1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
|
// Copyright 2018 The gVisor Authors.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
package cmd
import (
"context"
"flag"
"github.com/google/subcommands"
"gvisor.dev/gvisor/runsc/boot"
"gvisor.dev/gvisor/runsc/container"
"gvisor.dev/gvisor/runsc/specutils"
)
// Create implements subcommands.Command for the "create" command.
type Create struct {
// bundleDir is the path to the bundle directory (defaults to the
// current working directory).
bundleDir string
// pidFile is the filename that the sandbox pid will be written to.
// This file should only be created once the container process inside
// the sandbox is ready to use.
pidFile string
// consoleSocket is the path to an AF_UNIX socket which will receive a
// file descriptor referencing the master end of the console's
// pseudoterminal. This is ignored unless spec.Process.Terminal is
// true.
consoleSocket string
// userLog is the path to send user-visible logs to. This log is different
// from debug logs. The former is meant to be consumed by the users and should
// contain only information that is relevant to the person running the
// container, e.g. unsuported syscalls, while the later is more verbose and
// consumed by developers.
userLog string
}
// Name implements subcommands.Command.Name.
func (*Create) Name() string {
return "create"
}
// Synopsis implements subcommands.Command.Synopsis.
func (*Create) Synopsis() string {
return "create a secure container"
}
// Usage implements subcommands.Command.Usage.
func (*Create) Usage() string {
return `create [flags] <container id> - create a secure container
`
}
// SetFlags implements subcommands.Command.SetFlags.
func (c *Create) SetFlags(f *flag.FlagSet) {
f.StringVar(&c.bundleDir, "bundle", "", "path to the root of the bundle directory, defaults to the current directory")
f.StringVar(&c.consoleSocket, "console-socket", "", "path to an AF_UNIX socket which will receive a file descriptor referencing the master end of the console's pseudoterminal")
f.StringVar(&c.pidFile, "pid-file", "", "filename that the container pid will be written to")
f.StringVar(&c.userLog, "user-log", "", "filename to send user-visible logs to. Empty means no logging.")
}
// Execute implements subcommands.Command.Execute.
func (c *Create) Execute(_ context.Context, f *flag.FlagSet, args ...interface{}) subcommands.ExitStatus {
if f.NArg() != 1 {
f.Usage()
return subcommands.ExitUsageError
}
id := f.Arg(0)
conf := args[0].(*boot.Config)
if conf.Rootless {
return Errorf("Rootless mode not supported with %q", c.Name())
}
bundleDir := c.bundleDir
if bundleDir == "" {
bundleDir = getwdOrDie()
}
spec, err := specutils.ReadSpec(bundleDir)
if err != nil {
return Errorf("reading spec: %v", err)
}
specutils.LogSpec(spec)
// Create the container. A new sandbox will be created for the
// container unless the metadata specifies that it should be run in an
// existing container.
contArgs := container.Args{
ID: id,
Spec: spec,
BundleDir: bundleDir,
ConsoleSocket: c.consoleSocket,
PIDFile: c.pidFile,
UserLog: c.userLog,
}
if _, err := container.New(conf, contArgs); err != nil {
return Errorf("creating container: %v", err)
}
return subcommands.ExitSuccess
}
|
