.New (perfsprint)
return "", "", fmt.Errorf("empty string specified for links")
^
opts/parse.go:84:37: fmt.Errorf can be replaced with errors.New (perfsprint)
return container.RestartPolicy{}, fmt.Errorf("invalid restart policy format: no policy provided before colon")
^
opts/parse.go:89:38: fmt.Errorf can be replaced with errors.New (perfsprint)
return container.RestartPolicy{}, fmt.Errorf("invalid restart policy format: maximum retry count must be an integer")
^
opts/port.go:105:13: fmt.Errorf can be replaced with errors.New (perfsprint)
return fmt.Errorf("hostip is not supported")
^
opts/secret.go:70:10: fmt.Errorf can be replaced with errors.New (perfsprint)
return fmt.Errorf("source is required")
^
opts/env_test.go:57:11: fmt.Errorf can be replaced with errors.New (perfsprint)
err: fmt.Errorf("invalid environment variable: =a"),
^
opts/env_test.go:93:11: fmt.Errorf can be replaced with errors.New (perfsprint)
err: fmt.Errorf("invalid environment variable: ="),
^
cli-plugins/manager/error_test.go:16:11: fmt.Errorf can be replaced with errors.New (perfsprint)
inner := fmt.Errorf("testing")
^
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2024-06-10 14:47:07 -04:00
return nil , errors . New ( "--health-start-period cannot be negative" )
2016-11-29 04:58:47 -05:00
}
2023-07-06 15:05:34 -04:00
if copts . healthStartInterval < 0 {
linting: fmt.Errorf can be replaced with errors.New (perfsprint)
internal/test/cli.go:175:14: fmt.Errorf can be replaced with errors.New (perfsprint)
return nil, fmt.Errorf("no notary client available unless defined")
^
cli/command/cli.go:318:29: fmt.Errorf can be replaced with errors.New (perfsprint)
return docker.Endpoint{}, fmt.Errorf("no context store initialized")
^
cli/command/container/attach.go:161:11: fmt.Errorf can be replaced with errors.New (perfsprint)
return fmt.Errorf(result.Error.Message)
^
cli/command/container/opts.go:577:16: fmt.Errorf can be replaced with errors.New (perfsprint)
return nil, fmt.Errorf("--health-start-period cannot be negative")
^
cli/command/container/opts.go:580:16: fmt.Errorf can be replaced with errors.New (perfsprint)
return nil, fmt.Errorf("--health-start-interval cannot be negative")
^
cli/command/container/stats.go:221:11: fmt.Errorf can be replaced with errors.New (perfsprint)
return fmt.Errorf("filtering is not supported when specifying a list of containers")
^
cli/command/container/attach_test.go:82:17: fmt.Errorf can be replaced with errors.New (perfsprint)
expectedErr = fmt.Errorf("unexpected error")
^
cli/command/container/create_test.go:234:40: fmt.Errorf can be replaced with errors.New (perfsprint)
return container.CreateResponse{}, fmt.Errorf("shouldn't try to pull image")
^
cli/command/container/list_test.go:150:17: fmt.Errorf can be replaced with errors.New (perfsprint)
return nil, fmt.Errorf("error listing containers")
^
cli/command/container/rm_test.go:40:31: fmt.Errorf can be replaced with errors.New (perfsprint)
return errdefs.NotFound(fmt.Errorf("Error: no such container: " + container))
^
cli/command/container/run_test.go:138:40: fmt.Errorf can be replaced with errors.New (perfsprint)
return container.CreateResponse{}, fmt.Errorf("shouldn't try to pull image")
^
cli/command/image/pull_test.go:115:49: fmt.Errorf can be replaced with errors.New (perfsprint)
return io.NopCloser(strings.NewReader("")), fmt.Errorf("shouldn't try to pull image")
^
cli/command/network/connect.go:88:16: fmt.Errorf can be replaced with errors.New (perfsprint)
return nil, fmt.Errorf("invalid key/value pair format in driver options")
^
cli/command/plugin/create_test.go:96:11: fmt.Errorf can be replaced with errors.New (perfsprint)
return fmt.Errorf("Error creating plugin")
^
cli/command/plugin/disable_test.go:32:12: fmt.Errorf can be replaced with errors.New (perfsprint)
return fmt.Errorf("Error disabling plugin")
^
cli/command/plugin/enable_test.go:32:12: fmt.Errorf can be replaced with errors.New (perfsprint)
return fmt.Errorf("failed to enable plugin")
^
cli/command/plugin/inspect_test.go:55:22: fmt.Errorf can be replaced with errors.New (perfsprint)
return nil, nil, fmt.Errorf("error inspecting plugin")
^
cli/command/plugin/install_test.go:43:17: fmt.Errorf can be replaced with errors.New (perfsprint)
return nil, fmt.Errorf("Error installing plugin")
^
cli/command/plugin/install_test.go:51:17: fmt.Errorf can be replaced with errors.New (perfsprint)
return nil, fmt.Errorf("(image) when fetching")
^
cli/command/plugin/install_test.go:95:17: fmt.Errorf can be replaced with errors.New (perfsprint)
return nil, fmt.Errorf("should not try to install plugin")
^
cli/command/plugin/list_test.go:35:41: fmt.Errorf can be replaced with errors.New (perfsprint)
return types.PluginsListResponse{}, fmt.Errorf("error listing plugins")
^
cli/command/plugin/remove_test.go:27:12: fmt.Errorf can be replaced with errors.New (perfsprint)
return fmt.Errorf("Error removing plugin")
^
cli/command/registry/login_test.go:36:46: fmt.Errorf can be replaced with errors.New (perfsprint)
return registrytypes.AuthenticateOKBody{}, fmt.Errorf("Invalid Username or Password")
^
cli/command/registry/login_test.go:44:46: fmt.Errorf can be replaced with errors.New (perfsprint)
return registrytypes.AuthenticateOKBody{}, fmt.Errorf(errUnknownUser)
^
cli/command/system/info.go:190:10: fmt.Errorf can be replaced with errors.New (perfsprint)
return fmt.Errorf("errors pretty printing info")
^
cli/command/system/prune.go:77:10: fmt.Errorf can be replaced with errors.New (perfsprint)
return fmt.Errorf(`ERROR: The "until" filter is not supported with "--volumes"`)
^
cli/command/system/version_test.go:19:28: fmt.Errorf can be replaced with errors.New (perfsprint)
return types.Version{}, fmt.Errorf("no server")
^
cli/command/trust/key_load.go:112:22: fmt.Errorf can be replaced with errors.New (perfsprint)
return []byte{}, fmt.Errorf("could not decrypt key")
^
cli/command/trust/revoke.go:44:10: fmt.Errorf can be replaced with errors.New (perfsprint)
return fmt.Errorf("cannot use a digest reference for IMAGE:TAG")
^
cli/command/trust/revoke.go:105:10: fmt.Errorf can be replaced with errors.New (perfsprint)
return fmt.Errorf("no signed tags to remove")
^
cli/command/trust/signer_add.go:56:10: fmt.Errorf can be replaced with errors.New (perfsprint)
return fmt.Errorf("releases is a reserved keyword, please use a different signer name")
^
cli/command/trust/signer_add.go:60:10: fmt.Errorf can be replaced with errors.New (perfsprint)
return fmt.Errorf("path to a public key must be provided using the `--key` flag")
^
opts/config.go:71:10: fmt.Errorf can be replaced with errors.New (perfsprint)
return fmt.Errorf("source is required")
^
opts/mount.go:168:10: fmt.Errorf can be replaced with errors.New (perfsprint)
return fmt.Errorf("type is required")
^
opts/mount.go:172:10: fmt.Errorf can be replaced with errors.New (perfsprint)
return fmt.Errorf("target is required")
^
opts/network.go:90:11: fmt.Errorf can be replaced with errors.New (perfsprint)
return fmt.Errorf("network name/id is not specified")
^
opts/network.go:129:18: fmt.Errorf can be replaced with errors.New (perfsprint)
return "", "", fmt.Errorf("invalid key value pair format in driver options")
^
opts/opts.go:404:13: fmt.Errorf can be replaced with errors.New (perfsprint)
return 0, fmt.Errorf("value is too precise")
^
opts/opts.go:412:18: fmt.Errorf can be replaced with errors.New (perfsprint)
return "", "", fmt.Errorf("empty string specified for links")
^
opts/parse.go:84:37: fmt.Errorf can be replaced with errors.New (perfsprint)
return container.RestartPolicy{}, fmt.Errorf("invalid restart policy format: no policy provided before colon")
^
opts/parse.go:89:38: fmt.Errorf can be replaced with errors.New (perfsprint)
return container.RestartPolicy{}, fmt.Errorf("invalid restart policy format: maximum retry count must be an integer")
^
opts/port.go:105:13: fmt.Errorf can be replaced with errors.New (perfsprint)
return fmt.Errorf("hostip is not supported")
^
opts/secret.go:70:10: fmt.Errorf can be replaced with errors.New (perfsprint)
return fmt.Errorf("source is required")
^
opts/env_test.go:57:11: fmt.Errorf can be replaced with errors.New (perfsprint)
err: fmt.Errorf("invalid environment variable: =a"),
^
opts/env_test.go:93:11: fmt.Errorf can be replaced with errors.New (perfsprint)
err: fmt.Errorf("invalid environment variable: ="),
^
cli-plugins/manager/error_test.go:16:11: fmt.Errorf can be replaced with errors.New (perfsprint)
inner := fmt.Errorf("testing")
^
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2024-06-10 14:47:07 -04:00
return nil , errors . New ( "--health-start-interval cannot be negative" )
2023-07-06 15:05:34 -04:00
}
2016-12-23 14:09:12 -05:00
healthConfig = & container . HealthConfig {
2023-07-06 15:05:34 -04:00
Test : probe ,
Interval : copts . healthInterval ,
Timeout : copts . healthTimeout ,
StartPeriod : copts . healthStartPeriod ,
StartInterval : copts . healthStartInterval ,
Retries : copts . healthRetries ,
2016-12-23 14:09:12 -05:00
}
}
2023-03-10 01:29:47 -05:00
deviceRequests := copts . gpus . Value ( )
if len ( cdiDeviceNames ) > 0 {
cdiDeviceRequest := container . DeviceRequest {
Driver : "cdi" ,
DeviceIDs : cdiDeviceNames ,
}
deviceRequests = append ( deviceRequests , cdiDeviceRequest )
}
2016-12-23 14:09:12 -05:00
resources := container . Resources {
CgroupParent : copts . cgroupParent ,
2017-03-06 16:01:04 -05:00
Memory : copts . memory . Value ( ) ,
MemoryReservation : copts . memoryReservation . Value ( ) ,
MemorySwap : copts . memorySwap . Value ( ) ,
2016-12-23 14:09:12 -05:00
MemorySwappiness : & copts . swappiness ,
2017-03-06 16:01:04 -05:00
KernelMemory : copts . kernelMemory . Value ( ) ,
2016-12-23 14:09:12 -05:00
OomKillDisable : & copts . oomKillDisable ,
NanoCPUs : copts . cpus . Value ( ) ,
CPUCount : copts . cpuCount ,
CPUPercent : copts . cpuPercent ,
CPUShares : copts . cpuShares ,
CPUPeriod : copts . cpuPeriod ,
CpusetCpus : copts . cpusetCpus ,
CpusetMems : copts . cpusetMems ,
CPUQuota : copts . cpuQuota ,
CPURealtimePeriod : copts . cpuRealtimePeriod ,
CPURealtimeRuntime : copts . cpuRealtimeRuntime ,
2019-02-28 12:50:31 -05:00
PidsLimit : & copts . pidsLimit ,
2016-12-23 14:09:12 -05:00
BlkioWeight : copts . blkioWeight ,
BlkioWeightDevice : copts . blkioWeightDevice . GetList ( ) ,
BlkioDeviceReadBps : copts . deviceReadBps . GetList ( ) ,
BlkioDeviceWriteBps : copts . deviceWriteBps . GetList ( ) ,
BlkioDeviceReadIOps : copts . deviceReadIOps . GetList ( ) ,
BlkioDeviceWriteIOps : copts . deviceWriteIOps . GetList ( ) ,
IOMaximumIOps : copts . ioMaxIOps ,
2017-03-06 16:01:04 -05:00
IOMaximumBandwidth : uint64 ( copts . ioMaxBandwidth ) ,
2016-12-23 14:09:12 -05:00
Ulimits : copts . ulimits . GetList ( ) ,
2016-05-06 18:09:46 -04:00
DeviceCgroupRules : copts . deviceCgroupRules . GetAll ( ) ,
2016-12-23 14:09:12 -05:00
Devices : deviceMappings ,
2023-03-10 01:29:47 -05:00
DeviceRequests : deviceRequests ,
2016-12-23 14:09:12 -05:00
}
config := & container . Config {
Hostname : copts . hostname ,
2018-06-18 07:58:23 -04:00
Domainname : copts . domainname ,
2016-12-23 14:09:12 -05:00
ExposedPorts : ports ,
User : copts . user ,
Tty : copts . tty ,
2022-12-27 09:26:23 -05:00
OpenStdin : copts . stdin ,
AttachStdin : attachStdin ,
AttachStdout : attachStdout ,
AttachStderr : attachStderr ,
Env : envVariables ,
Cmd : runCmd ,
Image : copts . Image ,
Volumes : volumes ,
MacAddress : copts . macAddress ,
Entrypoint : entrypoint ,
WorkingDir : copts . workingDir ,
Labels : opts . ConvertKVStringsToMap ( labels ) ,
StopSignal : copts . stopSignal ,
Healthcheck : healthConfig ,
2016-12-23 14:09:12 -05:00
}
if flags . Changed ( "stop-timeout" ) {
config . StopTimeout = & copts . stopTimeout
}
hostConfig := & container . HostConfig {
Binds : binds ,
ContainerIDFile : copts . containerIDFile ,
OomScoreAdj : copts . oomScoreAdj ,
AutoRemove : copts . autoRemove ,
Privileged : copts . privileged ,
PortBindings : portBindings ,
Links : copts . links . GetAll ( ) ,
PublishAllPorts : copts . publishAll ,
// Make sure the dns fields are never nil.
// New containers don't ever have those fields nil,
// but pre created containers can still have those nil values.
// See https://github.com/docker/docker/pull/17779
// for a more detailed explanation on why we don't want that.
DNS : copts . dns . GetAllOrEmpty ( ) ,
DNSSearch : copts . dnsSearch . GetAllOrEmpty ( ) ,
DNSOptions : copts . dnsOptions . GetAllOrEmpty ( ) ,
ExtraHosts : copts . extraHosts . GetAll ( ) ,
VolumesFrom : copts . volumesFrom . GetAll ( ) ,
2017-07-20 17:42:51 -04:00
IpcMode : container . IpcMode ( copts . ipcMode ) ,
2017-07-10 16:44:45 -04:00
NetworkMode : container . NetworkMode ( copts . netMode . NetworkMode ( ) ) ,
2016-12-23 14:09:12 -05:00
PidMode : pidMode ,
UTSMode : utsMode ,
UsernsMode : usernsMode ,
2019-07-30 13:10:03 -04:00
CgroupnsMode : cgroupnsMode ,
2016-12-23 14:09:12 -05:00
CapAdd : strslice . StrSlice ( copts . capAdd . GetAll ( ) ) ,
CapDrop : strslice . StrSlice ( copts . capDrop . GetAll ( ) ) ,
GroupAdd : copts . groupAdd . GetAll ( ) ,
RestartPolicy : restartPolicy ,
SecurityOpt : securityOpts ,
StorageOpt : storageOpts ,
ReadonlyRootfs : copts . readonlyRootfs ,
LogConfig : container . LogConfig { Type : copts . loggingDriver , Config : loggingOpts } ,
VolumeDriver : copts . volumeDriver ,
Isolation : container . Isolation ( copts . isolation ) ,
2016-12-28 17:44:07 -05:00
ShmSize : copts . shmSize . Value ( ) ,
2016-12-23 14:09:12 -05:00
Resources : resources ,
Tmpfs : tmpfs ,
Sysctls : copts . sysctls . GetAll ( ) ,
Runtime : copts . runtime ,
2024-10-28 18:13:31 -04:00
Mounts : copts . mounts . Value ( ) ,
2019-04-04 17:43:43 -04:00
MaskedPaths : maskedPaths ,
ReadonlyPaths : readonlyPaths ,
2023-04-03 04:08:36 -04:00
Annotations : copts . annotations . GetAll ( ) ,
2016-12-23 14:09:12 -05:00
}
Don't use AutoRemove on older daemons
Docker 1.13 moves the `--rm` flag to the daemon,
through an AutoRemove option in HostConfig.
When using API 1.24 and under, AutoRemove should not be
used, even if the daemon is version 1.13 or above and
"supports" this feature.
This patch fixes a situation where an 1.13 client,
talking to an 1.13 daemon, but using the 1.24 API
version, still set the AutoRemove property.
As a result, both the client _and_ the daemon
were attempting to remove the container, resulting
in an error:
ERRO[0000] error removing container: Error response from daemon:
removal of container ce0976ad22495c7cbe9487752ea32721a282164862db036b2f3377bd07461c3a
is already in progress
In addition, the validation of conflicting options
is moved from `docker run` to `opts.parse()`, so
that conflicting options are also detected when
running `docker create` and `docker start` separately.
To resolve the issue, the `AutoRemove` option is now
always set to `false` both by the client and the
daemon, if API version 1.24 or under is used.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2017-01-12 19:05:39 -05:00
if copts . autoRemove && ! hostConfig . RestartPolicy . IsNone ( ) {
2024-10-01 05:44:59 -04:00
return nil , errors . Errorf ( "conflicting options: cannot specify both --restart and --rm" )
Don't use AutoRemove on older daemons
Docker 1.13 moves the `--rm` flag to the daemon,
through an AutoRemove option in HostConfig.
When using API 1.24 and under, AutoRemove should not be
used, even if the daemon is version 1.13 or above and
"supports" this feature.
This patch fixes a situation where an 1.13 client,
talking to an 1.13 daemon, but using the 1.24 API
version, still set the AutoRemove property.
As a result, both the client _and_ the daemon
were attempting to remove the container, resulting
in an error:
ERRO[0000] error removing container: Error response from daemon:
removal of container ce0976ad22495c7cbe9487752ea32721a282164862db036b2f3377bd07461c3a
is already in progress
In addition, the validation of conflicting options
is moved from `docker run` to `opts.parse()`, so
that conflicting options are also detected when
running `docker create` and `docker start` separately.
To resolve the issue, the `AutoRemove` option is now
always set to `false` both by the client and the
daemon, if API version 1.24 or under is used.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2017-01-12 19:05:39 -05:00
}
2016-12-23 14:09:12 -05:00
// only set this value if the user provided the flag, else it should default to nil
if flags . Changed ( "init" ) {
hostConfig . Init = & copts . init
}
// When allocating stdin in attached mode, close stdin at client disconnect
if config . OpenStdin && config . AttachStdin {
config . StdinOnce = true
}
networkingConfig := & networktypes . NetworkingConfig {
EndpointsConfig : make ( map [ string ] * networktypes . EndpointSettings ) ,
}
2019-03-20 12:53:44 -04:00
networkingConfig . EndpointsConfig , err = parseNetworkOpts ( copts )
if err != nil {
return nil , err
}
2016-12-23 14:09:12 -05:00
2023-07-13 05:50:01 -04:00
// Put the endpoint-specific MacAddress of the "main" network attachment into the container Config for backward
// compatibility with older daemons.
if nw , ok := networkingConfig . EndpointsConfig [ hostConfig . NetworkMode . NetworkName ( ) ] ; ok {
2023-11-07 10:51:39 -05:00
config . MacAddress = nw . MacAddress //nolint:staticcheck // ignore SA1019: field is deprecated, but still used on API < v1.44.
2023-07-13 05:50:01 -04:00
}
2019-03-20 12:53:44 -04:00
return & containerConfig {
Config : config ,
HostConfig : hostConfig ,
NetworkingConfig : networkingConfig ,
} , nil
}
2016-12-23 14:09:12 -05:00
2019-03-20 12:53:44 -04:00
// parseNetworkOpts converts --network advanced options to endpoint-specs, and combines
// them with the old --network-alias and --links. If returns an error if conflicting options
// are found.
//
// this function may return _multiple_ endpoints, which is not currently supported
// by the daemon, but may be in future; it's up to the daemon to produce an error
// in case that is not supported.
func parseNetworkOpts ( copts * containerOptions ) ( map [ string ] * networktypes . EndpointSettings , error ) {
var (
endpoints = make ( map [ string ] * networktypes . EndpointSettings , len ( copts . netMode . Value ( ) ) )
hasUserDefined , hasNonUserDefined bool
)
2023-08-10 06:52:31 -04:00
if len ( copts . netMode . Value ( ) ) == 0 {
n := opts . NetworkAttachmentOpts {
Target : "default" ,
}
if err := applyContainerOptions ( & n , copts ) ; err != nil {
return nil , err
}
ep , err := parseNetworkAttachmentOpt ( n )
if err != nil {
return nil , err
}
endpoints [ "default" ] = ep
}
2019-03-20 12:53:44 -04:00
for i , n := range copts . netMode . Value ( ) {
2019-10-29 09:15:29 -04:00
n := n
2019-03-20 12:53:44 -04:00
if container . NetworkMode ( n . Target ) . IsUserDefined ( ) {
hasUserDefined = true
} else {
hasNonUserDefined = true
}
if i == 0 {
// The first network corresponds with what was previously the "only"
// network, and what would be used when using the non-advanced syntax
// `--network-alias`, `--link`, `--ip`, `--ip6`, and `--link-local-ip`
// are set on this network, to preserve backward compatibility with
// the non-advanced notation
if err := applyContainerOptions ( & n , copts ) ; err != nil {
return nil , err
}
2016-12-23 14:09:12 -05:00
}
2019-03-20 12:53:44 -04:00
ep , err := parseNetworkAttachmentOpt ( n )
if err != nil {
return nil , err
}
if _ , ok := endpoints [ n . Target ] ; ok {
return nil , errdefs . InvalidParameter ( errors . Errorf ( "network %q is specified multiple times" , n . Target ) )
}
2019-05-23 15:27:02 -04:00
// For backward compatibility: if no custom options are provided for the network,
// and only a single network is specified, omit the endpoint-configuration
// on the client (the daemon will still create it when creating the container)
if i == 0 && len ( copts . netMode . Value ( ) ) == 1 {
if ep == nil || reflect . DeepEqual ( * ep , networktypes . EndpointSettings { } ) {
continue
}
}
2019-03-20 12:53:44 -04:00
endpoints [ n . Target ] = ep
}
if hasUserDefined && hasNonUserDefined {
return nil , errdefs . InvalidParameter ( errors . New ( "conflicting options: cannot attach both user-defined and non-user-defined network-modes" ) )
2016-12-23 14:09:12 -05:00
}
2019-03-20 12:53:44 -04:00
return endpoints , nil
}
2016-12-23 14:09:12 -05:00
2023-07-13 05:50:01 -04:00
func applyContainerOptions ( n * opts . NetworkAttachmentOpts , copts * containerOptions ) error { //nolint:gocyclo
2019-03-20 12:53:44 -04:00
// TODO should we error if _any_ advanced option is used? (i.e. forbid to combine advanced notation with the "old" flags (`--network-alias`, `--link`, `--ip`, `--ip6`)?
if len ( n . Aliases ) > 0 && copts . aliases . Len ( ) > 0 {
return errdefs . InvalidParameter ( errors . New ( "conflicting options: cannot specify both --network-alias and per-network alias" ) )
}
if len ( n . Links ) > 0 && copts . links . Len ( ) > 0 {
return errdefs . InvalidParameter ( errors . New ( "conflicting options: cannot specify both --link and per-network links" ) )
}
2019-04-03 08:37:26 -04:00
if n . IPv4Address != "" && copts . ipv4Address != "" {
return errdefs . InvalidParameter ( errors . New ( "conflicting options: cannot specify both --ip and per-network IPv4 address" ) )
}
if n . IPv6Address != "" && copts . ipv6Address != "" {
return errdefs . InvalidParameter ( errors . New ( "conflicting options: cannot specify both --ip6 and per-network IPv6 address" ) )
}
2023-07-13 05:50:01 -04:00
if n . MacAddress != "" && copts . macAddress != "" {
return errdefs . InvalidParameter ( errors . New ( "conflicting options: cannot specify both --mac-address and per-network MAC address" ) )
}
if len ( n . LinkLocalIPs ) > 0 && copts . linkLocalIPs . Len ( ) > 0 {
return errdefs . InvalidParameter ( errors . New ( "conflicting options: cannot specify both --link-local-ip and per-network link-local IP addresses" ) )
}
2019-03-20 12:53:44 -04:00
if copts . aliases . Len ( ) > 0 {
n . Aliases = make ( [ ] string , copts . aliases . Len ( ) )
copy ( n . Aliases , copts . aliases . GetAll ( ) )
}
2023-08-10 06:52:31 -04:00
if n . Target != "default" && copts . links . Len ( ) > 0 {
2019-03-20 12:53:44 -04:00
n . Links = make ( [ ] string , copts . links . Len ( ) )
copy ( n . Links , copts . links . GetAll ( ) )
2016-12-23 14:09:12 -05:00
}
2019-04-03 08:37:26 -04:00
if copts . ipv4Address != "" {
n . IPv4Address = copts . ipv4Address
}
if copts . ipv6Address != "" {
n . IPv6Address = copts . ipv6Address
}
2023-07-13 05:50:01 -04:00
if copts . macAddress != "" {
n . MacAddress = copts . macAddress
}
2019-03-20 12:53:44 -04:00
if copts . linkLocalIPs . Len ( ) > 0 {
n . LinkLocalIPs = make ( [ ] string , copts . linkLocalIPs . Len ( ) )
copy ( n . LinkLocalIPs , copts . linkLocalIPs . GetAll ( ) )
}
return nil
}
2017-07-10 16:44:45 -04:00
2019-03-20 12:53:44 -04:00
func parseNetworkAttachmentOpt ( ep opts . NetworkAttachmentOpts ) ( * networktypes . EndpointSettings , error ) {
if strings . TrimSpace ( ep . Target ) == "" {
return nil , errors . New ( "no name set for network" )
}
if ! container . NetworkMode ( ep . Target ) . IsUserDefined ( ) {
if len ( ep . Aliases ) > 0 {
return nil , errors . New ( "network-scoped aliases are only supported for user-defined networks" )
}
if len ( ep . Links ) > 0 {
return nil , errors . New ( "links are only supported for user-defined networks" )
2017-07-10 16:44:45 -04:00
}
}
2016-12-23 14:09:12 -05:00
2019-03-20 12:53:44 -04:00
epConfig := & networktypes . EndpointSettings { }
epConfig . Aliases = append ( epConfig . Aliases , ep . Aliases ... )
if len ( ep . DriverOpts ) > 0 {
epConfig . DriverOpts = make ( map [ string ] string )
epConfig . DriverOpts = ep . DriverOpts
}
if len ( ep . Links ) > 0 {
epConfig . Links = ep . Links
}
if ep . IPv4Address != "" || ep . IPv6Address != "" || len ( ep . LinkLocalIPs ) > 0 {
epConfig . IPAMConfig = & networktypes . EndpointIPAMConfig {
IPv4Address : ep . IPv4Address ,
IPv6Address : ep . IPv6Address ,
LinkLocalIPs : ep . LinkLocalIPs ,
2016-12-23 14:09:12 -05:00
}
}
2023-07-13 05:50:01 -04:00
if ep . MacAddress != "" {
if _ , err := opts . ValidateMACAddress ( ep . MacAddress ) ; err != nil {
return nil , errors . Errorf ( "%s is not a valid mac address" , ep . MacAddress )
}
epConfig . MacAddress = ep . MacAddress
}
2019-03-20 12:53:44 -04:00
return epConfig , nil
2016-12-23 14:09:12 -05:00
}
2019-06-21 16:11:48 -04:00
func convertToStandardNotation ( ports [ ] string ) ( [ ] string , error ) {
2018-07-04 18:32:25 -04:00
optsList := [ ] string { }
2019-06-21 16:11:48 -04:00
for _ , publish := range ports {
if strings . Contains ( publish , "=" ) {
params := map [ string ] string { "protocol" : "tcp" }
for _ , param := range strings . Split ( publish , "," ) {
2022-12-27 10:26:08 -05:00
k , v , ok := strings . Cut ( param , "=" )
if ! ok || k == "" {
2019-06-21 16:11:48 -04:00
return optsList , errors . Errorf ( "invalid publish opts format (should be name=value but got '%s')" , param )
}
2022-12-27 10:26:08 -05:00
params [ k ] = v
2018-07-04 18:32:25 -04:00
}
2019-06-21 16:11:48 -04:00
optsList = append ( optsList , fmt . Sprintf ( "%s:%s/%s" , params [ "published" ] , params [ "target" ] , params [ "protocol" ] ) )
} else {
optsList = append ( optsList , publish )
2018-07-04 18:32:25 -04:00
}
}
return optsList , nil
}
2016-12-23 14:09:12 -05:00
func parseLoggingOpts ( loggingDriver string , loggingOpts [ ] string ) ( map [ string ] string , error ) {
2017-06-05 18:23:21 -04:00
loggingOptsMap := opts . ConvertKVStringsToMap ( loggingOpts )
2016-12-23 14:09:12 -05:00
if loggingDriver == "none" && len ( loggingOpts ) > 0 {
2017-03-09 13:23:45 -05:00
return map [ string ] string { } , errors . Errorf ( "invalid logging opts for driver %s" , loggingDriver )
2016-12-23 14:09:12 -05:00
}
return loggingOptsMap , nil
}
// takes a local seccomp daemon, reads the file contents for sending to the daemon
func parseSecurityOpts ( securityOpts [ ] string ) ( [ ] string , error ) {
for key , opt := range securityOpts {
2022-12-27 10:26:08 -05:00
k , v , ok := strings . Cut ( opt , "=" )
if ! ok && k != "no-new-privileges" {
k , v , ok = strings . Cut ( opt , ":" )
}
if ( ! ok || v == "" ) && k != "no-new-privileges" {
// "no-new-privileges" is the only option that does not require a value.
return securityOpts , errors . Errorf ( "Invalid --security-opt: %q" , opt )
2016-12-23 14:09:12 -05:00
}
2024-01-05 05:57:19 -05:00
if k == "seccomp" {
switch v {
case seccompProfileDefault , seccompProfileUnconfined :
// known special names for built-in profiles, nothing to do.
default :
// value may be a filename, in which case we send the profile's
// content if it's valid JSON.
f , err := os . ReadFile ( v )
if err != nil {
return securityOpts , errors . Errorf ( "opening seccomp profile (%s) failed: %v" , v , err )
}
b := bytes . NewBuffer ( nil )
if err := json . Compact ( b , f ) ; err != nil {
return securityOpts , errors . Errorf ( "compacting json for seccomp profile (%s) failed: %v" , v , err )
}
securityOpts [ key ] = fmt . Sprintf ( "seccomp=%s" , b . Bytes ( ) )
2016-12-23 14:09:12 -05:00
}
}
}
return securityOpts , nil
}
2019-04-04 17:43:43 -04:00
// parseSystemPaths checks if `systempaths=unconfined` security option is set,
// and returns the `MaskedPaths` and `ReadonlyPaths` accordingly. An updated
// list of security options is returned with this option removed, because the
// `unconfined` option is handled client-side, and should not be sent to the
// daemon.
func parseSystemPaths ( securityOpts [ ] string ) ( filtered , maskedPaths , readonlyPaths [ ] string ) {
filtered = securityOpts [ : 0 ]
for _ , opt := range securityOpts {
if opt == "systempaths=unconfined" {
maskedPaths = [ ] string { }
readonlyPaths = [ ] string { }
} else {
filtered = append ( filtered , opt )
}
}
return filtered , maskedPaths , readonlyPaths
}
2016-12-23 14:09:12 -05:00
// parses storage options per container into a map
func parseStorageOpts ( storageOpts [ ] string ) ( map [ string ] string , error ) {
m := make ( map [ string ] string )
for _ , option := range storageOpts {
2022-12-27 10:26:08 -05:00
k , v , ok := strings . Cut ( option , "=" )
if ! ok {
2017-03-09 13:23:45 -05:00
return nil , errors . Errorf ( "invalid storage option" )
2016-12-23 14:09:12 -05:00
}
2022-12-27 10:26:08 -05:00
m [ k ] = v
2016-12-23 14:09:12 -05:00
}
return m , nil
}
// parseDevice parses a device mapping string to a container.DeviceMapping struct
2019-01-07 18:34:33 -05:00
func parseDevice ( device , serverOS string ) ( container . DeviceMapping , error ) {
switch serverOS {
case "linux" :
return parseLinuxDevice ( device )
case "windows" :
return parseWindowsDevice ( device )
}
return container . DeviceMapping { } , errors . Errorf ( "unknown server OS: %s" , serverOS )
}
// parseLinuxDevice parses a device mapping string to a container.DeviceMapping struct
// knowing that the target is a Linux daemon
func parseLinuxDevice ( device string ) ( container . DeviceMapping , error ) {
2022-09-03 12:50:45 -04:00
var src , dst string
2016-12-23 14:09:12 -05:00
permissions := "rwm"
2022-12-27 10:26:08 -05:00
// We expect 3 parts at maximum; limit to 4 parts to detect invalid options.
arr := strings . SplitN ( device , ":" , 4 )
2016-12-23 14:09:12 -05:00
switch len ( arr ) {
case 3 :
permissions = arr [ 2 ]
fallthrough
case 2 :
if validDeviceMode ( arr [ 1 ] ) {
permissions = arr [ 1 ]
} else {
dst = arr [ 1 ]
}
fallthrough
case 1 :
src = arr [ 0 ]
default :
2017-03-09 13:23:45 -05:00
return container . DeviceMapping { } , errors . Errorf ( "invalid device specification: %s" , device )
2016-12-23 14:09:12 -05:00
}
if dst == "" {
dst = src
}
deviceMapping := container . DeviceMapping {
PathOnHost : src ,
PathInContainer : dst ,
CgroupPermissions : permissions ,
}
return deviceMapping , nil
}
2019-01-07 18:34:33 -05:00
// parseWindowsDevice parses a device mapping string to a container.DeviceMapping struct
// knowing that the target is a Windows daemon
func parseWindowsDevice ( device string ) ( container . DeviceMapping , error ) {
return container . DeviceMapping { PathOnHost : device } , nil
}
2016-05-06 18:09:46 -04:00
// validateDeviceCgroupRule validates a device cgroup rule string format
// It will make sure 'val' is in the form:
2022-07-13 06:29:49 -04:00
//
// 'type major:minor mode'
2016-05-06 18:09:46 -04:00
func validateDeviceCgroupRule ( val string ) ( string , error ) {
if deviceCgroupRuleRegexp . MatchString ( val ) {
return val , nil
}
2017-03-09 13:23:45 -05:00
return val , errors . Errorf ( "invalid device cgroup format '%s'" , val )
2016-05-06 18:09:46 -04:00
}
2016-12-23 14:09:12 -05:00
// validDeviceMode checks if the mode for device is valid or not.
// Valid mode is a composition of r (read), w (write), and m (mknod).
func validDeviceMode ( mode string ) bool {
2022-09-29 11:21:51 -04:00
legalDeviceMode := map [ rune ] bool {
2016-12-23 14:09:12 -05:00
'r' : true ,
'w' : true ,
'm' : true ,
}
if mode == "" {
return false
}
for _ , c := range mode {
if ! legalDeviceMode [ c ] {
return false
}
legalDeviceMode [ c ] = false
}
return true
}
// validateDevice validates a path for devices
2019-01-07 18:34:33 -05:00
func validateDevice ( val string , serverOS string ) ( string , error ) {
switch serverOS {
case "linux" :
return validateLinuxPath ( val , validDeviceMode )
case "windows" :
// Windows does validation entirely server-side
return val , nil
}
return "" , errors . Errorf ( "unknown server OS: %s" , serverOS )
}
// validateLinuxPath is the implementation of validateDevice knowing that the
// target server operating system is a Linux daemon.
2016-12-23 14:09:12 -05:00
// It will make sure 'val' is in the form:
2022-07-13 06:29:49 -04:00
//
// [host-dir:]container-path[:mode]
//
2016-12-23 14:09:12 -05:00
// It also validates the device mode.
2019-01-07 18:34:33 -05:00
func validateLinuxPath ( val string , validator func ( string ) bool ) ( string , error ) {
2016-12-23 14:09:12 -05:00
var containerPath string
var mode string
if strings . Count ( val , ":" ) > 2 {
2017-03-09 13:23:45 -05:00
return val , errors . Errorf ( "bad format for path: %s" , val )
2016-12-23 14:09:12 -05:00
}
split := strings . SplitN ( val , ":" , 3 )
if split [ 0 ] == "" {
2017-03-09 13:23:45 -05:00
return val , errors . Errorf ( "bad format for path: %s" , val )
2016-12-23 14:09:12 -05:00
}
switch len ( split ) {
case 1 :
containerPath = split [ 0 ]
val = path . Clean ( containerPath )
case 2 :
if isValid := validator ( split [ 1 ] ) ; isValid {
containerPath = split [ 0 ]
mode = split [ 1 ]
val = fmt . Sprintf ( "%s:%s" , path . Clean ( containerPath ) , mode )
} else {
containerPath = split [ 1 ]
val = fmt . Sprintf ( "%s:%s" , split [ 0 ] , path . Clean ( containerPath ) )
}
case 3 :
containerPath = split [ 1 ]
mode = split [ 2 ]
if isValid := validator ( split [ 2 ] ) ; ! isValid {
2017-03-09 13:23:45 -05:00
return val , errors . Errorf ( "bad mode specified: %s" , mode )
2016-12-23 14:09:12 -05:00
}
val = fmt . Sprintf ( "%s:%s:%s" , split [ 0 ] , containerPath , mode )
}
if ! path . IsAbs ( containerPath ) {
2017-03-09 13:23:45 -05:00
return val , errors . Errorf ( "%s is not an absolute path" , containerPath )
2016-12-23 14:09:12 -05:00
}
return val , nil
}
// validateAttach validates that the specified string is a valid attach option.
func validateAttach ( val string ) ( string , error ) {
s := strings . ToLower ( val )
for _ , str := range [ ] string { "stdin" , "stdout" , "stderr" } {
if s == str {
return s , nil
}
}
2017-03-09 13:23:45 -05:00
return val , errors . Errorf ( "valid streams are STDIN, STDOUT and STDERR" )
2016-12-23 14:09:12 -05:00
}
2018-10-10 06:18:29 -04:00
func validateAPIVersion ( c * containerConfig , serverAPIVersion string ) error {
for _ , m := range c . HostConfig . Mounts {
2023-07-20 09:50:14 -04:00
if err := command . ValidateMountWithAPIVersion ( m , serverAPIVersion ) ; err != nil {
return err
2018-10-10 06:18:29 -04:00
}
}
return nil
}
